@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/README.md

@@ -345,6 +345,10 @@ did not derive.
 - **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
   script is the label that its own fields derive. A host admits the record a deploy declares with
   it before storing it, so every stored record decodes.
+- **Platform summary.** `acceptPlatformDeploymentSummary` admits the `summary:<label>` a platform
+  dispatch namespace keeps beside `record:<label>`: the deployment's `DeploymentSummaryV1` without
+  its record, owned by `platform`, named by its label, with no provider version id and no
+  `lastCallAt` or `expiresAt`. `encodePlatformDeploymentSummary` gives its one canonical text.
 
 ```ts
 import {

package/dist/deployment/adapter/adapter.d.ts

@@ -1,15 +1,10 @@
-import type { DeploymentSummaryV1, FrozenConfigurationV1 } from '../address/index.js';
+import type { FrozenConfigurationV1 } from '../address/index.js';
 import type { Bundler } from './bundle/index.js';
-import type { ArtifactSource, DeployContext, DeployResult, InstallationTarget, PrepareContext } from './legacy/index.js';
-import type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
+import type { ArtifactSource, DeployContext, DeployResult, PrepareContext } from './legacy/index.js';
+import type { ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
 /** What `admit` receives when `defineProject` binds an adapter to one Environment. */
 export interface AdapterEnvironmentContext {
     readonly environment: string;
-    /**
-     * @deprecated Deploy-time installation, which the canonical path refuses (CT33). Replacement:
-     * `astrale domain install <url> -i <instance>` after `astrale-domain deploy <environment>`.
-     */
-    readonly installation?: InstallationTarget;
 }
 /**
  * A provider adapter (adapter interface v2). It bundles a Build without any Environment, freezes
@@ -37,8 +32,11 @@ export interface Adapter<Parameters extends object = object> {
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     /** Create, or reuse, the immutable deployment of one sealed release. */
     deployRelease(parameters: Parameters, context: ReleaseDeployContext): Promise<ReleaseDeployResult>;
-    /** The deployments of one origin the host keeps for the caller. */
-    list?(parameters: Parameters, context: ListContext): Promise<readonly DeploymentSummaryV1[]>;
+    /**
+     * The deployments of one Environment of one origin the host keeps for the caller, each with
+     * where it is called. No effect at the host.
+     */
+    list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;
     /**
      * Keep one published deployment where the host has no registry principal to mark it (a platform
      * namespace). Called only after its Publication commits. Absent: the registry marks it (Admin's
@@ -66,7 +64,7 @@ export interface AdapterInput<Parameters extends object> {
     configure(parameters: Parameters, context: ConfigureContext): FrozenConfigurationV1;
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     deployRelease(parameters: Parameters, context: ReleaseDeployContext): Promise<ReleaseDeployResult>;
-    list?(parameters: Parameters, context: ListContext): Promise<readonly DeploymentSummaryV1[]>;
+    list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
     /** @deprecated Legacy direct-mode path (CT33) only. Replacement: `configure`, `placement`. */
     prepare?(parameters: Parameters, context: PrepareContext): Promise<ArtifactSource>;

package/dist/deployment/adapter/legacy/adapter.d.ts

@@ -2,16 +2,6 @@ import type { AdapterEnvironmentContext } from '../adapter.js';
 import type { Bundler } from '../bundle/index.js';
 import type { DeployContext, DeployResult } from './deploy/index.js';
 import type { ArtifactSource, PrepareContext } from './prepare/index.js';
-/**
- * The instance an Environment's `installation` installs on after each deploy.
- *
- * @deprecated Deploy-time installation. Replacement: `astrale domain install <url> -i <instance>`
- * after `astrale-domain deploy <environment>`, which never installs.
- */
-export interface InstallationTarget {
-    readonly instance: string;
-    readonly identity?: string;
-}
 /**
  * A provider adapter on the contract before adapter interface v2: `prepare` places a build at one
  * stable target per Environment and `deploy` replaces that target's code in place. It declares no

package/dist/deployment/adapter/legacy/deploy/context.d.ts

@@ -1,4 +1,3 @@
-import type { InstallationTarget } from '../adapter.js';
 import type { PreparedArtifact } from '../prepare/index.js';
 /**
  * What a legacy `deploy` receives to replace one Environment's stable target in place.
@@ -9,7 +8,6 @@ import type { PreparedArtifact } from '../prepare/index.js';
 export interface DeployContext {
     readonly projectDir: string;
     readonly environment: string;
-    readonly installation?: InstallationTarget;
     /** Optional command-scoped identity override (`--as`). */
     readonly identity?: string;
     /** Optional command-scoped credential; trusted adapters must neither retain nor disclose it. */

package/dist/deployment/adapter/legacy/deploy/result.d.ts

@@ -9,7 +9,7 @@ import type { MutationKnowledge } from '../../release/index.js';
  * @deprecated Legacy `prepare`/`deploy` contract (see `../index.ts`). Replacement:
  * `ReleaseDeploymentPhase`; an immutable deployment is neither addressed nor installed by its deploy.
  */
-export type DeploymentPhase = 'prerequisite' | 'provider' | 'addressing' | 'release' | 'configuration' | 'installation' | 'readiness';
+export type DeploymentPhase = 'prerequisite' | 'provider' | 'addressing' | 'release' | 'configuration' | 'readiness';
 /**
  * What a provider reports for the stable target it replaced.
  *
@@ -43,13 +43,12 @@ export type AppliedProviderDeployment = {
  * What a legacy `deploy` changed, effect by effect.
  *
  * @deprecated Legacy `prepare`/`deploy` contract (see `../index.ts`). Replacement:
- * `FailedReleaseDeployResult.provider`; an immutable deployment's deploy installs nothing.
+ * `FailedReleaseDeployResult.provider`.
  */
 export interface DeploymentProgress {
     readonly prerequisite: MutationKnowledge;
     readonly provider: MutationKnowledge<ProviderDeploymentEvidence>;
     readonly configuration: MutationKnowledge;
-    readonly installation: MutationKnowledge;
 }
 /**
  * A stable target replaced in place and ready.

package/dist/deployment/adapter/legacy/index.d.ts

@@ -1,24 +1,24 @@
 /**
  * The adapter contract before adapter interface v2: `prepare` places a build at one stable target
- * per Environment, `deploy` replaces that target's code in place and may install it, and the
- * stable target serves a v3 Publication under an issuer bound to it for life.
+ * per Environment, `deploy` replaces that target's code in place, and the stable target serves a
+ * v3 Publication under an issuer bound to it for life. Neither installs anything.
  *
  * @deprecated Replacement: `Adapter` (adapter interface v2): beside the same `bundler`, `configure`,
  * `placement` and `deployRelease`, which deploys one sealed release as one immutable deployment,
  * created or reused, and installs nothing.
  *
  * Short-term consumers: the legacy direct-mode path (CT33), which `astrale-domain deploy` and
- * `astrale-domain dev` run through these operations:
- * - adapter-cloudflare direct mode (`route`, `workerName`, `identityIssuer`, `addressing`,
- *   `signingIdentity`, or no `namespace`), which serves the configurations of domains ai-gateway,
- *   closing, grc, integrations and issues (until SV15), shell (until SH2), the Services
- *   `development` environment (until SV9) and ui:domain (until UI1);
- * - adapter-astrale, until S8 gives it `deployRelease`.
+ * `astrale-domain dev` run through these operations: adapter-cloudflare direct mode (`route`,
+ * `workerName`, `identityIssuer`, `addressing`, `signingIdentity`, or no `namespace`), which serves
+ * the configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15),
+ * domains organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until
+ * SV12), `development` (until SV9) and frozen `admin-beta` (until D19) environments, shell (until
+ * SH2) and its frozen `legacy-v3` (until D22), and ui:domain (until UI1).
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33); it deletes
- * these types with `prepare`/`deploy`, `src/deployment/release/legacy` and the stable-target CLI
- * path.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); it deletes these types with `prepare`/`deploy`, `src/deployment/release/legacy`
+ * and the stable-target CLI path.
  */
-export type { InstallationTarget, LegacyAdapter, LegacyAdapterInput } from './adapter.js';
+export type { LegacyAdapter, LegacyAdapterInput } from './adapter.js';
 export type * from './prepare/index.js';
 export type * from './deploy/index.js';

package/dist/deployment/adapter/legacy/prepare/context.d.ts

@@ -1,7 +1,6 @@
 import type { Build } from '../../../build/index.js';
 import type { ResolvedRuntimeReference } from '../../../runtime/index.js';
 import type { Bundle } from '../../bundle/index.js';
-import type { InstallationTarget } from '../adapter.js';
 /**
  * What `prepare` receives to produce the artifact of one Environment's stable target.
  *
@@ -11,7 +10,6 @@ import type { InstallationTarget } from '../adapter.js';
 export interface PrepareContext<BuildValue extends Build = Build> {
     readonly projectDir: string;
     readonly environment: string;
-    readonly installation?: InstallationTarget;
     /**
      * Preparation purpose. Remote development and one-shot deployment both
      * prepare complete release artifacts. Omitted by older custom callers means

package/dist/deployment/adapter/release/context.d.ts

@@ -1,9 +1,19 @@
 import type { DeploymentCommitV1, FrozenConfigurationV1, LineAddressing } from '../../address/index.js';
 import type { Release } from '../../release/index.js';
 import type { Bundle } from '../bundle/index.js';
-/** What `configure` receives: the Environment whose configuration it freezes, nothing else. */
+/**
+ * What `configure` receives: the Environment whose configuration it freezes, and the names of the
+ * secrets its deployment binds. Never a secret value: a rotated value is not another configuration,
+ * a name added or removed is.
+ */
 export interface ConfigureContext {
     readonly environment: string;
+    /**
+     * The names of the Environment's current secrets (the adapter's `secretsFile`), sorted and
+     * unique: exactly the secrets `deployRelease` receives, which the configuration declares in
+     * `bindings.secrets`.
+     */
+    readonly secrets: readonly string[];
 }
 /**
  * Where the host places the deployments of one Environment. `routingDomain` is the DNS name every
@@ -56,15 +66,25 @@ export interface ReleaseDeployContext {
      * `DomainRelease` v4 the deployment serves at `release.json`, its `url` the deployment URL.
      */
     readonly release: Release;
-    /** The commit the deployment is built from, as its deployment record declares it. */
+    /**
+     * The commit this deploy runs from, which the record of a deployment it creates declares. The
+     * label does not cover it: a reused deployment keeps the record, and so the commit, of the deploy
+     * that created it, and an adapter never refuses a reuse for another commit.
+     */
     readonly commit: DeploymentCommitV1 | null;
     /** Parent-owned lifecycle cancellation shared by every provider effect. */
     readonly signal: AbortSignal;
 }
-/** What `list` receives: the origin whose deployments the host lists for the caller. */
+/**
+ * What `list` receives: the origin and the Environment whose deployments the host lists for the
+ * caller. It answers without any effect at the host.
+ */
 export interface ListContext {
     readonly origin: string;
+    readonly environment: string;
+    /** Parent-owned lifecycle cancellation. */
     readonly signal: AbortSignal;
+    /** Optional command-scoped identity override (`--as`). */
     readonly identity?: string;
 }
 /** What `retain` receives: the label of the published deployment to keep. */

package/dist/deployment/adapter/release/index.d.ts

@@ -1,2 +1,3 @@
 export type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, RetainContext, } from './context.js';
+export type { DeploymentCallTarget, ListedDeployment } from './list.js';
 export type { DeploymentSecretsState, FailedReleaseDeployResult, MutationKnowledge, ReadyReleaseDeployResult, ReleaseDeploymentPhase, ReleaseDeployResult, } from './result.js';

package/dist/deployment/adapter/release/list.d.ts

@@ -0,0 +1,41 @@
+import type { DeploymentSummaryV1 } from '../../address/index.js';
+/**
+ * Where one listed deployment is called on its host, so that an operator can act on that
+ * deployment alone, such as rotating one of its secrets in place (AM-4'):
+ *
+ * - `services`: a deployment Admin's Services hosts, called on the Admin instance with
+ *   `astrale call "<path>.method.setSecret" --admin` (`--admin=<admin>` when `admin` names the
+ *   Admin bookmark). `path` is the deployment's node, `@<id>`, qualified by its class:
+ *   `@<id>::services.astrale.ai:class.CloudflareDeployment`.
+ * - `namespace`: a deployment of a platform dispatch namespace, which has no Services node: the
+ *   namespace and the script the per-script tooling of that namespace takes.
+ */
+export type DeploymentCallTarget = {
+    readonly kind: 'services';
+    readonly path: string;
+    /** The Admin bookmark the deployment is reached through; the CLI's own Admin target when absent. */
+    readonly admin?: string;
+} | {
+    readonly kind: 'namespace';
+    readonly namespace: string;
+    readonly script: string;
+};
+/**
+ * One deployment as an adapter's `list` returns it: what its host knows of it, its record as the
+ * host stores it, and where it is called. `lastCallAt`, and a preview's `expiresAt`, are as of the
+ * listing: an adapter whose host records calls only now and then reads the calls counted since, and
+ * one that cannot read them for want of a permission omits both rather than print stale values.
+ *
+ * The adapter does not admit the record. The listing admits it with `acceptDeploymentRecord`, and a
+ * record it refuses (one a host on an older SDK still admits, say) never fails the listing: that
+ * deployment is listed from the facts its host owns.
+ */
+export interface ListedDeployment extends Omit<DeploymentSummaryV1, 'record'> {
+    /**
+     * The record as the host stores it, unadmitted, whatever value that is (JSON `null` included).
+     * Absent when the host keeps no record of the deployment: a platform namespace keeps none until
+     * it activates the deployment.
+     */
+    readonly record?: unknown;
+    readonly callTarget: DeploymentCallTarget;
+}

package/dist/deployment/adapter/release/list.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/address/index.d.ts

@@ -2,4 +2,4 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, type DeploymentCommitV1, type DeploymentRecordV1, } from './record.js';
-export type { DeploymentSummaryV1 } from './summary.js';
+export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, type DeploymentSummaryV1, type PlatformDeploymentSummaryV1, } from './summary.js';

package/dist/deployment/address/index.js

@@ -2,3 +2,4 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, } from './record.js';
+export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, } from './summary.js';

package/dist/deployment/address/summary.d.ts

@@ -17,10 +17,40 @@ export interface DeploymentSummaryV1 {
     readonly retention: 'preview' | 'published';
     readonly createdAt: string;
     readonly lastCallAt?: string;
-    /** A preview's: 30 days after its creation or its last call, whichever is later. */
+    /** A preview's: 30 days after its activation or its last call, whichever is later (AM-123). */
     readonly expiresAt?: string;
     readonly retiredAt?: string;
     readonly retirement?: 'expired' | 'withdrawn';
     readonly signingKeyId: string;
     readonly record: DeploymentRecordV1;
 }
+/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
+export declare const PLATFORM_OWNER = "platform";
+/**
+ * `summary:<label>` in the routing KV of a platform dispatch namespace (CT20, AM-131): the
+ * `DeploymentSummaryV1` of one deployment without its record, which stays at `record:<label>`.
+ *
+ * Its writers are the deployer (`cloudflare({ namespace })`), which writes it once at activation,
+ * before `record:<label>`, then marks it published (`retain`), and the platform retirement tooling
+ * (SV6), which records a withdrawal. So it names the deployment by its label (`id` is the label),
+ * is owned by `platform`, is `active` until withdrawn, and carries no `lastCallAt` or `expiresAt`:
+ * nothing on the platform namespace keeps those clocks, and listings read them from the calls
+ * dataset (AM-133). It never carries a provider version id or a secret digest: an in-place secret
+ * write mints a new version id, which identifies nothing (OPS-2 X1).
+ */
+export type PlatformDeploymentSummaryV1 = Omit<DeploymentSummaryV1, 'record' | 'lastCallAt' | 'expiresAt' | 'state' | 'retirement'> & {
+    readonly state: 'active' | 'retiring' | 'retired';
+    readonly retirement?: 'withdrawn';
+};
+/**
+ * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
+ * provider version id or a clock among them; so is a summary whose id, line or URL is not its
+ * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
+ * meets a refused summary lists that label apart, never acting on it.
+ */
+export declare function acceptPlatformDeploymentSummary(input: unknown): PlatformDeploymentSummaryV1;
+/**
+ * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
+ * one summary has one text, so a writer that reads it back compares texts.
+ */
+export declare function encodePlatformDeploymentSummary(summary: PlatformDeploymentSummaryV1): string;

package/dist/deployment/address/summary.js

@@ -1 +1,117 @@
-export {};
+import { json } from '@astrale-os/kernel-dsl/value';
+import { deploymentUrl, parseDeploymentLabel } from './label.js';
+/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
+export const PLATFORM_OWNER = 'platform';
+const REQUIRED = [
+    'id',
+    'url',
+    'label',
+    'line',
+    'owner',
+    'state',
+    'retention',
+    'createdAt',
+    'signingKeyId',
+];
+const RETIREMENT = ['retiredAt', 'retirement'];
+const STATES = ['active', 'retiring', 'retired'];
+const RETENTIONS = ['preview', 'published'];
+/** An instant as `Date.prototype.toISOString` writes it, in UTC. */
+const INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+/** An RFC 7638 JWK thumbprint: the base64url SHA-256 of the public key, 43 characters. */
+const KEY_ID = /^[A-Za-z0-9_-]{43}$/u;
+/**
+ * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
+ * provider version id or a clock among them; so is a summary whose id, line or URL is not its
+ * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
+ * meets a refused summary lists that label apart, never acting on it.
+ */
+export function acceptPlatformDeploymentSummary(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid('members');
+    const value = input;
+    const keys = Reflect.ownKeys(value);
+    const retired = RETIREMENT.some((key) => Object.hasOwn(value, key));
+    const expected = retired ? [...REQUIRED, ...RETIREMENT] : REQUIRED;
+    if (keys.length !== expected.length || expected.some((key) => !Object.hasOwn(value, key))) {
+        invalid('members');
+    }
+    const label = text(value.label, 'label');
+    let line;
+    try {
+        line = parseDeploymentLabel(label).line;
+    }
+    catch {
+        invalid('label');
+    }
+    if (value.id !== label)
+        invalid('id');
+    if (value.line !== line)
+        invalid('line');
+    const url = text(value.url, 'url');
+    if (!sameDeploymentUrl(url, label))
+        invalid('url');
+    if (value.owner !== PLATFORM_OWNER)
+        invalid('owner');
+    const state = value.state;
+    if (typeof state !== 'string' || !STATES.includes(state))
+        invalid('state');
+    if (retired !== (state !== 'active'))
+        invalid('state');
+    const retention = value.retention;
+    if (typeof retention !== 'string' || !RETENTIONS.includes(retention))
+        invalid('retention');
+    const createdAt = instant(value.createdAt, 'createdAt');
+    const signingKeyId = text(value.signingKeyId, 'signingKeyId');
+    if (!KEY_ID.test(signingKeyId))
+        invalid('signingKeyId');
+    if (retired && value.retirement !== 'withdrawn')
+        invalid('retirement');
+    return Object.freeze({
+        id: label,
+        url,
+        label,
+        line,
+        owner: PLATFORM_OWNER,
+        state: state,
+        retention: retention,
+        createdAt,
+        signingKeyId,
+        ...(retired
+            ? { retiredAt: instant(value.retiredAt, 'retiredAt'), retirement: 'withdrawn' }
+            : {}),
+    });
+}
+/**
+ * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
+ * one summary has one text, so a writer that reads it back compares texts.
+ */
+export function encodePlatformDeploymentSummary(summary) {
+    return json.serialize(acceptPlatformDeploymentSummary(summary));
+}
+/** Whether `url` is exactly `https://<label>.<routing domain>` for some routing domain. */
+function sameDeploymentUrl(url, label) {
+    const prefix = `https://${label}.`;
+    if (!url.startsWith(prefix))
+        return false;
+    try {
+        return deploymentUrl(label, url.slice(prefix.length)) === url;
+    }
+    catch {
+        return false;
+    }
+}
+function text(input, member) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid(member);
+    return input;
+}
+function instant(input, member) {
+    const value = text(input, member);
+    if (!INSTANT.test(value) || new Date(value).toISOString() !== value)
+        invalid(member);
+    return value;
+}
+function invalid(member) {
+    throw new TypeError(`Platform deployment summary has invalid ${member}.`);
+}

package/dist/deployment/build/index.d.ts

@@ -2,6 +2,6 @@ export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, type BuildMaterial, type GeneratedBuildMaterial, } from './material.js';
 export type { Build } from './build.js';
-export { buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, type BuildDigest, type BuildManifestInput, type BuildManifestV1, } from './manifest.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, type BuildDigest, type BuildManifestInput, type BuildManifestV1, } from './manifest.js';
 export * as frontend from './frontend/index.js';
 export type { BuildBundle, BuildSchema } from './schema.js';

package/dist/deployment/build/index.js

@@ -1,5 +1,5 @@
 export { isBuild } from './admission.js';
 export { compile } from './compile.js';
 export { material, generatedMaterial, restoreBuild, restoreGeneratedBuild, } from './material.js';
-export { buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, } from './manifest.js';
+export { acceptBuildDigest, buildDigest, buildManifest, BUILD_MANIFEST_FORMAT, BUILD_MANIFEST_VERSION, } from './manifest.js';
 export * as frontend from './frontend/index.js';

package/dist/deployment/build/manifest.d.ts

@@ -51,4 +51,9 @@ export interface BuildManifestInput {
 export declare function buildManifest(input: BuildManifestInput): BuildManifestV1;
 /** `sha256` of the canonical JSON (RFC 8785) of one admitted build manifest. */
 export declare function buildDigest(manifest: BuildManifestV1): BuildDigest;
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export declare function acceptBuildDigest(input: unknown): BuildDigest;
 export {};

package/dist/deployment/build/manifest.js

@@ -30,6 +30,16 @@ export function buildManifest(input) {
 export function buildDigest(manifest) {
     return identify(json.encode(admit(manifest)), MANIFEST_MEDIA_TYPE).digest;
 }
+/**
+ * Admit a build digest as it travels outside its manifest (a deployment binding, a record): exactly
+ * `sha256:` and 64 lowercase hex digits. Anything else throws, so a reader fails closed.
+ */
+export function acceptBuildDigest(input) {
+    if (typeof input !== 'string' || !DIGEST.test(input)) {
+        throw new TypeError('Build digest must be sha256: followed by 64 lowercase hex digits.');
+    }
+    return input;
+}
 function admit(input) {
     if (input === null || typeof input !== 'object')
         invalid();

package/dist/deployment/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, InstallationTarget, LegacyAdapter, LegacyAdapterInput, ListContext, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
+export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { deploy } from './deploy.js';

package/dist/deployment/release/legacy/index.d.ts

@@ -8,22 +8,27 @@
  * seal the `DomainRelease` v4 of an immutable deployment from its build digest and URL.
  *
  * Short-term consumers:
- * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare and adapter-astrale,
- *   whose `DeployResult.release` is this Release) and the stable Worker that assembles its Release
+ * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare, whose
+ *   `DeployResult.release` is this Release) and the stable Worker that assembles its Release
  *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
- *   integrations and issues (until SV15), shell (until SH2), the Services `development`
- *   environment (until SV9) and ui:domain (until UI1);
- * - the SDK's serving surface, typed on this Release until S4b serves the v4 Release: `serve` and
- *   `createService` (`execution/service`), runtime loading (`execution/runtime/load.ts`),
- *   invocation admission (`execution/invocation/admission/authentication.ts`), Domain identity
- *   and delivery (`execution/identity`), preflight (`deployment/verify/preflight/publication.ts`)
- *   and readiness (`deployment/verify/readiness`);
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
  * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
  *   adapter-cloudflare direct mode (`identityIssuer`).
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33) and S4b serves
- * the v4 Release; canonical deploys reach adapters through `deployRelease` (S7a, CT23), and D10
- * deletes `prepare`/`deploy` and their `DeployResult`.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
  */
 export { assemble } from './assemble.js';
 export { isRelease } from './admission.js';

package/dist/deployment/release/legacy/index.js

@@ -8,22 +8,27 @@
  * seal the `DomainRelease` v4 of an immutable deployment from its build digest and URL.
  *
  * Short-term consumers:
- * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare and adapter-astrale,
- *   whose `DeployResult.release` is this Release) and the stable Worker that assembles its Release
+ * - the direct-mode deploy path (`prepare`/`deploy` of adapter-cloudflare, whose
+ *   `DeployResult.release` is this Release) and the stable Worker that assembles its Release
  *   at runtime, which serve the direct-mode configurations of domains ai-gateway, closing, grc,
- *   integrations and issues (until SV15), shell (until SH2), the Services `development`
- *   environment (until SV9) and ui:domain (until UI1);
- * - the SDK's serving surface, typed on this Release until S4b serves the v4 Release: `serve` and
- *   `createService` (`execution/service`), runtime loading (`execution/runtime/load.ts`),
- *   invocation admission (`execution/invocation/admission/authentication.ts`), Domain identity
- *   and delivery (`execution/identity`), preflight (`deployment/verify/preflight/publication.ts`)
- *   and readiness (`deployment/verify/readiness`);
+ *   integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ *   AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ *   `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until
+ *   D22), and ui:domain (until UI1);
+ * - the stable-target branch of the SDK's serving surface, which serves this Release beside the v4
+ *   one (`execution/runtime/release.ts` `ServedRelease`): its Kernel Server source
+ *   (`execution/service/serving/legacy/`), the Delivery v1-only answer of a Publication
+ *   (`execution/identity/delivery.ts`), its pinned-snapshot check
+ *   (`execution/invocation/invocation.ts`), its readiness at `domain.json`
+ *   (`deployment/verify/readiness/legacy/`) and the preflight of the direct-mode prepare path
+ *   (`deployment/verify/preflight/publication.ts`);
  * - the split-issuer option of `addressing` (`publicUrl` distinct from the issuer), used only by
  *   adapter-cloudflare direct mode (`identityIssuer`).
  *
- * Removal: D10, once no supported configuration selects the direct-mode path (CT33) and S4b serves
- * the v4 Release; canonical deploys reach adapters through `deployRelease` (S7a, CT23), and D10
- * deletes `prepare`/`deploy` and their `DeployResult`.
+ * Removal: D10, once no configuration on any repository's main selects the direct-mode path
+ * (CT33, AM-147); the serving surface already serves the v4 Release (S4b), canonical deploys reach
+ * adapters through `deployRelease` (S7a, CT23), and D10 deletes `prepare`/`deploy` and their
+ * `DeployResult` with every branch listed above.
  */
 export { assemble } from './assemble.js';
 export { isRelease } from './admission.js';

package/dist/deployment/verify/readiness/deployment.js

@@ -15,23 +15,14 @@ export function verifyDeployment(artifact, input) {
             progress.provider.kind !== 'applied' ||
             progress.provider.evidence.issuer === undefined ||
             !terminal(progress.prerequisite) ||
-            !terminal(progress.configuration) ||
-            !terminal(progress.installation)) {
+            !terminal(progress.configuration)) {
             invalid();
         }
         return Object.freeze({ status: 'ready', phase: 'complete', progress, release });
     }
     if (input.status === 'failed') {
         exact(input, ['status', 'phase', 'progress', 'error'], ['release']);
-        if (![
-            'prerequisite',
-            'provider',
-            'addressing',
-            'release',
-            'configuration',
-            'installation',
-            'readiness',
-        ].includes(input.phase) ||
+        if (!['prerequisite', 'provider', 'addressing', 'release', 'configuration', 'readiness'].includes(input.phase) ||
             !(input.error instanceof Error)) {
             invalid();
         }
@@ -59,12 +50,11 @@ function verifyRelease(artifact, release) {
 function verifyProgress(artifact, input, release) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    exact(input, ['prerequisite', 'provider', 'configuration', 'installation']);
+    exact(input, ['prerequisite', 'provider', 'configuration']);
     return Object.freeze({
         prerequisite: knowledge(input.prerequisite),
         provider: providerKnowledge(artifact, input.provider, release),
         configuration: knowledge(input.configuration),
-        installation: knowledge(input.installation),
     });
 }
 function providerKnowledge(artifact, input, release) {