@astrale-domains/services 0.4.5 → 0.4.7

package/dist/schema/modules/deployment/functions/index.d.ts

@@ -0,0 +1,11 @@
+export { deployCloudflareDeployment } from './deploy-cloudflare-deployment.js';
+export { describeDeploymentHosting } from './describe-deployment-hosting.js';
+export { expireDeploymentPreviews } from './expire-deployment-previews.js';
+export { listCloudflareDeployments } from './list-cloudflare-deployments.js';
+export { listCloudflareDeploymentSecretNames } from './list-cloudflare-deployment-secret-names.js';
+export { listDeploymentSecretNames } from './list-deployment-secret-names.js';
+export { readDeploymentLastCalls } from './read-deployment-last-calls.js';
+export { retainDeployment } from './retain-deployment.js';
+export { retireDeployment } from './retire-deployment.js';
+export { setCloudflareDeploymentSecret } from './set-cloudflare-deployment-secret.js';
+export { setDeploymentSecret } from './set-deployment-secret.js';

package/dist/schema/modules/deployment/functions/index.js

@@ -0,0 +1,11 @@
+export { deployCloudflareDeployment } from './deploy-cloudflare-deployment.js';
+export { describeDeploymentHosting } from './describe-deployment-hosting.js';
+export { expireDeploymentPreviews } from './expire-deployment-previews.js';
+export { listCloudflareDeployments } from './list-cloudflare-deployments.js';
+export { listCloudflareDeploymentSecretNames } from './list-cloudflare-deployment-secret-names.js';
+export { listDeploymentSecretNames } from './list-deployment-secret-names.js';
+export { readDeploymentLastCalls } from './read-deployment-last-calls.js';
+export { retainDeployment } from './retain-deployment.js';
+export { retireDeployment } from './retire-deployment.js';
+export { setCloudflareDeploymentSecret } from './set-cloudflare-deployment-secret.js';
+export { setDeploymentSecret } from './set-deployment-secret.js';

package/dist/schema/modules/deployment/functions/list-cloudflare-deployment-secret-names.d.ts

@@ -0,0 +1,5 @@
+/** Decided as `setSecret`: `OwnDeployment` for the caller, before the deployment is read. */
+export declare const listCloudflareDeploymentSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: string[];
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/list-cloudflare-deployment-secret-names.js

@@ -0,0 +1,4 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentSecretNamesContract } from '../types/deployment-secret.js';
+/** Decided as `setSecret`: `OwnDeployment` for the caller, before the deployment is read. */
+export const listCloudflareDeploymentSecretNames = method(listDeploymentSecretNamesContract);

package/dist/schema/modules/deployment/functions/list-cloudflare-deployments.d.ts

@@ -0,0 +1,58 @@
+/** The deployments of the lines the caller holds, or acts for through `extends_with`. */
+export declare const listCloudflareDeployments: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    origin?: string | undefined;
+    environment?: string | undefined;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        deployments: ({
+            id: string;
+            url: string;
+            label: string;
+            line: string;
+            owner: string;
+            state: "active" | "deploying" | "failed" | "retired" | "retiring";
+            retention: "preview" | "published";
+            createdAt: string;
+            lastCallAt?: string | undefined;
+            expiresAt?: string | undefined;
+            retiredAt?: string | undefined;
+            retirement?: "expired" | "withdrawn" | undefined;
+            signingKeyId: string;
+            record: {
+                format: "astrale.deployment-record";
+                version: 1;
+                origin: string;
+                environment: string;
+                releaseDigest: string;
+                buildDigest: string;
+                schemaRevision: string;
+                configuration: string;
+                providerScript: string;
+                commit: {
+                    sha: string;
+                    dirty: boolean;
+                    base?: {
+                        version: string;
+                        distance: number;
+                    } | undefined;
+                } | null;
+            };
+        } | {
+            id: string;
+            url: string;
+            label: string;
+            line: string;
+            owner: string;
+            state: "active" | "deploying" | "failed" | "retired" | "retiring";
+            retention: "preview" | "published";
+            createdAt: string;
+            lastCallAt?: string | undefined;
+            expiresAt?: string | undefined;
+            retiredAt?: string | undefined;
+            retirement?: "expired" | "withdrawn" | undefined;
+            signingKeyId: string;
+            record: unknown;
+        })[];
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/list-cloudflare-deployments.js

@@ -0,0 +1,10 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentsInput, listDeploymentsOutput } from '../types/deployment-hosting.js';
+/** The deployments of the lines the caller holds, or acts for through `extends_with`. */
+export const listCloudflareDeployments = method({
+    description: 'List the deployments of the lines the caller holds.',
+    auth: 'authenticated',
+    static: true,
+    input: listDeploymentsInput,
+    output: listDeploymentsOutput,
+});

package/dist/schema/modules/deployment/functions/list-deployment-secret-names.d.ts

@@ -0,0 +1,4 @@
+export declare const listDeploymentSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: string[];
+}, "authenticated", false, true, undefined>>;

package/dist/schema/modules/deployment/functions/list-deployment-secret-names.js

@@ -0,0 +1,6 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentSecretNamesContract } from '../types/deployment-secret.js';
+export const listDeploymentSecretNames = method({
+    ...listDeploymentSecretNamesContract,
+    abstract: true,
+});

package/dist/schema/modules/deployment/functions/read-deployment-last-calls.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The last call of each deployment named, as the dispatcher counted it. The caller must hold
+ * every label's line; the registry Domain may read any label.
+ */
+export declare const readDeploymentLastCalls: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    labels: string[];
+}, {
+    readonly mode: 'value';
+    readonly value: Record<string, string | null>;
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/read-deployment-last-calls.js

@@ -0,0 +1,13 @@
+import { method } from '@astrale-os/sdk/schema';
+import { lastCallsInput, lastCallsOutput } from '../types/deployment-retention.js';
+/**
+ * The last call of each deployment named, as the dispatcher counted it. The caller must hold
+ * every label's line; the registry Domain may read any label.
+ */
+export const readDeploymentLastCalls = method({
+    description: 'Read the instant of the last call of each named deployment.',
+    auth: 'authenticated',
+    static: true,
+    input: lastCallsInput,
+    output: lastCallsOutput,
+});

package/dist/schema/modules/deployment/functions/retain-deployment.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mark one deployment published, so it is served as long as it exists. Only the registry Domain
+ * marks, after the Publication that names the release; a line holder cannot keep its own preview.
+ */
+export declare const retainDeployment: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    label: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        retention: "published";
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/retain-deployment.js

@@ -0,0 +1,13 @@
+import { method } from '@astrale-os/sdk/schema';
+import { retainInput, retainOutput } from '../types/deployment-retention.js';
+/**
+ * Mark one deployment published, so it is served as long as it exists. Only the registry Domain
+ * marks, after the Publication that names the release; a line holder cannot keep its own preview.
+ */
+export const retainDeployment = method({
+    description: 'Mark one deployment published so that it never expires.',
+    auth: 'authenticated',
+    static: true,
+    input: retainInput,
+    output: retainOutput,
+});

package/dist/schema/modules/deployment/functions/retire-deployment.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Withdraw one deployment for good: the emergency stop of its line holder. Its URL then answers
+ * `DEPLOYMENT_RETIRED`, its script and key are deleted, and no redeploy serves it again.
+ *
+ * Only the holder of the deployment's line, or an Identity acting for it, withdraws it: the
+ * handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment, as
+ * `setSecret` does. An `authorized` Method would also require the caller's principal to hold
+ * `can_use` on this Function, which no publisher identity holds on the Admin instance.
+ */
+export declare const retireDeployment: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        kind: "retired";
+    } | {
+        kind: "retiring";
+        retryAfterMs: number;
+    } | {
+        kind: "rejected";
+        reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/retire-deployment.js

@@ -0,0 +1,17 @@
+import { method } from '@astrale-os/sdk/schema';
+import { retireDeploymentInput, retireDeploymentOutput } from '../types/deployment-retire.js';
+/**
+ * Withdraw one deployment for good: the emergency stop of its line holder. Its URL then answers
+ * `DEPLOYMENT_RETIRED`, its script and key are deleted, and no redeploy serves it again.
+ *
+ * Only the holder of the deployment's line, or an Identity acting for it, withdraws it: the
+ * handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment, as
+ * `setSecret` does. An `authorized` Method would also require the caller's principal to hold
+ * `can_use` on this Function, which no publisher identity holds on the Admin instance.
+ */
+export const retireDeployment = method({
+    description: 'Withdraw this deployment for good: an emergency stop.',
+    auth: 'authenticated',
+    input: retireDeploymentInput,
+    output: retireDeploymentOutput,
+});

package/dist/schema/modules/deployment/functions/set-cloudflare-deployment-secret.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Only the holder of the deployment's line, or an Identity acting for it, rewrites its secrets:
+ * the handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment.
+ */
+export declare const setCloudflareDeploymentSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    name: string;
+    value: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        name: string;
+    } | {
+        kind: "rejected";
+        reason: "secret-undeclared" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/set-cloudflare-deployment-secret.js

@@ -0,0 +1,7 @@
+import { method } from '@astrale-os/sdk/schema';
+import { setDeploymentSecretContract } from '../types/deployment-secret.js';
+/**
+ * Only the holder of the deployment's line, or an Identity acting for it, rewrites its secrets:
+ * the handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment.
+ */
+export const setCloudflareDeploymentSecret = method(setDeploymentSecretContract);

package/dist/schema/modules/deployment/functions/set-deployment-secret.d.ts

@@ -0,0 +1,14 @@
+export declare const setDeploymentSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    name: string;
+    value: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        name: string;
+    } | {
+        kind: "rejected";
+        reason: "secret-undeclared" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, true, undefined>>;

package/dist/schema/modules/deployment/functions/set-deployment-secret.js

@@ -0,0 +1,3 @@
+import { method } from '@astrale-os/sdk/schema';
+import { setDeploymentSecretContract } from '../types/deployment-secret.js';
+export const setDeploymentSecret = method({ ...setDeploymentSecretContract, abstract: true });

package/dist/schema/modules/deployment/index.d.ts

@@ -0,0 +1,8 @@
+export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
+export { deploymentHostingUnavailable, deploymentLabelNotFound, deploymentNotFound, deploymentRegistryOnly, } from './errors/index.js';
+export { deployCloudflareDeployment, describeDeploymentHosting, expireDeploymentPreviews, listCloudflareDeploymentSecretNames, listCloudflareDeployments, listDeploymentSecretNames, readDeploymentLastCalls, retainDeployment, retireDeployment, setCloudflareDeploymentSecret, setDeploymentSecret, } from './functions/index.js';
+export { ActForOrganization, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentLifecycle } from './states/index.js';
+export type { DeploymentLifecycle, DeploymentLifecycleEvent } from './states/index.js';
+export { deploymentCommit, deploymentHosting, deploymentLabel, deploymentRecord, deploymentRejection, deploymentRejectionReason, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigest, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, expirePreviewsInput, expirePreviewsOutput, frozenConfiguration, lastCallsInput, lastCallsOutput, listDeploymentSecretNamesContract, listedDeploymentSummary, listDeploymentsInput, listDeploymentsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, retireDeploymentInput, retireDeploymentOutput, setDeploymentSecretContract, unadmittedDeploymentSummary, } from './types/index.js';
+export type { DeploymentHosting, DeploymentRecord, DeploymentRejection, DeploymentRejectionReason, DeploymentRequest, DeploymentResponse, DeploymentRetention, DeploymentRetirement, DeploymentSecretDigest, DeploymentSecretRejection, DeploymentSummary, ExpirePreviewsResult, FrozenConfiguration, ListedDeploymentSummary, RetireDeploymentResult, UnadmittedDeploymentSummary, } from './types/index.js';

package/dist/schema/modules/deployment/index.js

@@ -0,0 +1,6 @@
+export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
+export { deploymentHostingUnavailable, deploymentLabelNotFound, deploymentNotFound, deploymentRegistryOnly, } from './errors/index.js';
+export { deployCloudflareDeployment, describeDeploymentHosting, expireDeploymentPreviews, listCloudflareDeploymentSecretNames, listCloudflareDeployments, listDeploymentSecretNames, readDeploymentLastCalls, retainDeployment, retireDeployment, setCloudflareDeploymentSecret, setDeploymentSecret, } from './functions/index.js';
+export { ActForOrganization, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentLifecycle } from './states/index.js';
+export { deploymentCommit, deploymentHosting, deploymentLabel, deploymentRecord, deploymentRejection, deploymentRejectionReason, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigest, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, expirePreviewsInput, expirePreviewsOutput, frozenConfiguration, lastCallsInput, lastCallsOutput, listDeploymentSecretNamesContract, listedDeploymentSummary, listDeploymentsInput, listDeploymentsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, retireDeploymentInput, retireDeploymentOutput, setDeploymentSecretContract, unadmittedDeploymentSummary, } from './types/index.js';

package/dist/schema/modules/deployment/policies/act-for-organization.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The subject is this organisation, or an Identity acting for it: a member or a CI identity
+ * reaches its organisation through `extends_with`, which the Kernel expands for the subject. Deploy
+ * asks it of the caller, on the organisation it names, before registering a line for it.
+ */
+export declare const ActForOrganization: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/act-for-organization.js

@@ -0,0 +1,10 @@
+import { policy } from '@astrale-os/sdk/schema';
+/**
+ * The subject is this organisation, or an Identity acting for it: a member or a CI identity
+ * reaches its organisation through `extends_with`, which the Kernel expands for the subject. Deploy
+ * asks it of the caller, on the organisation it names, before registering a line for it.
+ */
+export const ActForOrganization = policy({
+    description: 'The subject is this organisation or acts for it through extends_with.',
+    match: ({ sameNode, subject, object }) => sameNode(subject, object),
+});

package/dist/schema/modules/deployment/policies/index.d.ts

@@ -0,0 +1,5 @@
+export { ActForOrganization } from './act-for-organization.js';
+export { OwnDeployment } from './own-deployment.js';
+export { OwnLine } from './own-line.js';
+export { TraverseOwnedLine } from './traverse-owned-line.js';
+export { TraverseOwnedLineDeployment } from './traverse-owned-line-deployment.js';

package/dist/schema/modules/deployment/policies/index.js

@@ -0,0 +1,5 @@
+export { ActForOrganization } from './act-for-organization.js';
+export { OwnDeployment } from './own-deployment.js';
+export { OwnLine } from './own-line.js';
+export { TraverseOwnedLine } from './traverse-owned-line.js';
+export { TraverseOwnedLineDeployment } from './traverse-owned-line-deployment.js';

package/dist/schema/modules/deployment/policies/own-deployment.d.ts

@@ -0,0 +1,2 @@
+/** A deployment belongs to whoever holds its line; it carries no owner of its own. */
+export declare const OwnDeployment: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/own-deployment.js

@@ -0,0 +1,12 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { DeploymentLine } from '../classes/deployment-line.js';
+import { deployment_on_line } from '../classes/deployment-on-line.js';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/** A deployment belongs to whoever holds its line; it carries no owner of its own. */
+export const OwnDeployment = policy({
+    description: 'The subject holds the deployment line this Deployment was made on.',
+    match: ({ allOf, edge, exists, object, subject }) => exists(({ node }) => {
+        const line = node(() => DeploymentLine);
+        return allOf(edge({ source: object, class: () => deployment_on_line, target: line }), edge({ source: line, class: () => line_owned_by, target: subject }));
+    }),
+});

package/dist/schema/modules/deployment/policies/own-line.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The organisation holding a line, and every Identity that acts for it: a member or a CI identity
+ * reaches it through its `extends_with` composition, never through a second rule here.
+ */
+export declare const OwnLine: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/own-line.js

@@ -0,0 +1,10 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/**
+ * The organisation holding a line, and every Identity that acts for it: a member or a CI identity
+ * reaches it through its `extends_with` composition, never through a second rule here.
+ */
+export const OwnLine = policy({
+    description: 'The subject holds this deployment line.',
+    match: ({ edge, object, subject }) => edge({ source: object, class: () => line_owned_by, target: subject }),
+});

package/dist/schema/modules/deployment/policies/traverse-owned-line-deployment.d.ts

@@ -0,0 +1,2 @@
+/** A deployment's line relationship is visible only to the holder of that line. */
+export declare const TraverseOwnedLineDeployment: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/traverse-owned-line-deployment.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/** A deployment's line relationship is visible only to the holder of that line. */
+export const TraverseOwnedLineDeployment = policy({
+    description: 'The subject holds the deployment line at the target of this relationship.',
+    match: ({ edge, subject, target }) => edge({ source: target, class: () => line_owned_by, target: subject }),
+});

package/dist/schema/modules/deployment/policies/traverse-owned-line.d.ts

@@ -0,0 +1,2 @@
+/** A line's holder relationship is visible only to the holder of that line. */
+export declare const TraverseOwnedLine: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/traverse-owned-line.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { line_owned_by } from '../classes/line-owned-by.js';
+/** A line's holder relationship is visible only to the holder of that line. */
+export const TraverseOwnedLine = policy({
+    description: 'The subject holds the deployment line at the source of this relationship.',
+    match: ({ edge, source, subject }) => edge({ source, class: () => line_owned_by, target: subject }),
+});

package/dist/schema/modules/deployment/states/deployment-lifecycle.d.ts

@@ -0,0 +1,30 @@
+import { type EventOf, type StateOf } from '@astrale-os/sdk/state';
+/**
+ * Lifecycle of one immutable deployment. A deployment never changes code: it is created
+ * `deploying`, becomes `active` once its script serves, and leaves only by retirement, in two
+ * phases: `retiring` once its tombstone is written, `retired` once its script and key are deleted.
+ * A failed creation can be retried on the same label, or retired, since it may have left a
+ * script. An expired retirement can be revived for the same line holder and artifact; a withdrawn
+ * one never.
+ */
+export declare const deploymentLifecycle: import("@astrale-os/sdk/schema").StateMachine<{
+    readonly deploying: {
+        readonly activate: "active";
+        readonly fail: "failed";
+    };
+    readonly active: {
+        readonly retire: "retiring";
+    };
+    readonly retiring: {
+        readonly completeRetirement: "retired";
+    };
+    readonly retired: {
+        readonly revive: "deploying";
+    };
+    readonly failed: {
+        readonly retry: "deploying";
+        readonly retire: "retiring";
+    };
+}, "deploying">;
+export type DeploymentLifecycle = StateOf<typeof deploymentLifecycle>;
+export type DeploymentLifecycleEvent = EventOf<typeof deploymentLifecycle>;

package/dist/schema/modules/deployment/states/deployment-lifecycle.js

@@ -0,0 +1,19 @@
+import { stateMachine } from '@astrale-os/sdk/state';
+/**
+ * Lifecycle of one immutable deployment. A deployment never changes code: it is created
+ * `deploying`, becomes `active` once its script serves, and leaves only by retirement, in two
+ * phases: `retiring` once its tombstone is written, `retired` once its script and key are deleted.
+ * A failed creation can be retried on the same label, or retired, since it may have left a
+ * script. An expired retirement can be revived for the same line holder and artifact; a withdrawn
+ * one never.
+ */
+export const deploymentLifecycle = stateMachine({
+    initial: 'deploying',
+    transitions: {
+        deploying: { activate: 'active', fail: 'failed' },
+        active: { retire: 'retiring' },
+        retiring: { completeRetirement: 'retired' },
+        retired: { revive: 'deploying' },
+        failed: { retry: 'deploying', retire: 'retiring' },
+    },
+});

package/dist/schema/modules/deployment/states/index.d.ts

@@ -0,0 +1,2 @@
+export { deploymentLifecycle } from './deployment-lifecycle.js';
+export type { DeploymentLifecycle, DeploymentLifecycleEvent } from './deployment-lifecycle.js';

package/dist/schema/modules/deployment/states/index.js

@@ -0,0 +1 @@
+export { deploymentLifecycle } from './deployment-lifecycle.js';

package/dist/schema/modules/deployment/types/deployment-hosting.d.ts

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+/** Where this Services runtime addresses deployments, and how the caller's own lines read. */
+export declare const deploymentHosting: z.ZodObject<{
+    routingDomain: z.ZodString;
+    addressing: z.ZodEnum<{
+        opaque: "opaque";
+        readable: "readable";
+    }>;
+}, z.core.$strict>;
+export declare const listDeploymentsInput: z.ZodObject<{
+    origin: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * The deployments of the caller's lines. A deployment whose stored record or configuration this
+ * Services SDK no longer admits is listed from its facts with its record as stored, never dropped,
+ * and never fails the listing.
+ */
+export declare const listDeploymentsOutput: z.ZodObject<{
+    deployments: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        id: z.ZodString;
+        url: z.ZodString;
+        label: z.ZodString;
+        line: z.ZodString;
+        owner: z.ZodString;
+        state: z.ZodEnum<{
+            active: "active";
+            deploying: "deploying";
+            failed: "failed";
+            retired: "retired";
+            retiring: "retiring";
+        }>;
+        retention: z.ZodEnum<{
+            preview: "preview";
+            published: "published";
+        }>;
+        createdAt: z.ZodString;
+        lastCallAt: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        retiredAt: z.ZodOptional<z.ZodString>;
+        retirement: z.ZodOptional<z.ZodEnum<{
+            expired: "expired";
+            withdrawn: "withdrawn";
+        }>>;
+        signingKeyId: z.ZodString;
+        record: z.ZodObject<{
+            format: z.ZodLiteral<"astrale.deployment-record">;
+            version: z.ZodLiteral<1>;
+            origin: z.ZodString;
+            environment: z.ZodString;
+            releaseDigest: z.ZodString;
+            buildDigest: z.ZodString;
+            schemaRevision: z.ZodString;
+            configuration: z.ZodString;
+            providerScript: z.ZodString;
+            commit: z.ZodNullable<z.ZodObject<{
+                sha: z.ZodString;
+                dirty: z.ZodBoolean;
+                base: z.ZodOptional<z.ZodObject<{
+                    version: z.ZodString;
+                    distance: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        id: z.ZodString;
+        url: z.ZodString;
+        label: z.ZodString;
+        line: z.ZodString;
+        owner: z.ZodString;
+        state: z.ZodEnum<{
+            active: "active";
+            deploying: "deploying";
+            failed: "failed";
+            retired: "retired";
+            retiring: "retiring";
+        }>;
+        retention: z.ZodEnum<{
+            preview: "preview";
+            published: "published";
+        }>;
+        createdAt: z.ZodString;
+        lastCallAt: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        retiredAt: z.ZodOptional<z.ZodString>;
+        retirement: z.ZodOptional<z.ZodEnum<{
+            expired: "expired";
+            withdrawn: "withdrawn";
+        }>>;
+        signingKeyId: z.ZodString;
+        record: z.ZodUnknown;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export type DeploymentHosting = z.output<typeof deploymentHosting>;

package/dist/schema/modules/deployment/types/deployment-hosting.js

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+import { listedDeploymentSummary } from './deployment-summary.js';
+/** Where this Services runtime addresses deployments, and how the caller's own lines read. */
+export const deploymentHosting = z.strictObject({
+    routingDomain: z.string().min(1).max(253),
+    addressing: z.enum(['readable', 'opaque']),
+});
+export const listDeploymentsInput = z.strictObject({
+    origin: z.string().min(1).max(253).optional(),
+    environment: z.string().min(1).max(63).optional(),
+});
+/**
+ * The deployments of the caller's lines. A deployment whose stored record or configuration this
+ * Services SDK no longer admits is listed from its facts with its record as stored, never dropped,
+ * and never fails the listing.
+ */
+export const listDeploymentsOutput = z.strictObject({
+    deployments: z.array(listedDeploymentSummary),
+});

package/dist/schema/modules/deployment/types/deployment-record.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+/** The commit a deployment was built from, as its deployer declared it. */
+export declare const deploymentCommit: z.ZodObject<{
+    sha: z.ZodString;
+    dirty: z.ZodBoolean;
+    base: z.ZodOptional<z.ZodObject<{
+        version: z.ZodString;
+        distance: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * The `DeploymentRecordV1` one deploy declares, stored as declared beside the facts Services
+ * knows itself. Services admits it with the SDK's `acceptDeploymentRecord` before storing it, so
+ * this shape only bounds what the graph holds; any extension is a new record version.
+ */
+export declare const deploymentRecord: z.ZodObject<{
+    format: z.ZodLiteral<"astrale.deployment-record">;
+    version: z.ZodLiteral<1>;
+    origin: z.ZodString;
+    environment: z.ZodString;
+    releaseDigest: z.ZodString;
+    buildDigest: z.ZodString;
+    schemaRevision: z.ZodString;
+    configuration: z.ZodString;
+    providerScript: z.ZodString;
+    commit: z.ZodNullable<z.ZodObject<{
+        sha: z.ZodString;
+        dirty: z.ZodBoolean;
+        base: z.ZodOptional<z.ZodObject<{
+            version: z.ZodString;
+            distance: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DeploymentRecord = z.output<typeof deploymentRecord>;

package/dist/schema/modules/deployment/types/deployment-record.js

@@ -0,0 +1,31 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+const digest = z.string().check(fullMatch('sha256:[0-9a-f]{64}'));
+/** The commit a deployment was built from, as its deployer declared it. */
+export const deploymentCommit = z.strictObject({
+    sha: z.string().check(fullMatch('[0-9a-fA-F]{40}')),
+    dirty: z.boolean(),
+    base: z
+        .strictObject({
+        version: z.string().min(1).max(256),
+        distance: z.number().int().min(0),
+    })
+        .optional(),
+});
+/**
+ * The `DeploymentRecordV1` one deploy declares, stored as declared beside the facts Services
+ * knows itself. Services admits it with the SDK's `acceptDeploymentRecord` before storing it, so
+ * this shape only bounds what the graph holds; any extension is a new record version.
+ */
+export const deploymentRecord = z.strictObject({
+    format: z.literal('astrale.deployment-record'),
+    version: z.literal(1),
+    origin: z.string().min(1).max(253),
+    environment: z.string().min(1).max(63),
+    releaseDigest: digest,
+    buildDigest: digest,
+    schemaRevision: digest,
+    configuration: digest,
+    providerScript: z.string().min(1).max(57),
+    commit: deploymentCommit.nullable(),
+});