@astrale-os/kernel-protocol 0.5.0-beta.9 → 0.5.0

package/dist/release/release.js

@@ -0,0 +1,125 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { admitBuild } from './build.js';
+import { admitDigest, sha256Hex } from './digest.js';
+import { fail } from './error.js';
+import { servedUrl } from './issuer.js';
+import { assertAuthoredManifest } from './manifest.js';
+import { admitServedContent } from './served.js';
+import { deepFreeze, exact, record } from './shape.js';
+/** Path of the release a deployment serves beneath its serving issuer. */
+export const PATH = '/.well-known/astrale/release.json';
+/** Media type of `DomainRelease` v4. */
+export const MEDIA_TYPE = 'application/vnd.astrale.domain-release+json;v=4';
+/** Resolve the canonical release URL beneath one exact HTTP(S) serving issuer, keeping its path. */
+export function url(issuer) {
+    return servedUrl(issuer, PATH);
+}
+const CONTENT_FIELDS = [
+    'format',
+    'version',
+    'origin',
+    'identity',
+    'build',
+    'schema',
+    'requirements',
+    'manifest',
+    'bindings',
+    'routes',
+    'delivery',
+];
+/**
+ * Release digest of canonical release content: SHA-256 of its canonical JSON. The content must be
+ * exactly what `seal` produces, a sealed release without its digest; content that `seal` would
+ * canonicalize or refuse throws `ReleaseError` instead of yielding a digest no decoder accepts.
+ * Authored content gets its digest from `seal(content).digest`.
+ */
+export function digestOf(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(value, CONTENT_FIELDS, 'RELEASE_INVALID');
+    return hash(admitCanonical(value));
+}
+/** Validate release content, canonicalize its View bindings, and set its release digest. */
+export function seal(input) {
+    const authored = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(authored, CONTENT_FIELDS, 'RELEASE_INVALID');
+    assertAuthoredManifest(authored.manifest);
+    const canonical = admitContent(admitContent(authored, 'canonicalize'), 'admit');
+    return release(canonical, hash(canonical));
+}
+/**
+ * Admit one wire release: exact fields at every level, every value in the canonical form `seal`
+ * produces, and a digest matching its content. One release therefore has exactly one wire
+ * document: `encode(accept(input))` is the canonical JSON of `input`.
+ */
+export function accept(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected a DomainRelease object.');
+    exact(value, [...CONTENT_FIELDS, 'digest'], 'RELEASE_INVALID');
+    const { digest: received, ...wire } = value;
+    const content = admitCanonical(wire);
+    const digest = admitDigest(received);
+    if (digest !== hash(content)) {
+        fail('RELEASE_DIGEST_MISMATCH', 'Release digest does not match its canonical content.');
+    }
+    return release(content, digest);
+}
+/** Encode one release as its canonical JSON bytes. */
+export function encode(input) {
+    return portable.json.encode(input);
+}
+function admitContent(value, views) {
+    if (value.format !== 'astrale.domain.release' || value.version !== 4) {
+        fail('RELEASE_INVALID', 'Unsupported release format or version.');
+    }
+    const served = admitServedContent(value, { views });
+    const build = admitBuild(value.build);
+    return deepFreeze({
+        format: 'astrale.domain.release',
+        version: 4,
+        origin: served.origin,
+        identity: served.identity,
+        build,
+        schema: served.schema,
+        requirements: served.requirements,
+        ...(served.manifest === undefined ? {} : { manifest: served.manifest }),
+        bindings: served.bindings,
+        routes: served.routes,
+        ...(served.delivery === undefined ? {} : { delivery: served.delivery }),
+    });
+}
+/** Shared validators normalize legacy values; releases require their exact canonical spelling. */
+function admitCanonical(value) {
+    const content = admitContent(value, 'admit');
+    const canonical = portable.json.serialize(content);
+    let received;
+    try {
+        received = portable.json.serialize(value);
+    }
+    catch (cause) {
+        if (cause instanceof portable.BoundaryError) {
+            return fail('RELEASE_INVALID', 'Release content is not in canonical form.', cause);
+        }
+        throw cause;
+    }
+    if (received !== canonical)
+        fail('RELEASE_INVALID', 'Release content is not in canonical form.');
+    return content;
+}
+function hash(content) {
+    return `sha256:${sha256Hex(portable.json.encode(content))}`;
+}
+function release(content, digest) {
+    return deepFreeze({
+        format: content.format,
+        version: content.version,
+        origin: content.origin,
+        identity: content.identity,
+        digest,
+        build: content.build,
+        schema: content.schema,
+        requirements: content.requirements,
+        ...(content.manifest === undefined ? {} : { manifest: content.manifest }),
+        bindings: content.bindings,
+        routes: content.routes,
+        ...(content.delivery === undefined ? {} : { delivery: content.delivery }),
+    });
+}

package/dist/release/requirements.d.ts

@@ -0,0 +1,41 @@
+import type { AuthorityOperation } from '@astrale-os/kernel-core/schema/authority/operation';
+import type { schema as schemaLanguage } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
+export type NonEmpty<Value> = readonly [Value, ...Value[]];
+export declare const ClassOperationOrder: readonly ["create", "read", "traverse", "update", "delete"];
+export type ClassOperation = (typeof ClassOperationOrder)[number];
+export interface ClassCapabilityRequirement {
+    readonly class: ClassRef;
+    readonly operations: NonEmpty<ClassOperation>;
+}
+export interface CapabilityAuthorityRequirements {
+    readonly grant?: NonEmpty<AuthorityOperation>;
+    readonly revoke?: NonEmpty<AuthorityOperation>;
+}
+export interface CapabilityRequirements {
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
+    readonly core?: NonEmpty<CoreCapabilityRequirement>;
+}
+/** Installation-owned authority materialized onto one local Core Identity. */
+export interface CoreCapabilityRequirement {
+    readonly subject: CoreRef;
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
+}
+export interface Requirements {
+    readonly capabilities: CapabilityRequirements;
+}
+/**
+ * Admit the exact closed canonical Release requirements object.
+ */
+export declare function admitRequirements(input: unknown): Requirements;
+/** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
+export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: Requirements): void;
+/**
+ * Distinct Function, Method and Class Keys, including Core-scoped targets, in code-unit order.
+ * Core subjects and authority operations contribute no Keys. Results may span multiple origins.
+ */
+export declare function capabilityKeys(capabilities: CapabilityRequirements): readonly SemanticKey[];

package/dist/release/requirements.js

@@ -0,0 +1,306 @@
+import { AuthorityOperationOrder } from '@astrale-os/kernel-core/schema/authority/operation';
+import { acceptDefinitionRef, callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isMethodExecutable } from '@astrale-os/kernel-dsl/v1/language';
+import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
+import { fail } from './error.js';
+import { array, deepFreeze, exact, record, unique } from './shape.js';
+const KernelIdentityClass = Object.freeze({
+    origin: 'kernel.astrale.ai',
+    kind: 'class',
+    name: 'Identity',
+});
+export const ClassOperationOrder = Object.freeze([
+    'create',
+    'read',
+    'traverse',
+    'update',
+    'delete',
+]);
+/**
+ * Admit the exact closed canonical Release requirements object.
+ */
+export function admitRequirements(input) {
+    const requirements = record(input, 'RELEASE_INVALID', 'Release requirements are invalid.');
+    exact(requirements, ['capabilities'], 'RELEASE_INVALID');
+    const capabilities = record(requirements.capabilities, 'RELEASE_INVALID', 'Release capability requirements are invalid.');
+    exact(capabilities, ['authority', 'classes', 'functions', 'core'], 'RELEASE_INVALID');
+    const functions = capabilities.functions === undefined
+        ? undefined
+        : nonEmpty(capabilities.functions, 'Function capability requirements').map(admitCallable);
+    if (functions !== undefined) {
+        unique(functions, 'RELEASE_INVALID', 'Function capability requirement');
+        canonical(functions, compare, 'Function capability requirements');
+    }
+    const classes = capabilities.classes === undefined
+        ? undefined
+        : nonEmpty(capabilities.classes, 'Class capability requirements').map(admitClassRequirement);
+    if (classes !== undefined) {
+        unique(classes.map((entry) => classKey(entry.class)), 'RELEASE_INVALID', 'Class capability requirement');
+        canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Class capability requirements');
+    }
+    const authority = capabilities.authority === undefined
+        ? undefined
+        : admitAuthorityRequirements(capabilities.authority);
+    const core = capabilities.core === undefined
+        ? undefined
+        : nonEmpty(capabilities.core, 'Core capability requirements').map(admitCoreCapabilityRequirement);
+    if (core !== undefined) {
+        unique(core.map(({ subject }) => Key.of(subject)), 'RELEASE_INVALID', 'Core capability subject');
+        canonical(core, (left, right) => compare(Key.of(left.subject), Key.of(right.subject)), 'Core capability requirements');
+    }
+    return deepFreeze({
+        capabilities: {
+            ...(functions === undefined
+                ? {}
+                : { functions: Object.freeze(functions) }),
+            ...(classes === undefined
+                ? {}
+                : { classes: Object.freeze(classes) }),
+            ...(authority === undefined ? {} : { authority }),
+            ...(core === undefined
+                ? {}
+                : { core: Object.freeze(core) }),
+        },
+    });
+}
+function admitCoreCapabilityRequirement(input) {
+    const requirement = record(input, 'RELEASE_INVALID', 'Core capability requirement is invalid.');
+    exact(requirement, ['authority', 'classes', 'functions', 'subject'], 'RELEASE_INVALID');
+    const subject = admitCoreRef(requirement.subject);
+    const functions = requirement.functions === undefined
+        ? undefined
+        : nonEmpty(requirement.functions, 'Core capability Function requirements').map(admitCallable);
+    if (functions !== undefined) {
+        unique(functions, 'RELEASE_INVALID', 'Core capability Function requirement');
+        canonical(functions, compare, 'Core capability Function requirements');
+    }
+    const classes = requirement.classes === undefined
+        ? undefined
+        : nonEmpty(requirement.classes, 'Core capability Class requirements').map(admitClassRequirement);
+    if (classes !== undefined) {
+        unique(classes.map((entry) => classKey(entry.class)), 'RELEASE_INVALID', 'Core capability Class requirement');
+        canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Core capability Class requirements');
+    }
+    const authority = requirement.authority === undefined
+        ? undefined
+        : admitAuthorityRequirements(requirement.authority);
+    if (functions === undefined && classes === undefined && authority === undefined) {
+        fail('RELEASE_INVALID', 'Core capability requirements cannot be empty.');
+    }
+    return Object.freeze({
+        subject,
+        ...(functions === undefined
+            ? {}
+            : { functions: Object.freeze(functions) }),
+        ...(classes === undefined
+            ? {}
+            : { classes: Object.freeze(classes) }),
+        ...(authority === undefined ? {} : { authority }),
+    });
+}
+/** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
+export function validateRequirements(root, closure, requirements) {
+    const dependencies = exactDependencyClosure(root, closure);
+    for (const callable of requirements.capabilities.functions ?? []) {
+        const dependency = capabilityOwner(root, dependencies, callable, 'Function');
+        if (!hasCallable(dependency, callable)) {
+            fail('RELEASE_INVALID', 'Function capability requirement names an unknown dependency callable.');
+        }
+    }
+    for (const requirement of requirements.capabilities.classes ?? []) {
+        const key = Key.of(requirement.class);
+        const dependency = capabilityOwner(root, dependencies, key, 'Class');
+        if (dependency.classes[requirement.class.name] === undefined) {
+            fail('RELEASE_INVALID', 'Class capability requirement names an unknown dependency Class.');
+        }
+    }
+    for (const requirement of requirements.capabilities.core ?? []) {
+        const subject = root.core.nodes[requirement.subject.name];
+        if (requirement.subject.origin !== root.origin ||
+            subject === undefined ||
+            !classSatisfies(root, dependencies, subject.class, KernelIdentityClass)) {
+            fail('RELEASE_INVALID', 'Core capability subject must name one local Core Identity.');
+        }
+        for (const callable of requirement.functions ?? []) {
+            const owner = Key.origin(callable) === root.origin
+                ? root
+                : capabilityOwner(root, dependencies, callable, 'Function');
+            if (!hasCallable(owner, callable)) {
+                fail('RELEASE_INVALID', 'Core capability Function requirement names an unknown or non-executable callable.');
+            }
+        }
+        for (const classRequirement of requirement.classes ?? []) {
+            const key = Key.of(classRequirement.class);
+            const owner = classRequirement.class.origin === root.origin
+                ? root
+                : capabilityOwner(root, dependencies, key, 'Class');
+            if (owner.classes[classRequirement.class.name] === undefined) {
+                fail('RELEASE_INVALID', 'Core capability Class requirement names an unknown dependency Class.');
+            }
+        }
+    }
+}
+/**
+ * Distinct Function, Method and Class Keys, including Core-scoped targets, in code-unit order.
+ * Core subjects and authority operations contribute no Keys. Results may span multiple origins.
+ */
+export function capabilityKeys(capabilities) {
+    const keys = new Set(capabilities.functions);
+    for (const requirement of capabilities.classes ?? [])
+        keys.add(Key.of(requirement.class));
+    for (const requirement of capabilities.core ?? []) {
+        for (const callable of requirement.functions ?? [])
+            keys.add(callable);
+        for (const classRequirement of requirement.classes ?? []) {
+            keys.add(Key.of(classRequirement.class));
+        }
+    }
+    return Object.freeze([...keys].sort(compare));
+}
+function classSatisfies(root, dependencies, candidate, expected) {
+    const expectedKey = Key.of(expected);
+    const visited = new Set();
+    const visit = (reference) => {
+        const key = Key.of(reference);
+        if (key === expectedKey)
+            return true;
+        if (visited.has(key))
+            return false;
+        visited.add(key);
+        const owner = reference.origin === root.origin ? root : dependencies.get(reference.origin);
+        const definition = owner?.classes[reference.name];
+        return definition?.kind === 'node' && definition.extends.some(visit);
+    };
+    return visit(candidate);
+}
+function exactDependencyClosure(root, closure) {
+    const supplied = new Map(closure.map((dependency) => [dependency.origin, dependency]));
+    const reachable = new Map();
+    const visit = (owner) => {
+        for (const coordinate of Object.values(owner.dependencies)) {
+            const dependency = supplied.get(coordinate.origin);
+            if (dependency === undefined || revision(dependency) !== coordinate.revision) {
+                fail('RELEASE_INVALID', 'Release bundle omits an exact dependency.');
+            }
+            if (reachable.has(dependency.origin))
+                continue;
+            reachable.set(dependency.origin, dependency);
+            visit(dependency);
+        }
+    };
+    visit(root);
+    return reachable;
+}
+function admitCallable(input) {
+    if (typeof input !== 'string' || !Key.is(input)) {
+        return fail('RELEASE_INVALID', 'Function capability reference is invalid.');
+    }
+    try {
+        callableAddress(input);
+    }
+    catch {
+        return fail('RELEASE_INVALID', 'Function capability reference must name a Function or Method.');
+    }
+    return input;
+}
+function admitClassRequirement(input) {
+    const requirement = record(input, 'RELEASE_INVALID', 'Class capability requirement is invalid.');
+    exact(requirement, ['class', 'operations'], 'RELEASE_INVALID');
+    const operations = nonEmpty(requirement.operations, 'Class capability operations').map((entry) => admitOperation(entry, ClassOperationOrder, 'Class capability operation'));
+    unique(operations, 'RELEASE_INVALID', 'Class capability operation');
+    canonical(operations, ordered(ClassOperationOrder), 'Class capability operations');
+    return Object.freeze({
+        class: admitClassRef(requirement.class),
+        operations: Object.freeze(operations),
+    });
+}
+function admitAuthorityRequirements(input) {
+    const authority = record(input, 'RELEASE_INVALID', 'Authority capability requirements are invalid.');
+    exact(authority, ['grant', 'revoke'], 'RELEASE_INVALID');
+    if (authority.grant === undefined && authority.revoke === undefined) {
+        fail('RELEASE_INVALID', 'Authority capability requirements cannot be empty.');
+    }
+    const grant = admitAuthorityOperations(authority.grant, 'grant');
+    const revoke = admitAuthorityOperations(authority.revoke, 'revoke');
+    return Object.freeze({
+        ...(grant === undefined ? {} : { grant }),
+        ...(revoke === undefined ? {} : { revoke }),
+    });
+}
+function admitAuthorityOperations(input, kind) {
+    if (input === undefined)
+        return undefined;
+    const values = nonEmpty(input, `Authority ${kind} operations`).map((entry) => admitOperation(entry, AuthorityOperationOrder, `Authority ${kind} operation`));
+    unique(values, 'RELEASE_INVALID', `authority ${kind} operation`);
+    canonical(values, ordered(AuthorityOperationOrder), `Authority ${kind} operations`);
+    return Object.freeze(values);
+}
+function admitClassRef(input) {
+    let value;
+    try {
+        value = acceptDefinitionRef(input);
+    }
+    catch {
+        fail('RELEASE_INVALID', 'Class capability reference is invalid.');
+    }
+    if (value.kind !== 'class')
+        fail('RELEASE_INVALID', 'Class capability reference is invalid.');
+    return value;
+}
+function admitCoreRef(input) {
+    let value;
+    try {
+        value = acceptDefinitionRef(input);
+    }
+    catch {
+        fail('RELEASE_INVALID', 'Core capability subject is invalid.');
+    }
+    if (value.kind !== 'core') {
+        fail('RELEASE_INVALID', 'Core capability subject must be one local Core reference.');
+    }
+    return value;
+}
+function nonEmpty(input, label) {
+    const values = [...array(input, 'RELEASE_INVALID')];
+    if (values.length === 0)
+        fail('RELEASE_INVALID', `${label} cannot be empty.`);
+    return values;
+}
+function admitOperation(input, vocabulary, label) {
+    if (typeof input !== 'string' || !vocabulary.includes(input)) {
+        return fail('RELEASE_INVALID', `${label} is unknown.`);
+    }
+    return input;
+}
+function canonical(values, comparator, label) {
+    if (values.some((entry, index) => index > 0 && comparator(values[index - 1], entry) >= 0)) {
+        fail('RELEASE_INVALID', `${label} must be sorted canonically.`);
+    }
+}
+function ordered(order) {
+    return (left, right) => order.indexOf(left) - order.indexOf(right);
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function classKey(input) {
+    return String(Key.of(input));
+}
+function capabilityOwner(root, dependencies, key, label) {
+    const origin = Key.origin(key);
+    if (origin === root.origin)
+        fail('RELEASE_INVALID', `${label} capability target cannot be local.`);
+    const dependency = dependencies.get(origin);
+    if (dependency === undefined) {
+        fail('RELEASE_INVALID', `${label} capability target must belong to the exact dependency closure.`);
+    }
+    return dependency;
+}
+function hasCallable(dependency, callable) {
+    const coordinate = callableAddress(callable);
+    if (coordinate.kind === 'function')
+        return dependency.functions[coordinate.name] !== undefined;
+    const declaration = dependency.classes[coordinate.owner.name];
+    const method = declaration?.kind === 'node' ? declaration.methods[coordinate.name] : undefined;
+    return method !== undefined && isMethodExecutable(declaration, method);
+}

package/dist/{publication → release}/route.js

@@ -1,31 +1,31 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { admitCallableKey } from './bindings/callable.js';
-import { absoluteHttpUrl, deepFreeze, exact, record } from './content.js';
 import { fail } from './error.js';
+import { absoluteHttpUrl, deepFreeze, exact, record } from './shape.js';
 const ROUTE_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/u;
 export function admitRoute(input, origin) {
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Published HTTP route is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Release HTTP route is invalid.');
     const common = admitRouteCommon(value, origin, 'href');
     return deepFreeze({
         ...common,
-        href: absoluteHttpUrl(value.href, false, 'PUBLICATION_ROUTE_INVALID', true),
+        href: absoluteHttpUrl(value.href, false, 'RELEASE_ROUTE_INVALID', true),
     });
 }
 export function admitRouteDeclaration(input, origin) {
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'HTTP route declaration is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'HTTP route declaration is invalid.');
     const common = admitRouteCommon(value, origin, 'path');
     if (typeof value.path !== 'string' || !value.path.startsWith('/')) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path must be relative to one issuer.');
+        fail('RELEASE_ROUTE_INVALID', 'Route declaration path must be relative to one issuer.');
     }
     let parsed;
     try {
         parsed = new URL(value.path, 'https://placement.invalid');
     }
     catch (cause) {
-        return fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path is invalid.', cause);
+        return fail('RELEASE_ROUTE_INVALID', 'Route declaration path is invalid.', cause);
     }
     if (parsed.origin !== 'https://placement.invalid' || parsed.search !== '' || parsed.hash !== '') {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path cannot select an origin, query, or fragment.');
+        fail('RELEASE_ROUTE_INVALID', 'Route declaration path cannot select an origin, query, or fragment.');
     }
     return deepFreeze({ ...common, path: value.path });
 }
@@ -42,24 +42,24 @@ function admitRouteCommon(value, origin, location) {
         'headers',
         'body',
         'credential',
-    ], 'PUBLICATION_ROUTE_INVALID');
+    ], 'RELEASE_ROUTE_INVALID');
     if (typeof value.name !== 'string' || !ROUTE_NAME.test(value.name)) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route name is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route name is invalid.');
     }
     const callable = admitCallableKey(value.callable, origin);
     if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*'].includes(value.method)) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route method is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route method is invalid.');
     }
     if (value.default !== undefined && value.default !== true) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route default may only be true.');
+        fail('RELEASE_ROUTE_INVALID', 'Route default may only be true.');
     }
     if (value.requestMethod !== undefined &&
         (typeof value.requestMethod !== 'string' || !patterns.memberName.test(value.requestMethod))) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route request-method mapping is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route request-method mapping is invalid.');
     }
     if (value.receiver !== undefined &&
         (typeof value.receiver !== 'string' || !patterns.memberName.test(value.receiver))) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route receiver is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route receiver is invalid.');
     }
     const query = stringRecord(value.query);
     const headers = headerRecord(value.headers);
@@ -83,13 +83,13 @@ function admitCredential(input) {
         return undefined;
     const values = Array.isArray(input) ? input : [input];
     if (values.length === 0)
-        fail('PUBLICATION_ROUTE_INVALID', 'Credential source list is empty.');
+        fail('RELEASE_ROUTE_INVALID', 'Credential source list is empty.');
     const admitted = values.map((entry) => {
-        const value = record(entry, 'PUBLICATION_ROUTE_INVALID', 'Credential source is invalid.');
-        exact(value, ['in', 'name'], 'PUBLICATION_ROUTE_INVALID');
+        const value = record(entry, 'RELEASE_ROUTE_INVALID', 'Credential source is invalid.');
+        exact(value, ['in', 'name'], 'RELEASE_ROUTE_INVALID');
         if (value.in === 'header') {
             if (value.name !== undefined && (typeof value.name !== 'string' || value.name.length === 0)) {
-                fail('PUBLICATION_ROUTE_INVALID', 'Credential header name is invalid.');
+                fail('RELEASE_ROUTE_INVALID', 'Credential header name is invalid.');
             }
             return Object.freeze({
                 in: 'header',
@@ -101,14 +101,14 @@ function admitCredential(input) {
             value.name.length > 0) {
             return Object.freeze({ in: value.in, name: value.name });
         }
-        return fail('PUBLICATION_ROUTE_INVALID', 'Credential source is invalid.');
+        return fail('RELEASE_ROUTE_INVALID', 'Credential source is invalid.');
     });
     return Array.isArray(input) ? Object.freeze(admitted) : admitted[0];
 }
 function admitBody(input) {
     if (input === undefined || input === '*')
         return input;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route body mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route body mapping is invalid.');
     const output = {};
     for (const [field, pick] of Object.entries(value)) {
         if (typeof pick === 'string' && pick.length > 0)
@@ -121,7 +121,7 @@ function admitBody(input) {
             output[field] = { as: 'text' };
         }
         else {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route body pick is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route body pick is invalid.');
         }
     }
     return Object.freeze(output);
@@ -129,11 +129,11 @@ function admitBody(input) {
 function headerRecord(input) {
     if (input === undefined)
         return undefined;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route header mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route header mapping is invalid.');
     const output = {};
     for (const [field, pick] of Object.entries(value)) {
         if (typeof pick !== 'string' || pick.length === 0) {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route header pick is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route header pick is invalid.');
         }
         output[field] = pick;
     }
@@ -142,11 +142,11 @@ function headerRecord(input) {
 function stringRecord(input) {
     if (input === undefined)
         return undefined;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route mapping is invalid.');
     const output = {};
     for (const [field, wire] of Object.entries(value)) {
         if (typeof wire !== 'string' || wire.length === 0) {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route wire name is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route wire name is invalid.');
         }
         output[field] = wire;
     }

package/dist/{publication → release}/schema.js

@@ -1,12 +1,12 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { admitBundleDescriptor } from './bundle-descriptor.js';
-import { exact, record } from './content.js';
 import { fail } from './error.js';
+import { exact, record } from './shape.js';
 export function admitSchema(input) {
-    const value = record(input, 'PUBLICATION_INVALID', 'Published schema is invalid.');
-    exact(value, ['revision', 'bundle'], 'PUBLICATION_INVALID');
+    const value = record(input, 'RELEASE_INVALID', 'Release schema is invalid.');
+    exact(value, ['revision', 'bundle'], 'RELEASE_INVALID');
     if (typeof value.revision !== 'string' || !patterns.revision.test(value.revision)) {
-        fail('PUBLICATION_INVALID', 'Published schema revision is invalid.');
+        fail('RELEASE_INVALID', 'Release schema revision is invalid.');
     }
     return Object.freeze({
         revision: value.revision,

package/dist/release/served.d.ts

@@ -0,0 +1,27 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { ServedRelease } from './bundle-admission.js';
+import type { Endpoint as DeliveryEndpoint } from './delivery-endpoint.js';
+import type { Requirements } from './requirements.js';
+/**
+ * Everything a served release document carries besides its format, version, digest and build:
+ * the content a bundle must match, the serving identity, and the optional Delivery endpoint.
+ */
+export interface ServedContent extends ServedRelease {
+    readonly identity: {
+        readonly issuer: IssuerId;
+        readonly subject: string;
+    };
+    readonly delivery?: DeliveryEndpoint;
+}
+interface ServedOptions {
+    /** `canonicalize` normalizes authored View bindings before sealing; `admit` requires canonical ones. */
+    readonly views: 'canonicalize' | 'admit';
+    /** Reads the requirements coordinate of the document version; canonical `core` by default. */
+    readonly requirements?: (input: unknown) => Requirements;
+}
+/**
+ * Admit the version-neutral content of one served release document. Every document version runs
+ * these checks in this order, so a document of any version admits exactly the same served content.
+ */
+export declare function admitServedContent(value: Readonly<Record<string, unknown>>, options: ServedOptions): ServedContent;
+export {};