@astrale-domains/services 0.2.3 → 0.2.5

package/dist/schema/{service/methods → modules/service/functions}/list-service-logs.d.ts

@@ -9,4 +9,4 @@ export declare const listServiceLogs: import("@astrale-os/sdk/schema").Method<im
         level: string;
         line: string;
     }[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/{service/methods → modules/service/functions}/list-service-logs.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const listServiceLogs = method({
     description: 'Read recent Service runtime logs.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({
         tail: z.number().int().min(1).max(1_000).optional(),
         since: z.number().int().min(0).optional(),

package/dist/schema/{service/methods → modules/service/functions}/list-service-schedules.d.ts

@@ -1,4 +1,4 @@
 export declare const listServiceSchedules: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
     readonly mode: 'value';
     readonly value: string[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/{service/methods → modules/service/functions}/list-service-schedules.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const listServiceSchedules = method({
     description: 'List active Service cron expressions.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({}),
     output: z.array(z.string()),
 });

package/dist/schema/{service/methods → modules/service/functions}/list-service-secret-names.d.ts

@@ -1,4 +1,4 @@
 export declare const listServiceSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
     readonly mode: 'value';
     readonly value: string[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/{service/methods → modules/service/functions}/list-service-secret-names.js

@@ -1,9 +1,11 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { secretName } from './secret-name.js';
+import { OwnService } from '../policies/own-service.js';
+import { secretName } from '../types/index.js';
 export const listServiceSecretNames = method({
     description: 'List write-only Service secret names without exposing values.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({}),
     output: z.array(secretName),
 });

package/dist/schema/{service/methods → modules/service/functions}/replace-service-schedules.d.ts

@@ -8,4 +8,4 @@ export declare const replaceServiceSchedules: import("@astrale-os/sdk/schema").M
         kind: "rejected";
         reason: "invalid-schedule" | "service-unavailable";
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/{service/methods → modules/service/functions}/replace-service-schedules.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const replaceServiceSchedules = method({
     description: 'Replace the complete Service cron set.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({ crons: z.array(z.string()).max(24) }),
     output: z.union([
         z.strictObject({ crons: z.array(z.string()) }),

package/dist/schema/{service/methods → modules/service/functions}/set-service-secret.d.ts

@@ -4,9 +4,9 @@ export declare const setServiceSecret: import("@astrale-os/sdk/schema").Method<i
 }, {
     readonly mode: 'value';
     readonly value: {
+        name: string;
+    } | {
         kind: "rejected";
         reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-    } | {
-        name: string;
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/{service/methods → modules/service/functions}/set-service-secret.js

@@ -1,10 +1,11 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { secretName } from './secret-name.js';
-import { secretOperationRejection } from './secret-operation-rejection.js';
+import { OwnService } from '../policies/own-service.js';
+import { secretName, secretOperationRejection } from '../types/index.js';
 export const setServiceSecret = method({
     description: 'Set one write-only Service secret.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({
         name: secretName,
         value: z

package/dist/schema/modules/service/index.d.ts

@@ -0,0 +1,8 @@
+export { CloudflareWorker, Service, service_owned_by } from './classes/index.js';
+export { artifact, deleteService, deleteServiceSecret, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, revisionedDeployment, setServiceSecret, } from './functions/index.js';
+export type { DeployServiceInput, DeployServiceOutput } from './functions/index.js';
+export { OwnService, TraverseOwnedService } from './policies/index.js';
+export { serviceLifecycle } from './states/index.js';
+export type { ServiceLifecycle, ServiceLifecycleEvent } from './states/index.js';
+export { artifactModule, assetBundle, assetFile, resourceLimits, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';
+export type { ArtifactModule, AssetBundle, ResourceLimits } from './types/index.js';

package/dist/schema/modules/service/index.js

@@ -0,0 +1,5 @@
+export { CloudflareWorker, Service, service_owned_by } from './classes/index.js';
+export { artifact, deleteService, deleteServiceSecret, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, revisionedDeployment, setServiceSecret, } from './functions/index.js';
+export { OwnService, TraverseOwnedService } from './policies/index.js';
+export { serviceLifecycle } from './states/index.js';
+export { artifactModule, assetBundle, assetFile, resourceLimits, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';

package/dist/schema/modules/service/policies/index.d.ts

@@ -0,0 +1,2 @@
+export { OwnService } from './own-service.js';
+export { TraverseOwnedService } from './traverse-owned-service.js';

package/dist/schema/modules/service/policies/index.js

@@ -0,0 +1,2 @@
+export { OwnService } from './own-service.js';
+export { TraverseOwnedService } from './traverse-owned-service.js';

package/dist/schema/modules/service/policies/own-service.d.ts

@@ -0,0 +1,2 @@
+/** One Identity may observe and manage exactly the Services it owns. */
+export declare const OwnService: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/service/policies/own-service.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { service_owned_by } from '../classes/service-owned-by.js';
+/** One Identity may observe and manage exactly the Services it owns. */
+export const OwnService = policy({
+    description: 'The subject owns this Service.',
+    match: ({ edge, object, subject }) => edge({ source: object, class: () => service_owned_by, target: subject }),
+});

package/dist/schema/{service/policies.d.ts → modules/service/policies/traverse-owned-service.d.ts}

@@ -1,4 +1,2 @@
-/** A Service is visible only to the Identity that owns its provider effects. */
-export declare const ObserveService: import("@astrale-os/sdk/schema").Policy;
 /** Ownership edges disclose only the subject's own Service relationship. */
 export declare const TraverseOwnedService: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/service/policies/traverse-owned-service.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { service_owned_by } from '../classes/service-owned-by.js';
+/** Ownership edges disclose only the subject's own Service relationship. */
+export const TraverseOwnedService = policy({
+    description: 'The subject owns the Service at the source of this relationship.',
+    match: ({ allOf, edge, source, subject, target }) => allOf(edge({ source, class: () => service_owned_by, target: subject }), edge({ source, class: () => service_owned_by, target })),
+});

package/dist/schema/modules/service/states/index.d.ts

@@ -0,0 +1,2 @@
+export { serviceLifecycle } from './service-lifecycle.js';
+export type { ServiceLifecycle, ServiceLifecycleEvent } from './service-lifecycle.js';

package/dist/schema/modules/service/states/index.js

@@ -0,0 +1 @@
+export { serviceLifecycle } from './service-lifecycle.js';

package/dist/schema/modules/service/states/service-lifecycle.d.ts

@@ -0,0 +1,25 @@
+import { type EventOf, type StateOf } from '@astrale-os/sdk/state';
+/** Complete provider-neutral lifecycle topology for one deployed Service. */
+export declare const serviceLifecycle: import("@astrale-os/sdk/schema").StateMachine<{
+    readonly deploying: {
+        readonly recordProviderDeployment: "reconciling";
+        readonly failDeployment: "failed";
+        readonly deleteService: "deleting";
+    };
+    readonly reconciling: {
+        readonly retryDeployment: "deploying";
+        readonly completeDeployment: "ready";
+        readonly deleteService: "deleting";
+    };
+    readonly ready: {
+        readonly redeploy: "deploying";
+        readonly deleteService: "deleting";
+    };
+    readonly failed: {
+        readonly retryDeployment: "deploying";
+        readonly deleteService: "deleting";
+    };
+    readonly deleting: {};
+}, "deploying">;
+export type ServiceLifecycle = StateOf<typeof serviceLifecycle>;
+export type ServiceLifecycleEvent = EventOf<typeof serviceLifecycle>;

package/dist/schema/modules/service/states/service-lifecycle.js

@@ -0,0 +1,26 @@
+import { stateMachine } from '@astrale-os/sdk/state';
+/** Complete provider-neutral lifecycle topology for one deployed Service. */
+export const serviceLifecycle = stateMachine({
+    initial: 'deploying',
+    transitions: {
+        deploying: {
+            recordProviderDeployment: 'reconciling',
+            failDeployment: 'failed',
+            deleteService: 'deleting',
+        },
+        reconciling: {
+            retryDeployment: 'deploying',
+            completeDeployment: 'ready',
+            deleteService: 'deleting',
+        },
+        ready: {
+            redeploy: 'deploying',
+            deleteService: 'deleting',
+        },
+        failed: {
+            retryDeployment: 'deploying',
+            deleteService: 'deleting',
+        },
+        deleting: {},
+    },
+});

package/dist/schema/modules/service/types/index.d.ts

@@ -0,0 +1,9 @@
+export { artifactModule } from './service-deployment-artifact-module.js';
+export type { ArtifactModule } from './service-deployment-artifact-module.js';
+export { assetBundle, assetFile } from './service-deployment-assets.js';
+export type { AssetBundle } from './service-deployment-assets.js';
+export { MAX_ASSET_BASE64_SIZE, MAX_MODULE_BASE64_SIZE, PORTABLE_BASE64_CHUNK_SIZE, } from './service-deployment-content.js';
+export { resourceLimits } from './service-deployment-resource-limits.js';
+export type { ResourceLimits } from './service-deployment-resource-limits.js';
+export { secretName } from './service-secret-name.js';
+export { secretOperationRejection } from './service-secret-operation-rejection.js';

package/dist/schema/modules/service/types/index.js

@@ -0,0 +1,6 @@
+export { artifactModule } from './service-deployment-artifact-module.js';
+export { assetBundle, assetFile } from './service-deployment-assets.js';
+export { MAX_ASSET_BASE64_SIZE, MAX_MODULE_BASE64_SIZE, PORTABLE_BASE64_CHUNK_SIZE, } from './service-deployment-content.js';
+export { resourceLimits } from './service-deployment-resource-limits.js';
+export { secretName } from './service-secret-name.js';
+export { secretOperationRejection } from './service-secret-operation-rejection.js';

package/dist/schema/{deployment/module.js → modules/service/types/service-deployment-artifact-module.js}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { encodedContent, MAX_MODULE_BASE64_SIZE } from './content.js';
+import { encodedContent, MAX_MODULE_BASE64_SIZE } from './service-deployment-content.js';
 const fields = {
     name: z.string().min(1).max(256),
     kind: z.enum(['esm', 'wasm', 'text', 'data']).optional(),

package/dist/schema/{deployment/asset.js → modules/service/types/service-deployment-assets.js}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { encodedContent, MAX_ASSET_BASE64_SIZE } from './content.js';
+import { encodedContent, MAX_ASSET_BASE64_SIZE } from './service-deployment-content.js';
 const fields = {
     path: z.string().min(1).max(2_048),
     contentType: z.string().min(1).max(256).optional(),

package/dist/schema/modules/service/types/service-secret-name.d.ts

@@ -0,0 +1,2 @@
+import { z } from 'zod';
+export declare const secretName: z.ZodString;

package/dist/schema/modules/service/types/service-secret-operation-rejection.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+export declare const secretOperationRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "binding-unavailable": "binding-unavailable";
+        "invalid-secret-name": "invalid-secret-name";
+        "service-unavailable": "service-unavailable";
+    }>;
+}, z.core.$strict>;