@astrale-domains/services 0.2.4 → 0.2.5

package/dist/schema/modules/service/classes/cloudflare-worker.js

@@ -1,6 +1,6 @@
 import { nodeClass, property } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { deployCloudflareWorker } from '../functions/index.js';
+import { deployCloudflareWorker } from '../functions/deploy-cloudflare-worker.js';
 import { Service } from './service.js';
 export const CloudflareWorker = nodeClass({
     description: 'One Service placed in a Cloudflare Workers dispatch namespace.',

package/dist/schema/modules/service/classes/service-owned-by.d.ts

@@ -4,12 +4,12 @@ export declare const service_owned_by: import("@astrale-os/sdk/schema").Directed
     readonly extends: readonly [];
     readonly properties: never;
     readonly source: {
-        readonly as: "owner";
-        readonly outgoing: "0..*";
+        readonly as: "service";
+        readonly outgoing: "1";
     };
     readonly target: {
-        readonly as: "service";
-        readonly incoming: "1";
+        readonly as: "owner";
+        readonly incoming: "0..*";
     };
     readonly constraints: Record<never, never>;
     readonly effectiveProperties: never;

package/dist/schema/modules/service/classes/service-owned-by.js

@@ -3,7 +3,7 @@ import { TraverseOwnedService } from '../policies/index.js';
 import { Service } from './service.js';
 export const service_owned_by = edgeClass.directed({
     description: 'The Identity that owns and may manage one Service.',
-    source: { as: 'owner', accepts: [K.classes.Identity], outgoing: '0..*' },
-    target: { as: 'service', accepts: [() => Service], incoming: '1' },
+    source: { as: 'service', accepts: [() => Service], outgoing: '1' },
+    target: { as: 'owner', accepts: [K.classes.Identity], incoming: '0..*' },
     policies: { traverse: () => TraverseOwnedService },
 });

package/dist/schema/modules/service/classes/service.d.ts

@@ -52,26 +52,33 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
         readonly origin: "kernel.astrale.ai";
     }, "kernel.astrale.ai:class.Node", readonly import("@astrale-os/sdk/schema").AnyResolvedClass[], never, never, never, never, never, never>, ...never[]], import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "createdAt", "kernel.astrale.ai:class.Timestamped.property.createdAt", undefined> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "updatedAt", "kernel.astrale.ai:class.Timestamped.property.updatedAt", undefined>, never, never, import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "createdAt", "kernel.astrale.ai:class.Timestamped.property.createdAt", undefined> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "updatedAt", "kernel.astrale.ai:class.Timestamped.property.updatedAt", undefined>, never, never>];
     readonly properties: {
-        readonly providerKey: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "providerKey", "self", undefined>;
         readonly providerName: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "providerName", "self", undefined>;
         readonly serviceKey: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "serviceKey", "self", undefined>;
         readonly url: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "url", "self", never>;
-        readonly state: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<"deleting" | "deploying" | "failed" | "ready" | "reconciling", "deleting" | "deploying" | "failed" | "ready" | "reconciling", true, "state", "self", undefined>;
+        readonly state: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<unknown, "deleting" | "deploying" | "failed" | "ready" | "reconciling", true, "state", "self", import("@astrale-os/sdk/state").StateTopology<{
+            readonly deploying: {
+                readonly recordProviderDeployment: "reconciling";
+                readonly failDeployment: "failed";
+                readonly deleteService: "deleting";
+            };
+            readonly reconciling: {
+                readonly retryDeployment: "deploying";
+                readonly completeDeployment: "ready";
+                readonly deleteService: "deleting";
+            };
+            readonly ready: {
+                readonly redeploy: "deploying";
+                readonly deleteService: "deleting";
+            };
+            readonly failed: {
+                readonly retryDeployment: "deploying";
+                readonly deleteService: "deleting";
+            };
+            readonly deleting: {};
+        }, "deploying">>;
         readonly digest: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "digest", "self", never>;
-        readonly revision: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "revision", "self", never>;
         readonly deploymentReceipt: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "deploymentReceipt", "self", never>;
         readonly operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<import("@astrale-os/sdk/schema").Value, import("@astrale-os/sdk/schema").Value, false, "operationExpiresAt", "self", never>;
-        readonly hostedIssuer: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedIssuer", "self", never>;
-        readonly hostedOrigin: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedOrigin", "self", never>;
-        readonly hostedRevision: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedRevision", "self", never>;
-        readonly hostedPublicationEtag: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedPublicationEtag", "self", never>;
-        readonly hostedFunctions: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<{
-            ref: string;
-            path: string;
-        }[], {
-            ref: string;
-            path: string;
-        }[], false, "hostedFunctions", "self", never>;
         readonly error: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "error", "self", never>;
     };
     readonly methods: {
@@ -86,7 +93,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
                 kind: "rejected";
                 reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
             };
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             name: string;
         }, {
@@ -97,11 +104,11 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
             } | {
                 ok: true;
             };
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
             readonly mode: 'value';
             readonly value: string[];
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly setSchedule: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             crons: string[];
         }, {
@@ -112,11 +119,11 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
                 kind: "rejected";
                 reason: "invalid-schedule" | "service-unavailable";
             };
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly schedules: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
             readonly mode: 'value';
             readonly value: string[];
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly logs: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             tail?: number | undefined;
             since?: number | undefined;
@@ -128,7 +135,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
                 level: string;
                 line: string;
             }[];
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
         readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
             readonly mode: 'value';
             readonly value: {
@@ -137,15 +144,29 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
                 kind: "deleting";
                 retryAfterMs: number;
             };
-        }, "authenticated", false, "default">>;
+        }, "authorized", false, "default">>;
     };
-    readonly effectiveProperties: (import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "deploymentReceipt", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "digest", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "error", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<{
-        ref: string;
-        path: string;
-    }[], {
-        ref: string;
-        path: string;
-    }[], false, "hostedFunctions", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedIssuer", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedOrigin", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedPublicationEtag", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "hostedRevision", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<import("@astrale-os/sdk/schema").Value, import("@astrale-os/sdk/schema").Value, false, "operationExpiresAt", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "providerKey", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "providerName", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "revision", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "serviceKey", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<"deleting" | "deploying" | "failed" | "ready" | "reconciling", "deleting" | "deploying" | "failed" | "ready" | "reconciling", true, "state", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "url", "self", never>) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false, never> & {
+    readonly effectiveProperties: (import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "deploymentReceipt", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "digest", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "error", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<import("@astrale-os/sdk/schema").Value, import("@astrale-os/sdk/schema").Value, false, "operationExpiresAt", "self", never> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "providerName", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, true, "serviceKey", "self", undefined> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<unknown, "deleting" | "deploying" | "failed" | "ready" | "reconciling", true, "state", "self", import("@astrale-os/sdk/state").StateTopology<{
+        readonly deploying: {
+            readonly recordProviderDeployment: "reconciling";
+            readonly failDeployment: "failed";
+            readonly deleteService: "deleting";
+        };
+        readonly reconciling: {
+            readonly retryDeployment: "deploying";
+            readonly completeDeployment: "ready";
+            readonly deleteService: "deleting";
+        };
+        readonly ready: {
+            readonly redeploy: "deploying";
+            readonly deleteService: "deleting";
+        };
+        readonly failed: {
+            readonly retryDeployment: "deploying";
+            readonly deleteService: "deleting";
+        };
+        readonly deleting: {};
+    }, "deploying">> | import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "url", "self", never>) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false, never> & {
         readonly name: "description";
         readonly key: "kernel.astrale.ai:class.Descriptable.property.description";
     }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true, undefined> & {
@@ -161,10 +182,10 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
     readonly effectiveInstanceMethods: import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
         readonly mode: 'value';
         readonly value: string[];
-    }, "authenticated", false, "default">>, "schedules", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    }, "authorized", false, "default">>, "schedules", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
         readonly mode: 'value';
         readonly value: string[];
-    }, "authenticated", false, "default">>, "secrets", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    }, "authorized", false, "default">>, "secrets", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
         readonly mode: 'value';
         readonly value: {
             kind: "deleted";
@@ -172,7 +193,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
             kind: "deleting";
             retryAfterMs: number;
         };
-    }, "authenticated", false, "default">>, "delete", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    }, "authorized", false, "default">>, "delete", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
         name: string;
         value: string;
     }, {
@@ -183,7 +204,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
             kind: "rejected";
             reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
         };
-    }, "authenticated", false, "default">>, "setSecret", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    }, "authorized", false, "default">>, "setSecret", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
         name: string;
     }, {
         readonly mode: 'value';
@@ -193,7 +214,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
         } | {
             ok: true;
         };
-    }, "authenticated", false, "default">>, "deleteSecret", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    }, "authorized", false, "default">>, "deleteSecret", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
         crons: string[];
     }, {
         readonly mode: 'value';
@@ -203,7 +224,7 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
             kind: "rejected";
             reason: "invalid-schedule" | "service-unavailable";
         };
-    }, "authenticated", false, "default">>, "setSchedule", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    }, "authorized", false, "default">>, "setSchedule", "self"> | import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
         tail?: number | undefined;
         since?: number | undefined;
     }, {
@@ -214,6 +235,6 @@ export declare const Service: import("@astrale-os/sdk/schema").NodeClass<{
             level: string;
             line: string;
         }[];
-    }, "authenticated", false, "default">>, "logs", "self">;
+    }, "authorized", false, "default">>, "logs", "self">;
     readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/modules/service/classes/service.js

@@ -1,36 +1,27 @@
-import { K, nodeClass, property, schema as valueSchema } from '@astrale-os/sdk/schema';
+import { K, nodeClass, property, schema as valueSchema, stateProperty, } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { deleteService, deleteServiceSecret, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, setServiceSecret, } from '../functions/index.js';
-import { ObserveService } from '../policies/index.js';
-import { serviceLifecycle } from '../types/index.js';
-const digest = z
-    .string()
-    .length(71)
-    .regex(/sha256:[0-9a-f]{64}/);
-const publishedFunction = z.strictObject({
-    ref: z.string().min(1).max(512),
-    path: z.string().min(1).max(2_048),
-});
+import { deleteServiceSecret } from '../functions/delete-service-secret.js';
+import { deleteService } from '../functions/delete-service.js';
+import { listServiceLogs } from '../functions/list-service-logs.js';
+import { listServiceSchedules } from '../functions/list-service-schedules.js';
+import { listServiceSecretNames } from '../functions/list-service-secret-names.js';
+import { replaceServiceSchedules } from '../functions/replace-service-schedules.js';
+import { setServiceSecret } from '../functions/set-service-secret.js';
+import { OwnService } from '../policies/own-service.js';
+import { serviceLifecycle } from '../states/index.js';
 /** Provider-neutral deployed resource. Provider implementation versions are deliberately external. */
 export const Service = nodeClass({
     abstract: true,
     description: 'One caller-owned provider-neutral deployed Service.',
     extends: [K.classes.Named, K.classes.Descriptable, K.classes.Timestamped],
     properties: {
-        providerKey: z.string().min(1).max(80),
         providerName: z.string().min(1).max(120),
         serviceKey: z.string().min(1).max(63),
         url: property(z.string().min(1).max(2_048), { required: false }),
-        state: serviceLifecycle,
+        state: stateProperty(serviceLifecycle),
         digest: property(z.string().min(1).max(256), { required: false }),
-        revision: property(digest, { required: false }),
         deploymentReceipt: property(z.string().min(1).max(128), { required: false }),
         operationExpiresAt: property(valueSchema.values.instant, { required: false }),
-        hostedIssuer: property(z.string().min(1).max(2_048), { required: false }),
-        hostedOrigin: property(z.string().min(1).max(512), { required: false }),
-        hostedRevision: property(digest, { required: false }),
-        hostedPublicationEtag: property(digest, { required: false }),
-        hostedFunctions: property(z.array(publishedFunction).max(1_024), { required: false }),
         error: property(z.string().max(5_000), { required: false }),
     },
     methods: {
@@ -42,5 +33,5 @@ export const Service = nodeClass({
         logs: listServiceLogs,
         delete: deleteService,
     },
-    policies: { read: () => ObserveService },
+    policies: { read: () => OwnService },
 });

package/dist/schema/modules/service/functions/delete-service-secret.d.ts

@@ -3,9 +3,9 @@ export declare const deleteServiceSecret: import("@astrale-os/sdk/schema").Metho
 }, {
     readonly mode: 'value';
     readonly value: {
-        ok: true;
-    } | {
         kind: "rejected";
         reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
+    } | {
+        ok: true;
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/delete-service-secret.js

@@ -1,9 +1,11 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 import { secretName, secretOperationRejection } from '../types/index.js';
 export const deleteServiceSecret = method({
     description: 'Delete one write-only Service secret.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({ name: secretName }),
     output: z.union([z.strictObject({ ok: z.literal(true) }), secretOperationRejection]),
 });

package/dist/schema/modules/service/functions/delete-service.d.ts

@@ -6,4 +6,4 @@ export declare const deleteService: import("@astrale-os/sdk/schema").Method<impo
         kind: "deleting";
         retryAfterMs: number;
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/delete-service.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const deleteService = method({
     description: 'Convergently delete provider resources and the owned Service without uninstalling consumers.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({}),
     output: z.discriminatedUnion('kind', [
         z.strictObject({ kind: z.literal('deleted') }),

package/dist/schema/modules/service/functions/deploy-cloudflare-worker.d.ts

@@ -1,3 +1,163 @@
+import { z } from 'zod';
+export declare const artifact: z.ZodObject<{
+    entry: z.ZodString;
+    modules: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        contentBase64: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            data: "data";
+            esm: "esm";
+            text: "text";
+            wasm: "wasm";
+        }>>;
+    }, z.core.$strict>, z.ZodObject<{
+        contentBase64Chunks: z.ZodArray<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            data: "data";
+            esm: "esm";
+            text: "text";
+            wasm: "wasm";
+        }>>;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export declare const revisionedDeployment: z.ZodObject<{
+    requiredSecrets: z.ZodArray<z.ZodString>;
+    release: z.ZodObject<{
+        entry: z.ZodString;
+        modules: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            contentBase64: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                data: "data";
+                esm: "esm";
+                text: "text";
+                wasm: "wasm";
+            }>>;
+        }, z.core.$strict>, z.ZodObject<{
+            contentBase64Chunks: z.ZodArray<z.ZodString>;
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                data: "data";
+                esm: "esm";
+                text: "text";
+                wasm: "wasm";
+            }>>;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const deployServiceInput: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    entry: z.ZodOptional<z.ZodString>;
+    modules: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        contentBase64: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            data: "data";
+            esm: "esm";
+            text: "text";
+            wasm: "wasm";
+        }>>;
+    }, z.core.$strict>, z.ZodObject<{
+        contentBase64Chunks: z.ZodArray<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            data: "data";
+            esm: "esm";
+            text: "text";
+            wasm: "wasm";
+        }>>;
+    }, z.core.$strict>]>>>;
+    revisioned: z.ZodOptional<z.ZodObject<{
+        requiredSecrets: z.ZodArray<z.ZodString>;
+        release: z.ZodObject<{
+            entry: z.ZodString;
+            modules: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                contentBase64: z.ZodString;
+                name: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    data: "data";
+                    esm: "esm";
+                    text: "text";
+                    wasm: "wasm";
+                }>>;
+            }, z.core.$strict>, z.ZodObject<{
+                contentBase64Chunks: z.ZodArray<z.ZodString>;
+                name: z.ZodString;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    data: "data";
+                    esm: "esm";
+                    text: "text";
+                    wasm: "wasm";
+                }>>;
+            }, z.core.$strict>]>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    compatibilityDate: z.ZodOptional<z.ZodString>;
+    compatibilityFlags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    serviceBindings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        service: z.ZodString;
+    }, z.core.$strict>>>;
+    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        files: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            contentBase64: z.ZodString;
+            path: z.ZodString;
+            contentType: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            contentBase64Chunks: z.ZodArray<z.ZodString>;
+            path: z.ZodString;
+            contentType: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>;
+        notFound: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodBoolean>;
+        htmlHandling: z.ZodOptional<z.ZodLiteral<"none">>;
+    }, z.core.$strict>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        cpuMs: z.ZodOptional<z.ZodNumber>;
+        subrequests: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    serviceKey: z.ZodString;
+}, z.core.$strict>;
+export type DeployServiceInput = z.infer<typeof deployServiceInput>;
+export declare const deployedService: z.ZodObject<{
+    id: z.ZodString;
+    serviceKey: z.ZodString;
+    url: z.ZodString;
+    digest: z.ZodString;
+    state: z.ZodLiteral<"ready">;
+}, z.core.$strict>;
+export declare const deploymentRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "artifact-mode-conflict": "artifact-mode-conflict";
+        "invalid-deployment": "invalid-deployment";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+export declare const deployServiceOutput: z.ZodUnion<readonly [z.ZodObject<{
+    id: z.ZodString;
+    serviceKey: z.ZodString;
+    url: z.ZodString;
+    digest: z.ZodString;
+    state: z.ZodLiteral<"ready">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "artifact-mode-conflict": "artifact-mode-conflict";
+        "invalid-deployment": "invalid-deployment";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>]>;
+export type DeployServiceOutput = z.infer<typeof deployServiceOutput>;
 export declare const deployCloudflareWorker: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
     name?: string | undefined;
     entry?: string | undefined;
@@ -11,7 +171,6 @@ export declare const deployCloudflareWorker: import("@astrale-os/sdk/schema").Me
         kind?: "data" | "esm" | "text" | "wasm" | undefined;
     })[] | undefined;
     revisioned?: {
-        revision: string;
         requiredSecrets: string[];
         release: {
             entry: string;
@@ -60,19 +219,7 @@ export declare const deployCloudflareWorker: import("@astrale-os/sdk/schema").Me
         serviceKey: string;
         url: string;
         digest: string;
-        revision?: string | undefined;
-        state: "deleting" | "deploying" | "failed" | "ready" | "reconciling";
-        error?: string | null | undefined;
-        application?: {
-            issuer: string;
-            origin: string;
-            revision: string;
-            publicationEtag: string;
-            functions: {
-                path: string;
-                ref: string;
-            }[];
-        } | undefined;
+        state: "ready";
     } | {
         kind: "rejected";
         reason: "artifact-mode-conflict" | "invalid-deployment" | "service-unavailable";

package/dist/schema/modules/service/functions/deploy-cloudflare-worker.js

@@ -1,7 +1,52 @@
 import { method } from '@astrale-os/sdk/schema';
-import { deployServiceInput, deployServiceOutput } from '../types/index.js';
+import { z } from 'zod';
+import { artifactModule, assetBundle, resourceLimits } from '../types/index.js';
+export const artifact = z.strictObject({
+    entry: z.string().min(1).max(256),
+    modules: z.array(artifactModule).min(1).max(40),
+});
+export const revisionedDeployment = z.strictObject({
+    requiredSecrets: z.array(z.string().min(1).max(128)).max(64),
+    release: artifact,
+});
+const deployServiceFields = {
+    name: z.string().min(1).max(256).optional(),
+    entry: z.string().min(1).max(256).optional(),
+    modules: z.array(artifactModule).min(1).max(40).optional(),
+    revisioned: revisionedDeployment.optional(),
+    compatibilityDate: z.string().min(1).max(32).optional(),
+    compatibilityFlags: z.array(z.string().min(1).max(128)).max(64).optional(),
+    serviceBindings: z
+        .array(z.strictObject({
+        name: z.string().min(1).max(64),
+        service: z.string().min(1).max(128),
+    }))
+        .max(32)
+        .optional(),
+    vars: z.record(z.string().max(256), z.string().max(64 * 1024)).optional(),
+    secrets: z.record(z.string().max(256), z.string().max(64 * 1024)).optional(),
+    assets: assetBundle.optional(),
+    limits: resourceLimits,
+};
+export const deployServiceInput = z.strictObject({
+    serviceKey: z.string().min(1).max(63),
+    ...deployServiceFields,
+});
+export const deployedService = z.strictObject({
+    id: z.string().min(1),
+    serviceKey: z.string().min(1),
+    url: z.string(),
+    digest: z.string(),
+    state: z.literal('ready'),
+});
+export const deploymentRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: z.enum(['invalid-deployment', 'service-unavailable', 'artifact-mode-conflict']),
+    message: z.string().min(1).max(500),
+});
+export const deployServiceOutput = z.union([deployedService, deploymentRejection]);
 export const deployCloudflareWorker = method({
-    description: 'Create or converge one Cloudflare Worker Service and admit its optional Publication.',
+    description: 'Create or converge one Cloudflare Worker Service.',
     auth: 'authenticated',
     static: true,
     input: deployServiceInput,

package/dist/schema/modules/service/functions/index.d.ts

@@ -1,6 +1,7 @@
 export { deleteServiceSecret } from './delete-service-secret.js';
 export { deleteService } from './delete-service.js';
-export { deployCloudflareWorker } from './deploy-cloudflare-worker.js';
+export { artifact, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, revisionedDeployment, } from './deploy-cloudflare-worker.js';
+export type { DeployServiceInput, DeployServiceOutput } from './deploy-cloudflare-worker.js';
 export { listServiceLogs } from './list-service-logs.js';
 export { listServiceSchedules } from './list-service-schedules.js';
 export { listServiceSecretNames } from './list-service-secret-names.js';

package/dist/schema/modules/service/functions/index.js

@@ -1,6 +1,6 @@
 export { deleteServiceSecret } from './delete-service-secret.js';
 export { deleteService } from './delete-service.js';
-export { deployCloudflareWorker } from './deploy-cloudflare-worker.js';
+export { artifact, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, revisionedDeployment, } from './deploy-cloudflare-worker.js';
 export { listServiceLogs } from './list-service-logs.js';
 export { listServiceSchedules } from './list-service-schedules.js';
 export { listServiceSecretNames } from './list-service-secret-names.js';

package/dist/schema/modules/service/functions/list-service-logs.d.ts

@@ -9,4 +9,4 @@ export declare const listServiceLogs: import("@astrale-os/sdk/schema").Method<im
         level: string;
         line: string;
     }[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/list-service-logs.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const listServiceLogs = method({
     description: 'Read recent Service runtime logs.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({
         tail: z.number().int().min(1).max(1_000).optional(),
         since: z.number().int().min(0).optional(),

package/dist/schema/modules/service/functions/list-service-schedules.d.ts

@@ -1,4 +1,4 @@
 export declare const listServiceSchedules: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
     readonly mode: 'value';
     readonly value: string[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;