@astrale-domains/services 0.4.4 → 0.4.6

package/README.md

@@ -11,14 +11,40 @@ protocols behind neutral SDK Integrations and stores only admitted lifecycle evi
 - Owners may be Shell users, local Kernel roots, or application/CI identities. Services requires only
   the Kernel Schema; a Shell installation is not required to deploy. Ownership
   remains exact-subject scoped, and existing Shell-user ownership edges remain valid.
+- a `DeploymentLine` is one `(origin, environment)`, named by its SDK fingerprint. `line_owned_by`
+  gives it to at most one organisation Identity, first come. Members and CI identities read the
+  line and its deployments through Kernel `extends_with` (`OwnLine`, `OwnDeployment`). A line is
+  never reassigned. Deleting its deployments, the organisation's Services or the organisation
+  itself leaves the line refused to every other organisation (`line-owned-elsewhere`). Only an
+  operator transfer moves the holder Edge.
+- the line Queries, `admitDeploymentLine` and the deployment Mutations run under the Services
+  Domain credential and trust the organisation they are given. Under a caller's credential the
+  Policies hide a foreign line, which would read as a free one. Their caller must first prove that
+  the requesting identity is that organisation or acts for it: `Identity.can` on `OwnLine` for a
+  held line, the identity itself or its `extends_with` for a registration.
+- each `Deployment` (`CloudflareDeployment`) sits on one line through `deployment_on_line` and is
+  visible to whoever holds that line. A deployment is recorded only while its organisation holds
+  the line. Its label must name the line, and its record must name the line's origin and
+  environment. [Real-Kernel proof](tests/kernel/README.md).
+- an operator deleting an organisation that holds lines deletes its `line_owned_by` Edges in the
+  same Mutation: the Kernel deletes a Node only together with every incident Edge. Its lines stay
+  registered with no holder and are refused to every organisation. A transfer is a root
+  `createEdge` of `line_owned_by` from the line to the new organisation; a line has one holder at
+  most.
 - secret values stay write-only at Cloudflare and never enter Astrale mutations or graph state.
 - schedules remain provider state; only the owner may read or replace them.
 - logs are remote evidence admitted by the Cloudflare Provider before a Workflow returns them.
 - the only admitted Worker service binding is the logical platform router; the provider resolves
   it to the selected environment and callers cannot name arbitrary same-account Workers.
+- tenant Workers do not receive namespace dispatch authority. Inter-Service requests use public
+  ingress, including its retirement and private-route checks. Only the platform dispatcher and
+  candidate-readiness operator retain their respective native dispatch bindings.
 - the provider supplies `WORKER_URL` as the Service's canonical HTTPS URL to both candidate and
   public Workers. It is reserved provider metadata, not a caller variable or secret. Applications
   therefore keep one issuer even when requests arrive over HTTP or through a dispatcher alias.
+- `ASTRALE_BUILD_DIGEST` is reserved the same way: a Worker's build digest is bound by its host,
+  never by its author, so Services refuses it as a caller variable or secret on every deployment
+  path and in secret management.
 
 The View, CLI, and agent consumers read the named Service Queries directly; there is intentionally
 no list Function wrapping `listServicesQuery`. Deployment, secrets, schedules, logs, and deletion
@@ -27,17 +53,159 @@ are authorized by the ownership Policy before their Workflows begin. `service-ho
 is the provider-neutral compute Integration contract. Cloudflare is its first Provider.
 
 `Service` declares seven abstract management contracts. `CloudflareWorker` owns their executable
-Methods (`setSecret`, `deleteSecret`, `secrets`, `setSchedule`, `schedules`, `logs`, `delete`) and
+Methods (`setSecret`, `deleteSecret`, `secrets`, `setSchedule`, `schedules`, `logs`, `migrateIngress`, `delete`) and
 applies `OwnService` to each one. Workflow addresses are `CloudflareWorker.*`; abstract `Service.*`
 keys are not executable. A future provider Class must supply its own concrete declarations and
 implementations. Properties and ownership relationships retain their inherited meaning.
 
-## Development
+## Shared public ingress
+
+New Services use the environment's proxied wildcard DNS, wildcard Worker route and wildcard
+certificate. Services observes the expected dispatcher route and probes a never-registered hostname
+before uploading a Worker without an existing Custom Domain. It never creates a per-Service Custom
+Domain or certificate. Missing shared ingress is an operator provisioning issue; it is not repaired
+by consuming another certificate during a Service deployment.
+
+After activating routing, deployment waits for public dispatcher visibility with a bounded budget.
+This is separate from optional candidate application health checks. An uncertain activation retains
+the Service record and can be retried with the same owner-scoped service key.
+
+Existing exact Custom Domains and their immutable certificate locators are retained on ordinary
+updates. Detaching old hostnames is a separate migration, coordinated with Service operations;
+upgrading this Runtime does not perform that migration. A Service without an exact domain persists
+`tenantDomainState: 'absent'`.
+Deletion handles both placements and never removes shared ingress infrastructure.
+
+Cloudflare callers that must traverse same-zone public Worker routes need
+`global_fetch_strictly_public`. Audit existing callers before migrating their exact hostnames;
+explicit runtime flags retain their authored meaning. A rollback after creating wildcard Services
+must use a Runtime that understands explicit absent placement, not an older certificate-required
+implementation.
+
+### Migrating existing Services
+
+The owner calls `CloudflareWorker.migrateIngress` with an `action` (`detach`, `complete`, or
+`restore`) and a deterministic public health `probe`: a local GET `path`, expected successful
+`status`, and the exact response body's SHA-256 in `bodySha256`. The Workflow acquires the existing
+Service operation lease and verifies provider ownership, active dispatch, wildcard TLS and health
+before detaching the exact Custom Domain. It does not redeploy the Worker or alter its routing KV,
+secrets or schedules.
+
+After `detach`, observe real traffic for at least 30 minutes before calling `complete`. Until
+completion, the graph retains the previous domain and certificate locators with
+`tenantDomainDetachedAt`; completion clears them after provider cleanup and another successful
+health check. Cloudflare can automatically delete the generated certificate as soon as its Custom
+Domain is detached. `restore` recreates the exact domain, waits for active TLS and records the actual
+replacement certificate locator. A `pending` result requires a later retry; it is not completion.
+
+The consumer runtimes are frozen ([`frozen-environments.json`](./frozen-environments.json)): the
+original R1 runtime at `https://services.beta.astrale.ai`, which 1Pact instances pin and which
+serves that issuer's discovery and keys, `https://services-v2.beta.astrale.ai`, which retains that
+issuer and key, and production at `https://services.astrale.ai`. They keep serving the code they run
+today and no Environment deploys them. Do not uninstall Services or replace a runtime underneath
+installations that still use its Schema. An instance rollback must restore any detached domain
+before reinstalling the original endpoint, and must first be qualified with real retained Service
+data.
+
+## Admin-hosted runtime
+
+The `admin-beta` Environment is the Services runtime of the Admin instance, the one that hosts
+publishers' deployments outside the instances that install them. It is a Worker of its own,
+`services-domain-admin-beta` at `https://services-admin.beta.astrale.ai`, on the beta data plane the
+Admin instance's Services already manage. Its plain vars name the router Worker
+(`ASTRALE_ROUTER_WORKER`), the routing domain under which deployments are addressed
+(`SERVICES_DEPLOYMENT_HOST`, served by the Services dispatcher) and the registry Domain
+(`SERVICES_REGISTRY_ORIGIN`). `.env.admin-beta` must set `SERVICES_SECRET_DIGEST_KEY`, the key of
+each hosted deployment's secret digest. The runtime keys HMAC-SHA256 with the UTF-8 bytes of the value
+as written, never base64-decoded, so the configuration refuses, before any deployment effect, a file
+without it or with a value shorter than 32 UTF-8 bytes.
+
+It retains the issuer `https://services.beta.astrale.ai` and its signing key, as services-v2 does.
+The Admin instance's Services are bound to that issuer, and the Kernel refuses an issuer change when
+it replaces an installed Domain (`issuer-changed`); neither the Admin Host's Kernel nor the CLI
+offers a consented issuer change yet. The cost: a Worker built from main holds the key that 1Pact's
+installations trust. Keep the key only in managed secret storage and in this Worker's
+`ASTRALE_SIGNING_IDENTITY` secret. The Admin instance moves to an issuer of its own when the
+canonical Admin-hosted runtime replaces this one through a consented issuer change; this Worker and
+its copy of the key are retired after that reinstall.
+
+Only the Admin instance installs this runtime; consumer instances keep the Services they pin.
+The operator sets it up once:
+
+1. Read what the Admin instance's Services are bound to, read-only:
+   `astrale introspect services.astrale.ai -i <admin-instance> --json`. Record `revision` and
+   `publication.identity.issuer`, and the frozen runtime whose `/.well-known/astrale/domain.json`
+   declares that revision: it is the rollback URL. Go on only if the issuer is
+   `https://services.beta.astrale.ai`; any other issuer makes step 6 an issuer change, which the
+   Kernel refuses.
+2. Create `.env.admin-beta` (mode 600) from `.env.example` with the beta data-plane coordinates the
+   Admin instance's Services manage today (account, token, dispatch namespace, routing domain
+   `svc.eu.beta.astrale.ai`, schedule KV, dispatcher, zone, Admin target) and a new
+   `SERVICES_SECRET_DIGEST_KEY` that no other environment uses, e.g. `openssl rand -base64 32` (32
+   random bytes, kept as their 44-character base64 text).
+3. Restore the retained `https://services.beta.astrale.ai` signing identity, the one services-v2 was
+   deployed with, from managed secret storage to `.astrale/services-beta-identity.json` (mode 600).
+   Never generate a key for this runtime: the frozen R1 Worker publishes the issuer's keys, so a new
+   key would never verify. Never leave that key at `.astrale/identity.json`, the development
+   Environment's default identity: `pnpm dev` would bind it to development Workers. Check that the
+   issuer publishes the restored key:
+
+   ```sh
+   node --input-type=module -e '
+   const { readFileSync } = await import("node:fs")
+   const { kid, x } = JSON.parse(readFileSync(".astrale/services-beta-identity.json", "utf8"))
+   const issuer = "https://services.beta.astrale.ai"
+   const { jwks_uri } = await (await fetch(`${issuer}/.well-known/openid-configuration`)).json()
+   const { keys } = await (await fetch(jwks_uri)).json()
+   if (!keys.some((key) => key.kid === kid && key.x === x)) throw new Error("key not published")
+   console.log(`issuer publishes kid ${kid}`)
+   '
+   ```
+
+4. Deploy once with `pnpm run deploy admin-beta`. It creates only the `services-domain-admin-beta`
+   Worker and its route; nothing is installed. Do not run `pnpm provider:bootstrap` or a
+   `provider:route-*` command for this runtime: on the beta data plane they redeploy the shared
+   dispatcher and DNS routing that serve 1Pact's tenants (see the
+   [operator README](./providers/cloudflare/operator/README.md)).
+5. Rehearse step 6 first on a disposable instance whose Host runs the Admin Host's Kernel release and
+   whose Services are bound to the same issuer and revision as in step 1, with at least one Service.
+   The install must succeed and the Service must stay manageable (list, secrets, logs). Then install
+   the step 1 rollback URL there again: if the Kernel refuses it, step 6 is one-way, and that must be
+   recorded before step 6 runs.
+6. Install on the Admin instance only, directly:
+   `astrale domain install https://services-admin.beta.astrale.ai --direct --allow-identity-override -i <admin-instance>`.
+   The only consent is the identity override, because the origin `services.astrale.ai` differs from
+   the serving host; the issuer does not change. On any refusal, stop: never uninstall Services on
+   the Admin instance to get around it, which would drop the Service records it holds. Never repoint
+   Admin's catalog entry for `services.astrale.ai` at this runtime: consumer flows, 1Pact's among
+   them, install Services by origin through that entry.
+
+## Plain background Service starter
+
+The package also ships an isolated scaffolding binary (the root import remains Schema-only):
+
+```sh
+npm exec --package @astrale-domains/services -- create-astrale-service my-worker
+cd my-worker
+npm install
+# Edit service.json and src/job.js for the existing business Domain.
+npm run deploy -- --instance development --as developer
+```
+
+The generator creates local source only and refuses an existing destination. It does not install
+dependencies, create/register accounts, grant permissions, set secrets, enable schedules or deploy.
+The generated project owns a plain HTTP/cron entry, an ES256 account session, a job implementation
+and build/deploy scripts. No Application, Schema, Publication, Domain signer or frontend is generated.
+Deployment calls the public Services API through the installed Astrale CLI and requires an explicit
+instance or URL. The project README explains account setup, secret custody, private cron and cleanup.
+No tooling dependency is added to the Schema runtime or imported from the package root.
+
+## Domain development
 
 Copy `.env.example` to `.env.dev` and fill the Cloudflare values.
 
-`pnpm dev` watches and deploys the development Environment remotely. `pnpm dev beta`
-selects beta; `pnpm beta` and `pnpm prod` deploy once. These bootstrap Environments
+`pnpm dev` watches and deploys the development Environment remotely. `pnpm run deploy admin-beta`
+deploys the [Admin-hosted runtime](#admin-hosted-runtime) once. These bootstrap Environments
 are deliberately deploy-only: install the resulting URL on the intended Kernel explicitly.
 Stopping development leaves the remote Worker available. No local Worker or tunnel is started.
 
@@ -52,12 +220,36 @@ pnpm build
 pnpm package
 ```
 
-The deployed module named by `entry` must be present in `modules`. Module contents use one Base64
-string or bounded Base64 chunks when one string cannot cross the portable Value boundary; names are
-unique and secrets use environment-variable identifiers. Plain and revisioned artifacts are
+The deployed module named by `entry` must be present in `modules`. Modules and assets carry
+`content: { encoding: 'identity' | 'gzip', decodedSize, contentBase64 }`; large encoded files use
+`contentBase64Chunks` instead, with each string bounded to 512 KiB. `decodedSize` is the exact original
+byte length. Compression changes transport only: provider uploads and deployment digests use the
+reconstructed bytes. Services validates complete gzip streams (including their checksum), exact sizes,
+and canonical Base64 before any graph or provider operation. Individual decoded files remain bounded
+to 7.5 MiB per module and 12 MiB per asset; all decoded deployment material shares a 32 MiB budget.
+
+The previous top-level `contentBase64` and `contentBase64Chunks` fields remain accepted and are
+explicitly deprecated. Roll out Services and install its new schema on consumer instances before
+publishing the compressed SDK adapter. Old SDK clients continue working against the new Services;
+new SDK requests are refused by an old schema without provider effects. The adapter never retries a
+deployment using a different wire representation after an uncertain outcome.
+
+Module names are unique and secrets use environment-variable identifiers. Plain and revisioned artifacts are
 distinct modes and cannot replace each other at one Service record. Five-field cron expressions are
 supported when `CLOUDFLARE_SCHEDULE_KV_ID` is configured.
 
+Plain deployments that omit `compatibilityFlags` use `nodejs_compat`,
+`nodejs_compat_populate_process_env`, and `global_fetch_strictly_public`. Public `fetch()` calls
+therefore traverse Cloudflare's public routes, including same-zone Astrale endpoints, instead of
+bypassing those routes for the zone's origin. This changes routing, not Kernel authorization.
+An explicitly supplied flags array replaces these defaults, including `[]`; low-level callers
+own that complete runtime configuration. Existing Workers change only on redeployment.
+
+Revisioned deployments require explicit runtime configuration and upload it unchanged to both the
+candidate and the serving Worker. Those exact flags participate in the deployment identity;
+Services must not inject defaults after its computation. The Cloudflare adapter already includes
+public-fetch routing in the generated configuration before building the artifact and its digest.
+
 SDK-authored Applications should deploy through `@astrale-os/adapter-astrale`, which projects the
 admitted Cloudflare artifact into the revisioned Services request and verifies the live Publication.
 Project tooling installs the exact Release only when that environment declares installation.

package/dist/scaffold/create-service.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import { cp, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises'
+import { basename, resolve } from 'node:path'
+
+const [directory, ...extra] = process.argv.slice(2)
+if (directory === '--help' || directory === '-h') {
+  console.log(
+    'Usage: create-astrale-service <new-directory>\nCreates local source only. Does not install dependencies, register identities or deploy.',
+  )
+} else {
+  try {
+    if (!directory || directory.startsWith('-') || extra.length) {
+      throw new Error('Usage: create-astrale-service <new-directory>')
+    }
+    const destination = resolve(directory)
+    const name = basename(destination)
+    if (!/^[a-z][a-z0-9-]{0,62}$/.test(name)) {
+      throw new Error(
+        'Use a lowercase project name beginning with a letter (maximum 63 characters).',
+      )
+    }
+    const owner = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'))
+    // Exclusive creation preserves existing projects and refuses symlink targets.
+    await mkdir(destination)
+    const template = new URL('./template/', import.meta.url)
+    for (const entry of await readdir(template)) {
+      await cp(new URL(entry, template), resolve(destination, entry), {
+        recursive: true,
+        force: false,
+        errorOnExist: true,
+      })
+    }
+    await rename(resolve(destination, 'gitignore'), resolve(destination, '.gitignore'))
+    await writeFile(
+      resolve(destination, 'package.json'),
+      JSON.stringify(
+        {
+          name,
+          version: '0.0.0',
+          private: true,
+          type: 'module',
+          scripts: { build: 'node scripts/build.mjs', deploy: 'node scripts/deploy.mjs' },
+          dependencies: {
+            '@astrale-os/sdk': owner.dependencies['@astrale-os/sdk'],
+            zod: owner.dependencies.zod,
+            jose: '6.2.3',
+          },
+          devDependencies: { esbuild: '0.28.2' },
+          engines: { node: '>=22.13' },
+        },
+        null,
+        2,
+      ) + '\n',
+      { flag: 'wx' },
+    )
+    await writeFile(
+      resolve(destination, 'service.json'),
+      JSON.stringify(
+        {
+          serviceKey: name,
+          vars: { KERNEL: '', TARGET: '' },
+        },
+        null,
+        2,
+      ) + '\n',
+      { flag: 'wx' },
+    )
+    console.log(
+      `Created ${destination}\nInstall dependencies, edit service.json and src/job.js, then run npm run deploy -- --instance <instance> --as <identity>.`,
+    )
+  } catch (error) {
+    console.error(
+      error.code === 'EEXIST' ? 'Destination already exists; no files overwritten.' : error.message,
+    )
+    process.exitCode = 1
+  }
+}

package/dist/scaffold/template/.env.example

@@ -0,0 +1,2 @@
+# Bind this through Services.setSecret; deployment does not read this file.
+ACCOUNT_PRIVATE_JWK=

package/dist/scaffold/template/README.md

@@ -0,0 +1,37 @@
+# Background Service
+
+This is plain compute, not a Domain. It does not publish or install an Application.
+
+1. Install dependencies with `npm install` (Node22.13+), and install the Astrale CLI separately.
+2. Edit `service.json`: KERNEL is the exact Kernel issuer (including /api when present); TARGET is
+   the canonical callable Path. Edit `src/job.js` to match that callable's input and business intent.
+3. Create a dedicated Identity in its business Domain, register its ES256 key on the same Node,
+   and grant only the required callable authority and business permissions. Use Shell.Group.assignMember
+   for supported custom groups; do not use Root or admin credentials in this Worker.
+4. Run `npm run deploy -- --instance <instance> --as <owner>`. It builds first and calls Services.
+   The returned Service ID belongs to compute; it is not the registered Identity Node ID.
+5. Use `CloudflareWorker.setSecret` on that Service ID to bind ACCOUNT_PRIVATE_JWK. Send its value
+   through stdin, not shell arguments or service.json. `.env.example` only names the secret.
+6. Verify the account's real call, then enable the cron through `CloudflareWorker.setSchedule`.
+
+```sh
+astrale call @SERVICE_ID::services.astrale.ai:class.CloudflareWorker.method.setSchedule \
+  --data '{"crons":["* * * * *"]}' -i INSTANCE --as OWNER --json
+astrale call @SERVICE_ID::services.astrale.ai:class.CloudflareWorker.method.logs \
+  tail=20 -i INSTANCE --as OWNER --json
+```
+
+The cron is a private Services-dispatched POST to /__scheduled, not a native Cloudflare scheduled
+export. The public dispatcher rejects that path; headers alone are not authentication. The job
+awaits the remote result before success and uses a 9s call budget under the current 10s dispatcher
+deadline. Health indicates compute is reachable, not that the account is registered or authorized.
+No exactly-once guarantee: design repeated or uncertain calls in the business Domain.
+
+Deployment uses the Services provider's default public-fetch routing. It requires the Services
+Runtime containing Domains PR210; publishing a schema package alone does not deploy that fix.
+Explicit compatibilityFlags in service.json replace defaults completely. Configuration changes
+require redeployment; no automatic fallback or provider-specific transport is embedded here.
+
+To stop, set crons to [] and observe convergence. Delete the Service through its public delete
+method, resuming a deleting result at retryAfterMs if necessary. Account/group/data retirement is
+a separate business operation. Never delete shared groups or uninstall another Domain implicitly.

package/dist/scaffold/template/gitignore

@@ -0,0 +1,6 @@
+node_modules/
+.dist/
+.env
+.env.*
+!.env.example
+*.private.jwk

package/dist/scaffold/template/scripts/build.mjs

@@ -0,0 +1,10 @@
+import { build } from 'esbuild'
+
+await build({
+  entryPoints: ['src/index.js'],
+  outfile: '.dist/worker.mjs',
+  bundle: true,
+  platform: 'browser',
+  format: 'esm',
+  target: 'es2022',
+})

package/dist/scaffold/template/scripts/deploy.mjs

@@ -0,0 +1,50 @@
+import { spawn } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+
+const args = process.argv.slice(2)
+if (args[0] === '--') args.shift()
+if (!args.some((arg) => arg === '-i' || /^(--instance|--url)(=|$)/.test(arg))) {
+  throw new Error(
+    'Select a Services instance explicitly: npm run deploy -- --instance <instance> --as <identity>',
+  )
+}
+const configuration = JSON.parse(await readFile('service.json', 'utf8'))
+await import('./build.mjs')
+const content = (await readFile('.dist/worker.mjs')).toString('base64')
+const request = {
+  ...configuration,
+  entry: 'index.mjs',
+  modules: [{ name: 'index.mjs', kind: 'esm', contentBase64Chunks: content.match(/.{1,524288}/g) }],
+}
+const child = spawn(
+  'astrale',
+  ['call', '/:services.astrale.ai:class.CloudflareWorker:deploy', ...args, '--json'],
+  {
+    stdio: ['pipe', 'pipe', 'inherit'],
+  },
+)
+let output = ''
+child.stdout.on('data', (chunk) => {
+  output += chunk
+})
+child.on('error', () => {
+  console.error('Could not start the Astrale CLI. Install @astrale-os/cli first.')
+  process.exitCode = 1
+})
+child.on('close', (code) => {
+  process.stdout.write(output)
+  if (code !== 0) {
+    process.exitCode = 1
+    return
+  }
+  try {
+    const result = JSON.parse(output)
+    if (result.state !== 'ready') process.exitCode = 1
+  } catch {
+    process.exitCode = 1
+  }
+})
+child.stdin.on('error', () => {
+  process.exitCode = 1
+})
+child.stdin.end(JSON.stringify(request))

package/dist/scaffold/template/src/account.js

@@ -0,0 +1,26 @@
+import { issuer, jwk, register } from '@astrale-os/sdk/auth'
+import { connect } from '@astrale-os/sdk/client/session'
+import { importJWK, SignJWT } from 'jose'
+
+export function openAccount(kernel, privateJwk) {
+  if (privateJwk.kty !== 'EC' || privateJwk.crv !== 'P-256' || !privateJwk.d) {
+    throw new TypeError('Expected a registered ES256 private JWK')
+  }
+  const publicKey = jwk.acceptPublic({ kty: 'EC', crv: 'P-256', x: privateJwk.x, y: privateJwk.y })
+  return connect({
+    url: kernel,
+    auth: {
+      ttlSeconds: 60,
+      resolve: async () => ({
+        credential: await new SignJWT({})
+          .setProtectedHeader({ alg: 'ES256', kid: privateJwk.kid, typ: 'JWT' })
+          .setIssuer(await register.selfIssuer(issuer.accept(kernel), publicKey))
+          .setSubject('self')
+          .setAudience(kernel)
+          .setIssuedAt()
+          .setExpirationTime('3m')
+          .sign(await importJWK(privateJwk, 'ES256')),
+      }),
+    },
+  })
+}

package/dist/scaffold/template/src/index.js

@@ -0,0 +1,32 @@
+import { runJob } from './job.js'
+
+export default {
+  async fetch(request, env) {
+    const path = new URL(request.url).pathname
+    if (path === '/health' && request.method === 'GET') return Response.json({ status: 'ok' })
+    if (path !== '/__scheduled' || request.method !== 'POST')
+      return new Response(null, { status: 404 })
+    // Services invokes this through private dispatch and blocks the public path.
+    const scheduledAt = Number(request.headers.get('x-astrale-scheduled-time'))
+    if (!Number.isSafeInteger(scheduledAt) || scheduledAt <= 0)
+      return new Response(null, { status: 400 })
+    const started = Date.now()
+    try {
+      await runJob({ scheduledAt, env, signal: AbortSignal.timeout(9000) })
+      console.log(
+        JSON.stringify({ event: 'job.completed', scheduledAt, elapsedMs: Date.now() - started }),
+      )
+      return Response.json({ status: 'completed' })
+    } catch (error) {
+      // Do not log credentials, provider envelopes or business result values.
+      console.error(
+        JSON.stringify({
+          event: 'job.failed',
+          scheduledAt,
+          code: typeof error?.code === 'number' ? error.code : undefined,
+        }),
+      )
+      return Response.json({ status: 'failed' }, { status: 503 })
+    }
+  },
+}

package/dist/scaffold/template/src/job.js

@@ -0,0 +1,19 @@
+import { Path } from '@astrale-os/sdk/graph/path'
+
+import { openAccount } from './account.js'
+
+// Adapt this input to the target Domain's contract. Repeat safety belongs there.
+export async function runJob({ scheduledAt, env, signal }) {
+  if (!env.KERNEL || !env.TARGET || !env.ACCOUNT_PRIVATE_JWK) {
+    throw new Error('Configure KERNEL, TARGET and the ACCOUNT_PRIVATE_JWK secret')
+  }
+  const session = openAccount(env.KERNEL, JSON.parse(env.ACCOUNT_PRIVATE_JWK))
+  try {
+    return await session.call(
+      { target: Path.parse(env.TARGET), input: { scheduledAt } },
+      { signal },
+    )
+  } finally {
+    session.close()
+  }
+}

package/dist/schema/index.d.ts

@@ -3,3 +3,5 @@ export type { ServicesDomain, ServicesSchema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
+export type { DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRetention, DeploymentRetirement, } from './modules/deployment/index.js';

package/dist/schema/index.js

@@ -1,3 +1,4 @@
 export { schema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';

package/dist/schema/modules/deployment/classes/cloudflare-deployment.d.ts

@@ -0,0 +1,97 @@
+export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly description: "One Deployment uploaded as the Workers for Platforms script its label names.";
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly extends: readonly [import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly abstract: true;
+        readonly description: "One immutable deployment of a release on a publisher line.";
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Timestamped">];
+        readonly properties: {
+            label: import("zod").ZodString;
+            url: import("zod").ZodString;
+            state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
+                readonly deploying: {
+                    readonly activate: "active";
+                    readonly fail: "failed";
+                };
+                readonly active: {
+                    readonly retire: "retiring";
+                };
+                readonly retiring: {
+                    readonly completeRetirement: "retired";
+                };
+                readonly retired: {
+                    readonly revive: "deploying";
+                };
+                readonly failed: {
+                    readonly retry: "deploying";
+                };
+            }, "deploying">, {
+                required?: boolean;
+                description?: string;
+            }>;
+            retention: import("zod").ZodEnum<{
+                preview: "preview";
+                published: "published";
+            }>;
+            record: import("zod").ZodObject<{
+                format: import("zod").ZodLiteral<"astrale.deployment-record">;
+                version: import("zod").ZodLiteral<1>;
+                origin: import("zod").ZodString;
+                environment: import("zod").ZodString;
+                releaseDigest: import("zod").ZodString;
+                buildDigest: import("zod").ZodString;
+                schemaRevision: import("zod").ZodString;
+                configuration: import("zod").ZodString;
+                providerScript: import("zod").ZodString;
+                commit: import("zod").ZodNullable<import("zod").ZodObject<{
+                    sha: import("zod").ZodString;
+                    dirty: import("zod").ZodBoolean;
+                    base: import("zod").ZodOptional<import("zod").ZodObject<{
+                        version: import("zod").ZodString;
+                        distance: import("zod").ZodNumber;
+                    }, import("zod/v4/core").$strict>>;
+                }, import("zod/v4/core").$strict>>;
+            }, import("zod/v4/core").$strict>;
+            signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
+            lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            retiredAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            retirement: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodEnum<{
+                expired: "expired";
+                withdrawn: "withdrawn";
+            }>, {
+                readonly required: false;
+            }>;
+            operationReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
+            operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+        };
+    }>];
+    readonly policies: {
+        read: () => import("@astrale-os/sdk/schema").Policy;
+    };
+}>;

package/dist/schema/modules/deployment/classes/cloudflare-deployment.js

@@ -0,0 +1,10 @@
+import { classIcon, nodeClass } from '@astrale-os/sdk/schema';
+import { CloudUpload } from '@astrale-os/sdk/schema/icons';
+import { OwnDeployment } from '../policies/own-deployment.js';
+import { Deployment } from './deployment.js';
+export const CloudflareDeployment = nodeClass({
+    description: 'One Deployment uploaded as the Workers for Platforms script its label names.',
+    icon: classIcon.lucide(CloudUpload),
+    extends: [Deployment],
+    policies: { read: () => OwnDeployment },
+});