@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/dist/execution/invocation/invocation.js

@@ -1,38 +1,39 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { authentication, input, requireVia, target } from './admission/index.js';
 import { action, context, select, workflow } from './dispatch/index.js';
 import { active, settle } from './lifecycle/index.js';
 import { project, protocolError } from './result/index.js';
+/** The reserved answer of a deployment that does not serve the call: its caller re-routes. */
+const MISS = Object.freeze({ kind: 'miss' });
+const FUNCTION_MISS = 'FUNCTION_MISS';
 export async function invoke(request, inputConfig) {
     active(request.context);
-    const release = inputConfig.runtime.loaded.release;
-    const snapshot = request.publication;
-    if (snapshot === undefined ||
-        !publication.matchesReference(snapshot.publication, publication.reference(release.publication))) {
-        throw protocolError('CONFLICT', 'Invocation Publication differs from the running Release.');
+    if (!pinsRunningRelease(request, inputConfig.runtime.loaded.release)) {
+        throw protocolError('CONFLICT', 'Invocation release differs from the running Release.');
     }
     if (request.credential !== undefined && typeof request.credential !== 'string') {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const via = requireVia(request);
-    const selectedTarget = target(await inputConfig.authority.admit({
+    const admitted = await admit(inputConfig.authority, {
         call: request.call,
         ...(request.credential === undefined ? {} : { credential: request.credential }),
-        via,
-        publication: release.publication,
+        via: requireVia(request),
         domain: inputConfig.runtime.loaded.domain,
         context: request.context,
-    }));
-    const selected = select(inputConfig.runtime.loaded.registry, selectedTarget);
+    });
+    if (admitted === undefined)
+        return MISS;
+    const selected = select(inputConfig.runtime.loaded.registry, admitted);
     if (selected === undefined)
-        return Object.freeze({ kind: 'miss' });
+        return MISS;
     if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
         // The Kernel records a durable call as an Execution and runs it on the engine; running it
         // inline here would silently drop durability.
         throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
     }
     input(selected.implementation.callable, request.call.input, request.context.binary);
-    const admittedAuthentication = await authentication(selected.implementation.callable, request, release, inputConfig.runtime.loaded.domain, inputConfig.authority);
+    const admittedAuthentication = await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
     const close = once(admittedAuthentication.close);
     try {
         active(request.context);
@@ -47,6 +48,42 @@ export async function invoke(request, inputConfig) {
         throw cause;
     }
 }
+/**
+ * The source Kernel's `Function.admit` refuses `FUNCTION_MISS` when it no longer places the call on
+ * this deployment, as for a client whose learned route still names a deployment replaced by a
+ * consented install. That refusal is answered as the reserved miss, never as a public error, so
+ * the client re-routes through its source Kernel (AM-85). Every other refusal is unchanged.
+ */
+async function admit(authority, admission) {
+    let admitted;
+    try {
+        admitted = await authority.admit(admission);
+    }
+    catch (cause) {
+        if (refusedAsMiss(cause))
+            return undefined;
+        throw cause;
+    }
+    return target(admitted);
+}
+function refusedAsMiss(cause) {
+    return (cause instanceof errors.ProtocolError &&
+        errors.reasonOf(cause.payload.data)?.code === FUNCTION_MISS);
+}
+/**
+ * The Kernel Server pins every request to the one snapshot it serves: the release of an immutable
+ * deployment, or a stable target's Publication. Execution answers only for that exact document.
+ */
+function pinsRunningRelease(request, running) {
+    if (running.kind === 'release') {
+        return (request.publication === undefined &&
+            request.release !== undefined &&
+            release.matchesReference(request.release.release, release.reference(running.document)));
+    }
+    return (request.release === undefined &&
+        request.publication !== undefined &&
+        release.legacy.matchesReference(request.publication.publication, release.legacy.reference(running.publication)));
+}
 function once(operation) {
     let called = false;
     return () => {

package/dist/execution/runtime/index.d.ts

@@ -3,3 +3,4 @@ export { initialize, type InitializedRuntime } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load, type LoadedRuntime } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving, type ServedRelease, type Serving } from './release.js';

package/dist/execution/runtime/index.js

@@ -3,3 +3,4 @@ export { initialize } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving } from './release.js';

package/dist/execution/runtime/load.d.ts

@@ -2,13 +2,13 @@ import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
 import type { DomainSchema, DomainOf } from '@astrale-os/kernel-dsl/v1/schema';
 import type { RuntimeRegistry } from '../../application/runtime/index.js';
 import type { Build } from '../../deployment/build/build.js';
-import type { Release } from '../../deployment/release/legacy/release.js';
+import type { ServedRelease } from './release.js';
 type DomainOfBuild<BuildValue extends Build> = BuildValue extends Build<infer Schema extends DomainSchema, object> ? Extract<DomainOf<Schema>, Domain> : Domain;
 export interface LoadedRuntime<BuildValue extends Build = Build> {
-    readonly release: Release<BuildValue>;
+    readonly release: ServedRelease<BuildValue>;
     readonly domain: DomainOfBuild<BuildValue>;
     readonly registry: RuntimeRegistry;
 }
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
-export declare function load<const BuildValue extends Build>(release: Release<BuildValue>): LoadedRuntime<BuildValue>;
+export declare function load<const BuildValue extends Build>(release: ServedRelease<BuildValue>): LoadedRuntime<BuildValue>;
 export {};

package/dist/execution/runtime/load.js

@@ -1,10 +1,11 @@
 import { evidenceOf } from '../../deployment/build/admission.js';
-import { isRelease } from '../../deployment/release/legacy/admission.js';
 import { capture } from './admission.js';
+import { isServedRelease } from './release.js';
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
 export function load(release) {
-    if (!isRelease(release))
+    if (!isServedRelease(release)) {
         throw new TypeError('Runtime loading requires an admitted Release.');
+    }
     const evidence = evidenceOf(release.build);
     const domain = evidence.domain;
     const { registry } = evidence;

package/dist/execution/runtime/release.d.ts

@@ -0,0 +1,22 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Build } from '../../deployment/build/build.js';
+import type * as legacy from '../../deployment/release/legacy/index.js';
+import type { Release } from '../../deployment/release/release.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+/**
+ * What one Service serves: the `DomainRelease` v4 Release of an immutable deployment, or the
+ * deprecated v3 Release of a stable target (`legacy`, its consumers and removal in
+ * `deployment/release/legacy/index.ts`, D10).
+ */
+export type ServedRelease<BuildValue extends Build = Build> = Release<BuildValue> | legacy.Release<BuildValue>;
+/** Where and as whom one served Release answers, and the document it serves. */
+export interface Serving {
+    /** Domain identity issuer: a deployment's URL, or a stable target's configured issuer. */
+    readonly issuer: IssuerId;
+    /** Public origin the Server answers at: a deployment's URL, or a stable target's route. */
+    readonly publicUrl: IssuerId;
+    /** The document served at `release.json`, or a stable target's v3 Publication at `domain.json`. */
+    readonly document: release.DomainRelease | release.legacy.Publication;
+}
+export declare function isServedRelease(input: unknown): input is ServedRelease;
+export declare function serving(served: ServedRelease): Serving;

package/dist/execution/runtime/release.js

@@ -0,0 +1,14 @@
+import { isRelease } from '../../deployment/release/admission.js';
+import { isRelease as isLegacyRelease } from '../../deployment/release/legacy/admission.js';
+export function isServedRelease(input) {
+    return isRelease(input) || isLegacyRelease(input);
+}
+export function serving(served) {
+    return served.kind === 'release'
+        ? Object.freeze({ issuer: served.url, publicUrl: served.url, document: served.document })
+        : Object.freeze({
+            issuer: served.addressing.issuer,
+            publicUrl: served.addressing.publicUrl,
+            document: served.publication,
+        });
+}

package/dist/execution/serve.d.ts

@@ -1,5 +1,5 @@
 import type { ServerCloseOptions } from '@astrale-os/kernel-server';
-import type { publication } from '@astrale-os/kernel-server';
+import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../application/runtime/index.js';
 import type { WorkflowRunner } from '../application/workflow/runner/index.js';
 import type { Identity } from './identity/index.js';
@@ -16,7 +16,7 @@ export interface ServeInput<Environment, RuntimeValue extends Runtime, RuntimeEn
     identity(environment: Environment): Identity;
     readonly initialize?: (environment: Environment) => RuntimeEnvironment;
     readonly server: ServiceServerOptions;
-    readonly delivery?: (environment: Environment) => publication.delivery.Provider | undefined;
+    readonly delivery?: (environment: Environment) => release.delivery.Provider | undefined;
     readonly workflows?: WorkflowRunner;
     /**
      * Serve durable Workflows to the workflow engine; required when the Release declares any.

package/dist/execution/service/create.js

@@ -3,12 +3,12 @@ import { isRuntime } from '../../application/runtime/index.js';
 import { invocationPath } from '../../deployment/release/invocation.js';
 import { identity as captureIdentity } from '../identity/index.js';
 import { createHandler } from '../invocation/index.js';
-import { initialize, load } from '../runtime/index.js';
+import { initialize, load, serving as servedRelease } from '../runtime/index.js';
 import { createDurableReceiver, durableServing, isDurableRequest, } from '../workflows/index.js';
 import { initialization } from './initialization.js';
 import { lifecycle } from './lifecycle.js';
-import { delivery, installation, source } from './publication/index.js';
 import { loadRelease } from './release.js';
+import { delivery, installation, source } from './serving/index.js';
 /** Create one lazy running Service around the exact current Release. */
 export function createService(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
@@ -24,20 +24,21 @@ export function createService(input) {
     const state = lifecycle(() => running?.server.drain());
     const realized = initialization(async () => {
         const release = await loadRelease(input.load, input.environment, input.runtime);
-        if (release.addressing.issuer !== selectedIdentity.issuer) {
+        const served = servedRelease(release);
+        if (served.issuer !== selectedIdentity.issuer) {
             throw new TypeError('Service Identity differs from Release Addressing.');
         }
         if (selectedIdentity.subject !== release.build.schema.compiled.root.origin) {
             throw new TypeError('Service Identity subject differs from the Release Domain origin.');
         }
-        const selectedDelivery = providedDelivery ?? selectedIdentity.delivery(release.publication);
-        installation(release, selectedDelivery);
+        const selectedDelivery = providedDelivery ?? selectedIdentity.delivery(served.document);
+        installation(served.document, selectedDelivery);
         const loaded = load(release);
         const runtime = await initialize(loaded, input.environment);
         const prepared = prepareServer({
             ...serverOptions(input.server),
             path: invocationPath(),
-            publicOrigin: release.addressing.publicUrl,
+            publicOrigin: served.publicUrl,
             invocation: {
                 source: selectedIdentity.issuer,
                 next: () => crypto.randomUUID(),
@@ -46,7 +47,7 @@ export function createService(input) {
             ...(selectedIdentity.tokenExchange === undefined
                 ? {}
                 : { tokenExchange: selectedIdentity.tokenExchange }),
-            publication: source(loaded),
+            ...source(loaded),
             ...(selectedDelivery === undefined ? {} : { delivery: selectedDelivery }),
         });
         const server = prepared.create(createHandler({
@@ -119,6 +120,7 @@ function serverOptions(input) {
         'issuer',
         'publicOrigin',
         'tokenExchange',
+        'release',
         'publication',
         'delivery',
         'handler',

package/dist/execution/service/release.d.ts

@@ -1,7 +1,7 @@
 import type { Runtime } from '../../application/runtime/index.js';
 import type { Build } from '../../deployment/build/build.js';
-import type { Release } from '../../deployment/release/legacy/release.js';
 import type { schema } from '../../platform/schema/index.js';
-export type ReleaseForRuntime<RuntimeValue extends Runtime> = Release<Build<schema.DomainSchema, RuntimeValue>>;
+import type { ServedRelease } from '../runtime/index.js';
+export type ReleaseForRuntime<RuntimeValue extends Runtime> = ServedRelease<Build<schema.DomainSchema, RuntimeValue>>;
 export type ReleaseLoader<Environment, RuntimeValue extends Runtime = Runtime> = (environment: Environment) => ReleaseForRuntime<RuntimeValue> | Promise<ReleaseForRuntime<RuntimeValue>>;
 export declare function loadRelease<Environment, RuntimeValue extends Runtime>(load: ReleaseLoader<Environment, RuntimeValue>, environment: Environment, runtime: RuntimeValue): Promise<ReleaseForRuntime<RuntimeValue>>;

package/dist/execution/service/release.js

@@ -1,10 +1,11 @@
-import { isRelease } from '../../deployment/release/legacy/admission.js';
+import { isServedRelease } from '../runtime/index.js';
 export async function loadRelease(load, environment, runtime) {
     if (typeof load !== 'function')
         throw new TypeError('Service Release loader is invalid.');
     const release = await load(environment);
-    if (!isRelease(release))
+    if (!isServedRelease(release)) {
         throw new TypeError('Service loader returned an unadmitted Release.');
+    }
     if (release.build.runtime !== runtime) {
         throw new TypeError('Service Release Runtime differs from the generated entrypoint Runtime.');
     }

package/dist/execution/service/service.d.ts

@@ -1,19 +1,23 @@
 import type { ApplicationHost, ServerCloseOptions, ServerOptions } from '@astrale-os/kernel-server';
-import type { publication } from '@astrale-os/kernel-server';
+import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../../application/runtime/index.js';
 import type { WorkflowRunner } from '../../application/workflow/runner/index.js';
-import type { Release } from '../../deployment/release/legacy/index.js';
 import type { Identity } from '../identity/index.js';
+import type { ServedRelease } from '../runtime/index.js';
 import type { DurableServing, DurableServingProvider } from '../workflows/index.js';
 import type { ReleaseLoader } from './release.js';
-export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'publication' | 'delivery'>;
+export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'release' | 'publication' | 'delivery'>;
 export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtime> {
     readonly runtime: RuntimeValue;
     readonly environment: Environment;
     readonly load: ReleaseLoader<Environment, RuntimeValue>;
     readonly identity: Identity;
     readonly server: ServiceServerOptions;
-    readonly delivery?: publication.delivery.Provider;
+    /**
+     * Answers Delivery in the request's version: v2 over an immutable deployment's release, v1 over
+     * the Publication (a release's frozen v3 projection). Defaults to the Identity's own.
+     */
+    readonly delivery?: release.delivery.Provider;
     readonly workflows?: WorkflowRunner;
     /**
      * Serve the Release's durable Workflows. A provider is resolved on the first engine request,
@@ -23,7 +27,7 @@ export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtim
 }
 export interface Service {
     fetch(request: Request, host?: ApplicationHost): Promise<Response>;
-    release(): Promise<Release>;
+    release(): Promise<ServedRelease>;
     drain(): void;
     close(options: ServerCloseOptions): Promise<void>;
 }

package/dist/execution/service/serving/delivery.d.ts

@@ -0,0 +1,6 @@
+import type { release } from '@astrale-os/kernel-server';
+/**
+ * Capture an explicit Delivery Provider. It answers in the request's version: v2 over an immutable
+ * deployment's release, v1 over the Publication (a release's frozen v3 projection).
+ */
+export declare function delivery(input: release.delivery.Provider | undefined): release.delivery.Provider | undefined;

package/dist/execution/service/{publication → serving}/delivery.js

@@ -1,8 +1,12 @@
+/**
+ * Capture an explicit Delivery Provider. It answers in the request's version: v2 over an immutable
+ * deployment's release, v1 over the Publication (a release's frozen v3 projection).
+ */
 export function delivery(input) {
     if (input === undefined)
         return undefined;
     if (input === null || typeof input !== 'object' || typeof input.create !== 'function') {
-        throw new TypeError('Publication delivery Provider is invalid.');
+        throw new TypeError('Delivery Provider is invalid.');
     }
     const create = input.create.bind(input);
     return Object.freeze({ create });

package/dist/execution/service/{publication → serving}/index.d.ts

@@ -1,3 +1,3 @@
 export { delivery } from './delivery.js';
 export { installation } from './installation.js';
-export { source } from './source.js';
+export { source, type ServingSource } from './source.js';

package/dist/execution/service/serving/installation.d.ts

@@ -0,0 +1,4 @@
+import type { release } from '@astrale-os/kernel-server';
+import type { Serving } from '../../runtime/index.js';
+/** A served document advertises Delivery exactly when the Service has a Provider for it. */
+export declare function installation(served: Serving['document'], provider: release.delivery.Provider | undefined): void;

package/dist/execution/service/serving/installation.js

@@ -0,0 +1,9 @@
+/** A served document advertises Delivery exactly when the Service has a Provider for it. */
+export function installation(served, provider) {
+    const advertised = served.delivery !== undefined;
+    if (advertised !== (provider !== undefined)) {
+        throw new TypeError(advertised
+            ? 'Release advertises delivery without a Provider.'
+            : 'Delivery Provider has no Release endpoint.');
+    }
+}

package/dist/execution/service/serving/legacy/index.d.ts

@@ -0,0 +1,15 @@
+import type { PublicationSource } from '@astrale-os/kernel-server';
+import type * as legacy from '../../../../deployment/release/legacy/index.js';
+import type { LoadedRuntime } from '../../../runtime/index.js';
+/**
+ * Serve a stable target's v3 Publication through the Kernel Server's v3-input source: `domain.json`
+ * only (404 at `release.json`), with the same-schema continuity of a stable Worker.
+ *
+ * @deprecated Replacement: the release source of `../source.ts`, which serves an immutable
+ * deployment's `DomainRelease` v4. Consumer: the stable Worker of the direct-mode path (the
+ * consumers of `deployment/release/legacy/index.ts`), whose host binds no build digest. Removal:
+ * D10, with `deployment/release/legacy/` and Kernel Server's `publication` source.
+ */
+export declare function publicationSource(runtime: LoadedRuntime, served: legacy.Release): {
+    readonly publication: PublicationSource;
+};

package/dist/execution/service/serving/legacy/index.js

@@ -0,0 +1,19 @@
+import { preparePublicationSnapshot } from '@astrale-os/kernel-server';
+/**
+ * Serve a stable target's v3 Publication through the Kernel Server's v3-input source: `domain.json`
+ * only (404 at `release.json`), with the same-schema continuity of a stable Worker.
+ *
+ * @deprecated Replacement: the release source of `../source.ts`, which serves an immutable
+ * deployment's `DomainRelease` v4. Consumer: the stable Worker of the direct-mode path (the
+ * consumers of `deployment/release/legacy/index.ts`), whose host binds no build digest. Removal:
+ * D10, with `deployment/release/legacy/` and Kernel Server's `publication` source.
+ */
+export function publicationSource(runtime, served) {
+    const snapshot = preparePublicationSnapshot({
+        publication: served.publication,
+        bundle: served.build.schema.bundle.bytes(),
+        table: served.routes,
+        domain: runtime.domain,
+    });
+    return Object.freeze({ publication: Object.freeze({ current: () => snapshot }) });
+}

package/dist/execution/service/serving/source.d.ts

@@ -0,0 +1,18 @@
+import type { PublicationSource, ReleaseSource } from '@astrale-os/kernel-server';
+import type { LoadedRuntime } from '../../runtime/index.js';
+/** The one source a Kernel Server serves, as `ServerOptions` takes it. */
+export type ServingSource = 
+/** The release of an immutable deployment: `release.json` and its v3 projection. */
+{
+    readonly release: ReleaseSource;
+}
+/** @deprecated A stable target's v3 Publication; see `legacy/index.ts`. */
+ | {
+    readonly publication: PublicationSource;
+};
+/**
+ * Prepare, once, the exact snapshot the loaded Release serves: an immutable deployment serves its
+ * `DomainRelease` through `prepareReleaseSnapshot`, which admits only routing naming that exact
+ * release or its exact v3 projection; a stable target keeps serving its v3 Publication.
+ */
+export declare function source(runtime: LoadedRuntime): ServingSource;

package/dist/execution/service/serving/source.js

@@ -0,0 +1,19 @@
+import { prepareReleaseSnapshot } from '@astrale-os/kernel-server';
+import { publicationSource } from './legacy/index.js';
+/**
+ * Prepare, once, the exact snapshot the loaded Release serves: an immutable deployment serves its
+ * `DomainRelease` through `prepareReleaseSnapshot`, which admits only routing naming that exact
+ * release or its exact v3 projection; a stable target keeps serving its v3 Publication.
+ */
+export function source(runtime) {
+    const served = runtime.release;
+    if (served.kind !== 'release')
+        return publicationSource(runtime, served);
+    const snapshot = prepareReleaseSnapshot({
+        release: served.document,
+        bundle: served.build.schema.bundle.bytes(),
+        table: served.routes,
+        domain: runtime.domain,
+    });
+    return Object.freeze({ release: Object.freeze({ current: () => snapshot }) });
+}

package/dist/execution/workflows/run.js

@@ -84,7 +84,7 @@ function durableContext(input, context, envelope) {
     /** One journaled unit of work acting as the Domain, with keys derived from its name. */
     const journal = (name, execute) => Promise.resolve(context.run(name, async () => {
         const deadline = Date.now() + serving.stepTimeoutMs;
-        const session = input.executor(execution.kernel, { deadline, signal });
+        const session = input.executor(execution.kernel, execution.id, { deadline, signal });
         try {
             const kernel = keyed(bindSessionOf(session, deadline, signal), await keySequence(execution.id, name));
             const output = await execute(Object.freeze({

package/dist/platform/versioning/name.d.ts

@@ -15,12 +15,13 @@ import type { Digest } from '@astrale-os/kernel-protocol/artifact';
  * hexadecimal digits names a plain preview, and the commit token is always printed in lower case,
  * like `git describe`. An environment outside the `defineProject` grammar is rendered as `?`, so no
  * record can put control characters or a ` · ` of its own in the name. Likewise only canonical
- * published versions name a deployment.
+ * published versions name a deployment. A deployment named without its digests (one whose record
+ * is not admitted) is never named by a published version.
  */
 export declare function deploymentName(deployment: {
     readonly environment: string;
-    readonly releaseDigest: Digest;
-    readonly buildDigest: Digest;
+    readonly releaseDigest?: Digest;
+    readonly buildDigest?: Digest;
     readonly commit: {
         readonly sha: string;
         readonly dirty: boolean;

package/dist/platform/versioning/name.js

@@ -21,17 +21,18 @@ const UNKNOWN_ENVIRONMENT = '?';
  * hexadecimal digits names a plain preview, and the commit token is always printed in lower case,
  * like `git describe`. An environment outside the `defineProject` grammar is rendered as `?`, so no
  * record can put control characters or a ` · ` of its own in the name. Likewise only canonical
- * published versions name a deployment.
+ * published versions name a deployment. A deployment named without its digests (one whose record
+ * is not admitted) is never named by a published version.
  */
 export function deploymentName(deployment, publications) {
     const { commit } = deployment;
     const environment = typeof deployment.environment === 'string' && ENVIRONMENT_NAME.test(deployment.environment)
         ? deployment.environment
         : UNKNOWN_ENVIRONMENT;
-    const release = highest(publications.filter(({ releaseDigest }) => releaseDigest === deployment.releaseDigest));
+    const release = highest(publications.filter(({ releaseDigest }) => deployment.releaseDigest !== undefined && releaseDigest === deployment.releaseDigest));
     if (release !== undefined)
         return release;
-    const build = highest(publications.filter(({ buildDigest }) => buildDigest === deployment.buildDigest));
+    const build = highest(publications.filter(({ buildDigest }) => deployment.buildDigest !== undefined && buildDigest === deployment.buildDigest));
     if (build !== undefined)
         return `${build} · ${environment}`;
     if (commit === null || typeof commit.sha !== 'string' || !SHA.test(commit.sha)) {

package/dist/project/define.js

@@ -2,7 +2,12 @@ import { isDomainDefinition } from '../application/index.js';
 import { isDeployment } from '../deployment/deployment.js';
 import { ENVIRONMENT_NAME } from '../deployment/environment.js';
 import { isTests } from '../testing/index.js';
+import { installCommand } from './install-command.js';
 const admittedProjects = new WeakSet();
+/** The adapter name of adapter-astrale, whose removed instance mode once read `installation`. */
+const ASTRALE_ADAPTER = 'astrale';
+/** The one Environment adapter-astrale deploys without an explicit organisation (AM-7). */
+const ASTRALE_DEFAULT_ORGANIZATION_ENVIRONMENT = 'development';
 /** Capture one inert Project definition without loading entrypoints or performing effects. */
 export function defineProject(input) {
     const value = record(input, 'Project definition');
@@ -19,27 +24,28 @@ export function defineProject(input) {
     const names = Object.keys(environments);
     if (names.length === 0)
         throw new TypeError('Project must declare at least one Environment.');
-    const captured = Object.create(null);
-    for (const name of names) {
+    const declared = names.map((name) => {
         if (!ENVIRONMENT_NAME.test(name)) {
             throw new TypeError(`Project Environment name "${name}" is not normalized.`);
         }
-        const environment = record(environments[name], `Project Environment ${name}`);
-        exact(environment, ['deployment'], ['installation'], () => invalidEnvironment(name));
+        return [name, record(environments[name], `Project Environment ${name}`)];
+    });
+    // One refusal names every Environment that declares installation, each with its own commands.
+    const installations = declared
+        .filter(([, environment]) => Object.hasOwn(environment, 'installation'))
+        .map(([name, environment]) => installationRefusal(environment, name));
+    if (installations.length > 0)
+        throw new TypeError(installations.join('\n'));
+    const captured = Object.create(null);
+    for (const [name, environment] of declared) {
+        exact(environment, ['deployment'], [], () => invalidEnvironment(name));
         if (!isDeployment(environment.deployment)) {
             throw new TypeError(`Project Environment ${name} deployment is not admitted.`);
         }
-        const installation = environment.installation === undefined
-            ? undefined
-            : admitInstallation(environment.installation, name);
         environment.deployment.adapter.admit?.(environment.deployment.parameters, {
             environment: name,
-            ...(installation === undefined ? {} : { installation }),
-        });
-        captured[name] = Object.freeze({
-            deployment: environment.deployment,
-            ...(installation === undefined ? {} : { installation }),
         });
+        captured[name] = Object.freeze({ deployment: environment.deployment });
     }
     const entrypoints = input.entrypoints === undefined ? undefined : admitEntrypoints(input.entrypoints);
     if (input.tests !== undefined && !isTests(input.tests)) {
@@ -71,22 +77,46 @@ function admitEntrypoints(input) {
     }
     return Object.freeze({ runtime: input.runtime });
 }
-function admitInstallation(input, environment) {
-    const value = record(input, `Project Environment ${environment} installation`);
-    exact(value, ['instance'], ['identity'], () => {
-        throw new TypeError(`Project Environment ${environment} installation may contain only instance and identity.`);
-    });
-    const instance = stableCoordinate(value.instance, 'installation instance');
-    const identity = value.identity === undefined
-        ? undefined
-        : stableCoordinate(value.identity, 'installation identity');
-    return Object.freeze({ instance, ...(identity === undefined ? {} : { identity }) });
-}
-function stableCoordinate(input, label) {
-    if (typeof input !== 'string' || input.length === 0 || input.trim() !== input) {
-        throw new TypeError(`Project ${label} must be a non-empty stable string.`);
+/**
+ * A deploy no longer installs (DX [.81399], AM-72): an Environment that still declares
+ * `installation` is refused before any effect, with the commands that replace it. Its only
+ * consumer pins an SDK older than this refusal.
+ *
+ * adapter-astrale deploys on Admin's Services, never through the installation's instance: outside
+ * development its Environment also names the organisation that holds its deployment line (AM-7),
+ * which the guidance adds when the adapter names none. The installation's instance and identity
+ * move to the install command.
+ */
+function installationRefusal(environment, name) {
+    const declared = environment.installation;
+    if (declared === undefined) {
+        return (`Project Environment ${name} declares \`installation\`, which a deploy no longer reads: a ` +
+            'deploy never installs. Remove the key.');
     }
-    return input;
+    const installation = declared !== null && typeof declared === 'object'
+        ? declared
+        : {};
+    const instance = stable(installation.instance);
+    const identity = stable(installation.identity);
+    const deployment = environment.deployment;
+    const organization = isDeployment(deployment) &&
+        deployment.adapter.name === ASTRALE_ADAPTER &&
+        name !== ASTRALE_DEFAULT_ORGANIZATION_ENVIRONMENT &&
+        deployment.parameters.organization === undefined
+        ? ", name the organisation that holds its deployment line in `astrale({ organization: '<Identity id>' })`"
+        : '';
+    return (`Project Environment ${name} declares installation, and a deploy no longer installs. ` +
+        `Remove \`installation\`${organization}, run \`astrale-domain deploy ${name}\`, ` +
+        `then install the URL it prints with \`${installCommand(instance, identity)}\`.`);
+}
+/** A declared coordinate worth repeating in guidance: a non-empty single-line trimmed string. */
+function stable(input) {
+    return typeof input === 'string' &&
+        input.length > 0 &&
+        input.trim() === input &&
+        !/[\s`]/u.test(input)
+        ? input
+        : undefined;
 }
 function record(input, label) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
@@ -105,5 +135,5 @@ function invalid() {
     throw new TypeError('Project definition may contain only domain, environments, entrypoints, and tests.');
 }
 function invalidEnvironment(name) {
-    throw new TypeError(`Project Environment ${name} may contain only deployment and installation.`);
+    throw new TypeError(`Project Environment ${name} may contain only deployment.`);
 }