@astrale-domains/services 0.4.6 → 0.4.7

package/README.md

@@ -46,6 +46,154 @@ protocols behind neutral SDK Integrations and stores only admitted lifecycle evi
   never by its author, so Services refuses it as a caller variable or secret on every deployment
   path and in secret management.
 
+## Immutable deployments
+
+The Admin-hosted Services runtime hosts publishers' releases as immutable deployments, one per
+label, on the publisher's line. Three static `CloudflareDeployment` Methods serve them, and two
+instance Methods rotate one deployment's secrets; any authenticated identity of the Admin instance
+may call them. A Domain Worker serves every Kernel that
+installs it, but deployments are hosted for the Admin instance's Kernel alone
+(`SERVICES_DEPLOYMENT_KERNEL`): its graph is the line registry, while the deployments namespace and
+the routing KV are shared. Any other Kernel finds hosting unavailable before anything is read.
+
+- `deploy` takes a `DeploymentRequestV1`: the release's origin, environment, addressing, label,
+  build digest, frozen configuration, record fields, Worker bundle and the environment's current
+  secrets. It is a non-durable Action, never a Workflow, so no Execution, step result or journal
+  entry holds its input. Before any read it recomputes the build digest and the label, admits the
+  record with the SDK, and refuses a service binding, a router other than the logical
+  `admin-router`, a reserved binding name, or secrets other than exactly the declared ones. Only
+  the platform organisation (`SERVICES_PLATFORM_OWNER`) deploys on readable lines.
+- `deploy` then observes the line under the Services Domain credential and proves, on the caller's
+  own session, that the caller acts for the organisation it names (`OwnLine` on a held line,
+  `ActForOrganization` for a new one) before any Mutation. A new label is created under a graph
+  lease. The provider uploads it create-only, with `ASTRALE_BUILD_DIGEST`, `ASTRALE_SETTINGS` (router
+  binding `ROUTER`), a signing key Services generates for this deployment alone, and the request's
+  secrets. It adopts a script only when resuming a deployment the graph already held from an earlier
+  attempt, and only when the script's tags name the same artifact, line and key and this Kernel's
+  installation; any other script under the label is another deployment's, refused
+  `deployment-conflict`, and its secrets are never written. It checks that the uploaded version
+  itself serves before it activates the label through the routing KV `record:<label>`. The graph then records the deployment active with its key id, script etag and
+  a keyed HMAC-SHA256 digest of its secrets; no value, private key or version id is stored.
+- the same release again is the same label: `deploy` answers `reused`. Its secrets are the
+  environment's current values: when they match the recorded digests it answers `unchanged` and
+  writes nothing; otherwise it rewrites the changed values in place on that deployment alone and
+  answers `updated` (same script, URL, issuer and key, no new release). Every other deployment of
+  the line keeps its own secrets.
+- `setSecret({ name, value })` and `secrets({})` are instance Methods of one `CloudflareDeployment`.
+  `setSecret` rewrites one secret in place on that deployment only, and only a name its frozen
+  configuration declares (`secret-undeclared` otherwise); there is no `deleteSecret`, since a bound
+  name is part of the release, and the signing key never rotates. `secrets` lists the names its
+  script binds, never a value. Like `deploy`, any authenticated identity may call them, because a
+  publisher holds no `can_use` on Services' Functions and an `authorized` Method requires it of
+  every non-Root caller: before anything is read, the Kernel answers `OwnDeployment` for the caller
+  on its own session, and any other caller finds no such deployment (`DEPLOYMENT_NOT_FOUND`). If the
+  Admin instance ever grants publishers `can_use` on these Methods, they become `authorized` with
+  the `OwnDeployment` Policy instead. Both are non-durable Actions, so no Execution, step result or
+  journal entry holds a value.
+- a `setSecret` refusal is `{ kind: 'rejected', reason, message, retryAfter? }`.
+  `service-unavailable` with `retryAfter` (the deployment is being created, another operation
+  holds it, or the provider failed) is retried then; without `retryAfter` the deployment cannot be
+  rotated in place (its creation failed, it is retiring or retired, or the script under its label is
+  not the recorded one, which is the operator's to inspect), and the message says what can.
+- an in-place rewrite, by `deploy` or `setSecret`, runs under the deployment's graph lease. It
+  compares the values with the keyed digests and writes only the changed ones; it first forgets the
+  digests of the names it writes and records the new digests only once every write succeeded, so a
+  recorded digest always names the value last written. A provider failure answers
+  `service-unavailable` with `retryAfter`, and a rerun, with any values, converges. The script is
+  first checked to be the recorded one (code hash, artifact tag, key tag, installation tag); a
+  rewrite never touches another script. Workers for Platforms keeps the script's name, code hash,
+  tags and bindings across a secret write and mints a new provider version, which serves the new
+  value a few seconds later (OPS-2 X1): propagation is eventually consistent, and nothing records a
+  version id.
+- `hosting` returns the routing domain and how the caller's lines read (readable for the platform
+  organisation, opaque otherwise). `list` returns the deployments of the lines the caller holds. It
+  reads the held lines under the Services Domain credential, narrowed in the Query to the origin
+  and environment asked for, and keeps the lines a batched `Identity.can(OwnLine)` grants the
+  caller: a caller-mode read sees none of the lines a caller holds through `extends_with`
+  ([kernel#1138](https://github.com/astrale-os/kernel/issues/1138), the removal trigger of this
+  filter). One listing reads at most 16,384 matching held lines and fails beyond, so a listing
+  without an origin is bounded by the platform's held lines. A deployment whose stored record or
+  configuration this Services SDK no longer admits, for instance after a stricter decoder, is
+  still listed, from the facts Services owns, with its record exactly as stored (typed as JSON for
+  that row): the listing never fails on it, and the consumer admits the record itself. Deploy,
+  retain, retire, `setSecret`, `secrets` and `expirePreviews` fail closed on such a deployment
+  with an undeclared internal error (5000) and write nothing; `lastCalls` answers from its facts.
+- deleting a Service, or an instance and its Services, never addresses a publisher's deployment.
+
+Only a runtime whose Environment vars set `SERVICES_DEPLOYMENT_HOST` (the deployments' routing
+domain) hosts deployments; every other runtime answers `hosting-unavailable`. Such a runtime refuses
+to boot without `SERVICES_DEPLOYMENT_KERNEL` (the Admin Kernel's issuer URL),
+`SERVICES_SECRET_DIGEST_KEY` (at least 32 characters, kept for the life of the environment: the
+recorded digests depend on it), the `SERVICE_DEPLOYMENTS` dispatch binding to the environment's
+deployments namespace, and `CLOUDFLARE_SCHEDULE_KV_ID`, the routing KV that activates a label, and
+refuses a `SERVICES_PLATFORM_OWNER` that is not an Identity id. Hosting is declared once, by the
+Environment's `vars` in `astrale.config.ts`: the same vars decide the `SERVICE_DEPLOYMENTS` binding,
+and the configuration refuses a secrets file that sets a hosting var. [Real-Kernel
+proof](tests/kernel/README.md).
+
+### Retention and retirement
+
+A deployment is a `preview` until the registry Domain marks it `published`; only a preview expires.
+Four more `CloudflareDeployment` Methods manage what stays served. Retirement, retention and
+revival name a deployment by its label, script etag, artifact tag and configuration digest, never
+by a provider version id.
+
+- `retire` is the instance Method of the line holder's emergency stop. Any authenticated identity
+  may call it, because a publisher holds no `can_use` on Services' Functions and an `authorized`
+  Method requires it of every non-Root caller: before anything is read, the Kernel answers
+  `OwnDeployment` for the caller on its own session, and any other caller finds no such deployment
+  (`DEPLOYMENT_NOT_FOUND`). If the Admin instance ever grants publishers `can_use` on it, it becomes
+  `authorized` with the `OwnDeployment` Policy instead. It withdraws the deployment for good in two
+  phases. The graph records it `retiring` first, so no deploy reuses it; the same Mutation evicts
+  the operation lease of any operation writing the script, such as an in-place rewrite of its
+  secrets, which then records nothing. Then the routing KV gets the tombstone
+  `retirement:<label>` = `withdrawn`. The dispatcher
+  answers a label with a tombstone `DEPLOYMENT_RETIRED` (`410`) and keeps serving its
+  `deployment.json` from `record:<label>`, which stays. The first call answers `retiring` with
+  `retryAfterMs`. A call 65 seconds after the tombstone, once the dispatcher's retirement probe
+  answers `DEPLOYMENT_RETIRED`, deletes the script and its signing key and answers `retired`. A
+  withdrawn label is never served again: deploying the same release is refused
+  `deployment-retired`.
+- `retain` marks one preview `published`. Only the registry Domain's principal calls it, acting as
+  itself; it is the installed, unfrozen Domain whose origin is `SERVICES_REGISTRY_ORIGIN`. Services
+  reads the caller's Domain node by id under its own credential, which is why it requires read on
+  the Kernel's `Domain` Class; nothing the caller presents decides it. An authenticated caller
+  carries Identity ids but no Domain origin, and read on `Identity` does not reach a Domain's node.
+  Every instance that installs this Services version grants that read, so Services can read the
+  origin and frozen flag of each Domain installed there; only the Admin instance's hosting runtime
+  uses it. The requirement goes once the Kernel gives a handler its caller's Domain origin. A line
+  holder, or an identity acting for the registry, is refused `DEPLOYMENT_REGISTRY_ONLY`. The mark
+  is monotonic and idempotent, and it never undoes a retirement in progress: a preview marked after
+  its expiry started still retires, and a redeploy of the same release revives it.
+- `lastCalls` returns the last call of up to 100 labels the caller holds (as the Kernel answers
+  `OwnDeployment` on the caller's session), or any labels for the registry; an unknown label and
+  another organisation's both answer `DEPLOYMENT_LABEL_NOT_FOUND`. It reads the data points the dispatcher writes per admitted call, through the Analytics
+  Engine SQL API, and the last call recorded in the graph. A label nobody called reads `null`. It
+  reads only the facts Services recorded, so it answers for a listed deployment whose stored
+  record this SDK no longer admits.
+- `expirePreviews` is the registry's pass. A preview expires 30 days after its activation (its
+  creation, or its revival) or its last call, whichever is later; every activation records its
+  instant, and a pass refuses an active preview without one rather than expire it on its creation. The pass is a plan unless the runtime sets
+  `SERVICES_PREVIEW_EXPIRY=enforce` and the caller passes `apply: true`: it answers the `planned`
+  labels and retires none. Applied, it retires them in two phases with the tombstone `expired` and
+  answers `retired` and `pending` labels; the next pass completes the pending ones. Either way it
+  records later calls, so each preview's `expiresAt` follows its traffic. `limit` bounds the
+  deployment writes of one pass (64 by default), and retirements come first.
+
+An expired label revives. When the same owner deploys the same release (same label, so same
+artifact and configuration) again, the deployment resumes from `retired`. It is uploaded
+create-only with a new signing key, and the activation republishes the same `record:<label>`
+before it removes the `expired` tombstone. An instance that pins the label is served the same
+release digest at the same URL. A `withdrawn` tombstone is never removed.
+
+`SERVICES_REGISTRY_ORIGIN` and `SERVICES_PREVIEW_EXPIRY` (`plan`, the default, or `enforce`) are
+Environment vars of a hosting runtime, refused in a secrets file and refused without
+`SERVICES_DEPLOYMENT_HOST`. Without a registry origin no caller is the registry, and `retain` and
+`expirePreviews` are refused. `admin-beta` names `admin.astrale.ai` and keeps expiry a plan.
+Reading last calls needs the API token's Account Analytics Read permission. `pnpm
+provider:deployment-audit` lists the deployments namespace read-only
+([operator](providers/cloudflare/operator/README.md)).
+
 The View, CLI, and agent consumers read the named Service Queries directly; there is intentionally
 no list Function wrapping `listServicesQuery`. Deployment, secrets, schedules, logs, and deletion
 are Workflows because they coordinate admitted caller intent with external effects. Receiver Methods
@@ -114,11 +262,17 @@ publishers' deployments outside the instances that install them. It is a Worker
 `services-domain-admin-beta` at `https://services-admin.beta.astrale.ai`, on the beta data plane the
 Admin instance's Services already manage. Its plain vars name the router Worker
 (`ASTRALE_ROUTER_WORKER`), the routing domain under which deployments are addressed
-(`SERVICES_DEPLOYMENT_HOST`, served by the Services dispatcher) and the registry Domain
-(`SERVICES_REGISTRY_ORIGIN`). `.env.admin-beta` must set `SERVICES_SECRET_DIGEST_KEY`, the key of
-each hosted deployment's secret digest. The runtime keys HMAC-SHA256 with the UTF-8 bytes of the value
-as written, never base64-decoded, so the configuration refuses, before any deployment effect, a file
-without it or with a value shorter than 32 UTF-8 bytes.
+(`SERVICES_DEPLOYMENT_HOST`, served by the Services dispatcher), the Admin instance's Kernel, the
+only one it hosts deployments for (`SERVICES_DEPLOYMENT_KERNEL`, `https://admin.eu.beta.astrale.ai/api`),
+and the registry Domain (`SERVICES_REGISTRY_ORIGIN`). These vars are the only declaration of
+hosting: they also bind `SERVICE_DEPLOYMENTS`. `.env.admin-beta` must set
+`SERVICES_SECRET_DIGEST_KEY`, the key of each hosted deployment's secret digest, and the dispatch
+namespace and routing KV the runtime boots with. The runtime keys HMAC-SHA256 with the UTF-8 bytes
+of the digest key as written, never base64-decoded, so the configuration refuses, before any
+deployment effect, a file without them, a digest key shorter than 32 UTF-8 bytes, or a file that
+sets a hosting var. `SERVICES_PLATFORM_OWNER` is not set yet: until it names the platform
+organisation's Identity id on the Admin instance, every line is opaque and a readable deploy is
+refused.
 
 It retains the issuer `https://services.beta.astrale.ai` and its signing key, as services-v2 does.
 The Admin instance's Services are bound to that issuer, and the Kernel refuses an issuer change when
@@ -137,7 +291,10 @@ The operator sets it up once:
    `publication.identity.issuer`, and the frozen runtime whose `/.well-known/astrale/domain.json`
    declares that revision: it is the rollback URL. Go on only if the issuer is
    `https://services.beta.astrale.ai`; any other issuer makes step 6 an issuer change, which the
-   Kernel refuses.
+   Kernel refuses. Check as well that the Admin instance's Kernel issuer is admin-beta's
+   `SERVICES_DEPLOYMENT_KERNEL`; otherwise every deploy answers `hosting-unavailable`. Before the
+   first readable deploy, read the platform organisation's Identity id there and set it as
+   admin-beta's `SERVICES_PLATFORM_OWNER` var in a reviewed change to `astrale.config.ts`.
 2. Create `.env.admin-beta` (mode 600) from `.env.example` with the beta data-plane coordinates the
    Admin instance's Services manage today (account, token, dispatch namespace, routing domain
    `svc.eu.beta.astrale.ai`, schedule KV, dispatcher, zone, Admin target) and a new

package/dist/schema/index.d.ts

@@ -3,5 +3,5 @@ export type { ServicesDomain, ServicesSchema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
-export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
-export type { DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRetention, DeploymentRetirement, } from './modules/deployment/index.js';
+export { ActForOrganization, CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentHosting, deploymentLabel, deploymentLifecycle, deploymentRecord, deploymentRejection, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, deployment_on_line, expirePreviewsOutput, frozenConfiguration, lastCallsOutput, listedDeploymentSummary, line_owned_by, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retireDeploymentOutput, unadmittedDeploymentSummary, } from './modules/deployment/index.js';
+export type { DeploymentHosting, DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRejection, DeploymentRejectionReason, DeploymentRequest, DeploymentResponse, DeploymentRetention, DeploymentRetirement, DeploymentSecretDigest, DeploymentSecretRejection, DeploymentSummary, ExpirePreviewsResult, FrozenConfiguration, ListedDeploymentSummary, RetireDeploymentResult, UnadmittedDeploymentSummary, } from './modules/deployment/index.js';

package/dist/schema/index.js

@@ -1,4 +1,4 @@
 export { schema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
-export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
+export { ActForOrganization, CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentHosting, deploymentLabel, deploymentLifecycle, deploymentRecord, deploymentRejection, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, deployment_on_line, expirePreviewsOutput, frozenConfiguration, lastCallsOutput, listedDeploymentSummary, line_owned_by, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retireDeploymentOutput, unadmittedDeploymentSummary, } from './modules/deployment/index.js';

package/dist/schema/modules/deployment/classes/cloudflare-deployment.d.ts

@@ -25,6 +25,7 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                 };
                 readonly failed: {
                     readonly retry: "deploying";
+                    readonly retire: "retiring";
                 };
             }, "deploying">, {
                 required?: boolean;
@@ -53,9 +54,65 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                     }, import("zod/v4/core").$strict>>;
                 }, import("zod/v4/core").$strict>>;
             }, import("zod/v4/core").$strict>;
+            configuration: import("zod").ZodObject<{
+                format: import("zod").ZodLiteral<"astrale.deployment.configuration">;
+                version: import("zod").ZodLiteral<1>;
+                vars: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;
+                settings: import("zod").ZodObject<{
+                    maximumRequestBytes: import("zod").ZodNumber;
+                    invocationTimeoutMs: import("zod").ZodNumber;
+                    tokenExchange: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<false>, import("zod").ZodObject<{
+                        maximumLifetimeSeconds: import("zod").ZodNumber;
+                    }, import("zod/v4/core").$strict>]>;
+                    durableOptions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        retentionMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                        retry: import("zod").ZodOptional<import("zod").ZodObject<{
+                            initialIntervalMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                            maxAttempts: import("zod").ZodOptional<import("zod").ZodNumber>;
+                            maxIntervalMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                        }, import("zod/v4/core").$strict>>;
+                        stepTimeoutMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    }, import("zod/v4/core").$strict>>;
+                }, import("zod/v4/core").$strict>;
+                runtime: import("zod").ZodObject<{
+                    compatibilityDate: import("zod").ZodString;
+                    compatibilityFlags: import("zod").ZodArray<import("zod").ZodString>;
+                }, import("zod/v4/core").$strict>;
+                bindings: import("zod").ZodObject<{
+                    services: import("zod").ZodArray<import("zod").ZodObject<{
+                        name: import("zod").ZodString;
+                        service: import("zod").ZodString;
+                    }, import("zod/v4/core").$strict>>;
+                    dispatchNamespaces: import("zod").ZodArray<import("zod").ZodObject<{
+                        name: import("zod").ZodString;
+                        namespace: import("zod").ZodString;
+                    }, import("zod/v4/core").$strict>>;
+                    secrets: import("zod").ZodArray<import("zod").ZodString>;
+                }, import("zod/v4/core").$strict>;
+                router: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<false>, import("zod").ZodObject<{
+                    service: import("zod").ZodString;
+                    hostSuffix: import("zod").ZodString;
+                    minLabels: import("zod").ZodNumber;
+                }, import("zod/v4/core").$strict>]>;
+            }, import("zod/v4/core").$strict>;
+            secretDigests: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodArray<import("zod").ZodObject<{
+                name: import("zod").ZodString;
+                digest: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>>, {
+                readonly required: false;
+            }>;
+            scriptEtag: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
             signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                 readonly required: false;
             }>;
+            activatedAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
             lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
                 readonly type: 'string';
                 readonly 'x-astrale-value-kind': 'instant';
@@ -90,7 +147,316 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                 readonly required: false;
             }>;
         };
+        readonly methods: {
+            setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name: string;
+                value: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    name: string;
+                } | {
+                    kind: "rejected";
+                    reason: "secret-undeclared" | "service-unavailable";
+                    message: string;
+                    retryAfter?: string | undefined;
+                };
+            }, "authenticated", false, true, undefined>>;
+            secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: string[];
+            }, "authenticated", false, true, undefined>>;
+        };
     }>];
+    readonly methods: {
+        deploy: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            format: "astrale.services.deployment-request";
+            version: 1;
+            organization?: string | undefined;
+            origin: string;
+            environment: string;
+            addressing: "opaque" | "readable";
+            label: string;
+            buildDigest: string;
+            configuration: {
+                format: "astrale.deployment.configuration";
+                version: 1;
+                vars: Record<string, string>;
+                settings: {
+                    maximumRequestBytes: number;
+                    invocationTimeoutMs: number;
+                    tokenExchange: false | {
+                        maximumLifetimeSeconds: number;
+                    };
+                    durableOptions?: {
+                        retentionMs?: number | undefined;
+                        retry?: {
+                            initialIntervalMs?: number | undefined;
+                            maxAttempts?: number | undefined;
+                            maxIntervalMs?: number | undefined;
+                        } | undefined;
+                        stepTimeoutMs?: number | undefined;
+                    } | undefined;
+                };
+                runtime: {
+                    compatibilityDate: string;
+                    compatibilityFlags: string[];
+                };
+                bindings: {
+                    services: {
+                        name: string;
+                        service: string;
+                    }[];
+                    dispatchNamespaces: {
+                        name: string;
+                        namespace: string;
+                    }[];
+                    secrets: string[];
+                };
+                router: false | {
+                    service: string;
+                    hostSuffix: string;
+                    minLabels: number;
+                };
+            };
+            record: {
+                releaseDigest: string;
+                schemaRevision: string;
+                schemaBundle: string;
+                commit: {
+                    sha: string;
+                    dirty: boolean;
+                    base?: {
+                        version: string;
+                        distance: number;
+                    } | undefined;
+                } | null;
+            };
+            bundle: {
+                entrypoint: string;
+                modules: ({
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                    content: {
+                        encoding: "gzip" | "identity";
+                        decodedSize: number;
+                        contentBase64: string;
+                    } | {
+                        encoding: "gzip" | "identity";
+                        decodedSize: number;
+                        contentBase64Chunks: string[];
+                    };
+                } | {
+                    contentBase64: string;
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                } | {
+                    contentBase64Chunks: string[];
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                })[];
+                assets?: {
+                    files: ({
+                        path: string;
+                        contentType?: string | undefined;
+                        content: {
+                            encoding: "gzip" | "identity";
+                            decodedSize: number;
+                            contentBase64: string;
+                        } | {
+                            encoding: "gzip" | "identity";
+                            decodedSize: number;
+                            contentBase64Chunks: string[];
+                        };
+                    } | {
+                        contentBase64: string;
+                        path: string;
+                        contentType?: string | undefined;
+                    } | {
+                        contentBase64Chunks: string[];
+                        path: string;
+                        contentType?: string | undefined;
+                    })[];
+                    notFound?: "404-page" | "none" | "single-page-application" | undefined;
+                    runWorkerFirst?: boolean | undefined;
+                    htmlHandling?: "none" | undefined;
+                } | undefined;
+            };
+            secrets: Record<string, string>;
+            readiness?: {
+                paths: string[];
+            } | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                kind: "rejected";
+                reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            } | {
+                kind: "deployed";
+                state: "created" | "reused";
+                secrets: {
+                    state: "bound" | "unchanged" | "updated";
+                };
+                deployment: {
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: {
+                        format: "astrale.deployment-record";
+                        version: 1;
+                        origin: string;
+                        environment: string;
+                        releaseDigest: string;
+                        buildDigest: string;
+                        schemaRevision: string;
+                        configuration: string;
+                        providerScript: string;
+                        commit: {
+                            sha: string;
+                            dirty: boolean;
+                            base?: {
+                                version: string;
+                                distance: number;
+                            } | undefined;
+                        } | null;
+                    };
+                };
+            };
+        }, "authenticated", true, false, undefined>>;
+        hosting: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                routingDomain: string;
+                addressing: "opaque" | "readable";
+            };
+        }, "authenticated", true, false, undefined>>;
+        list: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            origin?: string | undefined;
+            environment?: string | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                deployments: ({
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: {
+                        format: "astrale.deployment-record";
+                        version: 1;
+                        origin: string;
+                        environment: string;
+                        releaseDigest: string;
+                        buildDigest: string;
+                        schemaRevision: string;
+                        configuration: string;
+                        providerScript: string;
+                        commit: {
+                            sha: string;
+                            dirty: boolean;
+                            base?: {
+                                version: string;
+                                distance: number;
+                            } | undefined;
+                        } | null;
+                    };
+                } | {
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: unknown;
+                })[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            name: string;
+            value: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                name: string;
+            } | {
+                kind: "rejected";
+                reason: "secret-undeclared" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            };
+        }, "authenticated", false, false, undefined>>;
+        secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: string[];
+        }, "authenticated", false, false, undefined>>;
+        lastCalls: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            labels: string[];
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, string | null>;
+        }, "authenticated", true, false, undefined>>;
+        expirePreviews: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            limit?: number | undefined;
+            apply?: boolean | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                planned: string[];
+                retired: string[];
+                pending: string[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        retain: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            label: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                retention: "published";
+            };
+        }, "authenticated", true, false, undefined>>;
+        retire: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                kind: "retired";
+            } | {
+                kind: "retiring";
+                retryAfterMs: number;
+            } | {
+                kind: "rejected";
+                reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            };
+        }, "authenticated", false, false, undefined>>;
+    };
     readonly policies: {
         read: () => import("@astrale-os/sdk/schema").Policy;
     };

package/dist/schema/modules/deployment/classes/cloudflare-deployment.js

@@ -1,10 +1,30 @@
 import { classIcon, nodeClass } from '@astrale-os/sdk/schema';
 import { CloudUpload } from '@astrale-os/sdk/schema/icons';
+import { deployCloudflareDeployment } from '../functions/deploy-cloudflare-deployment.js';
+import { describeDeploymentHosting } from '../functions/describe-deployment-hosting.js';
+import { expireDeploymentPreviews } from '../functions/expire-deployment-previews.js';
+import { listCloudflareDeploymentSecretNames } from '../functions/list-cloudflare-deployment-secret-names.js';
+import { listCloudflareDeployments } from '../functions/list-cloudflare-deployments.js';
+import { readDeploymentLastCalls } from '../functions/read-deployment-last-calls.js';
+import { retainDeployment } from '../functions/retain-deployment.js';
+import { retireDeployment } from '../functions/retire-deployment.js';
+import { setCloudflareDeploymentSecret } from '../functions/set-cloudflare-deployment-secret.js';
 import { OwnDeployment } from '../policies/own-deployment.js';
 import { Deployment } from './deployment.js';
 export const CloudflareDeployment = nodeClass({
     description: 'One Deployment uploaded as the Workers for Platforms script its label names.',
     icon: classIcon.lucide(CloudUpload),
     extends: [Deployment],
+    methods: {
+        deploy: deployCloudflareDeployment,
+        hosting: describeDeploymentHosting,
+        list: listCloudflareDeployments,
+        setSecret: setCloudflareDeploymentSecret,
+        secrets: listCloudflareDeploymentSecretNames,
+        lastCalls: readDeploymentLastCalls,
+        expirePreviews: expireDeploymentPreviews,
+        retain: retainDeployment,
+        retire: retireDeployment,
+    },
     policies: { read: () => OwnDeployment },
 });