@astrale-os/sdk 0.6.0-beta.3 → 0.6.0-beta.30

package/dist/deployment/build/frontend/compilation.js

@@ -15,16 +15,11 @@ export function compileFrontend(frontend, domain) {
             path: route.path,
             document: route.document,
             handshake: route.handshake,
-            ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
             ...(route.host === undefined ? {} : { host: route.host }),
         });
     });
-    const entrypoint = domain.views[frontend.entrypoint];
-    if (entrypoint === undefined)
-        throw new TypeError('Frontend entrypoint is absent from its Domain.');
     return Object.freeze({
         source: frontend.source,
         routes: Object.freeze(routes),
-        entrypoint: entrypoint.ref,
     });
 }

package/dist/deployment/build/frontend/digest.js

@@ -3,11 +3,7 @@ const MEDIA_TYPE = 'application/vnd.astrale.frontend-material+octet-stream;v=1';
 export function digest(frontend, files) {
     const encoder = new TextEncoder();
     const chunks = [
-        encoder.encode(JSON.stringify({
-            source: frontend.source,
-            routes: frontend.routes,
-            entrypoint: frontend.entrypoint,
-        })),
+        encoder.encode(JSON.stringify({ source: frontend.source, routes: frontend.routes })),
     ];
     for (const file of files) {
         const bytes = file.bytes();

package/dist/deployment/build/index.d.ts

@@ -2,5 +2,6 @@ export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, type BuildMaterial, type GeneratedBuildMaterial, } from './material.js';
 export type { Build } from './build.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, type BuildDigest, type BuildManifestInput, type BuildManifestV1, } from './manifest.js';
 export * as frontend from './frontend/index.js';
 export type { BuildBundle, BuildSchema } from './schema.js';

package/dist/deployment/build/index.js

@@ -1,4 +1,5 @@
 export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, } from './material.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, } from './manifest.js';
 export * as frontend from './frontend/index.js';

package/dist/deployment/build/manifest.d.ts

@@ -0,0 +1,59 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/**
+ * Identity of the code a deployment executes: the hash of the produced bytes (modules, assets,
+ * Schema and requirements), never of the address, issuer, key, secrets or Environment. Two builds of
+ * one source share it; a code change at equal Schema revision changes it.
+ */
+export type BuildDigest = Digest;
+/** Schema revision, unchanged: what the Domain means. */
+type Revision = Digest;
+export declare const BUILD_MANIFEST_FORMAT = "astrale.domain.build";
+export declare const BUILD_MANIFEST_VERSION = 1;
+/** Exact preimage of a build digest. */
+export interface BuildManifestV1 {
+    readonly format: typeof BUILD_MANIFEST_FORMAT;
+    readonly version: typeof BUILD_MANIFEST_VERSION;
+    readonly origin: string;
+    readonly schema: {
+        readonly revision: Revision;
+        readonly bundle: Digest;
+    };
+    readonly bundler: {
+        readonly id: string;
+        readonly version: string;
+    };
+    readonly entrypoint: string;
+    /**
+     * Unique, sorted by path (UTF-16 code units): modules by uploaded module name, static assets as
+     * `assets/<path>`.
+     */
+    readonly files: readonly {
+        readonly path: string;
+        readonly digest: Digest;
+        readonly size: number;
+    }[];
+}
+export interface BuildManifestInput {
+    readonly origin: string;
+    readonly revision: Revision;
+    readonly bundle: Digest;
+    readonly bundler: {
+        readonly id: string;
+        readonly version: string;
+    };
+    readonly entrypoint: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: Uint8Array;
+    }[];
+}
+/** Describe the exact files one bundler produced, in the one canonical order. */
+export declare function buildManifest(input: BuildManifestInput): BuildManifestV1;
+/** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
+export declare function buildDigest(manifest: BuildManifestV1): BuildDigest;
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export declare function acceptBuildDigest(input: unknown): BuildDigest;
+export {};

package/dist/deployment/build/manifest.js

@@ -0,0 +1,118 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+export const BUILD_MANIFEST_FORMAT = 'astrale.domain.build';
+export const BUILD_MANIFEST_VERSION = 1;
+const MANIFEST_MEDIA_TYPE = 'application/vnd.astrale.domain-build+json;v=1';
+const FILE_MEDIA_TYPE = 'application/octet-stream';
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+/** Describe the exact files one bundler produced, in the one canonical order. */
+export function buildManifest(input) {
+    if (input === null || typeof input !== 'object' || !Array.isArray(input.files))
+        invalid();
+    const files = input.files.map((file) => {
+        if (file === null || typeof file !== 'object' || !(file.content instanceof Uint8Array)) {
+            invalid();
+        }
+        const { digest, size } = identify(file.content, FILE_MEDIA_TYPE);
+        return { path: file.path, digest, size };
+    });
+    return admit({
+        format: BUILD_MANIFEST_FORMAT,
+        version: BUILD_MANIFEST_VERSION,
+        origin: input.origin,
+        schema: { revision: input.revision, bundle: input.bundle },
+        bundler: { id: input.bundler?.id, version: input.bundler?.version },
+        entrypoint: input.entrypoint,
+        files: files.sort((left, right) => compare(left.path, right.path)),
+    });
+}
+/** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
+export function buildDigest(manifest) {
+    return identify(json.encode(admit(manifest)), MANIFEST_MEDIA_TYPE).digest;
+}
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export function acceptBuildDigest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input)) {
+        throw new TypeError('Build digest must be sha256: followed by 64 lowercase hex digits.');
+    }
+    return input;
+}
+function admit(input) {
+    if (input === null || typeof input !== 'object')
+        invalid();
+    exact(input, ['format', 'version', 'origin', 'schema', 'bundler', 'entrypoint', 'files']);
+    if (input.format !== BUILD_MANIFEST_FORMAT || input.version !== BUILD_MANIFEST_VERSION)
+        invalid();
+    exact(input.schema, ['revision', 'bundle']);
+    exact(input.bundler, ['id', 'version']);
+    if (!Array.isArray(input.files) || input.files.length === 0)
+        invalid();
+    const files = input.files.map((file, index) => {
+        exact(file, ['path', 'digest', 'size']);
+        const path = contained(file.path);
+        if (index > 0 && compare(input.files[index - 1].path, path) >= 0) {
+            throw new TypeError('Build manifest files must be unique and sorted by path.');
+        }
+        if (!Number.isSafeInteger(file.size) || file.size < 0)
+            invalid();
+        return Object.freeze({ path, digest: digest(file.digest), size: file.size });
+    });
+    const entrypoint = contained(input.entrypoint);
+    if (!files.some((file) => file.path === entrypoint)) {
+        throw new TypeError('Build manifest entrypoint is absent from its files.');
+    }
+    return Object.freeze({
+        format: BUILD_MANIFEST_FORMAT,
+        version: BUILD_MANIFEST_VERSION,
+        origin: stable(input.origin, 'Build origin'),
+        schema: Object.freeze({
+            revision: digest(input.schema.revision),
+            bundle: digest(input.schema.bundle),
+        }),
+        bundler: Object.freeze({
+            id: stable(input.bundler.id, 'Bundler id'),
+            version: stable(input.bundler.version, 'Bundler version'),
+        }),
+        entrypoint,
+        files: Object.freeze(files),
+    });
+}
+function exact(input, keys) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== keys.length ||
+        keys.some((key) => !Object.hasOwn(input, key))) {
+        invalid();
+    }
+}
+function contained(input) {
+    if (typeof input !== 'string' ||
+        input.length === 0 ||
+        input.startsWith('/') ||
+        input.includes('\\') ||
+        input.split('/').some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new TypeError('Build manifest paths must be contained relative POSIX paths.');
+    }
+    return input;
+}
+function digest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input))
+        invalid();
+    return input;
+}
+function stable(input, label) {
+    if (typeof input !== 'string' || input.length === 0 || input.trim() !== input) {
+        throw new TypeError(`${label} must be a non-empty stable string.`);
+    }
+    return input;
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid() {
+    throw new TypeError('Build manifest is invalid.');
+}

package/dist/deployment/build/material.d.ts

@@ -1,6 +1,6 @@
 import type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
 import type { Runtime } from '../../application/runtime/index.js';
-import type { Build } from './build.js';
+import type { Build, BuildPresentation } from './build.js';
 import type { FrontendCompilation } from './frontend/index.js';
 export interface BuildMaterial {
     readonly format: 'astrale.sdk.build-material';
@@ -16,6 +16,7 @@ export interface BuildMaterial {
     readonly requirements: Build['requirements'];
     readonly routes: Build['routes'];
     readonly frontend?: FrontendCompilation;
+    readonly presentation?: BuildPresentation;
 }
 declare const GENERATED_BUILD_MATERIAL: unique symbol;
 /** Exact Build material embedded by an Astrale execution-code generator. */
@@ -23,7 +24,6 @@ export interface GeneratedBuildMaterial {
     readonly format: 'astrale.sdk.generated-build-material';
     readonly version: 1;
     readonly material: BuildMaterial;
-    readonly digest: Build['schema']['bundle']['ref']['digest'];
     readonly [GENERATED_BUILD_MATERIAL]: 'generated-build-material';
 }
 /** Detach the provider-neutral, runtime-free material embedded into generated execution code. */

package/dist/deployment/build/material.js

@@ -4,10 +4,11 @@ import { load as loadCompiledSchema } from '@astrale-os/kernel-dsl/v1/compiled/l
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { equal } from '@astrale-os/kernel-dsl/value';
 import * as artifact from '@astrale-os/kernel-protocol/artifact';
-import { BUNDLE_MEDIA_TYPE } from '@astrale-os/kernel-protocol/publication/bundle';
-import { admitRequirements, validateRequirements, } from '@astrale-os/kernel-protocol/publication/requirements';
+import { BUNDLE_MEDIA_TYPE } from '@astrale-os/kernel-protocol/release';
+import { admitRequirements, validateRequirements } from '@astrale-os/kernel-protocol/release';
 import * as routes from '@astrale-os/kernel-protocol/routes';
 import { admitRuntimeRegistry, isRuntime } from '../../application/runtime/index.js';
+import { admitClassIconSvg } from '../../platform/schema/class-icon-svg.js';
 import { admitBuild, isBuild } from './admission.js';
 /** Detach the provider-neutral, runtime-free material embedded into generated execution code. */
 export function material(build) {
@@ -29,6 +30,7 @@ export function material(build) {
         requirements: build.requirements,
         routes: build.routes,
         ...(build.frontend === undefined ? {} : { frontend: build.frontend }),
+        ...(build.presentation === undefined ? {} : { presentation: build.presentation }),
     });
 }
 /** Produce opaque material for execution code from one admitted Build. */
@@ -38,7 +40,6 @@ export function generatedMaterial(build) {
         format: 'astrale.sdk.generated-build-material',
         version: 1,
         material: value,
-        digest: digestOf(value),
     });
 }
 /** Re-admit detached provider-neutral Build material against the exact Runtime value. */
@@ -62,6 +63,7 @@ export function restoreBuild(input, runtime) {
     const compiled = deepFreeze(input.schema.compiled);
     const bundleRef = deepFreeze(input.schema.bundle.ref);
     const frontend = input.frontend === undefined ? undefined : deepFreeze(input.frontend);
+    const presentation = input.presentation === undefined ? undefined : admitPresentation(input.presentation);
     const detached = new Uint8Array(bytes);
     const build = Object.freeze({
         kind: 'build',
@@ -77,6 +79,7 @@ export function restoreBuild(input, runtime) {
         requirements,
         routes: plan,
         ...(frontend === undefined ? {} : { frontend }),
+        ...(presentation === undefined ? {} : { presentation }),
     });
     return admitBuild(build, { domain, registry });
 }
@@ -106,6 +109,7 @@ export function restoreGeneratedBuild(input, runtime) {
         requirements: material.requirements,
         routes: material.routes,
         ...(material.frontend === undefined ? {} : { frontend: material.frontend }),
+        ...(material.presentation === undefined ? {} : { presentation: material.presentation }),
     });
     return admitBuild(build, { domain, registry });
 }
@@ -118,7 +122,7 @@ function acceptGeneratedMaterial(input, runtime) {
         Array.isArray(input) ||
         format !== 'astrale.sdk.generated-build-material' ||
         version !== 1 ||
-        Reflect.ownKeys(input).some((key) => key !== 'format' && key !== 'version' && key !== 'material' && key !== 'digest')) {
+        Reflect.ownKeys(input).some((key) => key !== 'format' && key !== 'version' && key !== 'material')) {
         invalid();
     }
     assertMaterialEnvelope(material, runtime);
@@ -128,14 +132,6 @@ function acceptGeneratedMaterial(input, runtime) {
     deepFreeze(input);
     return Object.freeze({ material });
 }
-function digestOf(input) {
-    try {
-        return artifact.identify(new TextEncoder().encode(JSON.stringify(input)), 'application/vnd.astrale.sdk.build-material+json').digest;
-    }
-    catch {
-        invalid();
-    }
-}
 function assertMaterialEnvelope(input, runtime) {
     if (!isRuntime(runtime))
         throw new TypeError('Build Runtime is not admitted.');
@@ -150,7 +146,8 @@ function assertMaterialEnvelope(input, runtime) {
             key !== 'callables' &&
             key !== 'requirements' &&
             key !== 'routes' &&
-            key !== 'frontend')) {
+            key !== 'frontend' &&
+            key !== 'presentation')) {
         invalid();
     }
 }
@@ -186,6 +183,24 @@ function admitRoutePlan(input, domain) {
         invalid();
     return admitted;
 }
+/** External material must re-admit its icon using the same worker-safe SVG owner as authoring. */
+function admitPresentation(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const value = input;
+    if (Reflect.ownKeys(value).some((key) => key !== 'icon'))
+        invalid();
+    const { icon } = value;
+    if (icon === undefined)
+        return Object.freeze({});
+    if (typeof icon !== 'string')
+        invalid();
+    const admitted = admitClassIconSvg(icon);
+    // Material carries an exact admitted value, rather than authored text to normalize.
+    if (admitted !== icon)
+        invalid();
+    return Object.freeze({ icon: admitted });
+}
 function deepFreeze(input, seen = new WeakSet()) {
     if (input !== null && typeof input === 'object' && !seen.has(input)) {
         seen.add(input);

package/dist/deployment/build/schema.d.ts

@@ -1,7 +1,7 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { schema } from '../../platform/schema/index.js';
 export interface BuildBundle {
-    readonly ref: publication.BundleDescriptor['ref'];
+    readonly ref: release.BundleDescriptor['ref'];
     bytes(): Uint8Array;
 }
 export interface BuildSchema<Source extends schema.DomainSchema = schema.DomainSchema> {

package/dist/deployment/deployment.d.ts

@@ -1,7 +1,8 @@
 import type { Adapter } from './adapter/index.js';
-export interface Deployment<Parameters extends object = object> {
+/** One immutable-deployment adapter bound to one Project Environment. */
+export interface Deployment<Parameters extends object = object, AdapterValue extends Adapter<Parameters> = Adapter<Parameters>> {
     readonly kind: 'deployment';
-    readonly adapter: Adapter<Parameters>;
+    readonly adapter: AdapterValue;
     readonly parameters: Parameters;
 }
 /** Internal adapter binding boundary used by public provider packages. */

package/dist/deployment/environment.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The name of a project environment, the target a deployment is made for (`staging`, `production`,
+ * `pr-42`), as `defineProject` admits it: lower-case letters, digits, `.`, `_` and `-`, starting and
+ * ending with a letter or a digit. It stays Worker-safe because a deployment name renders it.
+ */
+export declare const ENVIRONMENT_NAME: RegExp;

package/dist/deployment/environment.js

@@ -0,0 +1,6 @@
+/**
+ * The name of a project environment, the target a deployment is made for (`staging`, `production`,
+ * `pr-42`), as `defineProject` admits it: lower-case letters, digits, `.`, `_` and `-`, starting and
+ * ending with a letter or a digit. It stays Worker-safe because a deployment name renders it.
+ */
+export const ENVIRONMENT_NAME = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/u;

package/dist/deployment/index.d.ts

@@ -1,14 +1,12 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, InstallationTarget, } from './adapter/index.js';
+export type { Adapter, AdapterCommand, AdapterCommandContext, AdapterCommandResult, AdapterEnvironmentContext, AdapterInput, ArtifactFile, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeploymentCallTarget, DeploymentSecretsState, FailedReleaseDeployResult, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifactFile, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
-export type { Build, BuildBundle, BuildSchema } from './build/index.js';
-export { deploy } from './deploy.js';
-export type { DeploymentInput, LegacyDeployment } from './deploy.js';
+export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { isDeployment } from './deployment.js';
 export type { Deployment } from './deployment.js';
 export { addressing, assemble, isAddressing, isRelease } from './release/index.js';
 export type { Addressing, Release } from './release/index.js';
 export { admit as admitRuntime, resolve as resolveRuntime, runtime } from './runtime/index.js';
 export type { ResolvedRuntimeReference, RuntimeModuleLoader, RuntimeReference, } from './runtime/index.js';
-export { verifyDeployment, verifyPreflight, verifyReadiness } from './verify/index.js';
-export type { PreflightInput } from './verify/index.js';
+export { verifyBundle, verifyReadiness, verifyUploadedBuild } from './verify/index.js';
+export type { BundleInput } from './verify/index.js';

package/dist/deployment/index.js

@@ -1,7 +1,6 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
-export { deploy } from './deploy.js';
 export { isDeployment } from './deployment.js';
 export { addressing, assemble, isAddressing, isRelease } from './release/index.js';
 export { admit as admitRuntime, resolve as resolveRuntime, runtime } from './runtime/index.js';
-export { verifyDeployment, verifyPreflight, verifyReadiness } from './verify/index.js';
+export { verifyBundle, verifyReadiness, verifyUploadedBuild } from './verify/index.js';

package/dist/deployment/release/addressing.d.ts

@@ -1,11 +1,12 @@
 import type { IssuerId } from '../../platform/auth/index.js';
-/** Stable Domain identity and public placement, independent of how a provider obtains them. */
+/**
+ * Domain identity and public placement, independent of how a provider obtains them. A deployment's
+ * `addressing(url)` has `issuer === publicUrl`: its URL is its issuer.
+ */
 export interface Addressing {
     readonly issuer: IssuerId;
-    /** Public origin serving this Release; the issuer can remain on an older deployment. */
+    /** Public origin serving this Release, identical to its issuer. */
     readonly publicUrl: IssuerId;
 }
-export declare function addressing(input: string, options?: {
-    readonly publicUrl?: string;
-}): Addressing;
+export declare function addressing(input: string): Addressing;
 export declare function isAddressing(input: unknown): input is Addressing;

package/dist/deployment/release/addressing.js

@@ -1,9 +1,8 @@
 import { issuer } from '../../platform/auth/index.js';
 const admittedAddressing = new WeakSet();
-export function addressing(input, options = {}) {
+export function addressing(input) {
     const admitted = origin(input);
-    const publicUrl = options.publicUrl === undefined ? admitted : origin(options.publicUrl);
-    const value = Object.freeze({ issuer: admitted, publicUrl });
+    const value = Object.freeze({ issuer: admitted, publicUrl: admitted });
     admittedAddressing.add(value);
     return value;
 }

package/dist/deployment/release/assemble.d.ts

@@ -1,5 +1,8 @@
 import type { Build } from '../build/build.js';
-import type { Addressing } from './addressing.js';
+import type { BuildDigest } from '../build/manifest.js';
 import type { Release } from './release.js';
-/** Purely assemble one complete current serving contract without a provider effect. */
-export declare function assemble<const BuildValue extends Build>(build: BuildValue, addressing: Addressing): Release<BuildValue>;
+/**
+ * Purely assemble what one immutable deployment serves at its URL, which is also its issuer, from
+ * its Build and the build digest of the code it runs, without a provider effect.
+ */
+export declare function assemble<const BuildValue extends Build>(build: BuildValue, buildDigest: BuildDigest, url: string): Release<BuildValue>;

package/dist/deployment/release/assemble.js

@@ -1,20 +1,22 @@
 import { isBuild } from '../build/admission.js';
-import { isAddressing } from './addressing.js';
+import { addressing } from './addressing.js';
 import { capture } from './admission.js';
-import { seal } from './publication/index.js';
-/** Purely assemble one complete current serving contract without a provider effect. */
-export function assemble(build, addressing) {
+import { seal } from './seal.js';
+/**
+ * Purely assemble what one immutable deployment serves at its URL, which is also its issuer, from
+ * its Build and the build digest of the code it runs, without a provider effect.
+ */
+export function assemble(build, buildDigest, url) {
     if (!isBuild(build))
         throw new TypeError('Release assembly requires an admitted Build.');
-    if (!isAddressing(addressing)) {
-        throw new TypeError('Release assembly requires admitted Addressing.');
-    }
-    const sealed = seal(build, addressing);
+    const placed = addressing(url);
+    const sealed = seal(build, buildDigest, placed);
     return capture(Object.freeze({
         kind: 'release',
         build,
-        addressing,
-        publication: sealed.publication,
+        url: placed.publicUrl,
+        document: sealed.document,
+        buildDigest: sealed.document.build.digest,
         routes: sealed.routes,
     }));
 }

package/dist/deployment/release/release.d.ts

@@ -1,11 +1,22 @@
-import type * as publication from '@astrale-os/kernel-protocol/publication';
+import type * as release from '@astrale-os/kernel-protocol/release';
 import type * as routes from '@astrale-os/kernel-protocol/routes';
-import type { Build } from '../build/index.js';
-import type { Addressing } from './addressing.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { Build, BuildDigest } from '../build/index.js';
+/**
+ * Everything one immutable deployment serves: the `DomainRelease` v4 it publishes at
+ * `release.json`, sealed from its Build, its URL and the build digest of its code, and the Route
+ * Table bound to that release.
+ */
 export interface Release<BuildValue extends Build = Build> {
     readonly kind: 'release';
     readonly build: BuildValue;
-    readonly addressing: Addressing;
-    readonly publication: publication.Publication;
+    /**
+     * The deployment's URL: its origin, which is also its issuer (`document.identity.issuer`). A
+     * deployment binds both to the same immutable URL.
+     */
+    readonly url: IssuerId;
+    readonly document: release.DomainRelease;
+    /** Digest of the exact bytes the deployment runs: `document.build.digest`. */
+    readonly buildDigest: BuildDigest;
     readonly routes: routes.Table;
 }

package/dist/deployment/release/seal.d.ts

@@ -0,0 +1,14 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
+import type { Build, BuildDigest } from '../build/index.js';
+import type { Addressing } from './addressing.js';
+export interface SealedRelease {
+    readonly document: release.DomainRelease;
+    readonly routes: protocolRoutes.Table;
+}
+/**
+ * Seal the `DomainRelease` v4 one deployment serves: the served content of the Build at its
+ * address, and the build digest of the exact code it runs. Its release digest therefore names the
+ * schema, the address and the code at once; the Route Table is bound to that release.
+ */
+export declare function seal(build: Build, buildDigest: BuildDigest, addressing: Addressing): SealedRelease;

package/dist/deployment/release/seal.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
+import { evidenceOf } from '../build/admission.js';
+import { served } from './served/index.js';
+/**
+ * Seal the `DomainRelease` v4 one deployment serves: the served content of the Build at its
+ * address, and the build digest of the exact code it runs. Its release digest therefore names the
+ * schema, the address and the code at once; the Route Table is bound to that release.
+ */
+export function seal(build, buildDigest, addressing) {
+    const document = release.seal({
+        format: 'astrale.domain.release',
+        version: 4,
+        ...served(build, addressing),
+        build: { digest: buildDigest },
+    });
+    const { domain } = evidenceOf(build);
+    return Object.freeze({
+        document,
+        routes: protocolRoutes.bind(build.routes, document, domain, addressing.publicUrl),
+    });
+}

package/dist/deployment/release/{publication → served}/callables.d.ts

@@ -1,4 +1,4 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { Build } from '../../build/index.js';
 import type { Addressing } from '../addressing.js';
-export declare function callables(build: Build, addressing: Addressing): readonly publication.CallableBinding[];
+export declare function callables(build: Build, addressing: Addressing): readonly release.CallableBinding[];

package/dist/deployment/release/{publication → served}/callables.js

@@ -1,7 +1,7 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { invocationPath } from '../invocation.js';
 export function callables(build, addressing) {
-    const endpoint = publication.acceptInvocationEndpoints({
+    const endpoint = release.acceptInvocationEndpoints({
         http: new URL(invocationPath(), addressing.publicUrl).href,
     });
     return Object.freeze(build.callables.map((callable) => Object.freeze({ callable, endpoint })));

package/dist/deployment/release/served/index.d.ts

@@ -0,0 +1,11 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Build } from '../../build/index.js';
+import type { Addressing } from '../addressing.js';
+export declare const DELIVERY_PATH: '/install';
+/**
+ * What a deployment serves beneath its URL: identity, schema bundle, requirements, bindings, routes
+ * and delivery. A `DomainRelease` v4 adds the digest of its running build.
+ */
+export type Served = Omit<release.Content, 'format' | 'version' | 'build'>;
+/** Derive the served content of one exact Build at one Addressing. */
+export declare function served(build: Build, addressing: Addressing): Served;

package/dist/deployment/release/served/index.js

@@ -0,0 +1,26 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { callables } from './callables.js';
+import { routes } from './routes.js';
+import { views } from './views.js';
+export const DELIVERY_PATH = '/install';
+/** Derive the served content of one exact Build at one Addressing. */
+export function served(build, addressing) {
+    const root = build.schema.compiled.root;
+    const bundle = release.bundleUrl(addressing.publicUrl, build.schema.bundle.ref);
+    return {
+        origin: root.origin,
+        identity: { issuer: addressing.issuer, subject: root.origin },
+        schema: { revision: root.revision, bundle: { href: bundle, ref: build.schema.bundle.ref } },
+        requirements: build.requirements,
+        // The root schema declares the Domain name and entrypoint; a release authors neither.
+        ...manifest(build),
+        bindings: { callables: callables(build, addressing), views: views(build, addressing) },
+        delivery: release.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.publicUrl, bundle),
+        routes: routes(build, addressing),
+    };
+}
+/** The release manifest carries the Domain icon as `logo`. Absent when the Build carries none. */
+function manifest(build) {
+    const { icon } = build.presentation ?? {};
+    return icon === undefined ? {} : { manifest: Object.freeze({ logo: icon }) };
+}