@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.14

package/README.md

@@ -345,6 +345,10 @@ did not derive.
 - **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
   script is the label that its own fields derive. A host admits the record a deploy declares with
   it before storing it, so every stored record decodes.
+- **Platform summary.** `acceptPlatformDeploymentSummary` admits the `summary:<label>` a platform
+  dispatch namespace keeps beside `record:<label>`: the deployment's `DeploymentSummaryV1` without
+  its record, owned by `platform`, named by its label, with no provider version id and no
+  `lastCallAt` or `expiresAt`. `encodePlatformDeploymentSummary` gives its one canonical text.
 
 ```ts
 import {

package/dist/deployment/adapter/adapter.d.ts

@@ -1,15 +1,10 @@
 import type { DeploymentSummaryV1, FrozenConfigurationV1 } from '../address/index.js';
 import type { Bundler } from './bundle/index.js';
-import type { ArtifactSource, DeployContext, DeployResult, InstallationTarget, PrepareContext } from './legacy/index.js';
+import type { ArtifactSource, DeployContext, DeployResult, PrepareContext } from './legacy/index.js';
 import type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
 /** What `admit` receives when `defineProject` binds an adapter to one Environment. */
 export interface AdapterEnvironmentContext {
     readonly environment: string;
-    /**
-     * @deprecated Deploy-time installation, which the canonical path refuses (CT33). Replacement:
-     * `astrale domain install <url> -i <instance>` after `astrale-domain deploy <environment>`.
-     */
-    readonly installation?: InstallationTarget;
 }
 /**
  * A provider adapter (adapter interface v2). It bundles a Build without any Environment, freezes

package/dist/deployment/adapter/legacy/adapter.d.ts

@@ -2,16 +2,6 @@ import type { AdapterEnvironmentContext } from '../adapter.js';
 import type { Bundler } from '../bundle/index.js';
 import type { DeployContext, DeployResult } from './deploy/index.js';
 import type { ArtifactSource, PrepareContext } from './prepare/index.js';
-/**
- * The instance an Environment's `installation` installs on after each deploy.
- *
- * @deprecated Deploy-time installation. Replacement: `astrale domain install <url> -i <instance>`
- * after `astrale-domain deploy <environment>`, which never installs.
- */
-export interface InstallationTarget {
-    readonly instance: string;
-    readonly identity?: string;
-}
 /**
  * A provider adapter on the contract before adapter interface v2: `prepare` places a build at one
  * stable target per Environment and `deploy` replaces that target's code in place. It declares no

package/dist/deployment/adapter/legacy/deploy/context.d.ts

@@ -1,4 +1,3 @@
-import type { InstallationTarget } from '../adapter.js';
 import type { PreparedArtifact } from '../prepare/index.js';
 /**
  * What a legacy `deploy` receives to replace one Environment's stable target in place.
@@ -9,7 +8,6 @@ import type { PreparedArtifact } from '../prepare/index.js';
 export interface DeployContext {
     readonly projectDir: string;
     readonly environment: string;
-    readonly installation?: InstallationTarget;
     /** Optional command-scoped identity override (`--as`). */
     readonly identity?: string;
     /** Optional command-scoped credential; trusted adapters must neither retain nor disclose it. */

package/dist/deployment/adapter/legacy/deploy/result.d.ts

@@ -9,7 +9,7 @@ import type { MutationKnowledge } from '../../release/index.js';
  * @deprecated Legacy `prepare`/`deploy` contract (see `../index.ts`). Replacement:
  * `ReleaseDeploymentPhase`; an immutable deployment is neither addressed nor installed by its deploy.
  */
-export type DeploymentPhase = 'prerequisite' | 'provider' | 'addressing' | 'release' | 'configuration' | 'installation' | 'readiness';
+export type DeploymentPhase = 'prerequisite' | 'provider' | 'addressing' | 'release' | 'configuration' | 'readiness';
 /**
  * What a provider reports for the stable target it replaced.
  *
@@ -43,13 +43,12 @@ export type AppliedProviderDeployment = {
  * What a legacy `deploy` changed, effect by effect.
  *
  * @deprecated Legacy `prepare`/`deploy` contract (see `../index.ts`). Replacement:
- * `FailedReleaseDeployResult.provider`; an immutable deployment's deploy installs nothing.
+ * `FailedReleaseDeployResult.provider`.
  */
 export interface DeploymentProgress {
     readonly prerequisite: MutationKnowledge;
     readonly provider: MutationKnowledge<ProviderDeploymentEvidence>;
     readonly configuration: MutationKnowledge;
-    readonly installation: MutationKnowledge;
 }
 /**
  * A stable target replaced in place and ready.

package/dist/deployment/adapter/legacy/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * The adapter contract before adapter interface v2: `prepare` places a build at one stable target
- * per Environment, `deploy` replaces that target's code in place and may install it, and the
- * stable target serves a v3 Publication under an issuer bound to it for life.
+ * per Environment, `deploy` replaces that target's code in place, and the stable target serves a
+ * v3 Publication under an issuer bound to it for life. Neither installs anything.
  *
  * @deprecated Replacement: `Adapter` (adapter interface v2): beside the same `bundler`, `configure`,
  * `placement` and `deployRelease`, which deploys one sealed release as one immutable deployment,
@@ -11,14 +11,16 @@
  * `astrale-domain dev` run through these operations:
  * - adapter-cloudflare direct mode (`route`, `workerName`, `identityIssuer`, `addressing`,
  *   `signingIdentity`, or no `namespace`), which serves the configurations of domains ai-gateway,
- *   closing, grc, integrations and issues (until SV15), shell (until SH2), the Services
- *   `development` environment (until SV9) and ui:domain (until UI1);
+ *   closing, grc, integrations and issues (until SV15), domains organization (until it leaves
+ *   direct mode, AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9)
+ *   and frozen `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3`
+ *   (until D22), and ui:domain (until UI1);
  * - adapter-astrale, until S8 gives it `deployRelease`.
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33); it deletes
- * these types with `prepare`/`deploy`, `src/deployment/release/legacy` and the stable-target CLI
- * path.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); it deletes these types with `prepare`/`deploy`, `src/deployment/release/legacy`
+ * and the stable-target CLI path.
  */
-export type { InstallationTarget, LegacyAdapter, LegacyAdapterInput } from './adapter.js';
+export type { LegacyAdapter, LegacyAdapterInput } from './adapter.js';
 export type * from './prepare/index.js';
 export type * from './deploy/index.js';

package/dist/deployment/adapter/legacy/prepare/context.d.ts

@@ -1,7 +1,6 @@
 import type { Build } from '../../../build/index.js';
 import type { ResolvedRuntimeReference } from '../../../runtime/index.js';
 import type { Bundle } from '../../bundle/index.js';
-import type { InstallationTarget } from '../adapter.js';
 /**
  * What `prepare` receives to produce the artifact of one Environment's stable target.
  *
@@ -11,7 +10,6 @@ import type { InstallationTarget } from '../adapter.js';
 export interface PrepareContext<BuildValue extends Build = Build> {
     readonly projectDir: string;
     readonly environment: string;
-    readonly installation?: InstallationTarget;
     /**
      * Preparation purpose. Remote development and one-shot deployment both
      * prepare complete release artifacts. Omitted by older custom callers means

package/dist/deployment/adapter/release/context.d.ts

@@ -1,9 +1,19 @@
 import type { DeploymentCommitV1, FrozenConfigurationV1, LineAddressing } from '../../address/index.js';
 import type { Release } from '../../release/index.js';
 import type { Bundle } from '../bundle/index.js';
-/** What `configure` receives: the Environment whose configuration it freezes, nothing else. */
+/**
+ * What `configure` receives: the Environment whose configuration it freezes, and the names of the
+ * secrets its deployment binds. Never a secret value: a rotated value is not another configuration,
+ * a name added or removed is.
+ */
 export interface ConfigureContext {
     readonly environment: string;
+    /**
+     * The names of the Environment's current secrets (the adapter's `secretsFile`), sorted and
+     * unique: exactly the secrets `deployRelease` receives, which the configuration declares in
+     * `bindings.secrets`.
+     */
+    readonly secrets: readonly string[];
 }
 /**
  * Where the host places the deployments of one Environment. `routingDomain` is the DNS name every
@@ -56,7 +66,11 @@ export interface ReleaseDeployContext {
      * `DomainRelease` v4 the deployment serves at `release.json`, its `url` the deployment URL.
      */
     readonly release: Release;
-    /** The commit the deployment is built from, as its deployment record declares it. */
+    /**
+     * The commit this deploy runs from, which the record of a deployment it creates declares. The
+     * label does not cover it: a reused deployment keeps the record, and so the commit, of the deploy
+     * that created it, and an adapter never refuses a reuse for another commit.
+     */
     readonly commit: DeploymentCommitV1 | null;
     /** Parent-owned lifecycle cancellation shared by every provider effect. */
     readonly signal: AbortSignal;

package/dist/deployment/address/index.d.ts

@@ -2,4 +2,4 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, type DeploymentCommitV1, type DeploymentRecordV1, } from './record.js';
-export type { DeploymentSummaryV1 } from './summary.js';
+export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, type DeploymentSummaryV1, type PlatformDeploymentSummaryV1, } from './summary.js';

package/dist/deployment/address/index.js

@@ -2,3 +2,4 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, } from './record.js';
+export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, } from './summary.js';

package/dist/deployment/address/summary.d.ts

@@ -24,3 +24,33 @@ export interface DeploymentSummaryV1 {
     readonly signingKeyId: string;
     readonly record: DeploymentRecordV1;
 }
+/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
+export declare const PLATFORM_OWNER = "platform";
+/**
+ * `summary:<label>` in the routing KV of a platform dispatch namespace (CT20, AM-131): the
+ * `DeploymentSummaryV1` of one deployment without its record, which stays at `record:<label>`.
+ *
+ * Its writers are the deployer (`cloudflare({ namespace })`), which writes it once at activation,
+ * before `record:<label>`, then marks it published (`retain`), and the platform retirement tooling
+ * (SV6), which records a withdrawal. So it names the deployment by its label (`id` is the label),
+ * is owned by `platform`, is `active` until withdrawn, and carries no `lastCallAt` or `expiresAt`:
+ * nothing on the platform namespace keeps those clocks, and listings read them from the calls
+ * dataset (AM-133). It never carries a provider version id or a secret digest: an in-place secret
+ * write mints a new version id, which identifies nothing (OPS-2 X1).
+ */
+export type PlatformDeploymentSummaryV1 = Omit<DeploymentSummaryV1, 'record' | 'lastCallAt' | 'expiresAt' | 'state' | 'retirement'> & {
+    readonly state: 'active' | 'retiring' | 'retired';
+    readonly retirement?: 'withdrawn';
+};
+/**
+ * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
+ * provider version id or a clock among them; so is a summary whose id, line or URL is not its
+ * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
+ * meets a refused summary lists that label apart, never acting on it.
+ */
+export declare function acceptPlatformDeploymentSummary(input: unknown): PlatformDeploymentSummaryV1;
+/**
+ * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
+ * one summary has one text, so a writer that reads it back compares texts.
+ */
+export declare function encodePlatformDeploymentSummary(summary: PlatformDeploymentSummaryV1): string;

package/dist/deployment/address/summary.js

@@ -1 +1,117 @@
-export {};
+import { json } from '@astrale-os/kernel-dsl/value';
+import { deploymentUrl, parseDeploymentLabel } from './label.js';
+/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
+export const PLATFORM_OWNER = 'platform';
+const REQUIRED = [
+    'id',
+    'url',
+    'label',
+    'line',
+    'owner',
+    'state',
+    'retention',
+    'createdAt',
+    'signingKeyId',
+];
+const RETIREMENT = ['retiredAt', 'retirement'];
+const STATES = ['active', 'retiring', 'retired'];
+const RETENTIONS = ['preview', 'published'];
+/** An instant as `Date.prototype.toISOString` writes it, in UTC. */
+const INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+/** An RFC 7638 JWK thumbprint: the base64url SHA-256 of the public key, 43 characters. */
+const KEY_ID = /^[A-Za-z0-9_-]{43}$/u;
+/**
+ * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
+ * provider version id or a clock among them; so is a summary whose id, line or URL is not its
+ * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
+ * meets a refused summary lists that label apart, never acting on it.
+ */
+export function acceptPlatformDeploymentSummary(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid('members');
+    const value = input;
+    const keys = Reflect.ownKeys(value);
+    const retired = RETIREMENT.some((key) => Object.hasOwn(value, key));
+    const expected = retired ? [...REQUIRED, ...RETIREMENT] : REQUIRED;
+    if (keys.length !== expected.length || expected.some((key) => !Object.hasOwn(value, key))) {
+        invalid('members');
+    }
+    const label = text(value.label, 'label');
+    let line;
+    try {
+        line = parseDeploymentLabel(label).line;
+    }
+    catch {
+        invalid('label');
+    }
+    if (value.id !== label)
+        invalid('id');
+    if (value.line !== line)
+        invalid('line');
+    const url = text(value.url, 'url');
+    if (!sameDeploymentUrl(url, label))
+        invalid('url');
+    if (value.owner !== PLATFORM_OWNER)
+        invalid('owner');
+    const state = value.state;
+    if (typeof state !== 'string' || !STATES.includes(state))
+        invalid('state');
+    if (retired !== (state !== 'active'))
+        invalid('state');
+    const retention = value.retention;
+    if (typeof retention !== 'string' || !RETENTIONS.includes(retention))
+        invalid('retention');
+    const createdAt = instant(value.createdAt, 'createdAt');
+    const signingKeyId = text(value.signingKeyId, 'signingKeyId');
+    if (!KEY_ID.test(signingKeyId))
+        invalid('signingKeyId');
+    if (retired && value.retirement !== 'withdrawn')
+        invalid('retirement');
+    return Object.freeze({
+        id: label,
+        url,
+        label,
+        line,
+        owner: PLATFORM_OWNER,
+        state: state,
+        retention: retention,
+        createdAt,
+        signingKeyId,
+        ...(retired
+            ? { retiredAt: instant(value.retiredAt, 'retiredAt'), retirement: 'withdrawn' }
+            : {}),
+    });
+}
+/**
+ * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
+ * one summary has one text, so a writer that reads it back compares texts.
+ */
+export function encodePlatformDeploymentSummary(summary) {
+    return json.serialize(acceptPlatformDeploymentSummary(summary));
+}
+/** Whether `url` is exactly `https://<label>.<routing domain>` for some routing domain. */
+function sameDeploymentUrl(url, label) {
+    const prefix = `https://${label}.`;
+    if (!url.startsWith(prefix))
+        return false;
+    try {
+        return deploymentUrl(label, url.slice(prefix.length)) === url;
+    }
+    catch {
+        return false;
+    }
+}
+function text(input, member) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid(member);
+    return input;
+}
+function instant(input, member) {
+    const value = text(input, member);
+    if (!INSTANT.test(value) || new Date(value).toISOString() !== value)
+        invalid(member);
+    return value;
+}
+function invalid(member) {
+    throw new TypeError(`Platform deployment summary has invalid ${member}.`);
+}

package/dist/deployment/build/index.d.ts

@@ -2,6 +2,6 @@ export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, type BuildMaterial, type GeneratedBuildMaterial, } from './material.js';
 export type { Build } from './build.js';
-export { buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, type BuildDigest, type BuildManifestInput, type BuildManifestV1, } from './manifest.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, type BuildDigest, type BuildManifestInput, type BuildManifestV1, } from './manifest.js';
 export * as frontend from './frontend/index.js';
 export type { BuildBundle, BuildSchema } from './schema.js';

package/dist/deployment/build/index.js

@@ -1,5 +1,5 @@
 export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, } from './material.js';
-export { buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, } from './manifest.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, } from './manifest.js';
 export * as frontend from './frontend/index.js';

package/dist/deployment/build/manifest.d.ts

@@ -51,4 +51,9 @@ export interface BuildManifestInput {
 export declare function buildManifest(input: BuildManifestInput): BuildManifestV1;
 /** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
 export declare function buildDigest(manifest: BuildManifestV1): BuildDigest;
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export declare function acceptBuildDigest(input: unknown): BuildDigest;
 export {};

package/dist/deployment/build/manifest.js

@@ -30,6 +30,16 @@ export function buildManifest(input) {
 export function buildDigest(manifest) {
     return identify(json.encode(admit(manifest)), MANIFEST_MEDIA_TYPE).digest;
 }
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export function acceptBuildDigest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input)) {
+        throw new TypeError('Build digest must be sha256: followed by 64 lowercase hex digits.');
+    }
+    return input;
+}
 function admit(input) {
     if (input === null || typeof input !== 'object')
         invalid();

package/dist/deployment/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, InstallationTarget, LegacyAdapter, LegacyAdapterInput, ListContext, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
+export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { deploy } from './deploy.js';

package/dist/deployment/release/legacy/index.d.ts

@@ -11,19 +11,24 @@
  * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare and adapter-astrale,
  *   whose `DeployResult.release` is this Release) and the stable Worker that assembles its Release
  *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
- *   integrations and issues (until SV15), shell (until SH2), the Services `development`
- *   environment (until SV9) and ui:domain (until UI1);
- * - the SDK's serving surface, typed on this Release until S4b serves the v4 Release: `serve` and
- *   `createService` (`execution/service`), runtime loading (`execution/runtime/load.ts`),
- *   invocation admission (`execution/invocation/admission/authentication.ts`), Domain identity
- *   and delivery (`execution/identity`), preflight (`deployment/verify/preflight/publication.ts`)
- *   and readiness (`deployment/verify/readiness`);
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
  * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
  *   adapter-cloudflare direct mode (`identityIssuer`).
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33) and S4b serves
- * the v4 Release; canonical deploys reach adapters through `deployRelease` (S7a, CT23), and D10
- * deletes `prepare`/`deploy` and their `DeployResult`.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
  */
 export { assemble } from './assemble.js';
 export { isRelease } from './admission.js';

package/dist/deployment/release/legacy/index.js

@@ -11,19 +11,24 @@
  * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare and adapter-astrale,
  *   whose `DeployResult.release` is this Release) and the stable Worker that assembles its Release
  *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
- *   integrations and issues (until SV15), shell (until SH2), the Services `development`
- *   environment (until SV9) and ui:domain (until UI1);
- * - the SDK's serving surface, typed on this Release until S4b serves the v4 Release: `serve` and
- *   `createService` (`execution/service`), runtime loading (`execution/runtime/load.ts`),
- *   invocation admission (`execution/invocation/admission/authentication.ts`), Domain identity
- *   and delivery (`execution/identity`), preflight (`deployment/verify/preflight/publication.ts`)
- *   and readiness (`deployment/verify/readiness`);
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
  * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
  *   adapter-cloudflare direct mode (`identityIssuer`).
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33) and S4b serves
- * the v4 Release; canonical deploys reach adapters through `deployRelease` (S7a, CT23), and D10
- * deletes `prepare`/`deploy` and their `DeployResult`.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
  */
 export { assemble } from './assemble.js';
 export { isRelease } from './admission.js';

package/dist/deployment/verify/readiness/deployment.js

@@ -15,23 +15,14 @@ export function verifyDeployment(artifact, input) {
             progress.provider.kind !== 'applied' ||
             progress.provider.evidence.issuer === undefined ||
             !terminal(progress.prerequisite) ||
-            !terminal(progress.configuration) ||
-            !terminal(progress.installation)) {
+            !terminal(progress.configuration)) {
             invalid();
         }
         return Object.freeze({ status: 'ready', phase: 'complete', progress, release });
     }
     if (input.status === 'failed') {
         exact(input, ['status', 'phase', 'progress', 'error'], ['release']);
-        if (![
-            'prerequisite',
-            'provider',
-            'addressing',
-            'release',
-            'configuration',
-            'installation',
-            'readiness',
-        ].includes(input.phase) ||
+        if (!['prerequisite', 'provider', 'addressing', 'release', 'configuration', 'readiness'].includes(input.phase) ||
             !(input.error instanceof Error)) {
             invalid();
         }
@@ -59,12 +50,11 @@ function verifyRelease(artifact, release) {
 function verifyProgress(artifact, input, release) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    exact(input, ['prerequisite', 'provider', 'configuration', 'installation']);
+    exact(input, ['prerequisite', 'provider', 'configuration']);
     return Object.freeze({
         prerequisite: knowledge(input.prerequisite),
         provider: providerKnowledge(artifact, input.provider, release),
         configuration: knowledge(input.configuration),
-        installation: knowledge(input.installation),
     });
 }
 function providerKnowledge(artifact, input, release) {

package/dist/deployment/verify/readiness/fetch.d.ts

@@ -0,0 +1,13 @@
+export type ReadinessFetch = (input: string, init: {
+    readonly redirect: 'error';
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+export interface ReadinessOptions {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}
+export declare const MAXIMUM_DOCUMENT_BYTES: number;
+export declare const MAXIMUM_BUNDLE_BYTES: number;
+export declare function fetchRequired(fetcher: ReadinessFetch, url: string, signal: AbortSignal | undefined): Promise<Response>;
+export declare function bounded(response: Response, url: string, maximum: number): Promise<ArrayBuffer>;
+export declare function text(response: Response, url: string, maximum: number): Promise<string>;

package/dist/deployment/verify/readiness/fetch.js

@@ -0,0 +1,26 @@
+export const MAXIMUM_DOCUMENT_BYTES = 1024 * 1024;
+export const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
+export async function fetchRequired(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    return response;
+}
+export async function bounded(response, url, maximum) {
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > maximum)
+        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
+    return bytes;
+}
+export async function text(response, url, maximum) {
+    const bytes = await bounded(response, url, maximum);
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
+    }
+}

package/dist/deployment/verify/readiness/identity.d.ts

@@ -1,7 +1,4 @@
-import type { Addressing } from '../../release/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { IssuerId } from '../../../platform/auth/index.js';
+import type { ReadinessOptions } from './fetch.js';
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export declare function verifyIdentity(addressing: Addressing, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export declare function verifyIdentity(serving: IssuerId, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/identity.js

@@ -1,10 +1,10 @@
 import { issuer } from '@astrale-os/kernel-protocol';
 const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export async function verifyIdentity(addressing, options = {}) {
+export async function verifyIdentity(serving, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
-    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const configurationUrl = new URL(issuer.paths(serving).configuration, serving);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), serving);
     const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
     if (keys.keys.length === 0)
         throw new Error('Serving issuer publishes no signing keys.');

package/dist/deployment/verify/readiness/index.d.ts

@@ -1,10 +1,14 @@
-import type { Release } from '../../release/legacy/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { Release } from '../../release/index.js';
+import type * as legacy from '../../release/legacy/index.js';
+import type { ReadinessOptions } from './fetch.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication, type ReadinessFetch } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
-export declare function readiness(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export type { ReadinessFetch, ReadinessOptions } from './fetch.js';
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
+export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;