@astrale-domains/services 0.4.6 → 0.4.8

package/dist/schema/modules/deployment/errors/deployment-label-not-found.js

@@ -0,0 +1,11 @@
+import { error } from '@astrale-os/sdk/schema/errors';
+import { z } from 'zod';
+/**
+ * A label that names no deployment the caller may read: an unknown label and another
+ * organisation's deployment answer alike, so the answer never tells one from the other.
+ */
+export const deploymentLabelNotFound = error({
+    family: 'NOT_FOUND',
+    message: 'No deployment of yours has this label.',
+    details: z.strictObject({ label: z.string().min(1).max(63) }),
+});

package/dist/schema/modules/deployment/errors/deployment-not-found.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+/**
+ * Asked about a deployment the caller does not hold: a deployment of a line held by another
+ * organisation is invisible to the caller, as its read Policy keeps it.
+ */
+export declare const deploymentNotFound: Readonly<{
+    readonly family: "NOT_FOUND";
+    readonly message: "No deployment of a line the caller holds has this id.";
+    readonly details: z.ZodObject<{}, z.core.$strict>;
+}>;

package/dist/schema/modules/deployment/errors/deployment-not-found.js

@@ -0,0 +1,11 @@
+import { error } from '@astrale-os/sdk/schema/errors';
+import { z } from 'zod';
+/**
+ * Asked about a deployment the caller does not hold: a deployment of a line held by another
+ * organisation is invisible to the caller, as its read Policy keeps it.
+ */
+export const deploymentNotFound = error({
+    family: 'NOT_FOUND',
+    message: 'No deployment of a line the caller holds has this id.',
+    details: z.strictObject({}),
+});

package/dist/schema/modules/deployment/errors/deployment-registry-only.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * Asked of retention by anyone but the registry Domain (`SERVICES_REGISTRY_ORIGIN`). Only the
+ * registry knows which releases are published, so a line holder cannot keep its own preview by
+ * marking it, and only the registry runs the expiry of every organisation's previews.
+ */
+export declare const deploymentRegistryOnly: Readonly<{
+    readonly family: "UNSUPPORTED";
+    readonly message: "Only the registry Domain marks deployments published and expires previews.";
+    readonly details: z.ZodObject<{}, z.core.$strict>;
+}>;

package/dist/schema/modules/deployment/errors/deployment-registry-only.js

@@ -0,0 +1,12 @@
+import { error } from '@astrale-os/sdk/schema/errors';
+import { z } from 'zod';
+/**
+ * Asked of retention by anyone but the registry Domain (`SERVICES_REGISTRY_ORIGIN`). Only the
+ * registry knows which releases are published, so a line holder cannot keep its own preview by
+ * marking it, and only the registry runs the expiry of every organisation's previews.
+ */
+export const deploymentRegistryOnly = error({
+    family: 'UNSUPPORTED',
+    message: 'Only the registry Domain marks deployments published and expires previews.',
+    details: z.strictObject({}),
+});

package/dist/schema/modules/deployment/errors/index.d.ts

@@ -0,0 +1,4 @@
+export { deploymentHostingUnavailable } from './deployment-hosting-unavailable.js';
+export { deploymentLabelNotFound } from './deployment-label-not-found.js';
+export { deploymentNotFound } from './deployment-not-found.js';
+export { deploymentRegistryOnly } from './deployment-registry-only.js';

package/dist/schema/modules/deployment/errors/index.js

@@ -0,0 +1,4 @@
+export { deploymentHostingUnavailable } from './deployment-hosting-unavailable.js';
+export { deploymentLabelNotFound } from './deployment-label-not-found.js';
+export { deploymentNotFound } from './deployment-not-found.js';
+export { deploymentRegistryOnly } from './deployment-registry-only.js';

package/dist/schema/modules/deployment/functions/deploy-cloudflare-deployment.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Host one release as an immutable deployment on its publisher's line. Any authenticated identity
+ * may ask; the handler proves that it acts for the organisation it names before any write.
+ */
+export declare const deployCloudflareDeployment: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    format: "astrale.services.deployment-request";
+    version: 1;
+    organization?: string | undefined;
+    origin: string;
+    environment: string;
+    addressing: "opaque" | "readable";
+    label: string;
+    buildDigest: string;
+    configuration: {
+        format: "astrale.deployment.configuration";
+        version: 1;
+        vars: Record<string, string>;
+        settings: {
+            maximumRequestBytes: number;
+            invocationTimeoutMs: number;
+            tokenExchange: false | {
+                maximumLifetimeSeconds: number;
+            };
+            durableOptions?: {
+                retentionMs?: number | undefined;
+                retry?: {
+                    initialIntervalMs?: number | undefined;
+                    maxAttempts?: number | undefined;
+                    maxIntervalMs?: number | undefined;
+                } | undefined;
+                stepTimeoutMs?: number | undefined;
+            } | undefined;
+        };
+        runtime: {
+            compatibilityDate: string;
+            compatibilityFlags: string[];
+        };
+        bindings: {
+            services: {
+                name: string;
+                service: string;
+            }[];
+            dispatchNamespaces: {
+                name: string;
+                namespace: string;
+            }[];
+            secrets: string[];
+        };
+        router: false | {
+            service: string;
+            hostSuffix: string;
+            minLabels: number;
+        };
+    };
+    record: {
+        releaseDigest: string;
+        schemaRevision: string;
+        schemaBundle: string;
+        commit: {
+            sha: string;
+            dirty: boolean;
+            base?: {
+                version: string;
+                distance: number;
+            } | undefined;
+        } | null;
+    };
+    bundle: {
+        entrypoint: string;
+        modules: ({
+            name: string;
+            kind?: "data" | "esm" | "text" | "wasm" | undefined;
+            content: {
+                encoding: "gzip" | "identity";
+                decodedSize: number;
+                contentBase64: string;
+            } | {
+                encoding: "gzip" | "identity";
+                decodedSize: number;
+                contentBase64Chunks: string[];
+            };
+        } | {
+            contentBase64: string;
+            name: string;
+            kind?: "data" | "esm" | "text" | "wasm" | undefined;
+        } | {
+            contentBase64Chunks: string[];
+            name: string;
+            kind?: "data" | "esm" | "text" | "wasm" | undefined;
+        })[];
+        assets?: {
+            files: ({
+                path: string;
+                contentType?: string | undefined;
+                content: {
+                    encoding: "gzip" | "identity";
+                    decodedSize: number;
+                    contentBase64: string;
+                } | {
+                    encoding: "gzip" | "identity";
+                    decodedSize: number;
+                    contentBase64Chunks: string[];
+                };
+            } | {
+                contentBase64: string;
+                path: string;
+                contentType?: string | undefined;
+            } | {
+                contentBase64Chunks: string[];
+                path: string;
+                contentType?: string | undefined;
+            })[];
+            notFound?: "404-page" | "none" | "single-page-application" | undefined;
+            runWorkerFirst?: boolean | undefined;
+            htmlHandling?: "none" | undefined;
+        } | undefined;
+    };
+    secrets: Record<string, string>;
+    readiness?: {
+        paths: string[];
+    } | undefined;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        kind: "deployed";
+        state: "created" | "reused";
+        secrets: {
+            state: "bound" | "unchanged" | "updated";
+        };
+        deployment: {
+            id: string;
+            url: string;
+            label: string;
+            line: string;
+            owner: string;
+            state: "active" | "deploying" | "failed" | "retired" | "retiring";
+            retention: "preview" | "published";
+            createdAt: string;
+            lastCallAt?: string | undefined;
+            expiresAt?: string | undefined;
+            retiredAt?: string | undefined;
+            retirement?: "expired" | "withdrawn" | undefined;
+            signingKeyId: string;
+            record: {
+                format: "astrale.deployment-record";
+                version: 1;
+                origin: string;
+                environment: string;
+                releaseDigest: string;
+                buildDigest: string;
+                schemaRevision: string;
+                configuration: string;
+                providerScript: string;
+                commit: {
+                    sha: string;
+                    dirty: boolean;
+                    base?: {
+                        version: string;
+                        distance: number;
+                    } | undefined;
+                } | null;
+            };
+        };
+    } | {
+        kind: "rejected";
+        reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/deploy-cloudflare-deployment.js

@@ -0,0 +1,14 @@
+import { method } from '@astrale-os/sdk/schema';
+import { deploymentRequest } from '../types/deployment-request.js';
+import { deploymentResponse } from '../types/deployment-response.js';
+/**
+ * Host one release as an immutable deployment on its publisher's line. Any authenticated identity
+ * may ask; the handler proves that it acts for the organisation it names before any write.
+ */
+export const deployCloudflareDeployment = method({
+    description: 'Host one release as an immutable deployment on its publisher line.',
+    auth: 'authenticated',
+    static: true,
+    input: deploymentRequest,
+    output: deploymentResponse,
+});

package/dist/schema/modules/deployment/functions/describe-deployment-hosting.d.ts

@@ -0,0 +1,8 @@
+/** Where this Services runtime addresses the deployments it hosts. */
+export declare const describeDeploymentHosting: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        routingDomain: string;
+        addressing: "opaque" | "readable";
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/describe-deployment-hosting.js

@@ -0,0 +1,11 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { deploymentHosting } from '../types/deployment-hosting.js';
+/** Where this Services runtime addresses the deployments it hosts. */
+export const describeDeploymentHosting = method({
+    description: 'Describe the routing domain and line addressing of hosted deployments.',
+    auth: 'authenticated',
+    static: true,
+    input: z.strictObject({}),
+    output: deploymentHosting,
+});

package/dist/schema/modules/deployment/functions/expire-deployment-previews.d.ts

@@ -0,0 +1,16 @@
+/**
+ * One pass of preview expiry over every line: a preview expires 30 days after its last call or
+ * its activation, whichever is later, and a published deployment never does. The pass is a plan
+ * unless the runtime enforces expiry. Only the registry Domain runs it.
+ */
+export declare const expireDeploymentPreviews: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    limit?: number | undefined;
+    apply?: boolean | undefined;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        planned: string[];
+        retired: string[];
+        pending: string[];
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/expire-deployment-previews.js

@@ -0,0 +1,14 @@
+import { method } from '@astrale-os/sdk/schema';
+import { expirePreviewsInput, expirePreviewsOutput } from '../types/deployment-retention.js';
+/**
+ * One pass of preview expiry over every line: a preview expires 30 days after its last call or
+ * its activation, whichever is later, and a published deployment never does. The pass is a plan
+ * unless the runtime enforces expiry. Only the registry Domain runs it.
+ */
+export const expireDeploymentPreviews = method({
+    description: 'Plan, or where enforced apply, the expiry of previews uncalled for 30 days.',
+    auth: 'authenticated',
+    static: true,
+    input: expirePreviewsInput,
+    output: expirePreviewsOutput,
+});

package/dist/schema/modules/deployment/functions/index.d.ts

@@ -0,0 +1,11 @@
+export { deployCloudflareDeployment } from './deploy-cloudflare-deployment.js';
+export { describeDeploymentHosting } from './describe-deployment-hosting.js';
+export { expireDeploymentPreviews } from './expire-deployment-previews.js';
+export { listCloudflareDeployments } from './list-cloudflare-deployments.js';
+export { listCloudflareDeploymentSecretNames } from './list-cloudflare-deployment-secret-names.js';
+export { listDeploymentSecretNames } from './list-deployment-secret-names.js';
+export { readDeploymentLastCalls } from './read-deployment-last-calls.js';
+export { retainDeployment } from './retain-deployment.js';
+export { retireDeployment } from './retire-deployment.js';
+export { setCloudflareDeploymentSecret } from './set-cloudflare-deployment-secret.js';
+export { setDeploymentSecret } from './set-deployment-secret.js';

package/dist/schema/modules/deployment/functions/index.js

@@ -0,0 +1,11 @@
+export { deployCloudflareDeployment } from './deploy-cloudflare-deployment.js';
+export { describeDeploymentHosting } from './describe-deployment-hosting.js';
+export { expireDeploymentPreviews } from './expire-deployment-previews.js';
+export { listCloudflareDeployments } from './list-cloudflare-deployments.js';
+export { listCloudflareDeploymentSecretNames } from './list-cloudflare-deployment-secret-names.js';
+export { listDeploymentSecretNames } from './list-deployment-secret-names.js';
+export { readDeploymentLastCalls } from './read-deployment-last-calls.js';
+export { retainDeployment } from './retain-deployment.js';
+export { retireDeployment } from './retire-deployment.js';
+export { setCloudflareDeploymentSecret } from './set-cloudflare-deployment-secret.js';
+export { setDeploymentSecret } from './set-deployment-secret.js';

package/dist/schema/modules/deployment/functions/list-cloudflare-deployment-secret-names.d.ts

@@ -0,0 +1,5 @@
+/** Decided as `setSecret`: `OwnDeployment` for the caller, before the deployment is read. */
+export declare const listCloudflareDeploymentSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: string[];
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/list-cloudflare-deployment-secret-names.js

@@ -0,0 +1,4 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentSecretNamesContract } from '../types/deployment-secret.js';
+/** Decided as `setSecret`: `OwnDeployment` for the caller, before the deployment is read. */
+export const listCloudflareDeploymentSecretNames = method(listDeploymentSecretNamesContract);

package/dist/schema/modules/deployment/functions/list-cloudflare-deployments.d.ts

@@ -0,0 +1,58 @@
+/** The deployments of the lines the caller holds, or acts for through `extends_with`. */
+export declare const listCloudflareDeployments: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    origin?: string | undefined;
+    environment?: string | undefined;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        deployments: ({
+            id: string;
+            url: string;
+            label: string;
+            line: string;
+            owner: string;
+            state: "active" | "deploying" | "failed" | "retired" | "retiring";
+            retention: "preview" | "published";
+            createdAt: string;
+            lastCallAt?: string | undefined;
+            expiresAt?: string | undefined;
+            retiredAt?: string | undefined;
+            retirement?: "expired" | "withdrawn" | undefined;
+            signingKeyId: string;
+            record: {
+                format: "astrale.deployment-record";
+                version: 1;
+                origin: string;
+                environment: string;
+                releaseDigest: string;
+                buildDigest: string;
+                schemaRevision: string;
+                configuration: string;
+                providerScript: string;
+                commit: {
+                    sha: string;
+                    dirty: boolean;
+                    base?: {
+                        version: string;
+                        distance: number;
+                    } | undefined;
+                } | null;
+            };
+        } | {
+            id: string;
+            url: string;
+            label: string;
+            line: string;
+            owner: string;
+            state: "active" | "deploying" | "failed" | "retired" | "retiring";
+            retention: "preview" | "published";
+            createdAt: string;
+            lastCallAt?: string | undefined;
+            expiresAt?: string | undefined;
+            retiredAt?: string | undefined;
+            retirement?: "expired" | "withdrawn" | undefined;
+            signingKeyId: string;
+            record: unknown;
+        })[];
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/list-cloudflare-deployments.js

@@ -0,0 +1,10 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentsInput, listDeploymentsOutput } from '../types/deployment-hosting.js';
+/** The deployments of the lines the caller holds, or acts for through `extends_with`. */
+export const listCloudflareDeployments = method({
+    description: 'List the deployments of the lines the caller holds.',
+    auth: 'authenticated',
+    static: true,
+    input: listDeploymentsInput,
+    output: listDeploymentsOutput,
+});

package/dist/schema/modules/deployment/functions/list-deployment-secret-names.d.ts

@@ -0,0 +1,4 @@
+export declare const listDeploymentSecretNames: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: string[];
+}, "authenticated", false, true, undefined>>;

package/dist/schema/modules/deployment/functions/list-deployment-secret-names.js

@@ -0,0 +1,6 @@
+import { method } from '@astrale-os/sdk/schema';
+import { listDeploymentSecretNamesContract } from '../types/deployment-secret.js';
+export const listDeploymentSecretNames = method({
+    ...listDeploymentSecretNamesContract,
+    abstract: true,
+});

package/dist/schema/modules/deployment/functions/read-deployment-last-calls.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The last call of each deployment named, as the dispatcher counted it. The caller must hold
+ * every label's line; the registry Domain may read any label.
+ */
+export declare const readDeploymentLastCalls: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    labels: string[];
+}, {
+    readonly mode: 'value';
+    readonly value: Record<string, string | null>;
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/read-deployment-last-calls.js

@@ -0,0 +1,13 @@
+import { method } from '@astrale-os/sdk/schema';
+import { lastCallsInput, lastCallsOutput } from '../types/deployment-retention.js';
+/**
+ * The last call of each deployment named, as the dispatcher counted it. The caller must hold
+ * every label's line; the registry Domain may read any label.
+ */
+export const readDeploymentLastCalls = method({
+    description: 'Read the instant of the last call of each named deployment.',
+    auth: 'authenticated',
+    static: true,
+    input: lastCallsInput,
+    output: lastCallsOutput,
+});

package/dist/schema/modules/deployment/functions/retain-deployment.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mark one deployment published, so it is served as long as it exists. Only the registry Domain
+ * marks, after the Publication that names the release; a line holder cannot keep its own preview.
+ */
+export declare const retainDeployment: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    label: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        retention: "published";
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/modules/deployment/functions/retain-deployment.js

@@ -0,0 +1,13 @@
+import { method } from '@astrale-os/sdk/schema';
+import { retainInput, retainOutput } from '../types/deployment-retention.js';
+/**
+ * Mark one deployment published, so it is served as long as it exists. Only the registry Domain
+ * marks, after the Publication that names the release; a line holder cannot keep its own preview.
+ */
+export const retainDeployment = method({
+    description: 'Mark one deployment published so that it never expires.',
+    auth: 'authenticated',
+    static: true,
+    input: retainInput,
+    output: retainOutput,
+});

package/dist/schema/modules/deployment/functions/retire-deployment.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Withdraw one deployment for good: the emergency stop of its line holder. Its URL then answers
+ * `DEPLOYMENT_RETIRED`, its script and key are deleted, and no redeploy serves it again.
+ *
+ * Only the holder of the deployment's line, or an Identity acting for it, withdraws it: the
+ * handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment, as
+ * `setSecret` does. An `authorized` Method would also require the caller's principal to hold
+ * `can_use` on this Function, which no publisher identity holds on the Admin instance.
+ */
+export declare const retireDeployment: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        kind: "retired";
+    } | {
+        kind: "retiring";
+        retryAfterMs: number;
+    } | {
+        kind: "rejected";
+        reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/retire-deployment.js

@@ -0,0 +1,17 @@
+import { method } from '@astrale-os/sdk/schema';
+import { retireDeploymentInput, retireDeploymentOutput } from '../types/deployment-retire.js';
+/**
+ * Withdraw one deployment for good: the emergency stop of its line holder. Its URL then answers
+ * `DEPLOYMENT_RETIRED`, its script and key are deleted, and no redeploy serves it again.
+ *
+ * Only the holder of the deployment's line, or an Identity acting for it, withdraws it: the
+ * handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment, as
+ * `setSecret` does. An `authorized` Method would also require the caller's principal to hold
+ * `can_use` on this Function, which no publisher identity holds on the Admin instance.
+ */
+export const retireDeployment = method({
+    description: 'Withdraw this deployment for good: an emergency stop.',
+    auth: 'authenticated',
+    input: retireDeploymentInput,
+    output: retireDeploymentOutput,
+});

package/dist/schema/modules/deployment/functions/set-cloudflare-deployment-secret.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Only the holder of the deployment's line, or an Identity acting for it, rewrites its secrets:
+ * the handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment.
+ */
+export declare const setCloudflareDeploymentSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    name: string;
+    value: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        name: string;
+    } | {
+        kind: "rejected";
+        reason: "secret-undeclared" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, false, undefined>>;

package/dist/schema/modules/deployment/functions/set-cloudflare-deployment-secret.js

@@ -0,0 +1,7 @@
+import { method } from '@astrale-os/sdk/schema';
+import { setDeploymentSecretContract } from '../types/deployment-secret.js';
+/**
+ * Only the holder of the deployment's line, or an Identity acting for it, rewrites its secrets:
+ * the handler asks the Kernel `OwnDeployment` for the caller before it reads the deployment.
+ */
+export const setCloudflareDeploymentSecret = method(setDeploymentSecretContract);

package/dist/schema/modules/deployment/functions/set-deployment-secret.d.ts

@@ -0,0 +1,14 @@
+export declare const setDeploymentSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    name: string;
+    value: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        name: string;
+    } | {
+        kind: "rejected";
+        reason: "secret-undeclared" | "service-unavailable";
+        message: string;
+        retryAfter?: string | undefined;
+    };
+}, "authenticated", false, true, undefined>>;

package/dist/schema/modules/deployment/functions/set-deployment-secret.js

@@ -0,0 +1,3 @@
+import { method } from '@astrale-os/sdk/schema';
+import { setDeploymentSecretContract } from '../types/deployment-secret.js';
+export const setDeploymentSecret = method({ ...setDeploymentSecretContract, abstract: true });

package/dist/schema/modules/deployment/index.d.ts

@@ -1,6 +1,8 @@
 export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
-export { OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentHostingUnavailable, deploymentLabelNotFound, deploymentNotFound, deploymentRegistryOnly, } from './errors/index.js';
+export { deployCloudflareDeployment, describeDeploymentHosting, expireDeploymentPreviews, listCloudflareDeploymentSecretNames, listCloudflareDeployments, listDeploymentSecretNames, readDeploymentLastCalls, retainDeployment, retireDeployment, setCloudflareDeploymentSecret, setDeploymentSecret, } from './functions/index.js';
+export { ActForOrganization, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
 export { deploymentLifecycle } from './states/index.js';
 export type { DeploymentLifecycle, DeploymentLifecycleEvent } from './states/index.js';
-export { deploymentCommit, deploymentRecord, deploymentRetention, deploymentRetirement, } from './types/index.js';
-export type { DeploymentRecord, DeploymentRetention, DeploymentRetirement } from './types/index.js';
+export { deploymentCommit, deploymentHosting, deploymentLabel, deploymentRecord, deploymentRejection, deploymentRejectionReason, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigest, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, expirePreviewsInput, expirePreviewsOutput, frozenConfiguration, lastCallsInput, lastCallsOutput, listDeploymentSecretNamesContract, listedDeploymentSummary, listDeploymentsInput, listDeploymentsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, retireDeploymentInput, retireDeploymentOutput, setDeploymentSecretContract, unadmittedDeploymentSummary, } from './types/index.js';
+export type { DeploymentHosting, DeploymentRecord, DeploymentRejection, DeploymentRejectionReason, DeploymentRequest, DeploymentResponse, DeploymentRetention, DeploymentRetirement, DeploymentSecretDigest, DeploymentSecretRejection, DeploymentSummary, ExpirePreviewsResult, FrozenConfiguration, ListedDeploymentSummary, RetireDeploymentResult, UnadmittedDeploymentSummary, } from './types/index.js';

package/dist/schema/modules/deployment/index.js

@@ -1,4 +1,6 @@
 export { CloudflareDeployment, Deployment, DeploymentLine, deployment_on_line, line_owned_by, } from './classes/index.js';
-export { OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
+export { deploymentHostingUnavailable, deploymentLabelNotFound, deploymentNotFound, deploymentRegistryOnly, } from './errors/index.js';
+export { deployCloudflareDeployment, describeDeploymentHosting, expireDeploymentPreviews, listCloudflareDeploymentSecretNames, listCloudflareDeployments, listDeploymentSecretNames, readDeploymentLastCalls, retainDeployment, retireDeployment, setCloudflareDeploymentSecret, setDeploymentSecret, } from './functions/index.js';
+export { ActForOrganization, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, } from './policies/index.js';
 export { deploymentLifecycle } from './states/index.js';
-export { deploymentCommit, deploymentRecord, deploymentRetention, deploymentRetirement, } from './types/index.js';
+export { deploymentCommit, deploymentHosting, deploymentLabel, deploymentRecord, deploymentRejection, deploymentRejectionReason, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigest, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, expirePreviewsInput, expirePreviewsOutput, frozenConfiguration, lastCallsInput, lastCallsOutput, listDeploymentSecretNamesContract, listedDeploymentSummary, listDeploymentsInput, listDeploymentsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, retireDeploymentInput, retireDeploymentOutput, setDeploymentSecretContract, unadmittedDeploymentSummary, } from './types/index.js';

package/dist/schema/modules/deployment/policies/act-for-organization.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The subject is this organisation, or an Identity acting for it: a member or a CI identity
+ * reaches its organisation through `extends_with`, which the Kernel expands for the subject. Deploy
+ * asks it of the caller, on the organisation it names, before registering a line for it.
+ */
+export declare const ActForOrganization: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/deployment/policies/act-for-organization.js

@@ -0,0 +1,10 @@
+import { policy } from '@astrale-os/sdk/schema';
+/**
+ * The subject is this organisation, or an Identity acting for it: a member or a CI identity
+ * reaches its organisation through `extends_with`, which the Kernel expands for the subject. Deploy
+ * asks it of the caller, on the organisation it names, before registering a line for it.
+ */
+export const ActForOrganization = policy({
+    description: 'The subject is this organisation or acts for it through extends_with.',
+    match: ({ sameNode, subject, object }) => sameNode(subject, object),
+});