@astrale-domains/services 0.2.4 → 0.2.5

package/dist/schema/modules/service/functions/list-service-schedules.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const listServiceSchedules = method({
     description: 'List active Service cron expressions.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({}),
     output: z.array(z.string()),
 });

package/dist/schema/modules/service/functions/list-service-secret-names.d.ts

@@ -1,4 +1,4 @@
 export declare const listServiceSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
     readonly mode: 'value';
     readonly value: string[];
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/list-service-secret-names.js

@@ -1,9 +1,11 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 import { secretName } from '../types/index.js';
 export const listServiceSecretNames = method({
     description: 'List write-only Service secret names without exposing values.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({}),
     output: z.array(secretName),
 });

package/dist/schema/modules/service/functions/replace-service-schedules.d.ts

@@ -8,4 +8,4 @@ export declare const replaceServiceSchedules: import("@astrale-os/sdk/schema").M
         kind: "rejected";
         reason: "invalid-schedule" | "service-unavailable";
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/replace-service-schedules.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 export const replaceServiceSchedules = method({
     description: 'Replace the complete Service cron set.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({ crons: z.array(z.string()).max(24) }),
     output: z.union([
         z.strictObject({ crons: z.array(z.string()) }),

package/dist/schema/modules/service/functions/set-service-secret.d.ts

@@ -9,4 +9,4 @@ export declare const setServiceSecret: import("@astrale-os/sdk/schema").Method<i
         kind: "rejected";
         reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
     };
-}, "authenticated", false, "default">>;
+}, "authorized", false, "default">>;

package/dist/schema/modules/service/functions/set-service-secret.js

@@ -1,9 +1,11 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
 import { secretName, secretOperationRejection } from '../types/index.js';
 export const setServiceSecret = method({
     description: 'Set one write-only Service secret.',
-    auth: 'authenticated',
+    auth: 'authorized',
+    policy: ({ check, self }) => check(OwnService, self),
     input: z.strictObject({
         name: secretName,
         value: z

package/dist/schema/modules/service/index.d.ts

@@ -1,5 +1,8 @@
 export { CloudflareWorker, Service, service_owned_by } from './classes/index.js';
-export { deleteService, deleteServiceSecret, deployCloudflareWorker, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, setServiceSecret, } from './functions/index.js';
-export { ObserveService, TraverseOwnedService } from './policies/index.js';
-export { artifact, artifactModule, assetBundle, assetFile, deployedFunction, deployServiceInput, deployServiceOutput, publishedApplication, resourceLimits, revisionedDeployment, serviceLifecycle, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';
-export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './types/index.js';
+export { artifact, deleteService, deleteServiceSecret, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, revisionedDeployment, setServiceSecret, } from './functions/index.js';
+export type { DeployServiceInput, DeployServiceOutput } from './functions/index.js';
+export { OwnService, TraverseOwnedService } from './policies/index.js';
+export { serviceLifecycle } from './states/index.js';
+export type { ServiceLifecycle, ServiceLifecycleEvent } from './states/index.js';
+export { artifactModule, assetBundle, assetFile, resourceLimits, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';
+export type { ArtifactModule, AssetBundle, ResourceLimits } from './types/index.js';

package/dist/schema/modules/service/index.js

@@ -1,4 +1,5 @@
 export { CloudflareWorker, Service, service_owned_by } from './classes/index.js';
-export { deleteService, deleteServiceSecret, deployCloudflareWorker, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, setServiceSecret, } from './functions/index.js';
-export { ObserveService, TraverseOwnedService } from './policies/index.js';
-export { artifact, artifactModule, assetBundle, assetFile, deployedFunction, deployServiceInput, deployServiceOutput, publishedApplication, resourceLimits, revisionedDeployment, serviceLifecycle, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';
+export { artifact, deleteService, deleteServiceSecret, deployedService, deploymentRejection, deployCloudflareWorker, deployServiceInput, deployServiceOutput, listServiceLogs, listServiceSchedules, listServiceSecretNames, replaceServiceSchedules, revisionedDeployment, setServiceSecret, } from './functions/index.js';
+export { OwnService, TraverseOwnedService } from './policies/index.js';
+export { serviceLifecycle } from './states/index.js';
+export { artifactModule, assetBundle, assetFile, resourceLimits, PORTABLE_BASE64_CHUNK_SIZE, } from './types/index.js';

package/dist/schema/modules/service/policies/index.d.ts

@@ -1,2 +1,2 @@
-export { ObserveService } from './observe-service.js';
+export { OwnService } from './own-service.js';
 export { TraverseOwnedService } from './traverse-owned-service.js';

package/dist/schema/modules/service/policies/index.js

@@ -1,2 +1,2 @@
-export { ObserveService } from './observe-service.js';
+export { OwnService } from './own-service.js';
 export { TraverseOwnedService } from './traverse-owned-service.js';

package/dist/schema/modules/service/policies/own-service.d.ts

@@ -0,0 +1,2 @@
+/** One Identity may observe and manage exactly the Services it owns. */
+export declare const OwnService: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/service/policies/own-service.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { service_owned_by } from '../classes/service-owned-by.js';
+/** One Identity may observe and manage exactly the Services it owns. */
+export const OwnService = policy({
+    description: 'The subject owns this Service.',
+    match: ({ edge, object, subject }) => edge({ source: object, class: () => service_owned_by, target: subject }),
+});

package/dist/schema/modules/service/policies/traverse-owned-service.js

@@ -2,6 +2,6 @@ import { policy } from '@astrale-os/sdk/schema';
 import { service_owned_by } from '../classes/service-owned-by.js';
 /** Ownership edges disclose only the subject's own Service relationship. */
 export const TraverseOwnedService = policy({
-    description: 'The subject owns the Service at the target of this relationship.',
-    match: ({ allOf, edge, source, subject, target }) => allOf(edge({ source: subject, class: () => service_owned_by, target }), edge({ source, class: () => service_owned_by, target })),
+    description: 'The subject owns the Service at the source of this relationship.',
+    match: ({ allOf, edge, source, subject, target }) => allOf(edge({ source, class: () => service_owned_by, target: subject }), edge({ source, class: () => service_owned_by, target })),
 });

package/dist/schema/modules/service/states/index.d.ts

@@ -0,0 +1,2 @@
+export { serviceLifecycle } from './service-lifecycle.js';
+export type { ServiceLifecycle, ServiceLifecycleEvent } from './service-lifecycle.js';

package/dist/schema/modules/service/states/index.js

@@ -0,0 +1 @@
+export { serviceLifecycle } from './service-lifecycle.js';

package/dist/schema/modules/service/states/service-lifecycle.d.ts

@@ -0,0 +1,25 @@
+import { type EventOf, type StateOf } from '@astrale-os/sdk/state';
+/** Complete provider-neutral lifecycle topology for one deployed Service. */
+export declare const serviceLifecycle: import("@astrale-os/sdk/schema").StateMachine<{
+    readonly deploying: {
+        readonly recordProviderDeployment: "reconciling";
+        readonly failDeployment: "failed";
+        readonly deleteService: "deleting";
+    };
+    readonly reconciling: {
+        readonly retryDeployment: "deploying";
+        readonly completeDeployment: "ready";
+        readonly deleteService: "deleting";
+    };
+    readonly ready: {
+        readonly redeploy: "deploying";
+        readonly deleteService: "deleting";
+    };
+    readonly failed: {
+        readonly retryDeployment: "deploying";
+        readonly deleteService: "deleting";
+    };
+    readonly deleting: {};
+}, "deploying">;
+export type ServiceLifecycle = StateOf<typeof serviceLifecycle>;
+export type ServiceLifecycleEvent = EventOf<typeof serviceLifecycle>;

package/dist/schema/modules/service/states/service-lifecycle.js

@@ -0,0 +1,26 @@
+import { stateMachine } from '@astrale-os/sdk/state';
+/** Complete provider-neutral lifecycle topology for one deployed Service. */
+export const serviceLifecycle = stateMachine({
+    initial: 'deploying',
+    transitions: {
+        deploying: {
+            recordProviderDeployment: 'reconciling',
+            failDeployment: 'failed',
+            deleteService: 'deleting',
+        },
+        reconciling: {
+            retryDeployment: 'deploying',
+            completeDeployment: 'ready',
+            deleteService: 'deleting',
+        },
+        ready: {
+            redeploy: 'deploying',
+            deleteService: 'deleting',
+        },
+        failed: {
+            retryDeployment: 'deploying',
+            deleteService: 'deleting',
+        },
+        deleting: {},
+    },
+});

package/dist/schema/modules/service/types/index.d.ts

@@ -3,14 +3,7 @@ export type { ArtifactModule } from './service-deployment-artifact-module.js';
 export { assetBundle, assetFile } from './service-deployment-assets.js';
 export type { AssetBundle } from './service-deployment-assets.js';
 export { MAX_ASSET_BASE64_SIZE, MAX_MODULE_BASE64_SIZE, PORTABLE_BASE64_CHUNK_SIZE, } from './service-deployment-content.js';
-export { deploymentRejection } from './service-deployment-rejection.js';
-export type { DeploymentRejection } from './service-deployment-rejection.js';
 export { resourceLimits } from './service-deployment-resource-limits.js';
 export type { ResourceLimits } from './service-deployment-resource-limits.js';
-export { artifact, deployServiceInput, revisionedDeployment } from './deploy-service-input.js';
-export type { DeployServiceInput } from './deploy-service-input.js';
-export { deployedFunction, deployedService, deployServiceOutput, publishedApplication, } from './deploy-service-output.js';
-export type { DeployServiceOutput } from './deploy-service-output.js';
-export { serviceLifecycle } from './service-lifecycle.js';
 export { secretName } from './service-secret-name.js';
 export { secretOperationRejection } from './service-secret-operation-rejection.js';

package/dist/schema/modules/service/types/index.js

@@ -1,10 +1,6 @@
 export { artifactModule } from './service-deployment-artifact-module.js';
 export { assetBundle, assetFile } from './service-deployment-assets.js';
 export { MAX_ASSET_BASE64_SIZE, MAX_MODULE_BASE64_SIZE, PORTABLE_BASE64_CHUNK_SIZE, } from './service-deployment-content.js';
-export { deploymentRejection } from './service-deployment-rejection.js';
 export { resourceLimits } from './service-deployment-resource-limits.js';
-export { artifact, deployServiceInput, revisionedDeployment } from './deploy-service-input.js';
-export { deployedFunction, deployedService, deployServiceOutput, publishedApplication, } from './deploy-service-output.js';
-export { serviceLifecycle } from './service-lifecycle.js';
 export { secretName } from './service-secret-name.js';
 export { secretOperationRejection } from './service-secret-operation-rejection.js';