@nakafa/aksara-contracts 0.27.0

package/dist/release/rollback/spec.js

@@ -0,0 +1,156 @@
+import { Schema } from "effect";
+import { ContentFamilySchema, canonicalizeSignedContentArtifact, SignedContentArtifactSchema, } from "#contracts/content";
+import { ContentKeySchema, ReleaseIdSchema, Sha256HashSchema, } from "#contracts/ids";
+import { ContentProjectionSchema, canonicalizeContentProjection, familyForProjection, projectionArtifactLocale, } from "#contracts/projection/spec";
+import { canonicalizeContentChange } from "#contracts/release/canonical";
+import { ArticleHeadSchema, canonicalizeContentHead, MaterialHeadSchema, PageHeadSchema, QuestionHeadSchema, } from "#contracts/release/head";
+import { ContentDeleteSchema, ContentUpsertSchema, ReleaseItemIndexSchema, } from "#contracts/release/spec";
+/** Maximum complete body rollback page below the publication wire ceiling. */
+export const MAX_ROLLBACK_PAGE_BYTES = 4 * 1024 * 1024;
+/** Maximum byte-bounded rollback transitions requested from one target page. */
+export const MAX_ROLLBACK_PAGE_RECORDS = 512;
+const RollbackCursorSchema = Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(-1)));
+/** Explicit proof that a changed content head did not previously exist. */
+export const RollbackAbsentStateSchema = Schema.Struct({
+    artifactLocale: ContentUpsertSchema.fields.artifactLocale,
+    contentKey: ContentKeySchema,
+    family: ContentFamilySchema,
+    state: Schema.Literal("absent"),
+});
+/** Compact authoritative prior article head protected by one rollback digest. */
+export const RollbackArticleStateSchema = Schema.Struct({
+    head: ArticleHeadSchema,
+    state: Schema.Literal("article"),
+});
+/** Compact authoritative prior head protected by one rollback snapshot digest. */
+export const RollbackMaterialStateSchema = Schema.Struct({
+    head: MaterialHeadSchema,
+    state: Schema.Literal("material"),
+});
+/** Compact authoritative prior page head protected by one rollback digest. */
+export const RollbackPageStateSchema = Schema.Struct({
+    head: PageHeadSchema,
+    state: Schema.Literal("page"),
+});
+/** Compact authoritative prior question head protected by one rollback digest. */
+export const RollbackQuestionStateSchema = Schema.Struct({
+    head: QuestionHeadSchema,
+    state: Schema.Literal("question"),
+});
+/** Complete compact state vocabulary authenticated for one future rollback. */
+export const RollbackSnapshotStateSchema = Schema.Union([
+    RollbackAbsentStateSchema,
+    RollbackArticleStateSchema,
+    RollbackMaterialStateSchema,
+    RollbackPageStateSchema,
+    RollbackQuestionStateSchema,
+]);
+/** One ordered prior state covered by a signed release's rollback digest. */
+export const RollbackSnapshotEntrySchema = Schema.Struct({
+    index: ReleaseItemIndexSchema,
+    releaseId: ReleaseIdSchema,
+    snapshot: RollbackSnapshotStateSchema,
+});
+/** Serializes one authenticated prior state for incremental digest computation. */
+export function canonicalizeRollbackSnapshotEntry(entry) {
+    const snapshot = entry.snapshot.state === "absent"
+        ? `{"artifactLocale":${JSON.stringify(entry.snapshot.artifactLocale)},"contentKey":${JSON.stringify(entry.snapshot.contentKey)},"family":${JSON.stringify(entry.snapshot.family)},"state":"absent"}`
+        : `{"head":${canonicalizeContentHead(entry.snapshot.head)},"state":${JSON.stringify(entry.snapshot.state)}}`;
+    return `{"index":${entry.index},"releaseId":${JSON.stringify(entry.releaseId)},"snapshot":${snapshot}}`;
+}
+/** Checks identity coherence across one upsert, artifact, and projection. */
+function hasBoundRollbackUpsert(input) {
+    const { artifact, change, projection } = input;
+    const { payload } = artifact;
+    return (artifact.artifactHash === change.artifactHash &&
+        payload.contentKey === change.contentKey &&
+        payload.artifactLocale === change.artifactLocale &&
+        payload.rendererDomain === change.rendererDomain &&
+        projection.contentKey === change.contentKey &&
+        projectionArtifactLocale(projection) === change.artifactLocale &&
+        familyForProjection(projection) === change.family);
+}
+/** Complete body-bearing state for one existing material head. */
+export const RollbackUpsertStateSchema = Schema.Struct({
+    artifact: SignedContentArtifactSchema,
+    change: ContentUpsertSchema,
+    projection: ContentProjectionSchema,
+}).pipe(Schema.check(Schema.makeFilter(hasBoundRollbackUpsert, {
+    message: "Expected rollback change, artifact, and projection identities to match.",
+})));
+/** Body-free state proving that one locale-specific head is absent. */
+export const RollbackDeleteStateSchema = Schema.Struct({
+    change: ContentDeleteSchema,
+});
+/** Complete full-state vocabulary used by one rollback transition. */
+export const RollbackStateSchema = Schema.Union([
+    RollbackUpsertStateSchema,
+    RollbackDeleteStateSchema,
+]);
+/** Checks that current and prior states describe the same content head. */
+function hasBoundRollbackTransition(input) {
+    return (input.current.change.contentKey === input.prior.change.contentKey &&
+        input.current.change.family === input.prior.change.family &&
+        input.current.change.artifactLocale === input.prior.change.artifactLocale);
+}
+/** Authenticated source state paired with the exact prior state it replaced. */
+export const RollbackRecordSchema = Schema.Struct({
+    current: RollbackStateSchema,
+    index: ReleaseItemIndexSchema,
+    prior: RollbackStateSchema,
+}).pipe(Schema.check(Schema.makeFilter(hasBoundRollbackTransition, {
+    message: "Expected rollback current and prior states to share one identity.",
+})));
+/** Indexed request for one bounded page from the exact active release. */
+export const RollbackPageRequestSchema = Schema.Struct({
+    afterIndex: RollbackCursorSchema,
+    limit: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isBetween({ maximum: MAX_ROLLBACK_PAGE_RECORDS, minimum: 1 }))),
+    rollbackOf: ReleaseIdSchema,
+    rollbackOfManifestHash: Sha256HashSchema,
+});
+/** Checks that one response describes a real final or progressing page. */
+function hasCoherentRollbackPage(page) {
+    const [first] = page.records;
+    const last = page.records.at(-1);
+    if (!(first && last)) {
+        return page.done && page.nextIndex === -1 && page.total === 0;
+    }
+    const hasContiguousRecords = page.records.every((record, offset) => record.index === first.index + offset);
+    return (hasContiguousRecords &&
+        last.index === page.nextIndex &&
+        page.nextIndex < page.total &&
+        page.done === (page.nextIndex + 1 === page.total));
+}
+/** Strict bounded response carrying current and exact prior release states. */
+export const RollbackPageSchema = Schema.Struct({
+    done: Schema.Boolean,
+    nextIndex: RollbackCursorSchema,
+    records: Schema.Array(RollbackRecordSchema).pipe(Schema.check(Schema.isMaxLength(MAX_ROLLBACK_PAGE_RECORDS))),
+    rollbackOf: ReleaseIdSchema,
+    rollbackOfManifestHash: Sha256HashSchema,
+    total: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+}).pipe(Schema.check(Schema.makeFilter(hasCoherentRollbackPage, {
+    message: "Expected one contiguous rollback page with coherent progress evidence.",
+})));
+/** Narrows one full rollback state to its signed prior upsert body. */
+export function isRollbackUpsert(state) {
+    return "artifact" in state;
+}
+/** Serializes one complete rollback state in stable wire field order. */
+function canonicalizeRollbackState(state) {
+    const change = JSON.stringify(canonicalizeContentChange(state.change));
+    if (!isRollbackUpsert(state)) {
+        return `{"change":${change}}`;
+    }
+    return `{"artifact":${canonicalizeSignedContentArtifact(state.artifact)},"change":${change},"projection":${canonicalizeContentProjection(state.projection)}}`;
+}
+/** Serializes one rollback transition in stable wire field order. */
+export function canonicalizeRollbackRecord(record) {
+    return `{"current":${canonicalizeRollbackState(record.current)},"index":${record.index},"prior":${canonicalizeRollbackState(record.prior)}}`;
+}
+/** Serializes the complete body-bearing page for an exact byte ceiling. */
+export function canonicalizeRollbackPage(page) {
+    return `{"done":${page.done},"nextIndex":${page.nextIndex},"records":[${page.records
+        .map(canonicalizeRollbackRecord)
+        .join(",")}],"rollbackOfManifestHash":${JSON.stringify(page.rollbackOfManifestHash)},"rollbackOf":${JSON.stringify(page.rollbackOf)},"total":${page.total}}`;
+}

package/dist/release/route/digest.d.ts

@@ -0,0 +1,45 @@
+import { Effect, Schema, Stream } from "effect";
+import { type ReleaseId } from "#contracts/ids";
+import { type ContentRouteItem } from "#contracts/release/route/spec";
+declare const RouteHashError_base: Schema.Class<RouteHashError, Schema.TaggedStruct<"RouteHashError", {
+    readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+}>, import("effect/Cause").YieldableError>;
+/** SHA-256 computation failed before route integrity was established. */
+export declare class RouteHashError extends RouteHashError_base {
+}
+/** Keeps incremental route hash state private to one release preparation. */
+declare class RouteDigestState {
+    #private;
+    count: number;
+    /** Initializes a domain-separated incremental route hash. */
+    constructor();
+    /** Adds one canonical route item to this invocation-owned digest. */
+    update(item: ContentRouteItem): void;
+    /** Consumes the route hash and returns its branded identity. */
+    digest(): string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+}
+/** Creates fresh domain-separated route digest state. */
+export declare function createRouteDigest(releaseId: ReleaseId): Effect.Effect<RouteDigestState, RouteHashError, never>;
+/** Adds one canonical route item to an incremental digest. */
+export declare function updateRouteDigest(releaseId: ReleaseId, state: RouteDigestState, item: ContentRouteItem): Effect.Effect<RouteDigestState, RouteHashError, never>;
+/** Completes one incremental route digest with typed hash failures. */
+export declare function completeRouteDigest(releaseId: ReleaseId, state: RouteDigestState): Effect.Effect<string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">, RouteHashError, never>;
+/** Digests a canonical route stream without retaining its rows. */
+export declare const digestRoutes: <E, R>(releaseId: string & import("effect/Brand").Brand<"@NakafaAI/AksaraReleaseId">, routes: Stream.Stream<{
+    readonly change: {
+        readonly appLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraAppLocale">;
+        readonly contentKey: string & import("effect/Brand").Brand<"@NakafaAI/AksaraContentKey">;
+        readonly operation: "bind";
+        readonly publicPath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraPublicPath">;
+    } | {
+        readonly appLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraAppLocale">;
+        readonly operation: "delete";
+        readonly publicPath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraPublicPath">;
+    };
+    readonly index: number;
+    readonly releaseId: string & import("effect/Brand").Brand<"@NakafaAI/AksaraReleaseId">;
+}, E, R>) => Effect.Effect<{
+    count: number;
+    digest: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+}, E | RouteHashError, R>;
+export {};

package/dist/release/route/digest.js

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { Effect, Schema, Stream } from "effect";
+import { ReleaseIdSchema, Sha256HashSchema, } from "#contracts/ids";
+import { canonicalizeContentRouteItem, } from "#contracts/release/route/spec";
+const CONTENT_ROUTE_DIGEST_DOMAIN = "nakafa.aksara.content-routes";
+/** SHA-256 computation failed before route integrity was established. */
+export class RouteHashError extends Schema.TaggedError()("RouteHashError", { releaseId: ReleaseIdSchema }) {
+}
+/** Keeps incremental route hash state private to one release preparation. */
+class RouteDigestState {
+    #hash = createHash("sha256");
+    count = 0;
+    /** Initializes a domain-separated incremental route hash. */
+    constructor() {
+        this.#hash.update(CONTENT_ROUTE_DIGEST_DOMAIN);
+        this.#hash.update("\n");
+    }
+    /** Adds one canonical route item to this invocation-owned digest. */
+    update(item) {
+        this.#hash.update(canonicalizeContentRouteItem(item));
+        this.#hash.update("\n");
+        this.count += 1;
+    }
+    /** Consumes the route hash and returns its branded identity. */
+    digest() {
+        return Sha256HashSchema.make(`sha256:${this.#hash.digest("hex")}`);
+    }
+}
+/** Creates fresh domain-separated route digest state. */
+export function createRouteDigest(releaseId) {
+    return Effect.try({
+        catch: () => new RouteHashError({ releaseId }),
+        try: () => new RouteDigestState(),
+    });
+}
+/** Adds one canonical route item to an incremental digest. */
+export function updateRouteDigest(releaseId, state, item) {
+    return Effect.try({
+        catch: () => new RouteHashError({ releaseId }),
+        try: () => {
+            state.update(item);
+            return state;
+        },
+    });
+}
+/** Completes one incremental route digest with typed hash failures. */
+export function completeRouteDigest(releaseId, state) {
+    return Effect.try({
+        catch: () => new RouteHashError({ releaseId }),
+        try: () => state.digest(),
+    });
+}
+/** Digests a canonical route stream without retaining its rows. */
+export const digestRoutes = Effect.fn("AksaraContracts.digestRoutes")(function* (releaseId, routes) {
+    const initial = yield* createRouteDigest(releaseId);
+    const state = yield* routes.pipe(Stream.runFoldEffect(() => initial, (current, route) => updateRouteDigest(releaseId, current, route)));
+    const digest = yield* completeRouteDigest(releaseId, state);
+    return { count: state.count, digest };
+});

package/dist/release/route/page.d.ts

@@ -0,0 +1,56 @@
+import { Schema } from "effect";
+/** Maximum route rollback records returned by one target page. */
+export declare const MAX_ROUTE_PAGE_RECORDS = 100;
+/** One signed route mutation paired with its exact prior owner. */
+export declare const RouteRollbackRecordSchema: Schema.Struct<{
+    readonly current: Schema.Struct<{
+        readonly change: Schema.Union<readonly [Schema.Struct<{
+            readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+            readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+            readonly operation: Schema.Literal<"bind">;
+            readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+        }>, Schema.Struct<{
+            readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+            readonly operation: Schema.Literal<"delete">;
+            readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+        }>]>;
+        readonly index: Schema.Finite;
+        readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+    }>;
+    readonly priorContentKey: Schema.NullOr<Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">>;
+}>;
+export type RouteRollbackRecord = typeof RouteRollbackRecordSchema.Type;
+/** Indexed request for one bounded route rollback page. */
+export declare const RoutePageRequestSchema: Schema.Struct<{
+    readonly afterIndex: Schema.Finite;
+    readonly limit: Schema.Finite;
+    readonly rollbackOf: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+    readonly rollbackOfManifestHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+}>;
+export type RoutePageRequest = typeof RoutePageRequestSchema.Type;
+/** Strict bounded response carrying prior route owners for one release. */
+export declare const RoutePageSchema: Schema.Struct<{
+    readonly done: Schema.Boolean;
+    readonly nextIndex: Schema.Finite;
+    readonly records: Schema.$Array<Schema.Struct<{
+        readonly current: Schema.Struct<{
+            readonly change: Schema.Union<readonly [Schema.Struct<{
+                readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+                readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+                readonly operation: Schema.Literal<"bind">;
+                readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+            }>, Schema.Struct<{
+                readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+                readonly operation: Schema.Literal<"delete">;
+                readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+            }>]>;
+            readonly index: Schema.Finite;
+            readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+        }>;
+        readonly priorContentKey: Schema.NullOr<Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">>;
+    }>>;
+    readonly rollbackOf: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+    readonly rollbackOfManifestHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    readonly total: Schema.Finite;
+}>;
+export type RoutePage = typeof RoutePageSchema.Type;

package/dist/release/route/page.js

@@ -0,0 +1,46 @@
+import { Schema } from "effect";
+import { ContentKeySchema, ReleaseIdSchema, Sha256HashSchema, } from "#contracts/ids";
+import { ContentRouteItemSchema } from "#contracts/release/route/spec";
+/** Maximum route rollback records returned by one target page. */
+export const MAX_ROUTE_PAGE_RECORDS = 100;
+const RouteCursorSchema = Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(-1)));
+/** One signed route mutation paired with its exact prior owner. */
+export const RouteRollbackRecordSchema = Schema.Struct({
+    current: ContentRouteItemSchema,
+    priorContentKey: Schema.NullOr(ContentKeySchema),
+}).pipe(Schema.check(Schema.makeFilter((record) => record.current.change.operation === "delete"
+    ? record.priorContentKey !== null
+    : record.priorContentKey !== record.current.change.contentKey, {
+    message: "Expected a route change to alter the prior binding owner.",
+})));
+/** Indexed request for one bounded route rollback page. */
+export const RoutePageRequestSchema = Schema.Struct({
+    afterIndex: RouteCursorSchema,
+    limit: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isBetween({ maximum: MAX_ROUTE_PAGE_RECORDS, minimum: 1 }))),
+    rollbackOf: ReleaseIdSchema,
+    rollbackOfManifestHash: Sha256HashSchema,
+});
+/** Checks stable total and contiguous signed route indexes. */
+function hasCoherentRoutePage(page) {
+    const [first] = page.records;
+    const last = page.records.at(-1);
+    if (!(first && last)) {
+        return page.done && page.nextIndex === -1 && page.total === 0;
+    }
+    const contiguous = page.records.every((record, offset) => record.current.index === first.current.index + offset);
+    return (contiguous &&
+        last.current.index === page.nextIndex &&
+        page.nextIndex < page.total &&
+        page.done === (page.nextIndex + 1 === page.total));
+}
+/** Strict bounded response carrying prior route owners for one release. */
+export const RoutePageSchema = Schema.Struct({
+    done: Schema.Boolean,
+    nextIndex: RouteCursorSchema,
+    records: Schema.Array(RouteRollbackRecordSchema).pipe(Schema.check(Schema.isMaxLength(MAX_ROUTE_PAGE_RECORDS))),
+    rollbackOf: ReleaseIdSchema,
+    rollbackOfManifestHash: Sha256HashSchema,
+    total: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+}).pipe(Schema.check(Schema.makeFilter(hasCoherentRoutePage, {
+    message: "Expected one contiguous route page with coherent progress evidence.",
+})));

package/dist/release/route/spec.d.ts

@@ -0,0 +1,49 @@
+/** Signed public route change and item wire contracts. */
+import { Schema } from "effect";
+/** One public route bound to a stable locale-specific content identity. */
+export declare const ContentRouteBindSchema: Schema.Struct<{
+    readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+    readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+    readonly operation: Schema.Literal<"bind">;
+    readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+}>;
+export type ContentRouteBind = typeof ContentRouteBindSchema.Type;
+/** One public route removed without deleting its stable content identity. */
+export declare const ContentRouteDeleteSchema: Schema.Struct<{
+    readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+    readonly operation: Schema.Literal<"delete">;
+    readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+}>;
+export type ContentRouteDelete = typeof ContentRouteDeleteSchema.Type;
+/** Complete immutable public-route change vocabulary for one release. */
+export declare const ContentRouteChangeSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+    readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+    readonly operation: Schema.Literal<"bind">;
+    readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+}>, Schema.Struct<{
+    readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+    readonly operation: Schema.Literal<"delete">;
+    readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+}>]>;
+export type ContentRouteChange = typeof ContentRouteChangeSchema.Type;
+/** One ordered route change authenticated by the signed release manifest. */
+export declare const ContentRouteItemSchema: Schema.Struct<{
+    readonly change: Schema.Union<readonly [Schema.Struct<{
+        readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+        readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+        readonly operation: Schema.Literal<"bind">;
+        readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+    }>, Schema.Struct<{
+        readonly appLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraAppLocale">;
+        readonly operation: Schema.Literal<"delete">;
+        readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+    }>]>;
+    readonly index: Schema.Finite;
+    readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+}>;
+export type ContentRouteItem = typeof ContentRouteItemSchema.Type;
+/** Serializes one route change in stable wire field order. */
+export declare function canonicalizeContentRouteChange(change: ContentRouteChange): string;
+/** Serializes one indexed route item for signed digest computation. */
+export declare function canonicalizeContentRouteItem(item: ContentRouteItem): string;

package/dist/release/route/spec.js

@@ -0,0 +1,40 @@
+/** Signed public route change and item wire contracts. */
+import { Schema } from "effect";
+import { ContentKeySchema, PublicPathSchema, ReleaseIdSchema, } from "#contracts/ids";
+import { AppLocaleSchema } from "#contracts/locale";
+import { ReleaseItemIndexSchema } from "#contracts/release/spec";
+/** One public route bound to a stable locale-specific content identity. */
+export const ContentRouteBindSchema = Schema.Struct({
+    appLocale: AppLocaleSchema,
+    contentKey: ContentKeySchema,
+    operation: Schema.Literal("bind"),
+    publicPath: PublicPathSchema,
+});
+/** One public route removed without deleting its stable content identity. */
+export const ContentRouteDeleteSchema = Schema.Struct({
+    appLocale: AppLocaleSchema,
+    operation: Schema.Literal("delete"),
+    publicPath: PublicPathSchema,
+});
+/** Complete immutable public-route change vocabulary for one release. */
+export const ContentRouteChangeSchema = Schema.Union([
+    ContentRouteBindSchema,
+    ContentRouteDeleteSchema,
+]);
+/** One ordered route change authenticated by the signed release manifest. */
+export const ContentRouteItemSchema = Schema.Struct({
+    change: ContentRouteChangeSchema,
+    index: ReleaseItemIndexSchema,
+    releaseId: ReleaseIdSchema,
+});
+/** Serializes one route change in stable wire field order. */
+export function canonicalizeContentRouteChange(change) {
+    if (change.operation === "delete") {
+        return `{"appLocale":${JSON.stringify(change.appLocale)},"operation":"delete","publicPath":${JSON.stringify(change.publicPath)}}`;
+    }
+    return `{"appLocale":${JSON.stringify(change.appLocale)},"contentKey":${JSON.stringify(change.contentKey)},"operation":"bind","publicPath":${JSON.stringify(change.publicPath)}}`;
+}
+/** Serializes one indexed route item for signed digest computation. */
+export function canonicalizeContentRouteItem(item) {
+    return `{"change":${canonicalizeContentRouteChange(item.change)},"index":${item.index},"releaseId":${JSON.stringify(item.releaseId)}}`;
+}

package/dist/release/route/verify.d.ts

@@ -0,0 +1,66 @@
+import { Effect, Schema, Stream } from "effect";
+import type { ContentReleaseManifest } from "#contracts/release/spec";
+declare const RouteDecodeError_base: Schema.Class<RouteDecodeError, Schema.TaggedStruct<"RouteDecodeError", {
+    readonly routeOffset: Schema.Finite;
+}>, import("effect/Cause").YieldableError>;
+/** One streamed route failed strict wire decoding. */
+export declare class RouteDecodeError extends RouteDecodeError_base {
+}
+declare const RouteIdentityError_base: Schema.Class<RouteIdentityError, Schema.TaggedStruct<"RouteIdentityError", {
+    readonly routeOffset: Schema.Finite;
+}>, import("effect/Cause").YieldableError>;
+/** One route belongs to another release or sequence position. */
+export declare class RouteIdentityError extends RouteIdentityError_base {
+}
+declare const RouteDuplicateError_base: Schema.Class<RouteDuplicateError, Schema.TaggedStruct<"RouteDuplicateError", {
+    readonly firstIndex: Schema.Finite;
+    readonly publicPath: Schema.brand<Schema.String, "@NakafaAI/AksaraPublicPath">;
+}>, import("effect/Cause").YieldableError>;
+/** Two changes in one release target the same locale-specific route. */
+export declare class RouteDuplicateError extends RouteDuplicateError_base {
+}
+declare const RouteCountError_base: Schema.Class<RouteCountError, Schema.TaggedStruct<"RouteCountError", {
+    readonly actualCount: Schema.Finite;
+    readonly expectedCount: Schema.Finite;
+}>, import("effect/Cause").YieldableError>;
+/** The streamed route count differs from its signed manifest. */
+export declare class RouteCountError extends RouteCountError_base {
+}
+declare const RouteDigestError_base: Schema.Class<RouteDigestError, Schema.TaggedStruct<"RouteDigestError", {
+    readonly actualDigest: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    readonly expectedDigest: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+}>, import("effect/Cause").YieldableError>;
+/** The streamed route digest differs from its signed manifest. */
+export declare class RouteDigestError extends RouteDigestError_base {
+}
+/** Count authenticated without retaining complete route rows. */
+export interface VerifiedContentRoutes {
+    readonly count: number;
+}
+/** Strictly decodes one replayable canonical route stream. */
+export declare function decodeContentRoutes<E, R>(input: {
+    readonly manifest: ContentReleaseManifest;
+    readonly routes: Stream.Stream<unknown, E, R>;
+}): Stream.Stream<{
+    readonly change: {
+        readonly appLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraAppLocale">;
+        readonly contentKey: string & import("effect/Brand").Brand<"@NakafaAI/AksaraContentKey">;
+        readonly operation: "bind";
+        readonly publicPath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraPublicPath">;
+    } | {
+        readonly appLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraAppLocale">;
+        readonly operation: "delete";
+        readonly publicPath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraPublicPath">;
+    };
+    readonly index: number;
+    readonly releaseId: string & import("effect/Brand").Brand<"@NakafaAI/AksaraReleaseId">;
+}, E | RouteDecodeError | RouteDuplicateError | RouteIdentityError, R>;
+/** Authenticates a replayable route stream against its signed manifest. */
+export declare const verifyContentRoutes: <E, R>(input: {
+    readonly manifest: ContentReleaseManifest;
+    readonly routes: Stream.Stream<unknown, E, R>;
+}) => Effect.Effect<{
+    count: number;
+}, E | RouteCountError | RouteDecodeError | RouteDigestError | RouteDuplicateError | import("#contracts/release/route/digest").RouteHashError | RouteIdentityError, R>;
+export {};

package/dist/release/route/verify.js

@@ -0,0 +1,67 @@
+import { Effect, Schema, Stream } from "effect";
+import { routeIdentity } from "#contracts/content";
+import { PublicPathSchema, ReleaseIdSchema, Sha256HashSchema, } from "#contracts/ids";
+import { digestRoutes } from "#contracts/release/route/digest";
+import { ContentRouteItemSchema } from "#contracts/release/route/spec";
+const RouteIndexSchema = Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0)));
+/** One streamed route failed strict wire decoding. */
+export class RouteDecodeError extends Schema.TaggedError()("RouteDecodeError", { routeOffset: RouteIndexSchema }) {
+}
+/** One route belongs to another release or sequence position. */
+export class RouteIdentityError extends Schema.TaggedError()("RouteIdentityError", { routeOffset: RouteIndexSchema }) {
+}
+/** Two changes in one release target the same locale-specific route. */
+export class RouteDuplicateError extends Schema.TaggedError()("RouteDuplicateError", { firstIndex: RouteIndexSchema, publicPath: PublicPathSchema }) {
+}
+/** The streamed route count differs from its signed manifest. */
+export class RouteCountError extends Schema.TaggedError()("RouteCountError", { actualCount: RouteIndexSchema, expectedCount: RouteIndexSchema }) {
+}
+/** The streamed route digest differs from its signed manifest. */
+export class RouteDigestError extends Schema.TaggedError()("RouteDigestError", {
+    actualDigest: Sha256HashSchema,
+    expectedDigest: Sha256HashSchema,
+    releaseId: ReleaseIdSchema,
+}) {
+}
+/** Decodes one route and applies release, index, and uniqueness invariants. */
+function decodeRoute(manifest, state, source, routeOffset) {
+    return Schema.decodeUnknownEffect(ContentRouteItemSchema)(source, {
+        onExcessProperty: "error",
+    }).pipe(Effect.mapError(() => new RouteDecodeError({ routeOffset })), Effect.filterOrFail((item) => item.releaseId === manifest.releaseId && item.index === routeOffset, () => new RouteIdentityError({ routeOffset })), Effect.flatMap((item) => {
+        const identity = routeIdentity(item.change);
+        const firstIndex = state.firstIndex.get(identity);
+        if (firstIndex !== undefined) {
+            return Effect.fail(new RouteDuplicateError({
+                firstIndex,
+                publicPath: item.change.publicPath,
+            }));
+        }
+        state.firstIndex.set(identity, item.index);
+        return Effect.succeed(item);
+    }));
+}
+/** Strictly decodes one replayable canonical route stream. */
+export function decodeContentRoutes(input) {
+    return Stream.unwrap(Effect.sync(() => {
+        const state = { firstIndex: new Map() };
+        return input.routes.pipe(Stream.zipWithIndex, Stream.mapEffect(([source, routeOffset]) => decodeRoute(input.manifest, state, source, routeOffset)));
+    }));
+}
+/** Authenticates a replayable route stream against its signed manifest. */
+export const verifyContentRoutes = Effect.fn("AksaraContracts.verifyContentRoutes")(function* (input) {
+    const summary = yield* digestRoutes(input.manifest.releaseId, decodeContentRoutes(input));
+    if (summary.count !== input.manifest.routeCount) {
+        return yield* new RouteCountError({
+            actualCount: summary.count,
+            expectedCount: input.manifest.routeCount,
+        });
+    }
+    if (summary.digest !== input.manifest.routeDigest) {
+        return yield* new RouteDigestError({
+            actualDigest: summary.digest,
+            expectedDigest: input.manifest.routeDigest,
+            releaseId: input.manifest.releaseId,
+        });
+    }
+    return { count: summary.count };
+});

package/dist/release/signing.d.ts

@@ -0,0 +1,6 @@
+import type { Sha256HashSchema } from "#contracts/ids";
+import type { ContentReleaseManifest } from "#contracts/release/spec";
+/** Produces stable manifest bytes including locale and source identity. */
+export declare function canonicalizeContentReleaseManifest(manifest: ContentReleaseManifest): string;
+/** Returns domain-separated canonical bytes covered by release Ed25519. */
+export declare function canonicalizeContentReleaseSigningInput(manifestHash: typeof Sha256HashSchema.Type, manifest: ContentReleaseManifest): string;

package/dist/release/signing.js

@@ -0,0 +1,38 @@
+import { canonicalizeReleaseOrigin } from "#contracts/release/origin";
+import { canonicalizePublicationScope } from "#contracts/release/snapshot/scope";
+import { canonicalizeContentSnapshotSet } from "#contracts/release/snapshot/spec";
+const CONTENT_RELEASE_SIGNATURE_DOMAIN = "nakafa.aksara.localized-content-release";
+/** Produces stable manifest bytes including locale and source identity. */
+export function canonicalizeContentReleaseManifest(manifest) {
+    return JSON.stringify({
+        activeAppLocales: manifest.activeAppLocales,
+        baseActiveAppLocales: manifest.baseActiveAppLocales,
+        baseManifestHash: manifest.baseManifestHash,
+        baseReleaseId: manifest.baseReleaseId,
+        baseResultCount: manifest.baseResultCount,
+        baseResultDigest: manifest.baseResultDigest,
+        deleteCount: manifest.deleteCount,
+        format: manifest.format,
+        itemCount: manifest.itemCount,
+        itemsDigest: manifest.itemsDigest,
+        origin: canonicalizeReleaseOrigin(manifest.origin),
+        projectionCount: manifest.projectionCount,
+        projectionDigest: manifest.projectionDigest,
+        releaseId: manifest.releaseId,
+        rendererContractVersion: manifest.rendererContractVersion,
+        rendererManifestHash: manifest.rendererManifestHash,
+        resultCount: manifest.resultCount,
+        resultDigest: manifest.resultDigest,
+        rollbackCount: manifest.rollbackCount,
+        rollbackDigest: manifest.rollbackDigest,
+        routeCount: manifest.routeCount,
+        routeDigest: manifest.routeDigest,
+        scope: canonicalizePublicationScope(manifest.scope),
+        snapshots: canonicalizeContentSnapshotSet(manifest.snapshots),
+        upsertCount: manifest.upsertCount,
+    });
+}
+/** Returns domain-separated canonical bytes covered by release Ed25519. */
+export function canonicalizeContentReleaseSigningInput(manifestHash, manifest) {
+    return `${CONTENT_RELEASE_SIGNATURE_DOMAIN}\n${manifestHash}\n${canonicalizeContentReleaseManifest(manifest)}`;
+}