@hypequery/protocol 0.2.1 → 0.4.0

package/README.md

@@ -5,10 +5,11 @@ Hypequery artifacts.
 
 ## Current status
 
-This package now contains the proposed version 1 tagged ClickHouse value codec.
-The API remains pre-stable while the language-neutral specification and
-conformance fixtures are reviewed. It does not yet define an executable
-deployment bundle or a stable Cloud protocol.
+This package contains proposed version 1 tagged values, identifiers,
+expressions, query schemas and implementations, Dataset deployment contracts,
+and deployment bundle manifests. The API remains pre-stable while the
+language-neutral specifications and conformance fixtures are reviewed; these
+drafts do not yet establish a stable Cloud protocol.
 
 The normative source is
 [`specs/security-protocol`](../../specs/security-protocol/README.md).
@@ -17,11 +18,10 @@ The normative source is
 
 The package contains deterministic, framework-independent implementations of
 accepted protocol rules. The current implementation provides strict tagged
-value validation, RFC 8785 canonical encoding, duplicate-aware decoding, a raw
-SHA-256 conformance digest, draft portable logical identifiers, and a proposed
-closed dataset expression/query AST. Artifact envelopes and compatibility
-checks will follow in separate changes. A closed portable query-schema tree
-provides the next layer for named-query input and output contracts.
+value validation, RFC 8785 canonical encoding, duplicate-aware decoding,
+portable logical identifiers, closed expression and schema trees, query
+implementation artifacts, and a validated deployment envelope with a
+domain-separated identity.
 
 It will not connect to ClickHouse, execute queries, load project source, access
 credentials or the environment, perform network or filesystem I/O, implement
@@ -74,6 +74,14 @@ The proposed deployment surface combines complete Dataset definitions, named
 Serve queries, endpoint policy, and runtime artifact identities into one strict
 versioned envelope. Dataset and Serve adapters live in their owning packages;
 the protocol package remains deterministic and framework-independent.
+Validated envelopes can be encoded as canonical RFC 8785 bytes and identified
+with the deployment-v1 domain-separated SHA-256 digest.
+
+The proposed deployment-bundle surface validates the portable manifest that
+binds a deployment identity to exact deployment and runtime artifact files. It
+provides canonical encoding and a separate bundle-v1 identity. Filesystem-safe
+writing and byte verification remain in the CLI because this package performs
+no I/O.
 
 ## Runtime compatibility
 

package/dist/bundles/codec.d.ts

@@ -0,0 +1,13 @@
+import type { ProtocolDeploymentBundleManifest, ProtocolDeploymentBundleOptions } from './types.js';
+export declare const PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN = "hypequery:deployment-bundle:v1\0";
+export interface PreparedProtocolDeploymentBundleManifest {
+    readonly manifest: ProtocolDeploymentBundleManifest;
+    readonly canonical: string;
+    readonly bytes: Uint8Array;
+    readonly identity: string;
+}
+export declare function prepareProtocolDeploymentBundleManifest(input: unknown, options?: ProtocolDeploymentBundleOptions): PreparedProtocolDeploymentBundleManifest;
+export declare function encodeProtocolDeploymentBundleManifest(input: unknown, options?: ProtocolDeploymentBundleOptions): Uint8Array;
+export declare function encodeProtocolDeploymentBundleManifestToString(input: unknown, options?: ProtocolDeploymentBundleOptions): string;
+export declare function hashProtocolDeploymentBundleManifest(input: unknown, options?: ProtocolDeploymentBundleOptions): string;
+//# sourceMappingURL=codec.d.ts.map

package/dist/bundles/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/bundles/codec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,+BAA+B,EAChC,MAAM,YAAY,CAAC;AAKpB,eAAO,MAAM,0CAA0C,qCAAqC,CAAC;AAE7F,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,+BAAoC,GAC5C,wCAAwC,CAS1C;AAED,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,+BAAoC,GAC5C,UAAU,CAEZ;AAED,wBAAgB,8CAA8C,CAC5D,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,+BAAoC,GAC5C,MAAM,CAER;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,+BAAoC,GAC5C,MAAM,CAER"}

package/dist/bundles/codec.js

@@ -0,0 +1,25 @@
+import { sha256 } from '@noble/hashes/sha2';
+import { bytesToHex } from '@noble/hashes/utils';
+import { serializeJcs } from '../values/jcs.js';
+import { validateProtocolDeploymentBundleManifest } from './validate.js';
+const textEncoder = new TextEncoder();
+export const PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN = 'hypequery:deployment-bundle:v1\0';
+export function prepareProtocolDeploymentBundleManifest(input, options = {}) {
+    const manifest = validateProtocolDeploymentBundleManifest(input, options);
+    const canonical = serializeJcs(manifest);
+    const bytes = textEncoder.encode(canonical);
+    const identity = bytesToHex(sha256.create()
+        .update(textEncoder.encode(PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN))
+        .update(bytes)
+        .digest());
+    return Object.freeze({ manifest, canonical, bytes, identity });
+}
+export function encodeProtocolDeploymentBundleManifest(input, options = {}) {
+    return prepareProtocolDeploymentBundleManifest(input, options).bytes;
+}
+export function encodeProtocolDeploymentBundleManifestToString(input, options = {}) {
+    return prepareProtocolDeploymentBundleManifest(input, options).canonical;
+}
+export function hashProtocolDeploymentBundleManifest(input, options = {}) {
+    return prepareProtocolDeploymentBundleManifest(input, options).identity;
+}

package/dist/bundles/errors.d.ts

@@ -0,0 +1,8 @@
+import type { ProtocolDeploymentBundleErrorCode } from './types.js';
+export declare class ProtocolDeploymentBundleError extends TypeError {
+    readonly code: ProtocolDeploymentBundleErrorCode;
+    readonly path: string;
+    constructor(code: ProtocolDeploymentBundleErrorCode, path?: string);
+}
+export declare function bundleError(code: ProtocolDeploymentBundleErrorCode, path?: string): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/bundles/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/bundles/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEpE,qBAAa,6BAA8B,SAAQ,SAAS;IAC1D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,iCAAiC,EAAE,IAAI,SAAM;CAMhE;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,iCAAiC,EACvC,IAAI,SAAM,GACT,KAAK,CAEP"}

package/dist/bundles/errors.js

@@ -0,0 +1,13 @@
+export class ProtocolDeploymentBundleError extends TypeError {
+    code;
+    path;
+    constructor(code, path = '$') {
+        super(`${code} at ${path}`);
+        this.name = 'ProtocolDeploymentBundleError';
+        this.code = code;
+        this.path = path;
+    }
+}
+export function bundleError(code, path = '$') {
+    throw new ProtocolDeploymentBundleError(code, path);
+}

package/dist/bundles/index.d.ts

@@ -0,0 +1,7 @@
+export { ProtocolDeploymentBundleError } from './errors.js';
+export { PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN, encodeProtocolDeploymentBundleManifest, encodeProtocolDeploymentBundleManifestToString, hashProtocolDeploymentBundleManifest, prepareProtocolDeploymentBundleManifest, } from './codec.js';
+export type { PreparedProtocolDeploymentBundleManifest } from './codec.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS } from './limits.js';
+export { validateProtocolDeploymentBundleManifest } from './validate.js';
+export type { ProtocolDeploymentBundleArtifact, ProtocolDeploymentBundleDeployment, ProtocolDeploymentBundleErrorCode, ProtocolDeploymentBundleFile, ProtocolDeploymentBundleLimits, ProtocolDeploymentBundleManifest, ProtocolDeploymentBundleOptions, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/bundles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundles/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,8CAA8C,EAC9C,oCAAoC,EACpC,uCAAuC,GACxC,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,wCAAwC,EAAE,MAAM,eAAe,CAAC;AACzE,YAAY,EACV,gCAAgC,EAChC,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,YAAY,CAAC"}

package/dist/bundles/index.js

@@ -0,0 +1,4 @@
+export { ProtocolDeploymentBundleError } from './errors.js';
+export { PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN, encodeProtocolDeploymentBundleManifest, encodeProtocolDeploymentBundleManifestToString, hashProtocolDeploymentBundleManifest, prepareProtocolDeploymentBundleManifest, } from './codec.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS } from './limits.js';
+export { validateProtocolDeploymentBundleManifest } from './validate.js';

package/dist/bundles/limits.d.ts

@@ -0,0 +1,4 @@
+import type { ProtocolDeploymentBundleLimits, ProtocolDeploymentBundleOptions } from './types.js';
+export declare const DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS: Readonly<ProtocolDeploymentBundleLimits>;
+export declare function resolveDeploymentBundleLimits(options?: ProtocolDeploymentBundleOptions): Readonly<ProtocolDeploymentBundleLimits>;
+//# sourceMappingURL=limits.d.ts.map

package/dist/bundles/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/bundles/limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAChC,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,yCAAyC,EACtD,QAAQ,CAAC,8BAA8B,CAMrC,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,+BAAoC,GAC5C,QAAQ,CAAC,8BAA8B,CAAC,CAe1C"}

package/dist/bundles/limits.js

@@ -0,0 +1,22 @@
+export const DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS = Object.freeze({
+    maxArtifacts: 100,
+    maxPathBytes: 1_024,
+    maxDeploymentBytes: 16 * 1_024 * 1_024,
+    maxArtifactBytes: 128 * 1_024 * 1_024,
+    maxTotalBytes: 256 * 1_024 * 1_024,
+});
+export function resolveDeploymentBundleLimits(options = {}) {
+    const result = { ...DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS };
+    for (const key of Object.keys(result)) {
+        const value = options.limits?.[key];
+        if (value === undefined)
+            continue;
+        const maximum = DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS[key];
+        if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+            throw new RangeError(`${key} must be a positive safe integer no greater than ${maximum} `
+                + '(the deployment bundle v1 maximum)');
+        }
+        result[key] = value;
+    }
+    return Object.freeze(result);
+}

package/dist/bundles/types.d.ts

@@ -0,0 +1,35 @@
+export interface ProtocolDeploymentBundleFile {
+    readonly path: string;
+    readonly sha256: string;
+    readonly byteLength: number;
+}
+export interface ProtocolDeploymentBundleDeployment extends ProtocolDeploymentBundleFile {
+    readonly identity: string;
+}
+export interface ProtocolDeploymentBundleArtifact extends ProtocolDeploymentBundleFile {
+    readonly runtime: 'node' | 'python';
+}
+export interface ProtocolDeploymentBundleManifest {
+    readonly kind: 'hypequery-deployment-bundle';
+    readonly version: 1;
+    readonly deployment: ProtocolDeploymentBundleDeployment;
+    readonly artifacts: readonly ProtocolDeploymentBundleArtifact[];
+}
+export interface ProtocolDeploymentBundleLimits {
+    readonly maxArtifacts: number;
+    readonly maxPathBytes: number;
+    readonly maxDeploymentBytes: number;
+    readonly maxArtifactBytes: number;
+    readonly maxTotalBytes: number;
+}
+/**
+ * Validation budgets for a deployment bundle manifest.
+ *
+ * Values may tighten the fixed bundle-v1 safety ceilings but cannot raise
+ * them. These are parser budgets, not deployment capacity settings.
+ */
+export interface ProtocolDeploymentBundleOptions {
+    readonly limits?: Partial<ProtocolDeploymentBundleLimits>;
+}
+export type ProtocolDeploymentBundleErrorCode = 'HQ_BUNDLE_TYPE' | 'HQ_BUNDLE_UNKNOWN_FIELD' | 'HQ_BUNDLE_INVALID_VERSION' | 'HQ_BUNDLE_INVALID_VALUE' | 'HQ_BUNDLE_INVALID_PATH' | 'HQ_BUNDLE_INVALID_REFERENCE' | 'HQ_BUNDLE_TOO_MANY_ITEMS' | 'HQ_BUNDLE_TOO_LARGE' | 'HQ_BUNDLE_UNSAFE_OBJECT';
+//# sourceMappingURL=types.d.ts.map

package/dist/bundles/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bundles/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,4BAA4B;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC;CACrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,gCAAgC,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,iCAAiC,GACzC,gBAAgB,GAChB,yBAAyB,GACzB,2BAA2B,GAC3B,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,0BAA0B,GAC1B,qBAAqB,GACrB,yBAAyB,CAAC"}

package/dist/bundles/types.js

@@ -0,0 +1 @@
+export {};

package/dist/bundles/validate.d.ts

@@ -0,0 +1,3 @@
+import type { ProtocolDeploymentBundleManifest, ProtocolDeploymentBundleOptions } from './types.js';
+export declare function validateProtocolDeploymentBundleManifest(input: unknown, options?: ProtocolDeploymentBundleOptions): ProtocolDeploymentBundleManifest;
+//# sourceMappingURL=validate.d.ts.map

package/dist/bundles/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/bundles/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAIV,gCAAgC,EAChC,+BAA+B,EAChC,MAAM,YAAY,CAAC;AA4HpB,wBAAgB,wCAAwC,CACtD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,+BAAoC,GAC5C,gCAAgC,CAwClC"}

package/dist/bundles/validate.js

@@ -0,0 +1,155 @@
+import { bundleError } from './errors.js';
+import { resolveDeploymentBundleLimits } from './limits.js';
+const textEncoder = new TextEncoder();
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const PATH_SEGMENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const WINDOWS_RESERVED_NAME = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i;
+function requireRecord(input, path) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        bundleError('HQ_BUNDLE_TYPE', path);
+    }
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== Object.prototype && prototype !== null) {
+        bundleError('HQ_BUNDLE_UNSAFE_OBJECT', path);
+    }
+    if (Object.getOwnPropertySymbols(input).length > 0) {
+        bundleError('HQ_BUNDLE_UNSAFE_OBJECT', path);
+    }
+    for (const descriptor of Object.values(Object.getOwnPropertyDescriptors(input))) {
+        if (!descriptor.enumerable || !('value' in descriptor)) {
+            bundleError('HQ_BUNDLE_UNSAFE_OBJECT', path);
+        }
+    }
+    return input;
+}
+function requireArray(input, path, maxItems) {
+    if (!Array.isArray(input))
+        bundleError('HQ_BUNDLE_TYPE', path);
+    if (Object.getPrototypeOf(input) !== Array.prototype
+        || Object.getOwnPropertySymbols(input).length > 0) {
+        bundleError('HQ_BUNDLE_UNSAFE_OBJECT', path);
+    }
+    if (input.length > maxItems)
+        bundleError('HQ_BUNDLE_TOO_MANY_ITEMS', path);
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    for (let index = 0; index < input.length; index += 1) {
+        const descriptor = descriptors[String(index)];
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+            bundleError('HQ_BUNDLE_UNSAFE_OBJECT', `${path}[${index}]`);
+        }
+    }
+    if (Object.keys(input).length !== input.length
+        || Object.getOwnPropertyNames(input).length !== input.length + 1) {
+        bundleError('HQ_BUNDLE_UNSAFE_OBJECT', path);
+    }
+    return input;
+}
+function exactFields(value, required, path) {
+    const allowed = new Set(required);
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key))
+            bundleError('HQ_BUNDLE_UNKNOWN_FIELD', `${path}.${key}`);
+    }
+    for (const key of required) {
+        if (!Object.hasOwn(value, key))
+            bundleError('HQ_BUNDLE_TYPE', `${path}.${key}`);
+    }
+}
+function freezeRecord(entries) {
+    return Object.freeze(Object.assign(Object.create(null), entries));
+}
+function digest(value, path) {
+    if (typeof value !== 'string')
+        bundleError('HQ_BUNDLE_TYPE', path);
+    if (!SHA256_PATTERN.test(value))
+        bundleError('HQ_BUNDLE_INVALID_VALUE', path);
+    return value;
+}
+function byteLength(value, path, maximum) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        bundleError('HQ_BUNDLE_INVALID_VALUE', path);
+    }
+    if (value > maximum)
+        bundleError('HQ_BUNDLE_TOO_LARGE', path);
+    return value;
+}
+function relativePath(value, path, maxBytes) {
+    if (typeof value !== 'string')
+        bundleError('HQ_BUNDLE_TYPE', path);
+    if (value.length > maxBytes || textEncoder.encode(value).byteLength > maxBytes) {
+        bundleError('HQ_BUNDLE_TOO_LARGE', path);
+    }
+    const segments = value.split('/');
+    if (segments.some(segment => !PATH_SEGMENT_PATTERN.test(segment)
+        || segment.endsWith('.')
+        || WINDOWS_RESERVED_NAME.test(segment))) {
+        bundleError('HQ_BUNDLE_INVALID_PATH', path);
+    }
+    return value;
+}
+function validateDeployment(input, path, limits) {
+    const value = requireRecord(input, path);
+    exactFields(value, ['path', 'identity', 'sha256', 'byteLength'], path);
+    return freezeRecord({
+        path: relativePath(value.path, `${path}.path`, limits.maxPathBytes),
+        identity: digest(value.identity, `${path}.identity`),
+        sha256: digest(value.sha256, `${path}.sha256`),
+        byteLength: byteLength(value.byteLength, `${path}.byteLength`, limits.maxDeploymentBytes),
+    });
+}
+function validateArtifact(input, path, limits) {
+    const value = requireRecord(input, path);
+    exactFields(value, ['runtime', 'path', 'sha256', 'byteLength'], path);
+    if (value.runtime !== 'node' && value.runtime !== 'python') {
+        if (typeof value.runtime !== 'string')
+            bundleError('HQ_BUNDLE_TYPE', `${path}.runtime`);
+        bundleError('HQ_BUNDLE_INVALID_VALUE', `${path}.runtime`);
+    }
+    return freezeRecord({
+        runtime: value.runtime,
+        path: relativePath(value.path, `${path}.path`, limits.maxPathBytes),
+        sha256: digest(value.sha256, `${path}.sha256`),
+        byteLength: byteLength(value.byteLength, `${path}.byteLength`, limits.maxArtifactBytes),
+    });
+}
+export function validateProtocolDeploymentBundleManifest(input, options = {}) {
+    const limits = resolveDeploymentBundleLimits(options);
+    const value = requireRecord(input, '$');
+    exactFields(value, ['kind', 'version', 'deployment', 'artifacts'], '$');
+    if (value.kind !== 'hypequery-deployment-bundle') {
+        if (typeof value.kind !== 'string')
+            bundleError('HQ_BUNDLE_TYPE', '$.kind');
+        bundleError('HQ_BUNDLE_INVALID_VALUE', '$.kind');
+    }
+    if (value.version !== 1) {
+        if (typeof value.version !== 'number')
+            bundleError('HQ_BUNDLE_TYPE', '$.version');
+        bundleError('HQ_BUNDLE_INVALID_VERSION', '$.version');
+    }
+    const deployment = validateDeployment(value.deployment, '$.deployment', limits);
+    const artifacts = Object.freeze(requireArray(value.artifacts, '$.artifacts', limits.maxArtifacts)
+        .map((artifact, index) => validateArtifact(artifact, `$.artifacts[${index}]`, limits)));
+    const paths = [deployment.path, ...artifacts.map(artifact => artifact.path)];
+    if (new Set(paths).size !== paths.length
+        || new Set(paths.map(bundlePath => bundlePath.toLowerCase())).size !== paths.length) {
+        bundleError('HQ_BUNDLE_INVALID_REFERENCE', '$.artifacts');
+    }
+    if (new Set(artifacts.map(artifact => artifact.sha256)).size !== artifacts.length) {
+        bundleError('HQ_BUNDLE_INVALID_REFERENCE', '$.artifacts');
+    }
+    const sortedPaths = artifacts.map(artifact => artifact.path).sort();
+    if (artifacts.some((artifact, index) => artifact.path !== sortedPaths[index])) {
+        bundleError('HQ_BUNDLE_INVALID_VALUE', '$.artifacts');
+    }
+    const totalBytes = deployment.byteLength
+        + artifacts.reduce((total, artifact) => total + artifact.byteLength, 0);
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > limits.maxTotalBytes) {
+        bundleError('HQ_BUNDLE_TOO_LARGE', '$');
+    }
+    return freezeRecord({
+        kind: 'hypequery-deployment-bundle',
+        version: 1,
+        deployment,
+        artifacts,
+    });
+}

package/dist/deployments/codec.d.ts

@@ -0,0 +1,18 @@
+import type { ProtocolDeploymentContract, ProtocolDeploymentOptions } from './types.js';
+/** Domain prefix for deployment contract v1 identities. */
+export declare const PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN = "hypequery:deployment:v1\0";
+export interface PreparedProtocolDeploymentContract {
+    readonly contract: ProtocolDeploymentContract;
+    readonly canonical: string;
+    readonly bytes: Uint8Array;
+    readonly identity: string;
+}
+/** Validates and serializes once, returning every deployment artifact representation. */
+export declare function prepareProtocolDeploymentContract(input: unknown, options?: ProtocolDeploymentOptions): PreparedProtocolDeploymentContract;
+/** Validates a deployment contract and returns canonical RFC 8785 UTF-8 bytes. */
+export declare function encodeProtocolDeploymentContract(input: unknown, options?: ProtocolDeploymentOptions): Uint8Array;
+/** String form of the canonical deployment contract bytes. */
+export declare function encodeProtocolDeploymentContractToString(input: unknown, options?: ProtocolDeploymentOptions): string;
+/** Domain-separated SHA-256 identity of a validated deployment contract. */
+export declare function hashProtocolDeploymentContract(input: unknown, options?: ProtocolDeploymentOptions): string;
+//# sourceMappingURL=codec.d.ts.map

package/dist/deployments/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/deployments/codec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAKxF,2DAA2D;AAC3D,eAAO,MAAM,mCAAmC,8BAA8B,CAAC;AAE/E,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,yBAA8B,GACtC,kCAAkC,CAcpC;AAED,kFAAkF;AAClF,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,yBAA8B,GACtC,UAAU,CAEZ;AAED,8DAA8D;AAC9D,wBAAgB,wCAAwC,CACtD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,yBAA8B,GACtC,MAAM,CAER;AAED,4EAA4E;AAC5E,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,yBAA8B,GACtC,MAAM,CAER"}

package/dist/deployments/codec.js

@@ -0,0 +1,35 @@
+import { sha256 } from '@noble/hashes/sha2';
+import { bytesToHex } from '@noble/hashes/utils';
+import { serializeJcs } from '../values/jcs.js';
+import { validateProtocolDeploymentContract } from './validate.js';
+const textEncoder = new TextEncoder();
+/** Domain prefix for deployment contract v1 identities. */
+export const PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN = 'hypequery:deployment:v1\0';
+/** Validates and serializes once, returning every deployment artifact representation. */
+export function prepareProtocolDeploymentContract(input, options = {}) {
+    const contract = validateProtocolDeploymentContract(input, options);
+    const canonical = serializeJcs(contract);
+    const bytes = textEncoder.encode(canonical);
+    const identity = bytesToHex(sha256.create()
+        .update(textEncoder.encode(PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN))
+        .update(bytes)
+        .digest());
+    return Object.freeze({
+        contract,
+        canonical,
+        bytes,
+        identity,
+    });
+}
+/** Validates a deployment contract and returns canonical RFC 8785 UTF-8 bytes. */
+export function encodeProtocolDeploymentContract(input, options = {}) {
+    return prepareProtocolDeploymentContract(input, options).bytes;
+}
+/** String form of the canonical deployment contract bytes. */
+export function encodeProtocolDeploymentContractToString(input, options = {}) {
+    return prepareProtocolDeploymentContract(input, options).canonical;
+}
+/** Domain-separated SHA-256 identity of a validated deployment contract. */
+export function hashProtocolDeploymentContract(input, options = {}) {
+    return prepareProtocolDeploymentContract(input, options).identity;
+}

package/dist/deployments/index.d.ts

@@ -1,4 +1,6 @@
 export { ProtocolDeploymentError } from './errors.js';
+export { PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN, encodeProtocolDeploymentContract, encodeProtocolDeploymentContractToString, hashProtocolDeploymentContract, prepareProtocolDeploymentContract, } from './codec.js';
+export type { PreparedProtocolDeploymentContract } from './codec.js';
 export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS } from './limits.js';
 export { validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './validate.js';
 export type { ProtocolAccessPolicy, ProtocolDatasetContract, ProtocolDatasetDimension, ProtocolDatasetFieldSource, ProtocolDatasetFieldType, ProtocolDatasetFilter, ProtocolDatasetLimits, ProtocolDatasetMeasure, ProtocolDatasetMetric, ProtocolDatasetRelationship, ProtocolDatasetTenantPolicy, ProtocolDeploymentContract, ProtocolDeploymentErrorCode, ProtocolDeploymentLimits, ProtocolDeploymentOptions, ProtocolEndpointPolicy, ProtocolEndpointTenantPolicy, ProtocolNamedQueryContract, ProtocolRuntimeArtifact, } from './types.js';

package/dist/deployments/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/deployments/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/deployments/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,wCAAwC,EACxC,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,YAAY,CAAC"}

package/dist/deployments/index.js

@@ -1,3 +1,4 @@
 export { ProtocolDeploymentError } from './errors.js';
+export { PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN, encodeProtocolDeploymentContract, encodeProtocolDeploymentContractToString, hashProtocolDeploymentContract, prepareProtocolDeploymentContract, } from './codec.js';
 export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS } from './limits.js';
 export { validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './validate.js';

package/dist/index.d.ts

@@ -7,7 +7,9 @@ export type { ProtocolSchema, ProtocolSchemaErrorCode, ProtocolSchemaLimits, Pro
 export type { ProtocolAggregation, ProtocolBinaryOperator, ProtocolComparisonOperator, ProtocolDatasetQuery, ProtocolExpression, ProtocolExpressionErrorCode, ProtocolExpressionLimits, ProtocolExpressionOptions, ProtocolFunctionName, ProtocolMetricQuery, ProtocolOrderBy, ProtocolSemanticQuery, ProtocolTimeGrain, } from './expressions/index.js';
 export type { ProtocolIdentifier, ProtocolIdentifierErrorCode, ProtocolQualifiedIdentifier, } from './identifiers/index.js';
 export { DEFAULT_PROTOCOL_QUERY_IMPLEMENTATION_LIMITS, ProtocolQueryImplementationError, validateProtocolQueryImplementation, validateProtocolSqlExpression, } from './query-implementations/index.js';
-export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS, ProtocolDeploymentError, validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './deployments/index.js';
-export type { ProtocolAccessPolicy, ProtocolDatasetContract, ProtocolDatasetDimension, ProtocolDatasetFieldSource, ProtocolDatasetFieldType, ProtocolDatasetFilter, ProtocolDatasetLimits, ProtocolDatasetMeasure, ProtocolDatasetMetric, ProtocolDatasetRelationship, ProtocolDatasetTenantPolicy, ProtocolDeploymentContract, ProtocolDeploymentErrorCode, ProtocolDeploymentLimits, ProtocolDeploymentOptions, ProtocolEndpointPolicy, ProtocolEndpointTenantPolicy, ProtocolNamedQueryContract, ProtocolRuntimeArtifact, } from './deployments/index.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN, ProtocolDeploymentBundleError, encodeProtocolDeploymentBundleManifest, encodeProtocolDeploymentBundleManifestToString, hashProtocolDeploymentBundleManifest, prepareProtocolDeploymentBundleManifest, validateProtocolDeploymentBundleManifest, } from './bundles/index.js';
+export type { PreparedProtocolDeploymentBundleManifest, ProtocolDeploymentBundleArtifact, ProtocolDeploymentBundleDeployment, ProtocolDeploymentBundleErrorCode, ProtocolDeploymentBundleFile, ProtocolDeploymentBundleLimits, ProtocolDeploymentBundleManifest, ProtocolDeploymentBundleOptions, } from './bundles/index.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS, PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN, ProtocolDeploymentError, encodeProtocolDeploymentContract, encodeProtocolDeploymentContractToString, hashProtocolDeploymentContract, prepareProtocolDeploymentContract, validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './deployments/index.js';
+export type { PreparedProtocolDeploymentContract, ProtocolAccessPolicy, ProtocolDatasetContract, ProtocolDatasetDimension, ProtocolDatasetFieldSource, ProtocolDatasetFieldType, ProtocolDatasetFilter, ProtocolDatasetLimits, ProtocolDatasetMeasure, ProtocolDatasetMetric, ProtocolDatasetRelationship, ProtocolDatasetTenantPolicy, ProtocolDeploymentContract, ProtocolDeploymentErrorCode, ProtocolDeploymentLimits, ProtocolDeploymentOptions, ProtocolEndpointPolicy, ProtocolEndpointTenantPolicy, ProtocolNamedQueryContract, ProtocolRuntimeArtifact, } from './deployments/index.js';
 export type { ProtocolQueryImplementation, ProtocolQueryImplementationErrorCode, ProtocolQueryImplementationLimits, ProtocolQueryImplementationOptions, ProtocolSqlDialect, ProtocolSqlExpression, ProtocolSqlParameter, ProtocolSqlParameterSource, ProtocolSqlTenantPolicy, } from './query-implementations/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4CAA4C,EAC5C,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,2BAA2B,EAC3B,oCAAoC,EACpC,iCAAiC,EACjC,kCAAkC,EAClC,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4CAA4C,EAC5C,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,yCAAyC,EACzC,0CAA0C,EAC1C,6BAA6B,EAC7B,sCAAsC,EACtC,8CAA8C,EAC9C,oCAAoC,EACpC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,wCAAwC,EACxC,gCAAgC,EAChC,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kCAAkC,EAClC,mCAAmC,EACnC,uBAAuB,EACvB,gCAAgC,EAChC,wCAAwC,EACxC,8BAA8B,EAC9B,iCAAiC,EACjC,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,kCAAkC,EAClC,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,2BAA2B,EAC3B,oCAAoC,EACpC,iCAAiC,EACjC,kCAAkC,EAClC,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -3,4 +3,5 @@ export { PROTOCOL_IDENTIFIER_LIMITS, ProtocolIdentifierError, isProtocolIdentifi
 export { DEFAULT_PROTOCOL_EXPRESSION_LIMITS, ProtocolExpressionError, validateProtocolExpression, validateProtocolSemanticQuery, } from './expressions/index.js';
 export { DEFAULT_PROTOCOL_SCHEMA_LIMITS, ProtocolSchemaError, validateProtocolSchema, } from './schemas/index.js';
 export { DEFAULT_PROTOCOL_QUERY_IMPLEMENTATION_LIMITS, ProtocolQueryImplementationError, validateProtocolQueryImplementation, validateProtocolSqlExpression, } from './query-implementations/index.js';
-export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS, ProtocolDeploymentError, validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './deployments/index.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, PROTOCOL_DEPLOYMENT_BUNDLE_IDENTITY_DOMAIN, ProtocolDeploymentBundleError, encodeProtocolDeploymentBundleManifest, encodeProtocolDeploymentBundleManifestToString, hashProtocolDeploymentBundleManifest, prepareProtocolDeploymentBundleManifest, validateProtocolDeploymentBundleManifest, } from './bundles/index.js';
+export { DEFAULT_PROTOCOL_DEPLOYMENT_LIMITS, PROTOCOL_DEPLOYMENT_IDENTITY_DOMAIN, ProtocolDeploymentError, encodeProtocolDeploymentContract, encodeProtocolDeploymentContractToString, hashProtocolDeploymentContract, prepareProtocolDeploymentContract, validateProtocolDatasetContract, validateProtocolDeploymentContract, } from './deployments/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/protocol",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Public contracts and TypeScript reference implementation for portable Hypequery artifacts",
   "license": "Apache-2.0",
   "type": "module",