@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.20

package/dist/deployment/release/seal.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
+import { evidenceOf } from '../build/admission.js';
+import { served } from './served/index.js';
+/**
+ * Seal the `DomainRelease` v4 one deployment serves: the served content of the Build at its
+ * address, and the build digest of the exact code it runs. Its release digest therefore names the
+ * schema, the address and the code at once; the Route Table is bound to that release.
+ */
+export function seal(build, buildDigest, addressing) {
+    const document = release.seal({
+        format: 'astrale.domain.release',
+        version: 4,
+        ...served(build, addressing),
+        build: { digest: buildDigest },
+    });
+    const { domain } = evidenceOf(build);
+    return Object.freeze({
+        document,
+        routes: protocolRoutes.bind(build.routes, document, domain, addressing.publicUrl),
+    });
+}

package/dist/deployment/release/{publication → served}/callables.d.ts

@@ -1,4 +1,4 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { Build } from '../../build/index.js';
 import type { Addressing } from '../addressing.js';
-export declare function callables(build: Build, addressing: Addressing): readonly publication.CallableBinding[];
+export declare function callables(build: Build, addressing: Addressing): readonly release.CallableBinding[];

package/dist/deployment/release/{publication → served}/callables.js

@@ -1,7 +1,7 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { invocationPath } from '../invocation.js';
 export function callables(build, addressing) {
-    const endpoint = publication.acceptInvocationEndpoints({
+    const endpoint = release.acceptInvocationEndpoints({
         http: new URL(invocationPath(), addressing.publicUrl).href,
     });
     return Object.freeze(build.callables.map((callable) => Object.freeze({ callable, endpoint })));

package/dist/deployment/release/served/index.d.ts

@@ -0,0 +1,12 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Build } from '../../build/index.js';
+import type { Addressing } from '../addressing.js';
+export declare const DELIVERY_PATH: '/install';
+/**
+ * What a deployment serves beneath its URL: identity, schema bundle, requirements, bindings, routes
+ * and delivery. A `DomainRelease` v4 adds its build to it, and the v3 Publication of the legacy
+ * path is exactly this content, so both documents of one build at one address agree.
+ */
+export type Served = Omit<release.Content, 'format' | 'version' | 'build'>;
+/** Derive the served content of one exact Build at one Addressing. */
+export declare function served(build: Build, addressing: Addressing): Served;

package/dist/deployment/release/served/index.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { callables } from './callables.js';
+import { routes } from './routes.js';
+import { views } from './views.js';
+export const DELIVERY_PATH = '/install';
+/** Derive the served content of one exact Build at one Addressing. */
+export function served(build, addressing) {
+    const root = build.schema.compiled.root;
+    const bundle = release.bundleUrl(addressing.publicUrl, build.schema.bundle.ref);
+    return {
+        origin: root.origin,
+        identity: { issuer: addressing.issuer, subject: root.origin },
+        schema: { revision: root.revision, bundle: { href: bundle, ref: build.schema.bundle.ref } },
+        requirements: build.requirements,
+        ...(build.frontend === undefined
+            ? {}
+            : { manifest: Object.freeze({ entrypoint: build.frontend.entrypoint }) }),
+        bindings: { callables: callables(build, addressing), views: views(build, addressing) },
+        delivery: release.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.publicUrl, bundle),
+        routes: routes(build, addressing),
+    };
+}

package/dist/deployment/release/{publication → served}/views.d.ts

@@ -1,4 +1,4 @@
-import type * as publication from '@astrale-os/kernel-protocol/publication';
+import type * as release from '@astrale-os/kernel-protocol/release';
 import type { Build } from '../../build/index.js';
 import type { Addressing } from '../addressing.js';
-export declare function views(build: Build, addressing: Addressing): readonly publication.ViewBinding[];
+export declare function views(build: Build, addressing: Addressing): readonly release.ViewBinding[];

package/dist/deployment/runtime/admission.d.ts

@@ -1,5 +1,5 @@
 import type { ResolvedRuntimeReference } from './resolve.js';
-/** Prove that a resolved module exports the exact Runtime captured by an Application. */
-export declare function admit<RuntimeValue extends object>(application: {
+/** Prove that a resolved module exports the exact Runtime captured by a Domain definition. */
+export declare function admit<RuntimeValue extends object>(definition: {
     readonly runtime: RuntimeValue;
 }, resolved: ResolvedRuntimeReference): RuntimeValue;

package/dist/deployment/runtime/admission.js

@@ -1,11 +1,11 @@
 import { isResolvedRuntimeReference } from './resolve.js';
-/** Prove that a resolved module exports the exact Runtime captured by an Application. */
-export function admit(application, resolved) {
+/** Prove that a resolved module exports the exact Runtime captured by a Domain definition. */
+export function admit(definition, resolved) {
     if (!isResolvedRuntimeReference(resolved)) {
         throw new TypeError('Resolved Runtime reference is not admitted.');
     }
-    if (resolved.runtime !== application.runtime) {
-        throw new TypeError('Runtime module default export differs from the Application Runtime.');
+    if (resolved.runtime !== definition.runtime) {
+        throw new TypeError('Runtime module default export differs from the Domain Runtime.');
     }
-    return application.runtime;
+    return definition.runtime;
 }

package/dist/deployment/verify/index.d.ts

@@ -1,4 +1,5 @@
 export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
-export type { PreflightInput } from './preflight/index.js';
+export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
+export type { BundleInput, PreflightInput } from './preflight/index.js';
 export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';

package/dist/deployment/verify/index.js

@@ -1,3 +1,4 @@
 export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
+export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
 export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';

package/dist/deployment/verify/preflight/artifact.d.ts

@@ -1,4 +1,4 @@
-import type { ArtifactSource, PreparedArtifact } from '../../adapter/prepare/index.js';
+import type { ArtifactSource, PreparedArtifact } from '../../adapter/legacy/index.js';
 import type { Build } from '../../build/index.js';
 import type { ResolvedRuntimeReference } from '../../runtime/index.js';
 /** Detach preparation output and bind it to the exact Build and resolved Runtime identity. */

package/dist/deployment/verify/preflight/bundle.d.ts

@@ -0,0 +1,18 @@
+import type { Bundle, Bundler, BundleSource } from '../../adapter/bundle/index.js';
+import type { Build, BuildDigest } from '../../build/index.js';
+import type { ResolvedRuntimeReference } from '../../runtime/index.js';
+export interface BundleInput<BuildValue extends Build = Build> {
+    readonly build: BuildValue;
+    readonly runtime: ResolvedRuntimeReference;
+    readonly bundler: Pick<Bundler, 'id' | 'version'>;
+    readonly source: BundleSource;
+}
+/** Detach bundler output and identify it by the build digest of its exact bytes. */
+export declare function bundle<const BuildValue extends Build>(input: BundleInput<BuildValue>): Bundle<BuildValue>;
+export declare function isBundle(input: unknown): input is Bundle;
+/**
+ * `deploy` rebuilds (there is no `deploy --from`), so the exact upload of an immutable deployment
+ * must carry the build digest `astrale-domain build` prints for the same tree. A different digest
+ * refuses the deployment.
+ */
+export declare function uploadedBuild(expected: Bundle, uploaded: BuildDigest): void;

package/dist/deployment/verify/preflight/bundle.js

@@ -0,0 +1,71 @@
+import { buildDigest, buildManifest } from '../../build/index.js';
+import { admit as admitRuntime } from '../../runtime/index.js';
+import { build as verifyBuild } from './build.js';
+const admittedBundles = new WeakSet();
+/** Detach bundler output and identify it by the build digest of its exact bytes. */
+export function bundle(input) {
+    verifyBuild(input.build);
+    admitRuntime({ runtime: input.build.runtime }, input.runtime);
+    const source = input.source;
+    if (source === null || typeof source !== 'object' || Array.isArray(source))
+        invalid();
+    if (Reflect.ownKeys(source).some((key) => key !== 'entrypoint' && key !== 'files'))
+        invalid();
+    if (!Array.isArray(source.files) || source.files.length === 0) {
+        throw new TypeError('Bundle files must be a non-empty array.');
+    }
+    const files = source.files.map((file) => {
+        if (file === null || typeof file !== 'object' || Array.isArray(file))
+            invalid();
+        if (Reflect.ownKeys(file).some((key) => key !== 'path' && key !== 'content') ||
+            !(file.content instanceof Uint8Array)) {
+            invalid();
+        }
+        return Object.freeze({ path: file.path, content: new Uint8Array(file.content) });
+    });
+    if (new Set(files.map((file) => file.path)).size !== files.length) {
+        throw new TypeError('Bundle files must have unique paths.');
+    }
+    const root = input.build.schema.compiled.root;
+    const manifest = buildManifest({
+        origin: root.origin,
+        revision: root.revision,
+        bundle: input.build.schema.bundle.ref.digest,
+        bundler: { id: input.bundler.id, version: input.bundler.version },
+        entrypoint: source.entrypoint,
+        files,
+    });
+    const contents = new Map(files.map((file) => [file.path, file.content]));
+    const admitted = Object.freeze({
+        kind: 'bundle',
+        build: input.build,
+        manifest,
+        digest: buildDigest(manifest),
+        entrypoint: manifest.entrypoint,
+        files: Object.freeze(manifest.files.map((file) => {
+            const content = contents.get(file.path);
+            return Object.freeze({ path: file.path, bytes: () => new Uint8Array(content) });
+        })),
+    });
+    admittedBundles.add(admitted);
+    return admitted;
+}
+export function isBundle(input) {
+    return input !== null && typeof input === 'object' && admittedBundles.has(input);
+}
+/**
+ * `deploy` rebuilds (there is no `deploy --from`), so the exact upload of an immutable deployment
+ * must carry the build digest `astrale-domain build` prints for the same tree. A different digest
+ * refuses the deployment.
+ */
+export function uploadedBuild(expected, uploaded) {
+    if (!isBundle(expected))
+        throw new TypeError('Uploaded build check requires an admitted Bundle.');
+    if (uploaded === expected.digest)
+        return;
+    throw new TypeError(`The uploaded code has build digest ${uploaded}, not ${expected.digest} ` +
+        'as `astrale-domain build` gives for this tree.');
+}
+function invalid() {
+    throw new TypeError('Bundle source is invalid.');
+}

package/dist/deployment/verify/preflight/index.d.ts

@@ -1,7 +1,8 @@
-import type { ArtifactSource, PreparedArtifact } from '../../adapter/prepare/index.js';
+import type { ArtifactSource, PreparedArtifact } from '../../adapter/legacy/index.js';
 import type { Build } from '../../build/index.js';
 import type { ResolvedRuntimeReference } from '../../runtime/index.js';
 export { artifact, isPreparedArtifact } from './artifact.js';
+export { bundle, isBundle, uploadedBuild, type BundleInput } from './bundle.js';
 export { build } from './build.js';
 export { publication } from './publication.js';
 export interface PreflightInput<BuildValue extends Build = Build> {

package/dist/deployment/verify/preflight/index.js

@@ -2,6 +2,7 @@ import { artifact } from './artifact.js';
 import { build as verifyBuild } from './build.js';
 import { publication as verifyPublication } from './publication.js';
 export { artifact, isPreparedArtifact } from './artifact.js';
+export { bundle, isBundle, uploadedBuild } from './bundle.js';
 export { build } from './build.js';
 export { publication } from './publication.js';
 /** Admit exact deployment material before any provider mutation. */

package/dist/deployment/verify/preflight/publication.d.ts

@@ -1,4 +1,4 @@
-import type { PreparedArtifact } from '../../adapter/prepare/index.js';
-import type { Release } from '../../release/index.js';
+import type { PreparedArtifact } from '../../adapter/legacy/index.js';
+import type { Release } from '../../release/legacy/index.js';
 /** Verify locally assemblable Publication evidence before any provider mutation. */
 export declare function publication(artifact: PreparedArtifact): Release | undefined;

package/dist/deployment/verify/preflight/publication.js

@@ -1,6 +1,7 @@
-import { publication as protocolPublication, routes } from '@astrale-os/kernel-protocol';
+import * as protocolPublication from '@astrale-os/kernel-protocol/release/legacy';
+import * as routes from '@astrale-os/kernel-protocol/routes';
 import { evidenceOf } from '../../build/admission.js';
-import { assemble } from '../../release/index.js';
+import { assemble } from '../../release/legacy/index.js';
 /** Verify locally assemblable Publication evidence before any provider mutation. */
 export function publication(artifact) {
     if (artifact.addressing.kind !== 'configured')
@@ -9,6 +10,6 @@ export function publication(artifact) {
     const admitted = protocolPublication.accept(release.publication);
     protocolPublication.verifyBundleBytes(admitted, artifact.build.schema.bundle.bytes());
     const { domain } = evidenceOf(artifact.build);
-    routes.verifyTable(release.routes, admitted, domain);
+    routes.legacy.verifyTable(release.routes, admitted, domain);
     return release;
 }

package/dist/deployment/verify/readiness/deployment.js

@@ -1,4 +1,4 @@
-import { isRelease } from '../../release/index.js';
+import { isRelease } from '../../release/legacy/index.js';
 import { isPreparedArtifact } from '../preflight/artifact.js';
 /** Admit adapter-reported progress without changing its mutation knowledge. */
 export function verifyDeployment(artifact, input) {
@@ -15,23 +15,14 @@ export function verifyDeployment(artifact, input) {
             progress.provider.kind !== 'applied' ||
             progress.provider.evidence.issuer === undefined ||
             !terminal(progress.prerequisite) ||
-            !terminal(progress.configuration) ||
-            !terminal(progress.installation)) {
+            !terminal(progress.configuration)) {
             invalid();
         }
         return Object.freeze({ status: 'ready', phase: 'complete', progress, release });
     }
     if (input.status === 'failed') {
         exact(input, ['status', 'phase', 'progress', 'error'], ['release']);
-        if (![
-            'prerequisite',
-            'provider',
-            'addressing',
-            'release',
-            'configuration',
-            'installation',
-            'readiness',
-        ].includes(input.phase) ||
+        if (!['prerequisite', 'provider', 'addressing', 'release', 'configuration', 'readiness'].includes(input.phase) ||
             !(input.error instanceof Error)) {
             invalid();
         }
@@ -59,12 +50,11 @@ function verifyRelease(artifact, release) {
 function verifyProgress(artifact, input, release) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    exact(input, ['prerequisite', 'provider', 'configuration', 'installation']);
+    exact(input, ['prerequisite', 'provider', 'configuration']);
     return Object.freeze({
         prerequisite: knowledge(input.prerequisite),
         provider: providerKnowledge(artifact, input.provider, release),
         configuration: knowledge(input.configuration),
-        installation: knowledge(input.installation),
     });
 }
 function providerKnowledge(artifact, input, release) {
@@ -103,7 +93,7 @@ function terminal(input) {
 function providerEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    exact(input, ['provider', 'deployment', 'artifact'], ['issuer', 'preflight']);
+    exact(input, ['provider', 'deployment', 'artifact'], ['build', 'issuer', 'preflight']);
     if (typeof input.provider !== 'string' ||
         input.provider.length === 0 ||
         input.provider.trim() !== input.provider ||
@@ -111,6 +101,8 @@ function providerEvidence(input) {
         input.deployment.length === 0 ||
         input.deployment.trim() !== input.deployment ||
         typeof input.artifact !== 'string' ||
+        (input.build !== undefined &&
+            (typeof input.build !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(input.build))) ||
         (input.issuer !== undefined && typeof input.issuer !== 'string') ||
         (input.preflight !== undefined &&
             input.preflight !== 'passed' &&

package/dist/deployment/verify/readiness/fetch.d.ts

@@ -0,0 +1,13 @@
+export type ReadinessFetch = (input: string, init: {
+    readonly redirect: 'error';
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+export interface ReadinessOptions {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}
+export declare const MAXIMUM_DOCUMENT_BYTES: number;
+export declare const MAXIMUM_BUNDLE_BYTES: number;
+export declare function fetchRequired(fetcher: ReadinessFetch, url: string, signal: AbortSignal | undefined): Promise<Response>;
+export declare function bounded(response: Response, url: string, maximum: number): Promise<ArrayBuffer>;
+export declare function text(response: Response, url: string, maximum: number): Promise<string>;

package/dist/deployment/verify/readiness/fetch.js

@@ -0,0 +1,26 @@
+export const MAXIMUM_DOCUMENT_BYTES = 1024 * 1024;
+export const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
+export async function fetchRequired(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    return response;
+}
+export async function bounded(response, url, maximum) {
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > maximum)
+        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
+    return bytes;
+}
+export async function text(response, url, maximum) {
+    const bytes = await bounded(response, url, maximum);
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
+    }
+}

package/dist/deployment/verify/readiness/identity.d.ts

@@ -1,7 +1,4 @@
-import type { Addressing } from '../../release/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { IssuerId } from '../../../platform/auth/index.js';
+import type { ReadinessOptions } from './fetch.js';
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export declare function verifyIdentity(addressing: Addressing, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export declare function verifyIdentity(serving: IssuerId, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/identity.js

@@ -1,10 +1,10 @@
 import { issuer } from '@astrale-os/kernel-protocol';
 const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export async function verifyIdentity(addressing, options = {}) {
+export async function verifyIdentity(serving, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
-    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const configurationUrl = new URL(issuer.paths(serving).configuration, serving);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), serving);
     const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
     if (keys.keys.length === 0)
         throw new Error('Serving issuer publishes no signing keys.');

package/dist/deployment/verify/readiness/index.d.ts

@@ -1,10 +1,14 @@
 import type { Release } from '../../release/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type * as legacy from '../../release/legacy/index.js';
+import type { ReadinessOptions } from './fetch.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication, type ReadinessFetch } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
-export declare function readiness(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export type { ReadinessFetch, ReadinessOptions } from './fetch.js';
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
+export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,10 +1,21 @@
 import { verifyIdentity } from './identity.js';
-import { verifyPublication } from './publication.js';
+import { verifyPublication } from './legacy/index.js';
+import { verifyRelease } from './release.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
 export async function readiness(release, options = {}) {
+    if (release.kind === 'release') {
+        await verifyRelease(release, options);
+        await verifyIdentity(release.url, options);
+        return;
+    }
     await verifyPublication(release, options);
-    await verifyIdentity(release.addressing, options);
+    await verifyIdentity(release.addressing.issuer, options);
 }

package/dist/deployment/verify/readiness/legacy/index.d.ts

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/index.js

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/publication.d.ts

@@ -0,0 +1,12 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type * as legacy from '../../../release/legacy/index.js';
+import type { ReadinessOptions } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export declare function verifyPublication(release: legacy.Release, options?: ReadinessOptions): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/legacy/publication.js

@@ -0,0 +1,23 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.publicUrl);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/deployment/verify/readiness/release.d.ts

@@ -0,0 +1,8 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Release } from '../../release/index.js';
+import type { ReadinessOptions } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export declare function verifyRelease(expected: Release, options?: ReadinessOptions): Promise<release.DomainRelease>;

package/dist/deployment/verify/readiness/release.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export async function verifyRelease(expected, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const releaseUrl = release.url(expected.url);
+    const response = await fetchRequired(fetcher, releaseUrl, options.signal);
+    const deployed = release.accept(JSON.parse(await text(response, releaseUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!release.matchesReference(deployed, release.reference(expected.document))) {
+        throw new Error('Live release differs from the expected Release.');
+    }
+    if (deployed.build.digest !== expected.buildDigest) {
+        throw new Error('Live release build digest differs from the expected build.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    release.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/execution/identity/authentication.d.ts

@@ -1,9 +1,18 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
+import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
 import type { AuthenticatedInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
+import { ClientSession } from '../../platform/client/session/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export declare const DEFAULT_ROUTE_AGE_MS = 60000;
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
     readonly issuer: IssuerId;
@@ -17,5 +26,17 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
-export declare function acceptResolvedDelegation(input: unknown): Grant;
+/**
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
+ */
+export declare function executorSession(kernel: IssuerId, executionId: NodeId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): ClientSession;
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
+export declare function acceptResolvedDelegation(input: unknown): IdentityId;
 export type { VerificationBasis };