@astrale-os/adapter-cloudflare 0.5.0-beta.177 → 0.5.0-beta.178

package/README.md

@@ -75,11 +75,14 @@ Every line is readable. Namespace mode is a thin layer over the hosting kit belo
   else. Its tags name its artifact (build digest), line and key; never `astrale-service`, which is
   Services'.
 - **Activation.** The deploy writes `record:<label>`, whose presence makes the dispatcher route the
-  label; it never holds a provider version or a secret digest. Readiness then waits, bounded,
-  until the URL serves the sealed release from the provider version the upload created.
+  label: the canonical `DeploymentRecordV1`, published through the kit's opaque record with its
+  media type, which the dispatcher serves at `/.well-known/astrale/deployment.json`. It never holds
+  a provider version or a secret digest. Readiness then waits, bounded, until the URL serves the
+  sealed release from the provider version the upload created.
 - **Reuse.** A redeploy of the same release finds the script under its label. It is reused only
-  when its artifact and line tags and its record name this build and configuration (or, when an
-  interrupted deploy left it unactivated, when it binds exactly this configuration). Then only that
+  when its artifact and line tags and its record name this build and configuration (only the
+  record's commit may differ: the deployment keeps the record it was first activated with), or,
+  when an interrupted deploy left it unactivated, when it binds exactly this configuration. Then only that
   script's declared secrets are rewritten in place, and readiness waits for the version the
   rewrite minted. Anything else is a `deployment-conflict`, refused with nothing written; no other
   deployment is ever touched. A `summary:<label>` an older adapter wrote is ignored.
@@ -112,21 +115,29 @@ Node and inside a Worker (`fetch` and WebCrypto only).
 - **Client.** `CloudflareClient`: bounded bodies, `Retry-After`/429 waits by policy
   (`DEFAULT_RATE_LIMIT`, `OPERATOR_RATE_LIMIT` or none), timeouts and a deadline, typed
   `CloudflareApiError`s (`kind`, `status`, `codes`), cursor and numbered pagination, multipart
-  forms and raw KV text.
-- **Routing KV.** `RoutingKv` (by title or id) and the contract: `record:<label>` (canonical
-  `DeploymentRecordV1`, written once; re-publication only for the same release, `sameRelease`),
-  `retirement:<label>` (`withdrawn`), `current:<name>` (one of the name's labels), `cron:<name>`
-  (canonical UTC crons). Every write is read back before it counts.
+  forms, raw KV text and bytes.
+- **Routing KV.** `RoutingKv` (by title or id) and the contract: `record:<label>` (the deployment's
+  record, opaque bytes with their media type in the value's metadata, `{"contentType":...}`, or
+  `-` with `{"contentType":null}` for a deployment that publishes none; written once and kept only
+  for the same bytes and media type), `retirement:<label>` (`withdrawn`), `current:<name>` (one of
+  the name's labels), `cron:<name>` (canonical UTC crons). A record written before records were
+  opaque has no metadata: it is a canonical `DeploymentRecordV1`, read and served as one. Every
+  write is read back before it counts.
 - **Scripts.** `deploymentBindings`, `deploymentTags` (with a host's extra tags),
   `uploadDeploymentScript` (create-only, every module kind, assets in parallel),
   `observeScript`, `scriptSettings`, `scriptSecretNames`, `putScriptSecret`, `deleteScript`, and
   `createSigningIdentity` (WebCrypto Ed25519).
-- **Lifecycle.** `activateDeployment`, `promoteDeployment`, `replaceSchedules`, two-phase retirement
+- **Lifecycle.** `activateDeployment` (a label and its record, `WorkerRecord` of
+  `@astrale-os/sdk/deployment/worker`, or `null`), `readRecord`, `promoteDeployment`,
+  `replaceSchedules`, two-phase retirement
   (`markRetired`, then `completeRetirement` once `retirementVisible` sees the dispatcher answer
   `DEPLOYMENT_RETIRED`), `waitForReadiness` through the public URL or a dispatch binding, and
   `listLineDeployments`.
 - **Dispatcher.** Plain ES modules shipped with the package (`dispatcherModules()`), routing a label
-  to its script, a name to `current:<name>`, and firing `cron:<name>` on schedule. A host prepends
+  to its script, a name to `current:<name>`, and firing `cron:<name>` on schedule. It serves a
+  label's record at `/.well-known/astrale/deployment.json`, its bytes and media type as published
+  (immutable, `405` but for `GET` and `HEAD`), and hands that path to a deployment that publishes
+  none. A host prepends
   its own routing and schedule targets with `createDispatcher(extension)` in its own `index.mjs`,
   without forking it. The public never reaches `/__scheduled`; nothing in the generated Worker
   serves it yet.
@@ -232,18 +243,11 @@ until the adapter versions are aligned.
 Services receives the placed modules as they are, so there the digest names the bytes the
 deployment runs. Direct mode runs `wrangler deploy`, which bundles the placed modules again: there
 the digest names the portable Worker the deployment was made from, not the bytes Cloudflare runs.
-A host that receives a Worker upload recomputes the digest from the exact upload with the same
-function:
-
-```ts
-import { workerBuildManifest } from '@astrale-os/adapter-cloudflare/release'
-import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest'
-
-const digest = buildDigest(workerBuildManifest({ origin, revision, bundle, entry, modules, assets }))
-```
-
-Modules keep their uploaded name and an asset `/<path>` is the file `assets/<path>`. The bundler
-version names this layout, not a package release. Both subpaths are runtime-safe.
+A host that receives a Worker upload recomputes the digest from the exact upload with
+`workerBuildDigest` (`@astrale-os/sdk/deployment/worker`), given the members of the Bundle's build
+manifest its deployer declares (`format`, `version`, `origin`, `schema`, `bundler`): modules keep
+their uploaded name and an asset `/<path>` is the file `assets/<path>`, so the digest is the
+Bundle's own. The bundler version names this layout, not a package release.
 
 ## Material for a custom Worker entrypoint
 

package/dist/build/index.d.ts

@@ -4,6 +4,7 @@ export { loadWorkerArtifact } from './worker/index.js';
 export type { WorkerArtifact } from './worker/index.js';
 export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, type BundleUpload, } from './worker/upload.js';
 export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
+export { encodeWorkerSettings, SETTINGS_BINDING } from '../worker/settings.js';
 export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';

package/dist/build/index.js

@@ -3,6 +3,7 @@ export { cloudflareWorkerBundler } from './bundler.js';
 export { loadWorkerArtifact } from './worker/index.js';
 export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, } from './worker/upload.js';
 export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
+export { encodeWorkerSettings, SETTINGS_BINDING } from '../worker/settings.js';
 export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';

package/dist/hosting/activation.d.ts

@@ -1,15 +1,22 @@
-import type { DeploymentRecordV1 } from '@astrale-os/sdk/deployment/address';
+import type { WorkerRecord } from '@astrale-os/sdk/deployment/worker';
 import type { RoutingKv } from './kv.js';
 /**
- * Activate one deployment: publish its record at `record:<label>`, which the dispatcher reads to
- * route the label and serves at `/.well-known/astrale/deployment.json`. A record never changes once
- * published: a record already there is kept and answered when it declares the same release
- * (`sameRelease`, so only its commit may differ), and refused (`deployment-conflict`) otherwise,
- * without any write.
+ * Activate one deployment: write `record:<label>`, which the dispatcher reads to route the label,
+ * with the record its deployer publishes (opaque bytes and their media type, served verbatim at
+ * `/.well-known/astrale/deployment.json`), or `null` for a deployment that publishes none. A
+ * record never changes once published: one already there is kept and answered when it is the same
+ * record (same media type, same bytes, or both none), and refused (`deployment-conflict`)
+ * otherwise, without any write.
  */
-export declare function activateDeployment(kv: RoutingKv, record: DeploymentRecordV1): Promise<DeploymentRecordV1>;
-/** The record a label was activated with, admitted, or undefined when it is not activated. */
-export declare function readRecord(kv: RoutingKv, label: string): Promise<DeploymentRecordV1 | undefined>;
+export declare function activateDeployment(kv: RoutingKv, label: string, record: WorkerRecord | null): Promise<WorkerRecord | null>;
+/**
+ * The record a label was activated with: the record, `null` when the deployment publishes none,
+ * or undefined when the label is not activated. A record written before records were opaque,
+ * without metadata, is the `DeploymentRecordV1` it holds, with that media type.
+ */
+export declare function readRecord(kv: RoutingKv, label: string): Promise<WorkerRecord | null | undefined>;
+/** Whether two activations publish the same record (or both none). */
+export declare function sameRecord(left: WorkerRecord | null, right: WorkerRecord | null): boolean;
 /**
  * Point a name (a deployment line) at the deployment its URL `https://<name>.<routing domain>`
  * serves: `current:<name>` = `label`, or no deployment when `label` is null (the key is deleted).

package/dist/hosting/activation.js

@@ -1,29 +1,66 @@
-import { cronKey, currentKey, decodeCurrent, decodeRecord, decodeSchedules, encodeRecord, encodeSchedules, isLabelOf, recordKey, sameRelease, } from './kv.js';
+import { DEPLOYMENT_RECORD_MEDIA_TYPE, parseDeploymentLabel, } from '@astrale-os/sdk/deployment/address';
+import { acceptWorkerRecord, sameWorkerRecord } from '@astrale-os/sdk/deployment/worker';
+import { cronKey, currentKey, decodeCurrent, decodeSchedules, encodeSchedules, isLabelOf, recordKey, } from './kv.js';
 import { HostingRefusal } from './refusal.js';
+/** What `record:<label>` holds for a deployment that publishes no record: never served. */
+const NO_RECORD = new TextEncoder().encode('-');
 /**
- * Activate one deployment: publish its record at `record:<label>`, which the dispatcher reads to
- * route the label and serves at `/.well-known/astrale/deployment.json`. A record never changes once
- * published: a record already there is kept and answered when it declares the same release
- * (`sameRelease`, so only its commit may differ), and refused (`deployment-conflict`) otherwise,
- * without any write.
+ * Activate one deployment: write `record:<label>`, which the dispatcher reads to route the label,
+ * with the record its deployer publishes (opaque bytes and their media type, served verbatim at
+ * `/.well-known/astrale/deployment.json`), or `null` for a deployment that publishes none. A
+ * record never changes once published: one already there is kept and answered when it is the same
+ * record (same media type, same bytes, or both none), and refused (`deployment-conflict`)
+ * otherwise, without any write.
  */
-export async function activateDeployment(kv, record) {
-    const label = record.providerScript;
-    const text = encodeRecord(record);
+export async function activateDeployment(kv, label, record) {
+    parseDeploymentLabel(label);
+    const published = record === null ? null : acceptWorkerRecord(record);
     const stored = await readRecord(kv, label);
     if (stored !== undefined) {
-        if (!sameRelease(stored, record)) {
+        if (!sameRecord(stored, published)) {
             throw new HostingRefusal('deployment-conflict', `Another record is already published for ${label}; nothing was written.`);
         }
         return stored;
     }
-    await kv.put(recordKey(label), text, 'application/json');
-    return record;
+    await kv.putWithMetadata(recordKey(label), published?.bytes ?? NO_RECORD, {
+        contentType: published?.contentType ?? null,
+    });
+    return published;
 }
-/** The record a label was activated with, admitted, or undefined when it is not activated. */
+/**
+ * The record a label was activated with: the record, `null` when the deployment publishes none,
+ * or undefined when the label is not activated. A record written before records were opaque,
+ * without metadata, is the `DeploymentRecordV1` it holds, with that media type.
+ */
 export async function readRecord(kv, label) {
-    const text = await kv.get(recordKey(label));
-    return text === undefined ? undefined : decodeRecord(text, label);
+    const stored = await kv.getWithMetadata(recordKey(label));
+    return stored === undefined ? undefined : storedRecord(stored, label);
+}
+/** Admit what `record:<label>` holds, value and metadata, as the dispatcher serves it. */
+function storedRecord(stored, label) {
+    const { metadata } = stored;
+    let contentType = DEPLOYMENT_RECORD_MEDIA_TYPE;
+    if (metadata !== null) {
+        if (typeof metadata !== 'object' ||
+            Array.isArray(metadata) ||
+            Reflect.ownKeys(metadata).length !== 1 ||
+            !Object.hasOwn(metadata, 'contentType')) {
+            throw new HostingRefusal('record-invalid', `The record of ${label} has invalid metadata.`);
+        }
+        contentType = metadata.contentType;
+        if (contentType === null)
+            return null;
+    }
+    try {
+        return acceptWorkerRecord({ contentType: contentType, bytes: stored.bytes });
+    }
+    catch (cause) {
+        throw new HostingRefusal('record-invalid', `The record of ${label} is not a record: ${String(cause)}`);
+    }
+}
+/** Whether two activations publish the same record (or both none). */
+export function sameRecord(left, right) {
+    return left === null || right === null ? left === right : sameWorkerRecord(left, right);
 }
 /**
  * Point a name (a deployment line) at the deployment its URL `https://<name>.<routing domain>`

package/dist/hosting/client.d.ts

@@ -126,6 +126,11 @@ export declare class CloudflareClient {
         readonly text: string;
         readonly contentType: string;
     }): Promise<string | undefined>;
+    /**
+     * A raw GET of bytes, for a KV value whose bytes are its meaning (a deployment record): the
+     * response body, or undefined when it answers 404. Bodies are bounded to 1 MiB.
+     */
+    bytes(path: string): Promise<Uint8Array | undefined>;
     private send;
     private request;
     /** The request timeout, bounded by the deadline and the caller's cancellation. */

package/dist/hosting/client.js

@@ -204,6 +204,30 @@ export class CloudflareClient {
             throw failure(method, path, response.status, decodeEnvelope(text));
         return text;
     }
+    /**
+     * A raw GET of bytes, for a KV value whose bytes are its meaning (a deployment record): the
+     * response body, or undefined when it answers 404. Bodies are bounded to 1 MiB.
+     */
+    async bytes(path) {
+        const response = await this.request('GET', path, {});
+        if (response.status === 404) {
+            await discard(response);
+            return undefined;
+        }
+        let bytes;
+        try {
+            bytes = await boundedBytes(response, MAXIMUM_TEXT_RESPONSE_BYTES);
+        }
+        catch (cause) {
+            if (cause instanceof CloudflareApiError)
+                throw cause;
+            this.unavailable('GET', path, cause);
+        }
+        if (!response.ok) {
+            throw failure('GET', path, response.status, decodeEnvelope(new TextDecoder().decode(bytes)));
+        }
+        return bytes;
+    }
     async send(method, path, input, allowEmptySuccess = false) {
         const response = await this.request(method, path, input);
         const text = await this.read(response, MAXIMUM_JSON_RESPONSE_BYTES, method, path);
@@ -389,6 +413,9 @@ function describe(path) {
     return 'request';
 }
 async function boundedText(response, maximumBytes) {
+    return new TextDecoder().decode(await boundedBytes(response, maximumBytes));
+}
+async function boundedBytes(response, maximumBytes) {
     const declared = response.headers.get('content-length');
     if (declared !== null) {
         const bytes = Number(declared);
@@ -398,11 +425,10 @@ async function boundedText(response, maximumBytes) {
         }
     }
     if (response.body === null)
-        return '';
+        return new Uint8Array();
     const reader = response.body.getReader();
-    const decoder = new TextDecoder();
+    const parts = [];
     let size = 0;
-    let text = '';
     for (;;) {
         const part = await reader.read();
         if (part.done)
@@ -417,9 +443,15 @@ async function boundedText(response, maximumBytes) {
             }
             throw new CloudflareApiError('upstream', 'Cloudflare response body is too large.');
         }
-        text += decoder.decode(part.value, { stream: true });
+        parts.push(part.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const part of parts) {
+        bytes.set(part, offset);
+        offset += part.byteLength;
     }
-    return text + decoder.decode();
+    return bytes;
 }
 function allowedHost(base) {
     try {

package/dist/hosting/dispatcher/deployments.mjs

@@ -3,6 +3,7 @@ import { scriptMissing } from './failure.mjs'
 // @ts-check
 
 /** @typedef {import('./env.mjs').DispatcherEnvironment} DispatcherEnvironment */
+/** @typedef {{ body?: ArrayBuffer, contentType?: string }} PublishedRecord */
 
 /**
  * Every deployment label, as `@astrale-os/sdk/deployment/address` declares `DEPLOYMENT_LABEL`: an
@@ -13,8 +14,12 @@ const DEPLOYMENT_LABEL = /^(?:[a-z0-9]+(?:-[a-z0-9]+)*-)?[a-z2-7]{16}-[a-z2-7]{1
 /** The longest label a deploy gives: a line of 40 characters, a dash and the content. */
 const MAXIMUM_LABEL_LENGTH = 57
 
-/** Reserved: the dispatcher answers it from the record, and the deployment never sees it. */
+/**
+ * Where the dispatcher serves a deployment's record, which the deployment then never sees. A
+ * deployment that publishes no record answers the path itself.
+ */
 const DEPLOYMENT_RECORD_PATH = '/.well-known/astrale/deployment.json'
+/** The media type of a record written before records were opaque: a `DeploymentRecordV1`. */
 const DEPLOYMENT_RECORD_TYPE = 'application/vnd.astrale.deployment-record+json;v=1'
 const ENVELOPE_TYPE = 'application/vnd.astrale+json'
 /** The retirement probe (`retirementVisible`); it is never a call of the deployment. */
@@ -31,9 +36,10 @@ export function isDeploymentLabel(label) {
  * (`./services.mjs`). A deployer writes `record:<label>` to activate the label, and its owner
  * `retirement:<label>` to retire it; the record outlives the retirement. Every call of a retired
  * deployment answers `DEPLOYMENT_RETIRED`, whatever its path. The record endpoint is not a call:
- * the dispatcher answers it itself, and the record it serves immutable stays readable after
- * retirement. A deployment without its record is not active yet (KV is eventually consistent, so
- * a caller retries), and only an active deployment runs, as one call point when `CALLS` is bound.
+ * the dispatcher answers it itself with the record the deployer published, its bytes and its media
+ * type as written, and the record it serves immutable stays readable after retirement. A
+ * deployment without its record is not active yet (KV is eventually consistent, so a caller
+ * retries), and only an active deployment runs, as one call point when `CALLS` is bound.
  *
  * @param {Request} request
  * @param {DispatcherEnvironment} environment
@@ -44,11 +50,14 @@ export async function dispatchDeployment(request, environment, label) {
   try {
     const [retirement, record] = await Promise.all([
       environment.SCHEDULES.get(`retirement:${label}`),
-      environment.SCHEDULES.get(`record:${label}`),
+      // Only the record endpoint reads the record's bytes; a call only needs its presence.
+      url.pathname === DEPLOYMENT_RECORD_PATH
+        ? publishedRecord(environment, label)
+        : environment.SCHEDULES.get(`record:${label}`).then((value) =>
+            value === null ? null : /** @type {PublishedRecord} */ ({}),
+          ),
     ])
-    if (url.pathname === DEPLOYMENT_RECORD_PATH && record !== null) {
-      return deploymentRecordResponse(request, record)
-    }
+    if (record?.contentType !== undefined) return deploymentRecordResponse(request, record)
     if (retirement !== null) return deploymentRetiredResponse(url.origin)
     if (record === null) return inactiveDeploymentResponse(url.origin)
     if (url.pathname !== RETIREMENT_PROBE_PATH) {
@@ -61,12 +70,34 @@ export async function dispatchDeployment(request, environment, label) {
   }
 }
 
+/**
+ * What `record:<label>` holds, as the record endpoint serves it: `null` when the label is not
+ * activated, the record's bytes and media type, or no `contentType` when the deployment publishes
+ * no record. A value written without metadata, before records were opaque, is a
+ * `DeploymentRecordV1`.
+ *
+ * @param {DispatcherEnvironment} environment
+ * @param {string} label
+ * @returns {Promise<PublishedRecord | null>}
+ */
+async function publishedRecord(environment, label) {
+  const stored = await environment.SCHEDULES.getWithMetadata(`record:${label}`, 'arrayBuffer')
+  if (stored.value === null) return null
+  if (stored.metadata === null || stored.metadata === undefined) {
+    return { body: stored.value, contentType: DEPLOYMENT_RECORD_TYPE }
+  }
+  const contentType = /** @type {{ contentType?: unknown }} */ (stored.metadata).contentType
+  return typeof contentType === 'string'
+    ? { body: stored.value, contentType }
+    : { body: stored.value }
+}
+
 /**
  * The record a deployer published for this label. It never changes: the label is derived from the
- * build and the frozen configuration it records.
+ * build and the configuration of the deployment it describes.
  *
  * @param {Request} request
- * @param {string} record
+ * @param {PublishedRecord} record
  */
 function deploymentRecordResponse(request, record) {
   if (request.method !== 'GET' && request.method !== 'HEAD') {
@@ -75,10 +106,10 @@ function deploymentRecordResponse(request, record) {
       headers: { allow: 'GET, HEAD', 'cache-control': 'no-store' },
     })
   }
-  return new Response(record, {
+  return new Response(record.body, {
     status: 200,
     headers: {
-      'content-type': DEPLOYMENT_RECORD_TYPE,
+      'content-type': /** @type {string} */ (record.contentType),
       'cache-control': 'public, max-age=31536000, immutable',
     },
   })

package/dist/hosting/dispatcher/env.d.mts

@@ -23,6 +23,11 @@ export type SchedulePage =
 /** The routing KV binding (`SCHEDULES`): the dispatcher only reads it. */
 export interface RoutingKvBinding {
   get(key: string): Promise<string | null>
+  /** Read for the record endpoint only: a record's bytes and the metadata it was written with. */
+  getWithMetadata(
+    key: string,
+    type: 'arrayBuffer',
+  ): Promise<{ readonly value: ArrayBuffer | null; readonly metadata: unknown }>
   list(options: { readonly prefix: string; readonly cursor?: string }): Promise<SchedulePage>
 }
 

package/dist/hosting/index.d.ts

@@ -6,7 +6,8 @@
  * - provision once: a dispatch namespace, its routing KV, the dispatcher Worker and the wildcard
  *   ingress of the routing domain (`planHosting`, `provisionHosting`; `astrale-domain cloudflare init`);
  * - deploy: one create-only script per deployment label, activated by its record in the routing
- *   KV (`uploadDeploymentScript`, `activateDeployment`; `cloudflare({ namespace })` does it);
+ *   KV, opaque bytes the dispatcher serves verbatim (`uploadDeploymentScript`,
+ *   `activateDeployment`; `cloudflare({ namespace })` and Admin's Services do it);
  * - operate: point a name at a deployment, schedule crons, retire in two phases, list a line.
  *
  * Everything but provisioning runs in Node and inside a Worker (`fetch` and WebCrypto only).
@@ -15,11 +16,11 @@
 export { CLOUDFLARE_API_BASE, CloudflareApiError, CloudflareClient, DEFAULT_RATE_LIMIT, isNotFound, OPERATOR_RATE_LIMIT, type CloudflareClientOptions, type CloudflareFailureKind, type CloudflarePage, type RateLimitPolicy, } from './client.js';
 export { HostingRefusal } from './refusal.js';
 export { callsDataset, isWorkerName, routingKvTitle } from './names.js';
-export { CRON_PREFIX, cronKey, CURRENT_PREFIX, currentKey, decodeCurrent, decodeRecord, decodeSchedules, encodeRecord, encodeSchedules, findKvNamespace, isLabelOf, RECORD_PREFIX, recordKey, RETIREMENT_PREFIX, retirementKey, RoutingKv, sameRelease, WITHDRAWN, type RoutingKvLocator, } from './kv.js';
+export { CRON_PREFIX, cronKey, CURRENT_PREFIX, currentKey, decodeCurrent, decodeSchedules, encodeSchedules, findKvNamespace, isLabelOf, RECORD_PREFIX, recordKey, RETIREMENT_PREFIX, retirementKey, RoutingKv, WITHDRAWN, type RoutingKvLocator, } from './kv.js';
 export { ARTIFACT_TAG_PREFIX, artifactOf, ASSETS_BINDING, BUILD_DIGEST_BINDING, decodeScript, deleteScript, deploymentBindings, deploymentTags, isExistingScript, KEY_TAG_PREFIX, LINE_TAG_PREFIX, observeScript, putScriptSecret, ROUTER_BINDING, scriptPath, scriptSecretNames, scriptSettings, SETTINGS_BINDING, settingsBind, SIGNING_IDENTITY_BINDING, uploadDeploymentScript, VERSION_METADATA_BINDING, versionUuid, WORKER_URL_BINDING, type DeploymentBindingsInput, type NamespaceScript, type ScriptBinding, type ScriptModule, type ScriptSettings, type ScriptUpload, } from './script.js';
 export { uploadAssets, type ScriptAsset } from './assets.js';
 export { createSigningIdentity, type DeploymentSigningIdentity } from './identity.js';
-export { activateDeployment, promoteDeployment, readCurrent, readRecord, readSchedules, replaceSchedules, } from './activation.js';
+export { activateDeployment, promoteDeployment, readCurrent, readRecord, readSchedules, replaceSchedules, sameRecord, } from './activation.js';
 export { completeRetirement, markRetired, readRetirement, RETIREMENT_PROBE_PATH, RETIREMENT_PROBE_RETRY_MS, RETIREMENT_PROPAGATION_MS, retirementVisible, type RetirementCompletion, } from './retirement.js';
 export { dispatchFetcher, publicFetcher, VERSION_HEADER, versionFetch, waitForReadiness, type ReadinessFetcher, } from './readiness.js';
 export { listLineDeployments, type LineDeployment } from './listing.js';

package/dist/hosting/index.js

@@ -6,7 +6,8 @@
  * - provision once: a dispatch namespace, its routing KV, the dispatcher Worker and the wildcard
  *   ingress of the routing domain (`planHosting`, `provisionHosting`; `astrale-domain cloudflare init`);
  * - deploy: one create-only script per deployment label, activated by its record in the routing
- *   KV (`uploadDeploymentScript`, `activateDeployment`; `cloudflare({ namespace })` does it);
+ *   KV, opaque bytes the dispatcher serves verbatim (`uploadDeploymentScript`,
+ *   `activateDeployment`; `cloudflare({ namespace })` and Admin's Services do it);
  * - operate: point a name at a deployment, schedule crons, retire in two phases, list a line.
  *
  * Everything but provisioning runs in Node and inside a Worker (`fetch` and WebCrypto only).
@@ -15,11 +16,11 @@
 export { CLOUDFLARE_API_BASE, CloudflareApiError, CloudflareClient, DEFAULT_RATE_LIMIT, isNotFound, OPERATOR_RATE_LIMIT, } from './client.js';
 export { HostingRefusal } from './refusal.js';
 export { callsDataset, isWorkerName, routingKvTitle } from './names.js';
-export { CRON_PREFIX, cronKey, CURRENT_PREFIX, currentKey, decodeCurrent, decodeRecord, decodeSchedules, encodeRecord, encodeSchedules, findKvNamespace, isLabelOf, RECORD_PREFIX, recordKey, RETIREMENT_PREFIX, retirementKey, RoutingKv, sameRelease, WITHDRAWN, } from './kv.js';
+export { CRON_PREFIX, cronKey, CURRENT_PREFIX, currentKey, decodeCurrent, decodeSchedules, encodeSchedules, findKvNamespace, isLabelOf, RECORD_PREFIX, recordKey, RETIREMENT_PREFIX, retirementKey, RoutingKv, WITHDRAWN, } from './kv.js';
 export { ARTIFACT_TAG_PREFIX, artifactOf, ASSETS_BINDING, BUILD_DIGEST_BINDING, decodeScript, deleteScript, deploymentBindings, deploymentTags, isExistingScript, KEY_TAG_PREFIX, LINE_TAG_PREFIX, observeScript, putScriptSecret, ROUTER_BINDING, scriptPath, scriptSecretNames, scriptSettings, SETTINGS_BINDING, settingsBind, SIGNING_IDENTITY_BINDING, uploadDeploymentScript, VERSION_METADATA_BINDING, versionUuid, WORKER_URL_BINDING, } from './script.js';
 export { uploadAssets } from './assets.js';
 export { createSigningIdentity } from './identity.js';
-export { activateDeployment, promoteDeployment, readCurrent, readRecord, readSchedules, replaceSchedules, } from './activation.js';
+export { activateDeployment, promoteDeployment, readCurrent, readRecord, readSchedules, replaceSchedules, sameRecord, } from './activation.js';
 export { completeRetirement, markRetired, readRetirement, RETIREMENT_PROBE_PATH, RETIREMENT_PROBE_RETRY_MS, RETIREMENT_PROPAGATION_MS, retirementVisible, } from './retirement.js';
 export { dispatchFetcher, publicFetcher, VERSION_HEADER, versionFetch, waitForReadiness, } from './readiness.js';
 export { listLineDeployments } from './listing.js';

package/dist/hosting/kv.d.ts

@@ -1,17 +1,17 @@
-import type { DeploymentRecordV1 } from '@astrale-os/sdk/deployment/address';
 import type { CloudflareClient } from './client.js';
 /**
  * The routing KV contract every dispatcher reads (`SCHEDULES`) and every writer of the kit keeps:
  *
- * | key | value | content type |
+ * | key | value | metadata |
  * |---|---|---|
- * | `record:<label>` | RFC 8785 JSON of the label's `DeploymentRecordV1`; never rewritten | `application/json` |
- * | `retirement:<label>` | `withdrawn`; any value retires the label at the dispatcher | `text/plain` |
- * | `current:<name>` | the label a name serves now, one of `<name>-…` | `text/plain` |
- * | `cron:<name>` | JSON array of distinct canonical five-field UTC crons; deleted when empty | `application/json` |
+ * | `record:<label>` | the deployment's record, opaque bytes; `-` when it publishes none; never rewritten | `{"contentType":<its media type>}`, `{"contentType":null}` without a record |
+ * | `retirement:<label>` | `withdrawn`; any value retires the label at the dispatcher | none |
+ * | `current:<name>` | the label a name serves now, one of `<name>-…` | none |
+ * | `cron:<name>` | JSON array of distinct canonical five-field UTC crons; deleted when empty | none |
  *
- * The record of a label activates it and outlives its retirement. Workers KV has no
- * compare-and-set: every write is read back before it counts.
+ * `record:<label>` activates the label and outlives its retirement. One written before records
+ * were opaque has no metadata: it is the RFC 8785 JSON of a `DeploymentRecordV1`, served as one.
+ * Workers KV has no compare-and-set: every write is read back before it counts.
  */
 export declare const RECORD_PREFIX = "record:";
 export declare const RETIREMENT_PREFIX = "retirement:";
@@ -27,17 +27,6 @@ export declare function retirementKey(label: string): string;
 export declare function currentKey(name: string): string;
 /** The key of a name's UTC crons, which the dispatcher fires on its current deployment. */
 export declare function cronKey(name: string): string;
-/** The text `record:<label>` holds: the record admitted, as RFC 8785 canonical JSON. */
-export declare function encodeRecord(record: DeploymentRecordV1): string;
-/** Admit the text `record:<label>` holds as that label's record. */
-export declare function decodeRecord(text: string, label: string): DeploymentRecordV1;
-/**
- * Whether two records declare the same deployment: same origin, environment, release, build,
- * Schema revision, configuration and script. Only the commit may differ: a redeploy of identical
- * bytes and configuration from another commit is the same deployment, whose record keeps the
- * commit it was first activated from. This is the kit's one re-publication rule.
- */
-export declare function sameRelease(left: DeploymentRecordV1, right: DeploymentRecordV1): boolean;
 /** Admit the label `current:<name>` holds: a deployment label of that name's line. */
 export declare function decodeCurrent(text: string, name: string): string;
 /** Whether `label` is a deployment label whose line is `name`, as the dispatcher admits it. */
@@ -76,6 +65,16 @@ export declare class RoutingKv {
     get(key: string): Promise<string | undefined>;
     /** Write `text` at `key`, then read it back. */
     put(key: string, text: string, contentType: string): Promise<void>;
+    /**
+     * The bytes stored at `key` and their metadata (`null` when they were written without), or
+     * undefined when the key is absent.
+     */
+    getWithMetadata(key: string): Promise<{
+        readonly bytes: Uint8Array;
+        readonly metadata: unknown;
+    } | undefined>;
+    /** Write `bytes` at `key` with its JSON `metadata`, then read both back. */
+    putWithMetadata(key: string, bytes: Uint8Array, metadata: Readonly<Record<string, unknown>>): Promise<void>;
     /** Delete `key`, then read back its absence. */
     delete(key: string): Promise<void>;
     /**
@@ -84,6 +83,7 @@ export declare class RoutingKv {
      */
     keys(prefix: string): Promise<readonly string[]>;
     private value;
+    private path;
 }
 /** The id of the account's KV namespace with exactly this title, or undefined. */
 export declare function findKvNamespace(client: CloudflareClient, title: string): Promise<string | undefined>;