@astrale-domains/services 0.4.6 → 0.4.7

package/dist/schema/modules/deployment/types/deployment-response.d.ts

@@ -0,0 +1,109 @@
+import { z } from 'zod';
+/** Why Services refused to host one release; nothing was changed for a refused request. */
+export declare const deploymentRejectionReason: z.ZodEnum<{
+    "address-mismatch": "address-mismatch";
+    "build-mismatch": "build-mismatch";
+    "deployment-conflict": "deployment-conflict";
+    "deployment-retired": "deployment-retired";
+    "hosting-unavailable": "hosting-unavailable";
+    "invalid-deployment": "invalid-deployment";
+    "line-owned-elsewhere": "line-owned-elsewhere";
+    "service-unavailable": "service-unavailable";
+}>;
+export declare const deploymentRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * `DeploymentResponseV1`. A created deployment binds the request's secrets at its create-only
+ * upload (`bound`); a reused one compares them with its keyed digest (`unchanged`) or rewrites them
+ * in place on that deployment only (`updated`).
+ */
+export declare const deploymentResponse: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"deployed">;
+    state: z.ZodEnum<{
+        created: "created";
+        reused: "reused";
+    }>;
+    secrets: z.ZodObject<{
+        state: z.ZodEnum<{
+            bound: "bound";
+            unchanged: "unchanged";
+            updated: "updated";
+        }>;
+    }, z.core.$strict>;
+    deployment: z.ZodObject<{
+        id: z.ZodString;
+        url: z.ZodString;
+        label: z.ZodString;
+        line: z.ZodString;
+        owner: z.ZodString;
+        state: z.ZodEnum<{
+            active: "active";
+            deploying: "deploying";
+            failed: "failed";
+            retired: "retired";
+            retiring: "retiring";
+        }>;
+        retention: z.ZodEnum<{
+            preview: "preview";
+            published: "published";
+        }>;
+        createdAt: z.ZodString;
+        lastCallAt: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        retiredAt: z.ZodOptional<z.ZodString>;
+        retirement: z.ZodOptional<z.ZodEnum<{
+            expired: "expired";
+            withdrawn: "withdrawn";
+        }>>;
+        signingKeyId: z.ZodString;
+        record: z.ZodObject<{
+            format: z.ZodLiteral<"astrale.deployment-record">;
+            version: z.ZodLiteral<1>;
+            origin: z.ZodString;
+            environment: z.ZodString;
+            releaseDigest: z.ZodString;
+            buildDigest: z.ZodString;
+            schemaRevision: z.ZodString;
+            configuration: z.ZodString;
+            providerScript: z.ZodString;
+            commit: z.ZodNullable<z.ZodObject<{
+                sha: z.ZodString;
+                dirty: z.ZodBoolean;
+                base: z.ZodOptional<z.ZodObject<{
+                    version: z.ZodString;
+                    distance: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type DeploymentRejection = z.output<typeof deploymentRejection>;
+export type DeploymentRejectionReason = z.output<typeof deploymentRejectionReason>;
+export type DeploymentResponse = z.output<typeof deploymentResponse>;

package/dist/schema/modules/deployment/types/deployment-response.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import { deploymentSummary } from './deployment-summary.js';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/** Why Services refused to host one release; nothing was changed for a refused request. */
+export const deploymentRejectionReason = z.enum([
+    'invalid-deployment',
+    'address-mismatch',
+    'build-mismatch',
+    'line-owned-elsewhere',
+    'deployment-conflict',
+    'deployment-retired',
+    'hosting-unavailable',
+    'service-unavailable',
+]);
+export const deploymentRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: deploymentRejectionReason,
+    message: z.string().min(1).max(500),
+    /** When a retry may succeed, for a refusal that only waits on another operation. */
+    retryAfter: instant.optional(),
+});
+/**
+ * `DeploymentResponseV1`. A created deployment binds the request's secrets at its create-only
+ * upload (`bound`); a reused one compares them with its keyed digest (`unchanged`) or rewrites them
+ * in place on that deployment only (`updated`).
+ */
+export const deploymentResponse = z.union([
+    z.strictObject({
+        kind: z.literal('deployed'),
+        state: z.enum(['created', 'reused']),
+        secrets: z.strictObject({ state: z.enum(['bound', 'updated', 'unchanged']) }),
+        deployment: deploymentSummary,
+    }),
+    deploymentRejection,
+]);

package/dist/schema/modules/deployment/types/deployment-retention.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-/** A preview expires after 30 days without a call; a published deployment is retained. */
+/** A preview expires 30 days after its last call; a published deployment is retained. */
 export declare const deploymentRetention: z.ZodEnum<{
     preview: "preview";
     published: "published";
@@ -9,5 +9,41 @@ export declare const deploymentRetirement: z.ZodEnum<{
     expired: "expired";
     withdrawn: "withdrawn";
 }>;
+/**
+ * One deployment label, `<line>-<content16>`, as `deploymentLabel` produces it: lower-case, at
+ * most 57 characters. Handlers admit it again with `parseDeploymentLabel`.
+ */
+export declare const deploymentLabel: z.ZodString;
+/** The most labels one `lastCalls` reads. */
+export declare const MAXIMUM_LAST_CALL_LABELS = 100;
+export declare const lastCallsInput: z.ZodObject<{
+    labels: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** The instant of each label's last call, or null when none was ever recorded. */
+export declare const lastCallsOutput: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>;
+/** The most deployment writes one `expirePreviews` makes; the rest waits for the next pass. */
+export declare const MAXIMUM_PREVIEW_EXPIRY_WRITES = 256;
+export declare const expirePreviewsInput: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+    apply: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/**
+ * One expiry pass. `planned`: previews past their expiry this pass did not retire. `retired`:
+ * previews this pass retired. `pending`: expired previews whose retirement started and waits for
+ * the dispatcher to answer `DEPLOYMENT_RETIRED` everywhere before their script is deleted.
+ */
+export declare const expirePreviewsOutput: z.ZodObject<{
+    planned: z.ZodArray<z.ZodString>;
+    retired: z.ZodArray<z.ZodString>;
+    pending: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const retainInput: z.ZodObject<{
+    label: z.ZodString;
+}, z.core.$strict>;
+/** A retained deployment is published: monotonic, it never becomes a preview again. */
+export declare const retainOutput: z.ZodObject<{
+    retention: z.ZodLiteral<"published">;
+}, z.core.$strict>;
 export type DeploymentRetention = z.output<typeof deploymentRetention>;
 export type DeploymentRetirement = z.output<typeof deploymentRetirement>;
+export type ExpirePreviewsResult = z.output<typeof expirePreviewsOutput>;

package/dist/schema/modules/deployment/types/deployment-retention.js

@@ -1,5 +1,45 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-/** A preview expires after 30 days without a call; a published deployment is retained. */
+/** A preview expires 30 days after its last call; a published deployment is retained. */
 export const deploymentRetention = z.enum(['preview', 'published']);
 /** Why a deployment left: an expired preview can be revived, a withdrawn one never. */
 export const deploymentRetirement = z.enum(['expired', 'withdrawn']);
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/**
+ * One deployment label, `<line>-<content16>`, as `deploymentLabel` produces it: lower-case, at
+ * most 57 characters. Handlers admit it again with `parseDeploymentLabel`.
+ */
+export const deploymentLabel = z
+    .string()
+    .min(33)
+    .max(57)
+    .check(fullMatch('([a-z0-9]+(-[a-z0-9]+)*-)?[a-z2-7]{16}-[a-z2-7]{16}'));
+/** The most labels one `lastCalls` reads. */
+export const MAXIMUM_LAST_CALL_LABELS = 100;
+export const lastCallsInput = z.strictObject({
+    labels: z.array(deploymentLabel).min(1).max(MAXIMUM_LAST_CALL_LABELS),
+});
+/** The instant of each label's last call, or null when none was ever recorded. */
+export const lastCallsOutput = z.record(z.string(), instant.nullable());
+/** The most deployment writes one `expirePreviews` makes; the rest waits for the next pass. */
+export const MAXIMUM_PREVIEW_EXPIRY_WRITES = 256;
+export const expirePreviewsInput = z.strictObject({
+    /** Deployment writes this pass may make, retirements first; 64 when absent. */
+    limit: z.number().int().min(1).max(MAXIMUM_PREVIEW_EXPIRY_WRITES).optional(),
+    /** Retire what the plan lists; honoured only where `SERVICES_PREVIEW_EXPIRY` is `enforce`. */
+    apply: z.boolean().optional(),
+});
+/**
+ * One expiry pass. `planned`: previews past their expiry this pass did not retire. `retired`:
+ * previews this pass retired. `pending`: expired previews whose retirement started and waits for
+ * the dispatcher to answer `DEPLOYMENT_RETIRED` everywhere before their script is deleted.
+ */
+export const expirePreviewsOutput = z.strictObject({
+    planned: z.array(z.string()),
+    retired: z.array(z.string()),
+    pending: z.array(z.string()),
+});
+export const retainInput = z.strictObject({ label: deploymentLabel });
+/** A retained deployment is published: monotonic, it never becomes a preview again. */
+export const retainOutput = z.strictObject({ retention: z.literal('published') });

package/dist/schema/modules/deployment/types/deployment-retire.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const retireDeploymentInput: z.ZodObject<{}, z.core.$strict>;
+/**
+ * Retiring a deployment is an emergency stop, in two phases. The first records the retirement and
+ * writes its tombstone: from then on the dispatcher answers `DEPLOYMENT_RETIRED`, and the answer is
+ * `retiring` with the delay after which a retry may finish. The second, once the dispatcher answers
+ * it everywhere, deletes the script and with it the deployment's key: the answer is `retired`. A
+ * withdrawn deployment is never served again, even by a redeploy of the same release.
+ */
+export declare const retireDeploymentOutput: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"retired">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"retiring">;
+    retryAfterMs: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "address-mismatch": "address-mismatch";
+        "build-mismatch": "build-mismatch";
+        "deployment-conflict": "deployment-conflict";
+        "deployment-retired": "deployment-retired";
+        "hosting-unavailable": "hosting-unavailable";
+        "invalid-deployment": "invalid-deployment";
+        "line-owned-elsewhere": "line-owned-elsewhere";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type RetireDeploymentResult = z.output<typeof retireDeploymentOutput>;

package/dist/schema/modules/deployment/types/deployment-retire.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { deploymentRejection } from './deployment-response.js';
+export const retireDeploymentInput = z.strictObject({});
+/**
+ * Retiring a deployment is an emergency stop, in two phases. The first records the retirement and
+ * writes its tombstone: from then on the dispatcher answers `DEPLOYMENT_RETIRED`, and the answer is
+ * `retiring` with the delay after which a retry may finish. The second, once the dispatcher answers
+ * it everywhere, deletes the script and with it the deployment's key: the answer is `retired`. A
+ * withdrawn deployment is never served again, even by a redeploy of the same release.
+ */
+export const retireDeploymentOutput = z.union([
+    z.strictObject({ kind: z.literal('retired') }),
+    z.strictObject({
+        kind: z.literal('retiring'),
+        retryAfterMs: z.number().int().min(0).max(3_600_000),
+    }),
+    deploymentRejection,
+]);

package/dist/schema/modules/deployment/types/deployment-secret-digest.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export declare const deploymentSecretDigest: z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>;
+/** One digest per bound secret name, sorted by name. */
+export declare const deploymentSecretDigests: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>>;
+export type DeploymentSecretDigest = z.output<typeof deploymentSecretDigest>;

package/dist/schema/modules/deployment/types/deployment-secret-digest.js

@@ -0,0 +1,14 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export const deploymentSecretDigest = z.strictObject({
+    name: z.string().min(1).max(128),
+    digest: z.string().check(fullMatch('hmac-sha256:[0-9a-f]{64}')),
+});
+/** One digest per bound secret name, sorted by name. */
+export const deploymentSecretDigests = z.array(deploymentSecretDigest).max(64);

package/dist/schema/modules/deployment/types/deployment-secret.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export declare const deploymentSecretRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "secret-undeclared": "secret-undeclared";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export declare const setDeploymentSecretContract: {
+    readonly description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"rejected">;
+        reason: z.ZodEnum<{
+            "secret-undeclared": "secret-undeclared";
+            "service-unavailable": "service-unavailable";
+        }>;
+        message: z.ZodString;
+        retryAfter: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export declare const listDeploymentSecretNamesContract: {
+    readonly description: 'List the names of the secrets this deployment binds, without their values.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{}, z.core.$strict>;
+    readonly output: z.ZodArray<z.ZodString>;
+};
+export type DeploymentSecretRejection = z.output<typeof deploymentSecretRejection>;

package/dist/schema/modules/deployment/types/deployment-secret.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/** A secret name as a deployment's frozen configuration declares it. */
+const secretName = z.string().min(1).max(128);
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export const deploymentSecretRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: z.enum(['secret-undeclared', 'service-unavailable']),
+    message: z.string().min(1).max(500),
+    retryAfter: instant.optional(),
+});
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export const setDeploymentSecretContract = {
+    description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.',
+    auth: 'authenticated',
+    input: z.strictObject({
+        name: secretName,
+        value: z
+            .string()
+            .min(1)
+            .max(64 * 1024),
+    }),
+    output: z.union([z.strictObject({ name: secretName }), deploymentSecretRejection]),
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export const listDeploymentSecretNamesContract = {
+    description: 'List the names of the secrets this deployment binds, without their values.',
+    auth: 'authenticated',
+    input: z.strictObject({}),
+    output: z.array(secretName),
+};

package/dist/schema/modules/deployment/types/deployment-summary.d.ts

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+/**
+ * `DeploymentSummaryV1`: what Services knows of one deployment beside the record its deployer
+ * declared. It names a deployment by its label and URL, never by a provider version.
+ */
+export declare const deploymentSummary: z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodObject<{
+        format: z.ZodLiteral<"astrale.deployment-record">;
+        version: z.ZodLiteral<1>;
+        origin: z.ZodString;
+        environment: z.ZodString;
+        releaseDigest: z.ZodString;
+        buildDigest: z.ZodString;
+        schemaRevision: z.ZodString;
+        configuration: z.ZodString;
+        providerScript: z.ZodString;
+        commit: z.ZodNullable<z.ZodObject<{
+            sha: z.ZodString;
+            dirty: z.ZodBoolean;
+            base: z.ZodOptional<z.ZodObject<{
+                version: z.ZodString;
+                distance: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * A deployment Services lists although this Services SDK no longer admits the record or the
+ * configuration it stores, for instance after a stricter decoder: the facts Services owns, and the
+ * record exactly as stored, any JSON value. Its consumer admits that record itself; Services never
+ * acts on such a deployment.
+ */
+export declare const unadmittedDeploymentSummary: z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodUnknown;
+}, z.core.$strict>;
+/**
+ * One listed deployment: a `DeploymentSummaryV1` whose record Services admits, or an unadmitted one
+ * whose record is typed as JSON.
+ */
+export declare const listedDeploymentSummary: z.ZodUnion<readonly [z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodObject<{
+        format: z.ZodLiteral<"astrale.deployment-record">;
+        version: z.ZodLiteral<1>;
+        origin: z.ZodString;
+        environment: z.ZodString;
+        releaseDigest: z.ZodString;
+        buildDigest: z.ZodString;
+        schemaRevision: z.ZodString;
+        configuration: z.ZodString;
+        providerScript: z.ZodString;
+        commit: z.ZodNullable<z.ZodObject<{
+            sha: z.ZodString;
+            dirty: z.ZodBoolean;
+            base: z.ZodOptional<z.ZodObject<{
+                version: z.ZodString;
+                distance: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodUnknown;
+}, z.core.$strict>]>;
+export type DeploymentSummary = z.output<typeof deploymentSummary>;
+export type UnadmittedDeploymentSummary = z.output<typeof unadmittedDeploymentSummary>;
+export type ListedDeploymentSummary = z.output<typeof listedDeploymentSummary>;

package/dist/schema/modules/deployment/types/deployment-summary.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { deploymentRecord } from './deployment-record.js';
+import { deploymentRetention, deploymentRetirement } from './deployment-retention.js';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/**
+ * `DeploymentSummaryV1`: what Services knows of one deployment beside the record its deployer
+ * declared. It names a deployment by its label and URL, never by a provider version.
+ */
+export const deploymentSummary = z.strictObject({
+    id: z.string().min(1),
+    url: z.string().min(1).max(2_048),
+    label: z.string().min(1).max(63),
+    line: z.string().min(1).max(40),
+    /** The Identity path of the organisation holding the line. */
+    owner: z.string().min(1),
+    state: z.enum(['deploying', 'active', 'retiring', 'retired', 'failed']),
+    retention: deploymentRetention,
+    createdAt: instant,
+    lastCallAt: instant.optional(),
+    expiresAt: instant.optional(),
+    retiredAt: instant.optional(),
+    retirement: deploymentRetirement.optional(),
+    signingKeyId: z.string().min(1).max(128),
+    record: deploymentRecord,
+});
+/**
+ * A deployment Services lists although this Services SDK no longer admits the record or the
+ * configuration it stores, for instance after a stricter decoder: the facts Services owns, and the
+ * record exactly as stored, any JSON value. Its consumer admits that record itself; Services never
+ * acts on such a deployment.
+ */
+export const unadmittedDeploymentSummary = deploymentSummary.extend({ record: z.unknown() });
+/**
+ * One listed deployment: a `DeploymentSummaryV1` whose record Services admits, or an unadmitted one
+ * whose record is typed as JSON.
+ */
+export const listedDeploymentSummary = z.union([deploymentSummary, unadmittedDeploymentSummary]);