@astrale-domains/services 0.4.5 → 0.4.6

package/README.md

@@ -11,6 +11,26 @@ protocols behind neutral SDK Integrations and stores only admitted lifecycle evi
 - Owners may be Shell users, local Kernel roots, or application/CI identities. Services requires only
   the Kernel Schema; a Shell installation is not required to deploy. Ownership
   remains exact-subject scoped, and existing Shell-user ownership edges remain valid.
+- a `DeploymentLine` is one `(origin, environment)`, named by its SDK fingerprint. `line_owned_by`
+  gives it to at most one organisation Identity, first come. Members and CI identities read the
+  line and its deployments through Kernel `extends_with` (`OwnLine`, `OwnDeployment`). A line is
+  never reassigned. Deleting its deployments, the organisation's Services or the organisation
+  itself leaves the line refused to every other organisation (`line-owned-elsewhere`). Only an
+  operator transfer moves the holder Edge.
+- the line Queries, `admitDeploymentLine` and the deployment Mutations run under the Services
+  Domain credential and trust the organisation they are given. Under a caller's credential the
+  Policies hide a foreign line, which would read as a free one. Their caller must first prove that
+  the requesting identity is that organisation or acts for it: `Identity.can` on `OwnLine` for a
+  held line, the identity itself or its `extends_with` for a registration.
+- each `Deployment` (`CloudflareDeployment`) sits on one line through `deployment_on_line` and is
+  visible to whoever holds that line. A deployment is recorded only while its organisation holds
+  the line. Its label must name the line, and its record must name the line's origin and
+  environment. [Real-Kernel proof](tests/kernel/README.md).
+- an operator deleting an organisation that holds lines deletes its `line_owned_by` Edges in the
+  same Mutation: the Kernel deletes a Node only together with every incident Edge. Its lines stay
+  registered with no holder and are refused to every organisation. A transfer is a root
+  `createEdge` of `line_owned_by` from the line to the new organisation; a line has one holder at
+  most.
 - secret values stay write-only at Cloudflare and never enter Astrale mutations or graph state.
 - schedules remain provider state; only the owner may read or replace them.
 - logs are remote evidence admitted by the Cloudflare Provider before a Workflow returns them.
@@ -22,6 +42,9 @@ protocols behind neutral SDK Integrations and stores only admitted lifecycle evi
 - the provider supplies `WORKER_URL` as the Service's canonical HTTPS URL to both candidate and
   public Workers. It is reserved provider metadata, not a caller variable or secret. Applications
   therefore keep one issuer even when requests arrive over HTTP or through a dispatcher alias.
+- `ASTRALE_BUILD_DIGEST` is reserved the same way: a Worker's build digest is bound by its host,
+  never by its author, so Services refuses it as a caller variable or secret on every deployment
+  path and in secret management.
 
 The View, CLI, and agent consumers read the named Service Queries directly; there is intentionally
 no list Function wrapping `listServicesQuery`. Deployment, secrets, schedules, logs, and deletion
@@ -75,13 +98,87 @@ health check. Cloudflare can automatically delete the generated certificate as s
 Domain is detached. `restore` recreates the exact domain, waits for active TLS and records the actual
 replacement certificate locator. A `pending` result requires a later retry; it is not completion.
 
-The beta replacement serves at `https://services-v2.beta.astrale.ai` with the retained
-`https://services.beta.astrale.ai` issuer and signing key. Keep the original runtime and identity
-discovery available for existing installations. Adopt the replacement's public URL per instance
-before invoking its additive migration API; do not uninstall Services or replace the shared R1
-runtime underneath installations that still use its Schema. An instance rollback must restore any
-detached domain before reinstalling the original endpoint, and must first be qualified with real
-retained Service data.
+The consumer runtimes are frozen ([`frozen-environments.json`](./frozen-environments.json)): the
+original R1 runtime at `https://services.beta.astrale.ai`, which 1Pact instances pin and which
+serves that issuer's discovery and keys, `https://services-v2.beta.astrale.ai`, which retains that
+issuer and key, and production at `https://services.astrale.ai`. They keep serving the code they run
+today and no Environment deploys them. Do not uninstall Services or replace a runtime underneath
+installations that still use its Schema. An instance rollback must restore any detached domain
+before reinstalling the original endpoint, and must first be qualified with real retained Service
+data.
+
+## Admin-hosted runtime
+
+The `admin-beta` Environment is the Services runtime of the Admin instance, the one that hosts
+publishers' deployments outside the instances that install them. It is a Worker of its own,
+`services-domain-admin-beta` at `https://services-admin.beta.astrale.ai`, on the beta data plane the
+Admin instance's Services already manage. Its plain vars name the router Worker
+(`ASTRALE_ROUTER_WORKER`), the routing domain under which deployments are addressed
+(`SERVICES_DEPLOYMENT_HOST`, served by the Services dispatcher) and the registry Domain
+(`SERVICES_REGISTRY_ORIGIN`). `.env.admin-beta` must set `SERVICES_SECRET_DIGEST_KEY`, the key of
+each hosted deployment's secret digest. The runtime keys HMAC-SHA256 with the UTF-8 bytes of the value
+as written, never base64-decoded, so the configuration refuses, before any deployment effect, a file
+without it or with a value shorter than 32 UTF-8 bytes.
+
+It retains the issuer `https://services.beta.astrale.ai` and its signing key, as services-v2 does.
+The Admin instance's Services are bound to that issuer, and the Kernel refuses an issuer change when
+it replaces an installed Domain (`issuer-changed`); neither the Admin Host's Kernel nor the CLI
+offers a consented issuer change yet. The cost: a Worker built from main holds the key that 1Pact's
+installations trust. Keep the key only in managed secret storage and in this Worker's
+`ASTRALE_SIGNING_IDENTITY` secret. The Admin instance moves to an issuer of its own when the
+canonical Admin-hosted runtime replaces this one through a consented issuer change; this Worker and
+its copy of the key are retired after that reinstall.
+
+Only the Admin instance installs this runtime; consumer instances keep the Services they pin.
+The operator sets it up once:
+
+1. Read what the Admin instance's Services are bound to, read-only:
+   `astrale introspect services.astrale.ai -i <admin-instance> --json`. Record `revision` and
+   `publication.identity.issuer`, and the frozen runtime whose `/.well-known/astrale/domain.json`
+   declares that revision: it is the rollback URL. Go on only if the issuer is
+   `https://services.beta.astrale.ai`; any other issuer makes step 6 an issuer change, which the
+   Kernel refuses.
+2. Create `.env.admin-beta` (mode 600) from `.env.example` with the beta data-plane coordinates the
+   Admin instance's Services manage today (account, token, dispatch namespace, routing domain
+   `svc.eu.beta.astrale.ai`, schedule KV, dispatcher, zone, Admin target) and a new
+   `SERVICES_SECRET_DIGEST_KEY` that no other environment uses, e.g. `openssl rand -base64 32` (32
+   random bytes, kept as their 44-character base64 text).
+3. Restore the retained `https://services.beta.astrale.ai` signing identity, the one services-v2 was
+   deployed with, from managed secret storage to `.astrale/services-beta-identity.json` (mode 600).
+   Never generate a key for this runtime: the frozen R1 Worker publishes the issuer's keys, so a new
+   key would never verify. Never leave that key at `.astrale/identity.json`, the development
+   Environment's default identity: `pnpm dev` would bind it to development Workers. Check that the
+   issuer publishes the restored key:
+
+   ```sh
+   node --input-type=module -e '
+   const { readFileSync } = await import("node:fs")
+   const { kid, x } = JSON.parse(readFileSync(".astrale/services-beta-identity.json", "utf8"))
+   const issuer = "https://services.beta.astrale.ai"
+   const { jwks_uri } = await (await fetch(`${issuer}/.well-known/openid-configuration`)).json()
+   const { keys } = await (await fetch(jwks_uri)).json()
+   if (!keys.some((key) => key.kid === kid && key.x === x)) throw new Error("key not published")
+   console.log(`issuer publishes kid ${kid}`)
+   '
+   ```
+
+4. Deploy once with `pnpm run deploy admin-beta`. It creates only the `services-domain-admin-beta`
+   Worker and its route; nothing is installed. Do not run `pnpm provider:bootstrap` or a
+   `provider:route-*` command for this runtime: on the beta data plane they redeploy the shared
+   dispatcher and DNS routing that serve 1Pact's tenants (see the
+   [operator README](./providers/cloudflare/operator/README.md)).
+5. Rehearse step 6 first on a disposable instance whose Host runs the Admin Host's Kernel release and
+   whose Services are bound to the same issuer and revision as in step 1, with at least one Service.
+   The install must succeed and the Service must stay manageable (list, secrets, logs). Then install
+   the step 1 rollback URL there again: if the Kernel refuses it, step 6 is one-way, and that must be
+   recorded before step 6 runs.
+6. Install on the Admin instance only, directly:
+   `astrale domain install https://services-admin.beta.astrale.ai --direct --allow-identity-override -i <admin-instance>`.
+   The only consent is the identity override, because the origin `services.astrale.ai` differs from
+   the serving host; the issuer does not change. On any refusal, stop: never uninstall Services on
+   the Admin instance to get around it, which would drop the Service records it holds. Never repoint
+   Admin's catalog entry for `services.astrale.ai` at this runtime: consumer flows, 1Pact's among
+   them, install Services by origin through that entry.
 
 ## Plain background Service starter
 
@@ -107,8 +204,8 @@ No tooling dependency is added to the Schema runtime or imported from the packag
 
 Copy `.env.example` to `.env.dev` and fill the Cloudflare values.
 
-`pnpm dev` watches and deploys the development Environment remotely. `pnpm dev beta`
-selects beta; `pnpm beta` and `pnpm prod` deploy once. These bootstrap Environments
+`pnpm dev` watches and deploys the development Environment remotely. `pnpm run deploy admin-beta`
+deploys the [Admin-hosted runtime](#admin-hosted-runtime) once. These bootstrap Environments
 are deliberately deploy-only: install the resulting URL on the intended Kernel explicitly.
 Stopping development leaves the remote Worker available. No local Worker or tunnel is started.
 
@@ -123,9 +220,21 @@ pnpm build
 pnpm package
 ```
 
-The deployed module named by `entry` must be present in `modules`. Module contents use one Base64
-string or bounded Base64 chunks when one string cannot cross the portable Value boundary; names are
-unique and secrets use environment-variable identifiers. Plain and revisioned artifacts are
+The deployed module named by `entry` must be present in `modules`. Modules and assets carry
+`content: { encoding: 'identity' | 'gzip', decodedSize, contentBase64 }`; large encoded files use
+`contentBase64Chunks` instead, with each string bounded to 512 KiB. `decodedSize` is the exact original
+byte length. Compression changes transport only: provider uploads and deployment digests use the
+reconstructed bytes. Services validates complete gzip streams (including their checksum), exact sizes,
+and canonical Base64 before any graph or provider operation. Individual decoded files remain bounded
+to 7.5 MiB per module and 12 MiB per asset; all decoded deployment material shares a 32 MiB budget.
+
+The previous top-level `contentBase64` and `contentBase64Chunks` fields remain accepted and are
+explicitly deprecated. Roll out Services and install its new schema on consumer instances before
+publishing the compressed SDK adapter. Old SDK clients continue working against the new Services;
+new SDK requests are refused by an old schema without provider effects. The adapter never retries a
+deployment using a different wire representation after an uncertain outcome.
+
+Module names are unique and secrets use environment-variable identifiers. Plain and revisioned artifacts are
 distinct modes and cannot replace each other at one Service record. Five-field cron expressions are
 supported when `CLOUDFLARE_SCHEDULE_KV_ID` is configured.
 

package/dist/schema/index.d.ts

@@ -3,3 +3,5 @@ export type { ServicesDomain, ServicesSchema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
+export type { DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRetention, DeploymentRetirement, } from './modules/deployment/index.js';

package/dist/schema/index.js

@@ -1,3 +1,4 @@
 export { schema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';

package/dist/schema/modules/deployment/classes/cloudflare-deployment.d.ts

@@ -0,0 +1,97 @@
+export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly description: "One Deployment uploaded as the Workers for Platforms script its label names.";
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly extends: readonly [import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly abstract: true;
+        readonly description: "One immutable deployment of a release on a publisher line.";
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Timestamped">];
+        readonly properties: {
+            label: import("zod").ZodString;
+            url: import("zod").ZodString;
+            state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
+                readonly deploying: {
+                    readonly activate: "active";
+                    readonly fail: "failed";
+                };
+                readonly active: {
+                    readonly retire: "retiring";
+                };
+                readonly retiring: {
+                    readonly completeRetirement: "retired";
+                };
+                readonly retired: {
+                    readonly revive: "deploying";
+                };
+                readonly failed: {
+                    readonly retry: "deploying";
+                };
+            }, "deploying">, {
+                required?: boolean;
+                description?: string;
+            }>;
+            retention: import("zod").ZodEnum<{
+                preview: "preview";
+                published: "published";
+            }>;
+            record: import("zod").ZodObject<{
+                format: import("zod").ZodLiteral<"astrale.deployment-record">;
+                version: import("zod").ZodLiteral<1>;
+                origin: import("zod").ZodString;
+                environment: import("zod").ZodString;
+                releaseDigest: import("zod").ZodString;
+                buildDigest: import("zod").ZodString;
+                schemaRevision: import("zod").ZodString;
+                configuration: import("zod").ZodString;
+                providerScript: import("zod").ZodString;
+                commit: import("zod").ZodNullable<import("zod").ZodObject<{
+                    sha: import("zod").ZodString;
+                    dirty: import("zod").ZodBoolean;
+                    base: import("zod").ZodOptional<import("zod").ZodObject<{
+                        version: import("zod").ZodString;
+                        distance: import("zod").ZodNumber;
+                    }, import("zod/v4/core").$strict>>;
+                }, import("zod/v4/core").$strict>>;
+            }, import("zod/v4/core").$strict>;
+            signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
+            lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            retiredAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+            retirement: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodEnum<{
+                expired: "expired";
+                withdrawn: "withdrawn";
+            }>, {
+                readonly required: false;
+            }>;
+            operationReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
+            operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
+        };
+    }>];
+    readonly policies: {
+        read: () => import("@astrale-os/sdk/schema").Policy;
+    };
+}>;

package/dist/schema/modules/deployment/classes/cloudflare-deployment.js

@@ -0,0 +1,10 @@
+import { classIcon, nodeClass } from '@astrale-os/sdk/schema';
+import { CloudUpload } from '@astrale-os/sdk/schema/icons';
+import { OwnDeployment } from '../policies/own-deployment.js';
+import { Deployment } from './deployment.js';
+export const CloudflareDeployment = nodeClass({
+    description: 'One Deployment uploaded as the Workers for Platforms script its label names.',
+    icon: classIcon.lucide(CloudUpload),
+    extends: [Deployment],
+    policies: { read: () => OwnDeployment },
+});

package/dist/schema/modules/deployment/classes/deployment-line.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+/**
+ * The line every deployment of one origin in one environment shares. The first organisation that
+ * deploys on it holds it, and only an operator transfer gives it to another: it stays registered
+ * and refused to every other organisation after its organisation, that organisation's Services or
+ * every deployment on it are deleted.
+ */
+export declare const DeploymentLine: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly description: "The deployment line of one origin in one environment, held by one organisation.";
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Timestamped">];
+    readonly properties: {
+        origin: z.ZodString;
+        environment: z.ZodString;
+        /** The 16-character fingerprint of `(origin, environment)`; it alone identifies the line. */
+        fingerprint: z.ZodString;
+        /** How the line reads in its deployments' labels: readable, or the fingerprint alone. */
+        line: z.ZodString;
+    };
+    readonly policies: {
+        read: () => import("@astrale-os/sdk/schema").Policy;
+    };
+}>;

package/dist/schema/modules/deployment/classes/deployment-line.js

@@ -0,0 +1,24 @@
+import { classIcon, fullMatch, K, nodeClass } from '@astrale-os/sdk/schema';
+import { GitBranch } from '@astrale-os/sdk/schema/icons';
+import { z } from 'zod';
+import { OwnLine } from '../policies/own-line.js';
+/**
+ * The line every deployment of one origin in one environment shares. The first organisation that
+ * deploys on it holds it, and only an operator transfer gives it to another: it stays registered
+ * and refused to every other organisation after its organisation, that organisation's Services or
+ * every deployment on it are deleted.
+ */
+export const DeploymentLine = nodeClass({
+    description: 'The deployment line of one origin in one environment, held by one organisation.',
+    icon: classIcon.lucide(GitBranch),
+    extends: [K.classes.Timestamped],
+    properties: {
+        origin: z.string().min(1).max(253),
+        environment: z.string().min(1).max(63),
+        /** The 16-character fingerprint of `(origin, environment)`; it alone identifies the line. */
+        fingerprint: z.string().check(fullMatch('[a-z2-7]{16}')),
+        /** How the line reads in its deployments' labels: readable, or the fingerprint alone. */
+        line: z.string().min(16).max(40),
+    },
+    policies: { read: () => OwnLine },
+});

package/dist/schema/modules/deployment/classes/deployment-on-line.d.ts

@@ -0,0 +1,17 @@
+/** The line one deployment was made on; a deployment never moves to another line. */
+export declare const deployment_on_line: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+    readonly depth: 0;
+    readonly abstract: false;
+    readonly extends: readonly [];
+    readonly properties: never;
+    readonly source: {
+        readonly as: "deployment";
+        readonly outgoing: "1";
+    };
+    readonly target: {
+        readonly as: "line";
+        readonly incoming: "0..*";
+    };
+    readonly constraints: Record<never, never>;
+    readonly effectiveProperties: never;
+}>;

package/dist/schema/modules/deployment/classes/deployment-on-line.js

@@ -0,0 +1,11 @@
+import { edgeClass } from '@astrale-os/sdk/schema';
+import { TraverseOwnedLineDeployment } from '../policies/traverse-owned-line-deployment.js';
+import { DeploymentLine } from './deployment-line.js';
+import { Deployment } from './deployment.js';
+/** The line one deployment was made on; a deployment never moves to another line. */
+export const deployment_on_line = edgeClass.directed({
+    description: 'The deployment line one Deployment belongs to.',
+    source: { as: 'deployment', accepts: [() => Deployment], outgoing: '1' },
+    target: { as: 'line', accepts: [() => DeploymentLine], incoming: '0..*' },
+    policies: { traverse: () => TraverseOwnedLineDeployment },
+});

package/dist/schema/modules/deployment/classes/deployment.d.ts

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * One immutable deployment of a release: one build in one environment with its frozen
+ * configuration, served by one script at its own URL. It never changes code; a new release is a
+ * new deployment on the same line.
+ */
+export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly abstract: true;
+    readonly description: "One immutable deployment of a release on a publisher line.";
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Timestamped">];
+    readonly properties: {
+        /** `<line>-<content16>`, the DNS label and provider script name of this deployment. */
+        label: z.ZodString;
+        url: z.ZodString;
+        state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
+            readonly deploying: {
+                readonly activate: "active";
+                readonly fail: "failed";
+            };
+            readonly active: {
+                readonly retire: "retiring";
+            };
+            readonly retiring: {
+                readonly completeRetirement: "retired";
+            };
+            readonly retired: {
+                readonly revive: "deploying";
+            };
+            readonly failed: {
+                readonly retry: "deploying";
+            };
+        }, "deploying">, {
+            required?: boolean;
+            description?: string;
+        }>;
+        retention: z.ZodEnum<{
+            preview: "preview";
+            published: "published";
+        }>;
+        record: z.ZodObject<{
+            format: z.ZodLiteral<"astrale.deployment-record">;
+            version: z.ZodLiteral<1>;
+            origin: z.ZodString;
+            environment: z.ZodString;
+            releaseDigest: z.ZodString;
+            buildDigest: z.ZodString;
+            schemaRevision: z.ZodString;
+            configuration: z.ZodString;
+            providerScript: z.ZodString;
+            commit: z.ZodNullable<z.ZodObject<{
+                sha: z.ZodString;
+                dirty: z.ZodBoolean;
+                base: z.ZodOptional<z.ZodObject<{
+                    version: z.ZodString;
+                    distance: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
+            readonly required: false;
+        }>;
+        lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
+        expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
+        retiredAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
+        retirement: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodEnum<{
+            expired: "expired";
+            withdrawn: "withdrawn";
+        }>, {
+            readonly required: false;
+        }>;
+        /** The graph lease of the provider operation in flight on this deployment. */
+        operationReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
+            readonly required: false;
+        }>;
+        operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
+    };
+}>;

package/dist/schema/modules/deployment/classes/deployment.js

@@ -0,0 +1,32 @@
+import { classIcon, K, nodeClass, property, schema as valueSchema, stateProperty, } from '@astrale-os/sdk/schema';
+import { Rocket } from '@astrale-os/sdk/schema/icons';
+import { z } from 'zod';
+import { deploymentLifecycle } from '../states/index.js';
+import { deploymentRecord, deploymentRetention, deploymentRetirement } from '../types/index.js';
+/**
+ * One immutable deployment of a release: one build in one environment with its frozen
+ * configuration, served by one script at its own URL. It never changes code; a new release is a
+ * new deployment on the same line.
+ */
+export const Deployment = nodeClass({
+    abstract: true,
+    description: 'One immutable deployment of a release on a publisher line.',
+    icon: classIcon.lucide(Rocket),
+    extends: [K.classes.Timestamped],
+    properties: {
+        /** `<line>-<content16>`, the DNS label and provider script name of this deployment. */
+        label: z.string().min(33).max(57),
+        url: z.string().min(1).max(2_048),
+        state: stateProperty(deploymentLifecycle),
+        retention: deploymentRetention,
+        record: deploymentRecord,
+        signingKeyId: property(z.string().min(1).max(128), { required: false }),
+        lastCallAt: property(valueSchema.values.instant, { required: false }),
+        expiresAt: property(valueSchema.values.instant, { required: false }),
+        retiredAt: property(valueSchema.values.instant, { required: false }),
+        retirement: property(deploymentRetirement, { required: false }),
+        /** The graph lease of the provider operation in flight on this deployment. */
+        operationReceipt: property(z.string().min(1).max(128), { required: false }),
+        operationExpiresAt: property(valueSchema.values.instant, { required: false }),
+    },
+});

package/dist/schema/modules/deployment/classes/index.d.ts

@@ -0,0 +1,5 @@
+export { CloudflareDeployment } from './cloudflare-deployment.js';
+export { Deployment } from './deployment.js';
+export { DeploymentLine } from './deployment-line.js';
+export { deployment_on_line } from './deployment-on-line.js';
+export { line_owned_by } from './line-owned-by.js';

package/dist/schema/modules/deployment/classes/index.js

@@ -0,0 +1,5 @@
+export { CloudflareDeployment } from './cloudflare-deployment.js';
+export { Deployment } from './deployment.js';
+export { DeploymentLine } from './deployment-line.js';
+export { deployment_on_line } from './deployment-on-line.js';
+export { line_owned_by } from './line-owned-by.js';

package/dist/schema/modules/deployment/classes/line-owned-by.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The organisation holding one deployment line: an Identity of the Admin instance, a Shell User
+ * or Group, whose members and CI identities act for it through `extends_with`. A line outlives
+ * this Edge: deleting its organisation removes the Edge and leaves the line held by nobody until
+ * an operator transfer.
+ *
+ * Hence at most one holder, not exactly one: the Kernel deletes a Node only together with every
+ * incident Edge, so a required holder would make the organisation undeletable unless its lines
+ * went with it, and a deleted line would free its fingerprint for another organisation.
+ */
+export declare const line_owned_by: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+    readonly depth: 0;
+    readonly abstract: false;
+    readonly extends: readonly [];
+    readonly properties: never;
+    readonly source: {
+        readonly as: "line";
+        readonly outgoing: "0..1";
+    };
+    readonly target: {
+        readonly as: "owner";
+        readonly incoming: "0..*";
+    };
+    readonly constraints: Record<never, never>;
+    readonly effectiveProperties: never;
+}>;

package/dist/schema/modules/deployment/classes/line-owned-by.js

@@ -0,0 +1,19 @@
+import { edgeClass, K } from '@astrale-os/sdk/schema';
+import { TraverseOwnedLine } from '../policies/traverse-owned-line.js';
+import { DeploymentLine } from './deployment-line.js';
+/**
+ * The organisation holding one deployment line: an Identity of the Admin instance, a Shell User
+ * or Group, whose members and CI identities act for it through `extends_with`. A line outlives
+ * this Edge: deleting its organisation removes the Edge and leaves the line held by nobody until
+ * an operator transfer.
+ *
+ * Hence at most one holder, not exactly one: the Kernel deletes a Node only together with every
+ * incident Edge, so a required holder would make the organisation undeletable unless its lines
+ * went with it, and a deleted line would free its fingerprint for another organisation.
+ */
+export const line_owned_by = edgeClass.directed({
+    description: 'The organisation that holds one deployment line.',
+    source: { as: 'line', accepts: [() => DeploymentLine], outgoing: '0..1' },
+    target: { as: 'owner', accepts: [K.classes.Identity], incoming: '0..*' },
+    policies: { traverse: () => TraverseOwnedLine },
+});

package/dist/schema/modules/deployment/index.d.ts

@@ -0,0 +1,6 @@
+export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
+export { OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentLifecycle } from './states/index.js';
+export type { DeploymentLifecycle, DeploymentLifecycleEvent } from './states/index.js';
+export { deploymentCommit, deploymentRecord, deploymentRetention, deploymentRetirement, } from './types/index.js';
+export type { DeploymentRecord, DeploymentRetention, DeploymentRetirement } from './types/index.js';

package/dist/schema/modules/deployment/index.js

@@ -0,0 +1,4 @@
+export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
+export { OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentLifecycle } from './states/index.js';
+export { deploymentCommit, deploymentRecord, deploymentRetention, deploymentRetirement, } from './types/index.js';

package/dist/schema/modules/deployment/policies/index.d.ts

@@ -0,0 +1,4 @@
+export { OwnDeployment } from './own-deployment.js';
+export { OwnLine } from './own-line.js';
+export { TraverseOwnedLine } from './traverse-owned-line.js';
+export { TraverseOwnedLineDeployment } from './traverse-owned-line-deployment.js';

package/dist/schema/modules/deployment/policies/index.js

@@ -0,0 +1,4 @@
+export { OwnDeployment } from './own-deployment.js';
+export { OwnLine } from './own-line.js';
+export { TraverseOwnedLine } from './traverse-owned-line.js';
+export { TraverseOwnedLineDeployment } from './traverse-owned-line-deployment.js';

package/dist/schema/modules/deployment/policies/own-deployment.d.ts

@@ -0,0 +1,2 @@
+/** A deployment belongs to whoever holds its line; it carries no owner of its own. */
+export declare const OwnDeployment: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/own-deployment.js

@@ -0,0 +1,12 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { DeploymentLine } from '../classes/deployment-line.js';
+import { deployment_on_line } from '../classes/deployment-on-line.js';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/** A deployment belongs to whoever holds its line; it carries no owner of its own. */
+export const OwnDeployment = policy({
+    description: 'The subject holds the deployment line this Deployment was made on.',
+    match: ({ allOf, edge, exists, object, subject }) => exists(({ node }) => {
+        const line = node(() => DeploymentLine);
+        return allOf(edge({ source: object, class: () => deployment_on_line, target: line }), edge({ source: line, class: () => line_owned_by, target: subject }));
+    }),
+});

package/dist/schema/modules/deployment/policies/own-line.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The organisation holding a line, and every Identity that acts for it: a member or a CI identity
+ * reaches it through its `extends_with` composition, never through a second rule here.
+ */
+export declare const OwnLine: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/own-line.js

@@ -0,0 +1,10 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/**
+ * The organisation holding a line, and every Identity that acts for it: a member or a CI identity
+ * reaches it through its `extends_with` composition, never through a second rule here.
+ */
+export const OwnLine = policy({
+    description: 'The subject holds this deployment line.',
+    match: ({ edge, object, subject }) => edge({ source: object, class: () => line_owned_by, target: subject }),
+});