@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.20

package/dist/deployment/build/manifest.d.ts

@@ -0,0 +1,59 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/**
+ * Identity of the code a deployment executes: the hash of the produced bytes (modules, assets,
+ * Schema and requirements), never of the address, issuer, key, secrets or Environment. Two builds of
+ * one source share it; a code change at equal Schema revision changes it.
+ */
+export type BuildDigest = Digest;
+/** Schema revision, unchanged: what the Domain means. */
+type Revision = Digest;
+export declare const BUILD_MANIFEST_FORMAT = "astrale.domain.build";
+export declare const BUILD_MANIFEST_VERSION = 1;
+/** Exact preimage of a build digest. */
+export interface BuildManifestV1 {
+    readonly format: typeof BUILD_MANIFEST_FORMAT;
+    readonly version: typeof BUILD_MANIFEST_VERSION;
+    readonly origin: string;
+    readonly schema: {
+        readonly revision: Revision;
+        readonly bundle: Digest;
+    };
+    readonly bundler: {
+        readonly id: string;
+        readonly version: string;
+    };
+    readonly entrypoint: string;
+    /**
+     * Unique, sorted by path (UTF-16 code units): modules by uploaded module name, static assets as
+     * `assets/<path>`.
+     */
+    readonly files: readonly {
+        readonly path: string;
+        readonly digest: Digest;
+        readonly size: number;
+    }[];
+}
+export interface BuildManifestInput {
+    readonly origin: string;
+    readonly revision: Revision;
+    readonly bundle: Digest;
+    readonly bundler: {
+        readonly id: string;
+        readonly version: string;
+    };
+    readonly entrypoint: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: Uint8Array;
+    }[];
+}
+/** Describe the exact files one bundler produced, in the one canonical order. */
+export declare function buildManifest(input: BuildManifestInput): BuildManifestV1;
+/** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
+export declare function buildDigest(manifest: BuildManifestV1): BuildDigest;
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export declare function acceptBuildDigest(input: unknown): BuildDigest;
+export {};

package/dist/deployment/build/manifest.js

@@ -0,0 +1,118 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+export const BUILD_MANIFEST_FORMAT = 'astrale.domain.build';
+export const BUILD_MANIFEST_VERSION = 1;
+const MANIFEST_MEDIA_TYPE = 'application/vnd.astrale.domain-build+json;v=1';
+const FILE_MEDIA_TYPE = 'application/octet-stream';
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+/** Describe the exact files one bundler produced, in the one canonical order. */
+export function buildManifest(input) {
+    if (input === null || typeof input !== 'object' || !Array.isArray(input.files))
+        invalid();
+    const files = input.files.map((file) => {
+        if (file === null || typeof file !== 'object' || !(file.content instanceof Uint8Array)) {
+            invalid();
+        }
+        const { digest, size } = identify(file.content, FILE_MEDIA_TYPE);
+        return { path: file.path, digest, size };
+    });
+    return admit({
+        format: BUILD_MANIFEST_FORMAT,
+        version: BUILD_MANIFEST_VERSION,
+        origin: input.origin,
+        schema: { revision: input.revision, bundle: input.bundle },
+        bundler: { id: input.bundler?.id, version: input.bundler?.version },
+        entrypoint: input.entrypoint,
+        files: files.sort((left, right) => compare(left.path, right.path)),
+    });
+}
+/** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
+export function buildDigest(manifest) {
+    return identify(json.encode(admit(manifest)), MANIFEST_MEDIA_TYPE).digest;
+}
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export function acceptBuildDigest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input)) {
+        throw new TypeError('Build digest must be sha256: followed by 64 lowercase hex digits.');
+    }
+    return input;
+}
+function admit(input) {
+    if (input === null || typeof input !== 'object')
+        invalid();
+    exact(input, ['format', 'version', 'origin', 'schema', 'bundler', 'entrypoint', 'files']);
+    if (input.format !== BUILD_MANIFEST_FORMAT || input.version !== BUILD_MANIFEST_VERSION)
+        invalid();
+    exact(input.schema, ['revision', 'bundle']);
+    exact(input.bundler, ['id', 'version']);
+    if (!Array.isArray(input.files) || input.files.length === 0)
+        invalid();
+    const files = input.files.map((file, index) => {
+        exact(file, ['path', 'digest', 'size']);
+        const path = contained(file.path);
+        if (index > 0 && compare(input.files[index - 1].path, path) >= 0) {
+            throw new TypeError('Build manifest files must be unique and sorted by path.');
+        }
+        if (!Number.isSafeInteger(file.size) || file.size < 0)
+            invalid();
+        return Object.freeze({ path, digest: digest(file.digest), size: file.size });
+    });
+    const entrypoint = contained(input.entrypoint);
+    if (!files.some((file) => file.path === entrypoint)) {
+        throw new TypeError('Build manifest entrypoint is absent from its files.');
+    }
+    return Object.freeze({
+        format: BUILD_MANIFEST_FORMAT,
+        version: BUILD_MANIFEST_VERSION,
+        origin: stable(input.origin, 'Build origin'),
+        schema: Object.freeze({
+            revision: digest(input.schema.revision),
+            bundle: digest(input.schema.bundle),
+        }),
+        bundler: Object.freeze({
+            id: stable(input.bundler.id, 'Bundler id'),
+            version: stable(input.bundler.version, 'Bundler version'),
+        }),
+        entrypoint,
+        files: Object.freeze(files),
+    });
+}
+function exact(input, keys) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== keys.length ||
+        keys.some((key) => !Object.hasOwn(input, key))) {
+        invalid();
+    }
+}
+function contained(input) {
+    if (typeof input !== 'string' ||
+        input.length === 0 ||
+        input.startsWith('/') ||
+        input.includes('\\') ||
+        input.split('/').some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new TypeError('Build manifest paths must be contained relative POSIX paths.');
+    }
+    return input;
+}
+function digest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input))
+        invalid();
+    return input;
+}
+function stable(input, label) {
+    if (typeof input !== 'string' || input.length === 0 || input.trim() !== input) {
+        throw new TypeError(`${label} must be a non-empty stable string.`);
+    }
+    return input;
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid() {
+    throw new TypeError('Build manifest is invalid.');
+}

package/dist/deployment/build/material.js

@@ -4,8 +4,8 @@ import { load as loadCompiledSchema } from '@astrale-os/kernel-dsl/v1/compiled/l
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { equal } from '@astrale-os/kernel-dsl/value';
 import * as artifact from '@astrale-os/kernel-protocol/artifact';
-import { BUNDLE_MEDIA_TYPE } from '@astrale-os/kernel-protocol/publication/bundle';
-import { admitRequirements, validateRequirements, } from '@astrale-os/kernel-protocol/publication/requirements';
+import { BUNDLE_MEDIA_TYPE } from '@astrale-os/kernel-protocol/release/bundle';
+import { admitRequirements, validateRequirements, } from '@astrale-os/kernel-protocol/release/requirements';
 import * as routes from '@astrale-os/kernel-protocol/routes';
 import { admitRuntimeRegistry, isRuntime } from '../../application/runtime/index.js';
 import { admitBuild, isBuild } from './admission.js';

package/dist/deployment/build/schema.d.ts

@@ -1,7 +1,7 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { schema } from '../../platform/schema/index.js';
 export interface BuildBundle {
-    readonly ref: publication.BundleDescriptor['ref'];
+    readonly ref: release.BundleDescriptor['ref'];
     bytes(): Uint8Array;
 }
 export interface BuildSchema<Source extends schema.DomainSchema = schema.DomainSchema> {

package/dist/deployment/deploy.d.ts

@@ -1,20 +1,20 @@
-import type { ApplicationIdentity } from '../application/index.js';
-import type { Adapter } from './adapter/index.js';
+import type { DomainDefinitionIdentity } from '../application/index.js';
+import type { Adapter, LegacyAdapter } from './adapter/index.js';
 import type { RuntimeReference } from './runtime/index.js';
-type CanonicalAdapter<Value> = Value extends Adapter<infer _Parameters> ? Value : never;
-/** @deprecated Declare Application and Environments directly in defineProject(). */
-export interface DeploymentInput<ApplicationValue extends ApplicationIdentity, AdapterValue extends object> {
-    readonly application: ApplicationValue;
+type CanonicalAdapter<Value> = Value extends Adapter<infer _Parameters> ? Value : Value extends LegacyAdapter<infer _Parameters> ? Value : never;
+/** @deprecated Declare the Domain and Environments directly in defineProject(). */
+export interface DeploymentInput<DomainDefinitionValue extends DomainDefinitionIdentity, AdapterValue extends object> {
+    readonly application: DomainDefinitionValue;
     readonly entrypoint: RuntimeReference;
     readonly adapter: CanonicalAdapter<AdapterValue>;
 }
 /** @deprecated Legacy aggregate retained only so tooling can issue an exact migration diagnostic. */
-export interface LegacyDeployment<ApplicationValue extends ApplicationIdentity = ApplicationIdentity, AdapterValue extends object = object> {
-    readonly application: ApplicationValue;
+export interface LegacyDeployment<DomainDefinitionValue extends DomainDefinitionIdentity = DomainDefinitionIdentity, AdapterValue extends object = object> {
+    readonly application: DomainDefinitionValue;
     readonly entrypoint: RuntimeReference;
     readonly adapter: AdapterValue;
 }
-/** @deprecated Declare Application and Environments directly in defineProject(). */
-export declare function deploy<const ApplicationValue extends ApplicationIdentity, const AdapterValue extends object>(input: DeploymentInput<ApplicationValue, AdapterValue>): LegacyDeployment<ApplicationValue, AdapterValue>;
+/** @deprecated Declare the Domain and Environments directly in defineProject(). */
+export declare function deploy<const DomainDefinitionValue extends DomainDefinitionIdentity, const AdapterValue extends object>(input: DeploymentInput<DomainDefinitionValue, AdapterValue>): LegacyDeployment<DomainDefinitionValue, AdapterValue>;
 export declare function isLegacyDeployment(input: unknown): input is LegacyDeployment;
 export {};

package/dist/deployment/deploy.js

@@ -1,8 +1,8 @@
-import { isApplication } from '../application/index.js';
+import { isDomainDefinition } from '../application/index.js';
 import { isAdapter } from './adapter/index.js';
 import { isRuntimeReference } from './runtime/index.js';
 const legacyDeployments = new WeakSet();
-/** @deprecated Declare Application and Environments directly in defineProject(). */
+/** @deprecated Declare the Domain and Environments directly in defineProject(). */
 export function deploy(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
@@ -11,7 +11,7 @@ export function deploy(input) {
         keys.some((key) => key !== 'application' && key !== 'entrypoint' && key !== 'adapter')) {
         invalid();
     }
-    if (!isApplication(input.application)) {
+    if (!isDomainDefinition(input.application)) {
         throw new TypeError('Deployment Application is not admitted.');
     }
     if (!isRuntimeReference(input.entrypoint)) {

package/dist/deployment/deployment.d.ts

@@ -1,9 +1,14 @@
-import type { Adapter } from './adapter/index.js';
-export interface Deployment<Parameters extends object = object> {
+import type { Adapter, LegacyAdapter } from './adapter/index.js';
+/**
+ * One adapter bound to the parameters of one Project Environment. `AdapterValue` is an adapter
+ * interface v2 `Adapter`, or a `@deprecated` `LegacyAdapter` whose Environments are all on the
+ * legacy direct-mode path (CT33).
+ */
+export interface Deployment<Parameters extends object = object, AdapterValue extends Adapter<Parameters> | LegacyAdapter<Parameters> = Adapter<Parameters> | LegacyAdapter<Parameters>> {
     readonly kind: 'deployment';
-    readonly adapter: Adapter<Parameters>;
+    readonly adapter: AdapterValue;
     readonly parameters: Parameters;
 }
 /** Internal adapter binding boundary used by public provider packages. */
-export declare function captureDeployment<const Parameters extends object>(adapter: Adapter<Parameters>, parameters: Parameters): Deployment<Parameters>;
+export declare function captureDeployment<const Parameters extends object>(adapter: Adapter<Parameters> | LegacyAdapter<Parameters>, parameters: Parameters): Deployment<Parameters>;
 export declare function isDeployment(input: unknown): input is Deployment;

package/dist/deployment/environment.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The name of a project environment, the target a deployment is made for (`staging`, `production`,
+ * `pr-42`), as `defineProject` admits it: lower-case letters, digits, `.`, `_` and `-`, starting and
+ * ending with a letter or a digit. It stays Worker-safe because a deployment name renders it.
+ */
+export declare const ENVIRONMENT_NAME: RegExp;

package/dist/deployment/environment.js

@@ -0,0 +1,6 @@
+/**
+ * The name of a project environment, the target a deployment is made for (`staging`, `production`,
+ * `pr-42`), as `defineProject` admits it: lower-case letters, digits, `.`, `_` and `-`, starting and
+ * ending with a letter or a digit. It stays Worker-safe because a deployment name renders it.
+ */
+export const ENVIRONMENT_NAME = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/u;

package/dist/deployment/index.d.ts

@@ -1,7 +1,7 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, InstallationTarget, } from './adapter/index.js';
+export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
-export type { Build, BuildBundle, BuildSchema } from './build/index.js';
+export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { deploy } from './deploy.js';
 export type { DeploymentInput, LegacyDeployment } from './deploy.js';
 export { isDeployment } from './deployment.js';
@@ -10,5 +10,5 @@ export { addressing, assemble, isAddressing, isRelease } from './release/index.j
 export type { Addressing, Release } from './release/index.js';
 export { admit as admitRuntime, resolve as resolveRuntime, runtime } from './runtime/index.js';
 export type { ResolvedRuntimeReference, RuntimeModuleLoader, RuntimeReference, } from './runtime/index.js';
-export { verifyDeployment, verifyPreflight, verifyReadiness } from './verify/index.js';
-export type { PreflightInput } from './verify/index.js';
+export { verifyBundle, verifyDeployment, verifyPreflight, verifyReadiness, verifyUploadedBuild, } from './verify/index.js';
+export type { BundleInput, PreflightInput } from './verify/index.js';

package/dist/deployment/index.js

@@ -4,4 +4,4 @@ export { deploy } from './deploy.js';
 export { isDeployment } from './deployment.js';
 export { addressing, assemble, isAddressing, isRelease } from './release/index.js';
 export { admit as admitRuntime, resolve as resolveRuntime, runtime } from './runtime/index.js';
-export { verifyDeployment, verifyPreflight, verifyReadiness } from './verify/index.js';
+export { verifyBundle, verifyDeployment, verifyPreflight, verifyReadiness, verifyUploadedBuild, } from './verify/index.js';

package/dist/deployment/release/addressing.d.ts

@@ -1,11 +1,19 @@
 import type { IssuerId } from '../../platform/auth/index.js';
-/** Stable Domain identity and public placement, independent of how a provider obtains them. */
+/**
+ * Domain identity and public placement, independent of how a provider obtains them. A deployment's
+ * `addressing(url)` has `issuer === publicUrl`: its URL is its issuer.
+ */
 export interface Addressing {
     readonly issuer: IssuerId;
     /** Public origin serving this Release; the issuer can remain on an older deployment. */
     readonly publicUrl: IssuerId;
 }
 export declare function addressing(input: string, options?: {
+    /**
+     * @deprecated Stable-target `legacy` path only: adapter-cloudflare direct mode serves under an
+     * issuer distinct from its route (`identityIssuer`). Removed with that mode at D10; a
+     * deployment's URL is its issuer.
+     */
     readonly publicUrl?: string;
 }): Addressing;
 export declare function isAddressing(input: unknown): input is Addressing;

package/dist/deployment/release/assemble.d.ts

@@ -1,5 +1,8 @@
 import type { Build } from '../build/build.js';
-import type { Addressing } from './addressing.js';
+import type { BuildDigest } from '../build/manifest.js';
 import type { Release } from './release.js';
-/** Purely assemble one complete current serving contract without a provider effect. */
-export declare function assemble<const BuildValue extends Build>(build: BuildValue, addressing: Addressing): Release<BuildValue>;
+/**
+ * Purely assemble what one immutable deployment serves at its URL, which is also its issuer, from
+ * its Build and the build digest of the code it runs, without a provider effect.
+ */
+export declare function assemble<const BuildValue extends Build>(build: BuildValue, buildDigest: BuildDigest, url: string): Release<BuildValue>;

package/dist/deployment/release/assemble.js

@@ -1,20 +1,22 @@
 import { isBuild } from '../build/admission.js';
-import { isAddressing } from './addressing.js';
+import { addressing } from './addressing.js';
 import { capture } from './admission.js';
-import { seal } from './publication/index.js';
-/** Purely assemble one complete current serving contract without a provider effect. */
-export function assemble(build, addressing) {
+import { seal } from './seal.js';
+/**
+ * Purely assemble what one immutable deployment serves at its URL, which is also its issuer, from
+ * its Build and the build digest of the code it runs, without a provider effect.
+ */
+export function assemble(build, buildDigest, url) {
     if (!isBuild(build))
         throw new TypeError('Release assembly requires an admitted Build.');
-    if (!isAddressing(addressing)) {
-        throw new TypeError('Release assembly requires admitted Addressing.');
-    }
-    const sealed = seal(build, addressing);
+    const placed = addressing(url);
+    const sealed = seal(build, buildDigest, placed);
     return capture(Object.freeze({
         kind: 'release',
         build,
-        addressing,
-        publication: sealed.publication,
+        url: placed.publicUrl,
+        document: sealed.document,
+        buildDigest: sealed.document.build.digest,
         routes: sealed.routes,
     }));
 }

package/dist/deployment/release/index.d.ts

@@ -3,3 +3,5 @@ export { capture, isRelease } from './admission.js';
 export { addressing, isAddressing, type Addressing } from './addressing.js';
 export { invocationPath } from './invocation.js';
 export type { Release } from './release.js';
+/** @deprecated Stable-target Publication v3; see `legacy/index.ts` for its consumers and removal. */
+export * as legacy from './legacy/index.js';

package/dist/deployment/release/index.js

@@ -2,3 +2,5 @@ export { assemble } from './assemble.js';
 export { capture, isRelease } from './admission.js';
 export { addressing, isAddressing } from './addressing.js';
 export { invocationPath } from './invocation.js';
+/** @deprecated Stable-target Publication v3; see `legacy/index.ts` for its consumers and removal. */
+export * as legacy from './legacy/index.js';

package/dist/deployment/release/legacy/admission.d.ts

@@ -0,0 +1,3 @@
+import type { Release } from './release.js';
+export declare function capture<ReleaseValue extends Release>(release: ReleaseValue): ReleaseValue;
+export declare function isRelease(input: unknown): input is Release;

package/dist/deployment/release/legacy/admission.js

@@ -0,0 +1,8 @@
+const admittedReleases = new WeakSet();
+export function capture(release) {
+    admittedReleases.add(release);
+    return release;
+}
+export function isRelease(input) {
+    return input !== null && typeof input === 'object' && admittedReleases.has(input);
+}

package/dist/deployment/release/legacy/assemble.d.ts

@@ -0,0 +1,5 @@
+import type { Build } from '../../build/build.js';
+import type { Addressing } from '../addressing.js';
+import type { Release } from './release.js';
+/** Purely assemble what a stable target serves at its Addressing, without a provider effect. */
+export declare function assemble<const BuildValue extends Build>(build: BuildValue, addressing: Addressing): Release<BuildValue>;

package/dist/deployment/release/legacy/assemble.js

@@ -0,0 +1,20 @@
+import { isBuild } from '../../build/admission.js';
+import { isAddressing } from '../addressing.js';
+import { capture } from './admission.js';
+import { seal } from './seal.js';
+/** Purely assemble what a stable target serves at its Addressing, without a provider effect. */
+export function assemble(build, addressing) {
+    if (!isBuild(build))
+        throw new TypeError('Release assembly requires an admitted Build.');
+    if (!isAddressing(addressing)) {
+        throw new TypeError('Release assembly requires admitted Addressing.');
+    }
+    const sealed = seal(build, addressing);
+    return capture(Object.freeze({
+        kind: 'publication',
+        build,
+        addressing,
+        publication: sealed.publication,
+        routes: sealed.routes,
+    }));
+}

package/dist/deployment/release/legacy/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * What a stable target serves: the v3 Publication sealed from a Build and its Addressing, which
+ * carries no build digest, and the Route Table bound to that Publication. A stable target keeps one
+ * URL across deploys, so it never serves `release.json` and every Kernel pins it as a legacy
+ * document.
+ *
+ * @deprecated Replacement: `assemble` and `Release` of `@astrale-os/sdk/deployment/release`, which
+ * seal the `DomainRelease` v4 of an immutable deployment from its build digest and URL.
+ *
+ * Short-term consumers:
+ * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare, whose
+ *   `DeployResult.release` is this Release) and the stable Worker that assembles its Release
+ *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
+ * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
+ *   adapter-cloudflare direct mode (`identityIssuer`).
+ *
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
+ */
+export { assemble } from './assemble.js';
+export { isRelease } from './admission.js';
+export type { Release } from './release.js';

package/dist/deployment/release/legacy/index.js

@@ -0,0 +1,34 @@
+/**
+ * What a stable target serves: the v3 Publication sealed from a Build and its Addressing, which
+ * carries no build digest, and the Route Table bound to that Publication. A stable target keeps one
+ * URL across deploys, so it never serves `release.json` and every Kernel pins it as a legacy
+ * document.
+ *
+ * @deprecated Replacement: `assemble` and `Release` of `@astrale-os/sdk/deployment/release`, which
+ * seal the `DomainRelease` v4 of an immutable deployment from its build digest and URL.
+ *
+ * Short-term consumers:
+ * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare, whose
+ *   `DeployResult.release` is this Release) and the stable Worker that assembles its Release
+ *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
+ * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
+ *   adapter-cloudflare direct mode (`identityIssuer`).
+ *
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
+ */
+export { assemble } from './assemble.js';
+export { isRelease } from './admission.js';

package/dist/deployment/release/legacy/release.d.ts

@@ -0,0 +1,12 @@
+import type * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type * as routes from '@astrale-os/kernel-protocol/routes';
+import type { Build } from '../../build/index.js';
+import type { Addressing } from '../addressing.js';
+/** What a stable target serves: the v3 Publication of its Build and the Route Table bound to it. */
+export interface Release<BuildValue extends Build = Build> {
+    readonly kind: 'publication';
+    readonly build: BuildValue;
+    readonly addressing: Addressing;
+    readonly publication: publication.Publication;
+    readonly routes: routes.legacy.Table;
+}

package/dist/deployment/release/legacy/release.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/release/{publication → legacy}/seal.d.ts

@@ -1,10 +1,10 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
 import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
 import type { Build } from '../../build/index.js';
 import type { Addressing } from '../addressing.js';
-export declare const DELIVERY_PATH: '/install';
 export interface SealedPublication {
     readonly publication: publication.Publication;
-    readonly routes: protocolRoutes.Table;
+    readonly routes: protocolRoutes.legacy.Table;
 }
+/** Seal the v3 Publication a stable target serves: the served content of the Build, without code. */
 export declare function seal(build: Build, addressing: Addressing): SealedPublication;

package/dist/deployment/release/legacy/seal.js

@@ -0,0 +1,17 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
+import { evidenceOf } from '../../build/admission.js';
+import { served } from '../served/index.js';
+/** Seal the v3 Publication a stable target serves: the served content of the Build, without code. */
+export function seal(build, addressing) {
+    const sealed = publication.seal({
+        format: 'astrale.domain.publication',
+        version: 3,
+        ...served(build, addressing),
+    });
+    const { domain } = evidenceOf(build);
+    return Object.freeze({
+        publication: sealed,
+        routes: protocolRoutes.legacy.bind(build.routes, sealed, domain, addressing.publicUrl),
+    });
+}

package/dist/deployment/release/release.d.ts

@@ -1,11 +1,22 @@
-import type * as publication from '@astrale-os/kernel-protocol/publication';
+import type * as release from '@astrale-os/kernel-protocol/release';
 import type * as routes from '@astrale-os/kernel-protocol/routes';
-import type { Build } from '../build/index.js';
-import type { Addressing } from './addressing.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { Build, BuildDigest } from '../build/index.js';
+/**
+ * Everything one immutable deployment serves: the `DomainRelease` v4 it publishes at
+ * `release.json`, sealed from its Build, its URL and the build digest of its code, and the Route
+ * Table bound to that release.
+ */
 export interface Release<BuildValue extends Build = Build> {
     readonly kind: 'release';
     readonly build: BuildValue;
-    readonly addressing: Addressing;
-    readonly publication: publication.Publication;
+    /**
+     * The deployment's URL: its origin, which is also its issuer (`document.identity.issuer`). A
+     * deployment never splits the two; only the stable-target `legacy` path does.
+     */
+    readonly url: IssuerId;
+    readonly document: release.DomainRelease;
+    /** Digest of the exact bytes the deployment runs: `document.build.digest`. */
+    readonly buildDigest: BuildDigest;
     readonly routes: routes.Table;
 }

package/dist/deployment/release/runtime.d.ts

@@ -1,2 +1,4 @@
 export { assemble } from './assemble.js';
 export { addressing } from './addressing.js';
+/** @deprecated Stable-target Publication v3; see `legacy/index.ts` for its consumers and removal. */
+export * as legacy from './legacy/index.js';

package/dist/deployment/release/runtime.js

@@ -1,2 +1,4 @@
 export { assemble } from './assemble.js';
 export { addressing } from './addressing.js';
+/** @deprecated Stable-target Publication v3; see `legacy/index.ts` for its consumers and removal. */
+export * as legacy from './legacy/index.js';

package/dist/deployment/release/seal.d.ts

@@ -0,0 +1,14 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
+import type { Build, BuildDigest } from '../build/index.js';
+import type { Addressing } from './addressing.js';
+export interface SealedRelease {
+    readonly document: release.DomainRelease;
+    readonly routes: protocolRoutes.Table;
+}
+/**
+ * Seal the `DomainRelease` v4 one deployment serves: the served content of the Build at its
+ * address, and the build digest of the exact code it runs. Its release digest therefore names the
+ * schema, the address and the code at once; the Route Table is bound to that release.
+ */
+export declare function seal(build: Build, buildDigest: BuildDigest, addressing: Addressing): SealedRelease;