@astrale-domains/services 0.4.6 → 0.4.8

package/dist/schema/modules/deployment/types/deployment-retire.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { deploymentRejection } from './deployment-response.js';
+export const retireDeploymentInput = z.strictObject({});
+/**
+ * Retiring a deployment is an emergency stop, in two phases. The first records the retirement and
+ * writes its tombstone: from then on the dispatcher answers `DEPLOYMENT_RETIRED`, and the answer is
+ * `retiring` with the delay after which a retry may finish. The second, once the dispatcher answers
+ * it everywhere, deletes the script and with it the deployment's key: the answer is `retired`. A
+ * withdrawn deployment is never served again, even by a redeploy of the same release.
+ */
+export const retireDeploymentOutput = z.union([
+    z.strictObject({ kind: z.literal('retired') }),
+    z.strictObject({
+        kind: z.literal('retiring'),
+        retryAfterMs: z.number().int().min(0).max(3_600_000),
+    }),
+    deploymentRejection,
+]);

package/dist/schema/modules/deployment/types/deployment-secret-digest.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export declare const deploymentSecretDigest: z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>;
+/** One digest per bound secret name, sorted by name. */
+export declare const deploymentSecretDigests: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>>;
+export type DeploymentSecretDigest = z.output<typeof deploymentSecretDigest>;

package/dist/schema/modules/deployment/types/deployment-secret-digest.js

@@ -0,0 +1,14 @@
+import { fullMatch } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+/**
+ * The keyed digest of one secret a deployment binds: HMAC-SHA256 under the Services runtime's
+ * `SERVICES_SECRET_DIGEST_KEY` of the deployment label, the name and the value. It tells whether a
+ * later request carries the same value without Services keeping the value, and the same value on
+ * two deployments gives two digests.
+ */
+export const deploymentSecretDigest = z.strictObject({
+    name: z.string().min(1).max(128),
+    digest: z.string().check(fullMatch('hmac-sha256:[0-9a-f]{64}')),
+});
+/** One digest per bound secret name, sorted by name. */
+export const deploymentSecretDigests = z.array(deploymentSecretDigest).max(64);

package/dist/schema/modules/deployment/types/deployment-secret.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export declare const deploymentSecretRejection: z.ZodObject<{
+    kind: z.ZodLiteral<"rejected">;
+    reason: z.ZodEnum<{
+        "secret-undeclared": "secret-undeclared";
+        "service-unavailable": "service-unavailable";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export declare const setDeploymentSecretContract: {
+    readonly description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"rejected">;
+        reason: z.ZodEnum<{
+            "secret-undeclared": "secret-undeclared";
+            "service-unavailable": "service-unavailable";
+        }>;
+        message: z.ZodString;
+        retryAfter: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export declare const listDeploymentSecretNamesContract: {
+    readonly description: 'List the names of the secrets this deployment binds, without their values.';
+    readonly auth: 'authenticated';
+    readonly input: z.ZodObject<{}, z.core.$strict>;
+    readonly output: z.ZodArray<z.ZodString>;
+};
+export type DeploymentSecretRejection = z.output<typeof deploymentSecretRejection>;

package/dist/schema/modules/deployment/types/deployment-secret.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/** A secret name as a deployment's frozen configuration declares it. */
+const secretName = z.string().min(1).max(128);
+/**
+ * Why a deployment's secret was not rewritten. `secret-undeclared`: the name is not one the
+ * deployment's frozen configuration binds, and adding or removing a name is a new release; nothing
+ * was written. `service-unavailable`: the deployment is being created, another operation holds it
+ * or took it over, or the provider failed, and `retryAfter` is when a retry may succeed and then
+ * converges; or, without `retryAfter`, the deployment cannot be rotated in place at all (its
+ * creation failed, it is retiring or retired, or the script under its label is not the recorded
+ * one) and `message` says what can.
+ */
+export const deploymentSecretRejection = z.strictObject({
+    kind: z.literal('rejected'),
+    reason: z.enum(['secret-undeclared', 'service-unavailable']),
+    message: z.string().min(1).max(500),
+    retryAfter: instant.optional(),
+});
+/**
+ * Rewrite one secret of one deployment in place: the same script, URL, issuer and key, with no
+ * new release. The provider serves the new value once it has propagated, a few seconds later.
+ *
+ * `authenticated`, as `deploy`: a publisher's identities on the Admin instance hold no `can_use`
+ * on Services' Functions, which an `authorized` Method requires of every non-Root caller (Kernel
+ * law in `runtime/functions/.spec/laws/authentication.ts`), so `authorized` with the
+ * `OwnDeployment` Policy refuses a line holder (2004). The handler decides `OwnDeployment` on the
+ * caller's own session before anything is read or written, exactly as `deploy` decides
+ * `OwnLine`, and a caller who does not hold the line finds no such deployment
+ * (`DEPLOYMENT_NOT_FOUND`). The day the Admin instance grants publishers `can_use` on these
+ * Methods, they become `authorized` with that Policy and the handler check goes.
+ */
+export const setDeploymentSecretContract = {
+    description: 'Rewrite one declared secret of this deployment in place; the new value is served once the provider propagates it.',
+    auth: 'authenticated',
+    input: z.strictObject({
+        name: secretName,
+        value: z
+            .string()
+            .min(1)
+            .max(64 * 1024),
+    }),
+    output: z.union([z.strictObject({ name: secretName }), deploymentSecretRejection]),
+};
+/** The names of the secrets one deployment binds, never their values; decided as `setSecret`. */
+export const listDeploymentSecretNamesContract = {
+    description: 'List the names of the secrets this deployment binds, without their values.',
+    auth: 'authenticated',
+    input: z.strictObject({}),
+    output: z.array(secretName),
+};

package/dist/schema/modules/deployment/types/deployment-summary.d.ts

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+/**
+ * `DeploymentSummaryV1`: what Services knows of one deployment beside the record its deployer
+ * declared. It names a deployment by its label and URL, never by a provider version.
+ */
+export declare const deploymentSummary: z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodObject<{
+        format: z.ZodLiteral<"astrale.deployment-record">;
+        version: z.ZodLiteral<1>;
+        origin: z.ZodString;
+        environment: z.ZodString;
+        releaseDigest: z.ZodString;
+        buildDigest: z.ZodString;
+        schemaRevision: z.ZodString;
+        configuration: z.ZodString;
+        providerScript: z.ZodString;
+        commit: z.ZodNullable<z.ZodObject<{
+            sha: z.ZodString;
+            dirty: z.ZodBoolean;
+            base: z.ZodOptional<z.ZodObject<{
+                version: z.ZodString;
+                distance: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * A deployment Services lists although this Services SDK no longer admits the record or the
+ * configuration it stores, for instance after a stricter decoder: the facts Services owns, and the
+ * record exactly as stored, any JSON value. Its consumer admits that record itself; Services never
+ * acts on such a deployment.
+ */
+export declare const unadmittedDeploymentSummary: z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodUnknown;
+}, z.core.$strict>;
+/**
+ * One listed deployment: a `DeploymentSummaryV1` whose record Services admits, or an unadmitted one
+ * whose record is typed as JSON.
+ */
+export declare const listedDeploymentSummary: z.ZodUnion<readonly [z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodObject<{
+        format: z.ZodLiteral<"astrale.deployment-record">;
+        version: z.ZodLiteral<1>;
+        origin: z.ZodString;
+        environment: z.ZodString;
+        releaseDigest: z.ZodString;
+        buildDigest: z.ZodString;
+        schemaRevision: z.ZodString;
+        configuration: z.ZodString;
+        providerScript: z.ZodString;
+        commit: z.ZodNullable<z.ZodObject<{
+            sha: z.ZodString;
+            dirty: z.ZodBoolean;
+            base: z.ZodOptional<z.ZodObject<{
+                version: z.ZodString;
+                distance: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodString;
+    url: z.ZodString;
+    label: z.ZodString;
+    line: z.ZodString;
+    owner: z.ZodString;
+    state: z.ZodEnum<{
+        active: "active";
+        deploying: "deploying";
+        failed: "failed";
+        retired: "retired";
+        retiring: "retiring";
+    }>;
+    retention: z.ZodEnum<{
+        preview: "preview";
+        published: "published";
+    }>;
+    createdAt: z.ZodString;
+    lastCallAt: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    retiredAt: z.ZodOptional<z.ZodString>;
+    retirement: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        withdrawn: "withdrawn";
+    }>>;
+    signingKeyId: z.ZodString;
+    record: z.ZodUnknown;
+}, z.core.$strict>]>;
+export type DeploymentSummary = z.output<typeof deploymentSummary>;
+export type UnadmittedDeploymentSummary = z.output<typeof unadmittedDeploymentSummary>;
+export type ListedDeploymentSummary = z.output<typeof listedDeploymentSummary>;

package/dist/schema/modules/deployment/types/deployment-summary.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { deploymentRecord } from './deployment-record.js';
+import { deploymentRetention, deploymentRetirement } from './deployment-retention.js';
+/** An ISO 8601 instant, as the graph's instant values read. */
+const instant = z.string().min(1).max(64);
+/**
+ * `DeploymentSummaryV1`: what Services knows of one deployment beside the record its deployer
+ * declared. It names a deployment by its label and URL, never by a provider version.
+ */
+export const deploymentSummary = z.strictObject({
+    id: z.string().min(1),
+    url: z.string().min(1).max(2_048),
+    label: z.string().min(1).max(63),
+    line: z.string().min(1).max(40),
+    /** The Identity path of the organisation holding the line. */
+    owner: z.string().min(1),
+    state: z.enum(['deploying', 'active', 'retiring', 'retired', 'failed']),
+    retention: deploymentRetention,
+    createdAt: instant,
+    lastCallAt: instant.optional(),
+    expiresAt: instant.optional(),
+    retiredAt: instant.optional(),
+    retirement: deploymentRetirement.optional(),
+    signingKeyId: z.string().min(1).max(128),
+    record: deploymentRecord,
+});
+/**
+ * A deployment Services lists although this Services SDK no longer admits the record or the
+ * configuration it stores, for instance after a stricter decoder: the facts Services owns, and the
+ * record exactly as stored, any JSON value. Its consumer admits that record itself; Services never
+ * acts on such a deployment.
+ */
+export const unadmittedDeploymentSummary = deploymentSummary.extend({ record: z.unknown() });
+/**
+ * One listed deployment: a `DeploymentSummaryV1` whose record Services admits, or an unadmitted one
+ * whose record is typed as JSON.
+ */
+export const listedDeploymentSummary = z.union([deploymentSummary, unadmittedDeploymentSummary]);

package/dist/schema/modules/deployment/types/frozen-configuration.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/**
+ * The `FrozenConfigurationV1` (`@astrale-os/sdk/deployment/address`) one deployment freezes beside
+ * its build: the author's plain variables, the execution settings and the durable Workflow options
+ * it declares, the runtime, the services and dispatch namespaces it binds and the names of the
+ * secrets it binds, never their values. Its digest and the build digest make the deployment's
+ * address. This shape only bounds what a request and the graph carry; the SDK's
+ * `configurationDigest` admits its canonical form, and a hosted deployment's admission decides
+ * which bindings Services hosts (`acceptDeploymentRequest`).
+ */
+export declare const frozenConfiguration: z.ZodObject<{
+    format: z.ZodLiteral<"astrale.deployment.configuration">;
+    version: z.ZodLiteral<1>;
+    vars: z.ZodRecord<z.ZodString, z.ZodString>;
+    settings: z.ZodObject<{
+        maximumRequestBytes: z.ZodNumber;
+        invocationTimeoutMs: z.ZodNumber;
+        tokenExchange: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+            maximumLifetimeSeconds: z.ZodNumber;
+        }, z.core.$strict>]>;
+        durableOptions: z.ZodOptional<z.ZodObject<{
+            retentionMs: z.ZodOptional<z.ZodNumber>;
+            retry: z.ZodOptional<z.ZodObject<{
+                initialIntervalMs: z.ZodOptional<z.ZodNumber>;
+                maxAttempts: z.ZodOptional<z.ZodNumber>;
+                maxIntervalMs: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            stepTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    runtime: z.ZodObject<{
+        compatibilityDate: z.ZodString;
+        compatibilityFlags: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    bindings: z.ZodObject<{
+        services: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            service: z.ZodString;
+        }, z.core.$strict>>;
+        dispatchNamespaces: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodString;
+        }, z.core.$strict>>;
+        secrets: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    router: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+        service: z.ZodString;
+        hostSuffix: z.ZodString;
+        minLabels: z.ZodNumber;
+    }, z.core.$strict>]>;
+}, z.core.$strict>;
+export type FrozenConfiguration = z.output<typeof frozenConfiguration>;

package/dist/schema/modules/deployment/types/frozen-configuration.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+const name = z.string().min(1).max(128);
+const positive = z.number().int().min(1);
+/**
+ * The `FrozenConfigurationV1` (`@astrale-os/sdk/deployment/address`) one deployment freezes beside
+ * its build: the author's plain variables, the execution settings and the durable Workflow options
+ * it declares, the runtime, the services and dispatch namespaces it binds and the names of the
+ * secrets it binds, never their values. Its digest and the build digest make the deployment's
+ * address. This shape only bounds what a request and the graph carry; the SDK's
+ * `configurationDigest` admits its canonical form, and a hosted deployment's admission decides
+ * which bindings Services hosts (`acceptDeploymentRequest`).
+ */
+export const frozenConfiguration = z.strictObject({
+    format: z.literal('astrale.deployment.configuration'),
+    version: z.literal(1),
+    vars: z.record(name, z.string().max(64 * 1024)),
+    settings: z.strictObject({
+        maximumRequestBytes: z.number().int().min(1),
+        invocationTimeoutMs: z.number().int().min(1),
+        tokenExchange: z.union([
+            z.literal(false),
+            z.strictObject({ maximumLifetimeSeconds: z.number().int().min(1) }),
+        ]),
+        durableOptions: z
+            .strictObject({
+            retentionMs: positive.optional(),
+            retry: z
+                .strictObject({
+                initialIntervalMs: positive.optional(),
+                maxAttempts: positive.optional(),
+                maxIntervalMs: positive.optional(),
+            })
+                .optional(),
+            stepTimeoutMs: positive.optional(),
+        })
+            .optional(),
+    }),
+    runtime: z.strictObject({
+        compatibilityDate: z.string().min(1).max(32),
+        compatibilityFlags: z.array(name).max(64),
+    }),
+    bindings: z.strictObject({
+        services: z.array(z.strictObject({ name, service: name })).max(32),
+        dispatchNamespaces: z.array(z.strictObject({ name, namespace: name })).max(32),
+        secrets: z.array(name).max(64),
+    }),
+    router: z.union([
+        z.literal(false),
+        z.strictObject({
+            service: name,
+            hostSuffix: z.string().max(253),
+            minLabels: z.number().int().min(0).max(127),
+        }),
+    ]),
+});

package/dist/schema/modules/deployment/types/index.d.ts

@@ -1,4 +1,20 @@
+export { deploymentHosting, listDeploymentsInput, listDeploymentsOutput, } from './deployment-hosting.js';
+export type { DeploymentHosting } from './deployment-hosting.js';
 export { deploymentCommit, deploymentRecord } from './deployment-record.js';
 export type { DeploymentRecord } from './deployment-record.js';
-export { deploymentRetention, deploymentRetirement } from './deployment-retention.js';
-export type { DeploymentRetention, DeploymentRetirement } from './deployment-retention.js';
+export { deploymentRequest } from './deployment-request.js';
+export type { DeploymentRequest } from './deployment-request.js';
+export { deploymentRejection, deploymentRejectionReason, deploymentResponse, } from './deployment-response.js';
+export type { DeploymentRejection, DeploymentRejectionReason, DeploymentResponse, } from './deployment-response.js';
+export { deploymentLabel, deploymentRetention, deploymentRetirement, expirePreviewsInput, expirePreviewsOutput, lastCallsInput, lastCallsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, } from './deployment-retention.js';
+export type { DeploymentRetention, DeploymentRetirement, ExpirePreviewsResult, } from './deployment-retention.js';
+export { retireDeploymentInput, retireDeploymentOutput } from './deployment-retire.js';
+export type { RetireDeploymentResult } from './deployment-retire.js';
+export { deploymentSecretRejection, listDeploymentSecretNamesContract, setDeploymentSecretContract, } from './deployment-secret.js';
+export type { DeploymentSecretRejection } from './deployment-secret.js';
+export { deploymentSecretDigest, deploymentSecretDigests } from './deployment-secret-digest.js';
+export type { DeploymentSecretDigest } from './deployment-secret-digest.js';
+export { deploymentSummary, listedDeploymentSummary, unadmittedDeploymentSummary, } from './deployment-summary.js';
+export type { DeploymentSummary, ListedDeploymentSummary, UnadmittedDeploymentSummary, } from './deployment-summary.js';
+export { frozenConfiguration } from './frozen-configuration.js';
+export type { FrozenConfiguration } from './frozen-configuration.js';

package/dist/schema/modules/deployment/types/index.js

@@ -1,2 +1,10 @@
+export { deploymentHosting, listDeploymentsInput, listDeploymentsOutput, } from './deployment-hosting.js';
 export { deploymentCommit, deploymentRecord } from './deployment-record.js';
-export { deploymentRetention, deploymentRetirement } from './deployment-retention.js';
+export { deploymentRequest } from './deployment-request.js';
+export { deploymentRejection, deploymentRejectionReason, deploymentResponse, } from './deployment-response.js';
+export { deploymentLabel, deploymentRetention, deploymentRetirement, expirePreviewsInput, expirePreviewsOutput, lastCallsInput, lastCallsOutput, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retainInput, retainOutput, } from './deployment-retention.js';
+export { retireDeploymentInput, retireDeploymentOutput } from './deployment-retire.js';
+export { deploymentSecretRejection, listDeploymentSecretNamesContract, setDeploymentSecretContract, } from './deployment-secret.js';
+export { deploymentSecretDigest, deploymentSecretDigests } from './deployment-secret-digest.js';
+export { deploymentSummary, listedDeploymentSummary, unadmittedDeploymentSummary, } from './deployment-summary.js';
+export { frozenConfiguration } from './frozen-configuration.js';

package/dist/schema/modules/service/classes/cloudflare-worker.d.ts

@@ -61,10 +61,10 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
             }, {
                 readonly mode: 'value';
                 readonly value: {
+                    name: string;
+                } | {
                     kind: "rejected";
                     reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-                } | {
-                    name: string;
                 };
             }, "authorized", false, true, undefined>>;
             deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -288,10 +288,10 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
         }, {
             readonly mode: 'value';
             readonly value: {
+                name: string;
+            } | {
                 kind: "rejected";
                 reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-            } | {
-                name: string;
             };
         }, "authorized", false, false, undefined>>;
         deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{

package/dist/schema/modules/service/classes/service.d.ts

@@ -59,10 +59,10 @@ export declare const Service: import("@astrale-os/sdk/schema").AuthoredNodeClass
         }, {
             readonly mode: 'value';
             readonly value: {
-                name: string;
-            } | {
                 kind: "rejected";
                 reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
+            } | {
+                name: string;
             };
         }, "authorized", false, true, undefined>>;
         deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{

package/dist/schema/modules/service/functions/set-worker-secret.d.ts

@@ -4,9 +4,9 @@ export declare const setWorkerSecret: import("@astrale-os/sdk/schema").Method<im
 }, {
     readonly mode: 'value';
     readonly value: {
-        name: string;
-    } | {
         kind: "rejected";
         reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
+    } | {
+        name: string;
     };
 }, "authorized", false, false, undefined>>;

package/dist/schema/modules/service/types/legacy/service-deployment-content.js

@@ -1,6 +1,13 @@
 import { z } from 'zod';
 import { PORTABLE_BASE64_CHUNK_SIZE } from '../content/index.js';
-/** @deprecated Send the content envelope instead. Retained for deployed SDK clients. */
+/**
+ * Flat portable Base64 module and asset content, the form adapter-astrale ≤ 0.5.0-beta.157 sends.
+ * The `DeploymentContent` envelope (`identity` or `gzip`) is the canonical form; every deploy
+ * request, the Admin-hosted `CloudflareDeployment.deploy` included, decodes both to the same bytes
+ * (AM-176). Remove when no supported adapter-astrale is older than 0.5.0-beta.158.
+ *
+ * @deprecated Send the content envelope instead.
+ */
 export function legacyEncodedContent(maximumSize) {
     return Object.freeze({
         inline: { contentBase64: z.string().max(maximumSize).meta({ deprecated: true }) },