@astrale-domains/services 0.4.5 → 0.4.7

package/dist/schema/modules/deployment/types/deployment-request.d.ts

@@ -0,0 +1,161 @@
+import { z } from 'zod';
+/**
+ * `DeploymentRequestV1`: one release to host on the line of its origin and environment. Services
+ * recomputes the build digest from the uploaded bytes and the label from the line, the build and
+ * the configuration; the request states both so a deployer that computed another address is
+ * refused rather than served elsewhere. The secrets are the environment's current values, bound to
+ * the new deployment only.
+ */
+export declare const deploymentRequest: z.ZodObject<{
+    format: z.ZodLiteral<"astrale.services.deployment-request">;
+    version: z.ZodLiteral<1>;
+    organization: z.ZodOptional<z.ZodString>;
+    origin: z.ZodString;
+    environment: z.ZodString;
+    addressing: z.ZodEnum<{
+        opaque: "opaque";
+        readable: "readable";
+    }>;
+    label: z.ZodString;
+    buildDigest: z.ZodString;
+    configuration: z.ZodObject<{
+        format: z.ZodLiteral<"astrale.deployment.configuration">;
+        version: z.ZodLiteral<1>;
+        vars: z.ZodRecord<z.ZodString, z.ZodString>;
+        settings: z.ZodObject<{
+            maximumRequestBytes: z.ZodNumber;
+            invocationTimeoutMs: z.ZodNumber;
+            tokenExchange: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+                maximumLifetimeSeconds: z.ZodNumber;
+            }, z.core.$strict>]>;
+            durableOptions: z.ZodOptional<z.ZodObject<{
+                retentionMs: z.ZodOptional<z.ZodNumber>;
+                retry: z.ZodOptional<z.ZodObject<{
+                    initialIntervalMs: z.ZodOptional<z.ZodNumber>;
+                    maxAttempts: z.ZodOptional<z.ZodNumber>;
+                    maxIntervalMs: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                stepTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        runtime: z.ZodObject<{
+            compatibilityDate: z.ZodString;
+            compatibilityFlags: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        bindings: z.ZodObject<{
+            services: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                service: z.ZodString;
+            }, z.core.$strict>>;
+            dispatchNamespaces: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                namespace: z.ZodString;
+            }, z.core.$strict>>;
+            secrets: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        router: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+            service: z.ZodString;
+            hostSuffix: z.ZodString;
+            minLabels: z.ZodNumber;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>;
+    record: z.ZodObject<{
+        releaseDigest: z.ZodString;
+        schemaRevision: z.ZodString;
+        schemaBundle: z.ZodString;
+        commit: z.ZodNullable<z.ZodObject<{
+            sha: z.ZodString;
+            dirty: z.ZodBoolean;
+            base: z.ZodOptional<z.ZodObject<{
+                version: z.ZodString;
+                distance: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    bundle: z.ZodObject<{
+        entrypoint: z.ZodString;
+        modules: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                data: "data";
+                esm: "esm";
+                text: "text";
+                wasm: "wasm";
+            }>>;
+            content: z.ZodUnion<readonly [z.ZodObject<{
+                encoding: z.ZodEnum<{
+                    gzip: "gzip";
+                    identity: "identity";
+                }>;
+                decodedSize: z.ZodNumber;
+                contentBase64: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                encoding: z.ZodEnum<{
+                    gzip: "gzip";
+                    identity: "identity";
+                }>;
+                decodedSize: z.ZodNumber;
+                contentBase64Chunks: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>, z.ZodObject<{
+            contentBase64: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                data: "data";
+                esm: "esm";
+                text: "text";
+                wasm: "wasm";
+            }>>;
+        }, z.core.$strict>, z.ZodObject<{
+            contentBase64Chunks: z.ZodArray<z.ZodString>;
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                data: "data";
+                esm: "esm";
+                text: "text";
+                wasm: "wasm";
+            }>>;
+        }, z.core.$strict>]>>;
+        assets: z.ZodOptional<z.ZodObject<{
+            files: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                path: z.ZodString;
+                contentType: z.ZodOptional<z.ZodString>;
+                content: z.ZodUnion<readonly [z.ZodObject<{
+                    encoding: z.ZodEnum<{
+                        gzip: "gzip";
+                        identity: "identity";
+                    }>;
+                    decodedSize: z.ZodNumber;
+                    contentBase64: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    encoding: z.ZodEnum<{
+                        gzip: "gzip";
+                        identity: "identity";
+                    }>;
+                    decodedSize: z.ZodNumber;
+                    contentBase64Chunks: z.ZodArray<z.ZodString>;
+                }, z.core.$strict>]>;
+            }, z.core.$strict>, z.ZodObject<{
+                contentBase64: z.ZodString;
+                path: z.ZodString;
+                contentType: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                contentBase64Chunks: z.ZodArray<z.ZodString>;
+                path: z.ZodString;
+                contentType: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>]>>;
+            notFound: z.ZodOptional<z.ZodEnum<{
+                "404-page": "404-page";
+                none: "none";
+                "single-page-application": "single-page-application";
+            }>>;
+            runWorkerFirst: z.ZodOptional<z.ZodBoolean>;
+            htmlHandling: z.ZodOptional<z.ZodLiteral<"none">>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    secrets: z.ZodRecord<z.ZodString, z.ZodString>;
+    readiness: z.ZodOptional<z.ZodObject<{
+        paths: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DeploymentRequest = z.output<typeof deploymentRequest>;

package/dist/schema/modules/deployment/types/deployment-request.js

@@ -0,0 +1,40 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { artifactModule, assetBundle } from '../../service/index.js';
+import { deploymentCommit } from './deployment-record.js';
+import { frozenConfiguration } from './frozen-configuration.js';
+const digest = z.string().check(fullMatch('sha256:[0-9a-f]{64}'));
+/**
+ * `DeploymentRequestV1`: one release to host on the line of its origin and environment. Services
+ * recomputes the build digest from the uploaded bytes and the label from the line, the build and
+ * the configuration; the request states both so a deployer that computed another address is
+ * refused rather than served elsewhere. The secrets are the environment's current values, bound to
+ * the new deployment only.
+ */
+export const deploymentRequest = z.strictObject({
+    format: z.literal('astrale.services.deployment-request'),
+    version: z.literal(1),
+    /** The Identity of the Admin instance the deploy acts for; the exact caller when absent. */
+    organization: z.string().min(1).max(256).optional(),
+    origin: z.string().min(1).max(253),
+    environment: z.string().min(1).max(63),
+    addressing: z.enum(['readable', 'opaque']),
+    label: z.string().min(1).max(63),
+    buildDigest: digest,
+    configuration: frozenConfiguration,
+    record: z.strictObject({
+        releaseDigest: digest,
+        schemaRevision: digest,
+        schemaBundle: digest,
+        commit: deploymentCommit.nullable(),
+    }),
+    bundle: z.strictObject({
+        entrypoint: z.string().min(1).max(256),
+        modules: z.array(artifactModule).min(1).max(40),
+        assets: assetBundle.optional(),
+    }),
+    secrets: z.record(z.string().min(1).max(128), z.string().max(64 * 1024)),
+    readiness: z
+        .strictObject({ paths: z.array(z.string().min(1).max(1_024)).min(1).max(8) })
+        .optional(),
+});

package/dist/schema/modules/deployment/types/deployment-response.d.ts

@@ -0,0 +1,109 @@
+import { z } from 'zod';
+/** Why Services refused to host one release; nothing was changed for a refused request. */
+export declare const deploymentRejectionReason: z.ZodEnum<{
+    "address-mismatch": "address-mismatch";
+    "build-mismatch": "build-mismatch";
+    "deployment-conflict": "deployment-conflict";
+    "deployment-retired": "deployment-retired";
+    "hosting-unavailable": "hosting-unavailable";
+    "invalid-deployment": "invalid-deployment";
+    "line-owned-elsewhere": "line-owned-elsewhere";
+    "service-unavailable": "service-unavailable";
+}>;
+export declare const deploymentRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * `DeploymentResponseV1`. A created deployment binds the request's secrets at its create-only
+ * upload (`bound`); a reused one compares them with its keyed digest (`unchanged`) or rewrites them
+ * in place on that deployment only (`updated`).
+ */
+export declare const deploymentResponse: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"deployed">;
+    state: z.ZodEnum<{
+        created: "created";
+        reused: "reused";
+    }>;
+    secrets: z.ZodObject<{
+        state: z.ZodEnum<{
+            bound: "bound";
+            unchanged: "unchanged";
+            updated: "updated";
+        }>;
+    }, z.core.$strict>;
+    deployment: z.ZodObject<{
+        id: z.ZodString;
+        url: z.ZodString;
+        label: z.ZodString;
+        line: z.ZodString;
+        owner: z.ZodString;
+        state: z.ZodEnum<{
+            active: "active";
+            deploying: "deploying";
+            failed: "failed";
+            retired: "retired";
+            retiring: "retiring";
+        }>;
+        retention: z.ZodEnum<{
+            preview: "preview";
+            published: "published";
+        }>;
+        createdAt: z.ZodString;
+        lastCallAt: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        retiredAt: z.ZodOptional<z.ZodString>;
+        retirement: z.ZodOptional<z.ZodEnum<{
+            expired: "expired";
+            withdrawn: "withdrawn";
+        }>>;
+        signingKeyId: z.ZodString;
+        record: z.ZodObject<{
+            format: z.ZodLiteral<"astrale.deployment-record">;
+            version: z.ZodLiteral<1>;
+            origin: z.ZodString;
+            environment: z.ZodString;
+            releaseDigest: z.ZodString;
+            buildDigest: z.ZodString;
+            schemaRevision: z.ZodString;
+            configuration: z.ZodString;
+            providerScript: z.ZodString;
+            commit: z.ZodNullable<z.ZodObject<{
+                sha: z.ZodString;
+                dirty: z.ZodBoolean;
+                base: z.ZodOptional<z.ZodObject<{
+                    version: z.ZodString;
+                    distance: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type DeploymentRejection = z.output<typeof deploymentRejection>;
+export type DeploymentRejectionReason = z.output<typeof deploymentRejectionReason>;
+export type DeploymentResponse = z.output<typeof deploymentResponse>;

package/dist/schema/modules/deployment/types/deployment-response.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import { deploymentSummary } from './deployment-summary.js';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/** Why Services refused to host one release; nothing was changed for a refused request. */
+export const deploymentRejectionReason = z.enum([
+    'invalid-deployment',
+    'address-mismatch',
+    'build-mismatch',
+    'line-owned-elsewhere',
+    'deployment-conflict',
+    'deployment-retired',
+    'hosting-unavailable',
+    'service-unavailable',
+]);
+export const deploymentRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: deploymentRejectionReason,
+    message: z.string().min(1).max(500),
+    /** When a retry may succeed, for a refusal that only waits on another operation. */
+    retryAfter: instant.optional(),
+});
+/**
+ * `DeploymentResponseV1`. A created deployment binds the request's secrets at its create-only
+ * upload (`bound`); a reused one compares them with its keyed digest (`unchanged`) or rewrites them
+ * in place on that deployment only (`updated`).
+ */
+export const deploymentResponse = z.union([
+    z.strictObject({
+        kind: z.literal('deployed'),
+        state: z.enum(['created', 'reused']),
+        secrets: z.strictObject({ state: z.enum(['bound', 'updated', 'unchanged']) }),
+        deployment: deploymentSummary,
+    }),
+    deploymentRejection,
+]);

package/dist/schema/modules/deployment/types/deployment-retention.d.ts

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+/** A preview expires 30 days after its last call; a published deployment is retained. */
+export declare const deploymentRetention: z.ZodEnum<{
+    preview: "preview";
+    published: "published";
+}>;
+/** Why a deployment left: an expired preview can be revived, a withdrawn one never. */
+export declare const deploymentRetirement: z.ZodEnum<{
+    expired: "expired";
+    withdrawn: "withdrawn";
+}>;
+/**
+ * One deployment label, `<line>-<content16>`, as `deploymentLabel` produces it: lower-case, at
+ * most 57 characters. Handlers admit it again with `parseDeploymentLabel`.
+ */
+export declare const deploymentLabel: z.ZodString;
+/** The most labels one `lastCalls` reads. */
+export declare const MAXIMUM_LAST_CALL_LABELS = 100;
+export declare const lastCallsInput: z.ZodObject<{
+    labels: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** The instant of each label's last call, or null when none was ever recorded. */
+export declare const lastCallsOutput: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>;
+/** The most deployment writes one `expirePreviews` makes; the rest waits for the next pass. */
+export declare const MAXIMUM_PREVIEW_EXPIRY_WRITES = 256;
+export declare const expirePreviewsInput: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+    apply: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/**
+ * One expiry pass. `planned`: previews past their expiry this pass did not retire. `retired`:
+ * previews this pass retired. `pending`: expired previews whose retirement started and waits for
+ * the dispatcher to answer `DEPLOYMENT_RETIRED` everywhere before their script is deleted.
+ */
+export declare const expirePreviewsOutput: z.ZodObject<{
+    planned: z.ZodArray<z.ZodString>;
+    retired: z.ZodArray<z.ZodString>;
+    pending: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const retainInput: z.ZodObject<{
+    label: z.ZodString;
+}, z.core.$strict>;
+/** A retained deployment is published: monotonic, it never becomes a preview again. */
+export declare const retainOutput: z.ZodObject<{
+    retention: z.ZodLiteral<"published">;
+}, z.core.$strict>;
+export type DeploymentRetention = z.output<typeof deploymentRetention>;
+export type DeploymentRetirement = z.output<typeof deploymentRetirement>;
+export type ExpirePreviewsResult = z.output<typeof expirePreviewsOutput>;

package/dist/schema/modules/deployment/types/deployment-retention.js

@@ -0,0 +1,45 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+/** A preview expires 30 days after its last call; a published deployment is retained. */
+export const deploymentRetention = z.enum(['preview', 'published']);
+/** Why a deployment left: an expired preview can be revived, a withdrawn one never. */
+export const deploymentRetirement = z.enum(['expired', 'withdrawn']);
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/**
+ * One deployment label, `<line>-<content16>`, as `deploymentLabel` produces it: lower-case, at
+ * most 57 characters. Handlers admit it again with `parseDeploymentLabel`.
+ */
+export const deploymentLabel = z
+    .string()
+    .min(33)
+    .max(57)
+    .check(fullMatch('([a-z0-9]+(-[a-z0-9]+)*-)?[a-z2-7]{16}-[a-z2-7]{16}'));
+/** The most labels one `lastCalls` reads. */
+export const MAXIMUM_LAST_CALL_LABELS = 100;
+export const lastCallsInput = z.strictObject({
+    labels: z.array(deploymentLabel).min(1).max(MAXIMUM_LAST_CALL_LABELS),
+});
+/** The instant of each label's last call, or null when none was ever recorded. */
+export const lastCallsOutput = z.record(z.string(), instant.nullable());
+/** The most deployment writes one `expirePreviews` makes; the rest waits for the next pass. */
+export const MAXIMUM_PREVIEW_EXPIRY_WRITES = 256;
+export const expirePreviewsInput = z.strictObject({
+    /** Deployment writes this pass may make, retirements first; 64 when absent. */
+    limit: z.number().int().min(1).max(MAXIMUM_PREVIEW_EXPIRY_WRITES).optional(),
+    /** Retire what the plan lists; honoured only where `SERVICES_PREVIEW_EXPIRY` is `enforce`. */
+    apply: z.boolean().optional(),
+});
+/**
+ * One expiry pass. `planned`: previews past their expiry this pass did not retire. `retired`:
+ * previews this pass retired. `pending`: expired previews whose retirement started and waits for
+ * the dispatcher to answer `DEPLOYMENT_RETIRED` everywhere before their script is deleted.
+ */
+export const expirePreviewsOutput = z.strictObject({
+    planned: z.array(z.string()),
+    retired: z.array(z.string()),
+    pending: z.array(z.string()),
+});
+export const retainInput = z.strictObject({ label: deploymentLabel });
+/** A retained deployment is published: monotonic, it never becomes a preview again. */
+export const retainOutput = z.strictObject({ retention: z.literal('published') });

package/dist/schema/modules/deployment/types/deployment-retire.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const retireDeploymentInput: z.ZodObject<{}, z.core.$strict>;
+/**
+ * Retiring a deployment is an emergency stop, in two phases. The first records the retirement and
+ * writes its tombstone: from then on the dispatcher answers `DEPLOYMENT_RETIRED`, and the answer is
+ * `retiring` with the delay after which a retry may finish. The second, once the dispatcher answers
+ * it everywhere, deletes the script and with it the deployment's key: the answer is `retired`. A
+ * withdrawn deployment is never served again, even by a redeploy of the same release.
+ */
+export declare const retireDeploymentOutput: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"retired">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"retiring">;
+    retryAfterMs: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type RetireDeploymentResult = z.output<typeof retireDeploymentOutput>;

package/dist/schema/modules/deployment/types/deployment-retire.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { deploymentRejection } from './deployment-response.js';
+export const retireDeploymentInput = z.strictObject({});
+/**
+ * Retiring a deployment is an emergency stop, in two phases. The first records the retirement and
+ * writes its tombstone: from then on the dispatcher answers `DEPLOYMENT_RETIRED`, and the answer is
+ * `retiring` with the delay after which a retry may finish. The second, once the dispatcher answers
+ * it everywhere, deletes the script and with it the deployment's key: the answer is `retired`. A
+ * withdrawn deployment is never served again, even by a redeploy of the same release.
+ */
+export const retireDeploymentOutput = z.union([
+    z.strictObject({ kind: z.literal('retired') }),
+    z.strictObject({
+        kind: z.literal('retiring'),
+        retryAfterMs: z.number().int().min(0).max(3_600_000),
+    }),
+    deploymentRejection,
+]);

package/dist/schema/modules/deployment/types/deployment-secret-digest.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export declare const deploymentSecretDigest: z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>;
+/** One digest per bound secret name, sorted by name. */
+export declare const deploymentSecretDigests: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>>;
+export type DeploymentSecretDigest = z.output<typeof deploymentSecretDigest>;

package/dist/schema/modules/deployment/types/deployment-secret-digest.js

@@ -0,0 +1,14 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export const deploymentSecretDigest = z.strictObject({
+    name: z.string().min(1).max(128),
+    digest: z.string().check(fullMatch('hmac-sha256:[0-9a-f]{64}')),
+});
+/** One digest per bound secret name, sorted by name. */
+export const deploymentSecretDigests = z.array(deploymentSecretDigest).max(64);

package/dist/schema/modules/deployment/types/deployment-secret.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export declare const deploymentSecretRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "secret-undeclared": "secret-undeclared";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export declare const setDeploymentSecretContract: {
+    readonly description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"rejected">;
+        reason: z.ZodEnum<{
+            "secret-undeclared": "secret-undeclared";
+            "service-unavailable": "service-unavailable";
+        }>;
+        message: z.ZodString;
+        retryAfter: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export declare const listDeploymentSecretNamesContract: {
+    readonly description: 'List the names of the secrets this deployment binds, without their values.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{}, z.core.$strict>;
+    readonly output: z.ZodArray<z.ZodString>;
+};
+export type DeploymentSecretRejection = z.output<typeof deploymentSecretRejection>;

package/dist/schema/modules/deployment/types/deployment-secret.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/** A secret name as a deployment's frozen configuration declares it. */
+const secretName = z.string().min(1).max(128);
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export const deploymentSecretRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: z.enum(['secret-undeclared', 'service-unavailable']),
+    message: z.string().min(1).max(500),
+    retryAfter: instant.optional(),
+});
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export const setDeploymentSecretContract = {
+    description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.',
+    auth: 'authenticated',
+    input: z.strictObject({
+        name: secretName,
+        value: z
+            .string()
+            .min(1)
+            .max(64 * 1024),
+    }),
+    output: z.union([z.strictObject({ name: secretName }), deploymentSecretRejection]),
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export const listDeploymentSecretNamesContract = {
+    description: 'List the names of the secrets this deployment binds, without their values.',
+    auth: 'authenticated',
+    input: z.strictObject({}),
+    output: z.array(secretName),
+};