@astrale-os/sdk 0.6.0-beta.20 → 0.6.0-beta.22

package/README.md

@@ -345,10 +345,6 @@ did not derive.
 - **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
   script is the label that its own fields derive. A host admits the record a deploy declares with
   it before storing it, so every stored record decodes.
-- **Platform summary.** `acceptPlatformDeploymentSummary` admits the `summary:<label>` a platform
-  dispatch namespace keeps beside `record:<label>`: the deployment's `DeploymentSummaryV1` without
-  its record, owned by `platform`, named by its label, with no provider version id and no
-  `lastCallAt` or `expiresAt`. `encodePlatformDeploymentSummary` gives its one canonical text.
 
 ```ts
 import {

package/dist/application/workflow/durable.d.ts

@@ -36,25 +36,29 @@ export interface DurableExecution {
  */
 export interface DurableStepAuthority<DomainValue extends Domain = Domain> {
     /**
-     * Kernel Session acting as the Domain. Each `invoke` without an explicit `idempotencyKey` carries
-     * one derived from the Execution, the Step and its position, so a retried Step reaches the same
-     * durable child Execution.
+     * Kernel Session acting as the Domain. Each `invoke` of a durable callable without an explicit
+     * `idempotencyKey` carries one derived from the Execution, the Step and its position, so a
+     * retried Step reaches the same durable child Execution. An `invoke` of any other callable
+     * carries no key, which the Kernel would refuse, and runs again when the Step is retried.
      */
     readonly kernel: BoundClientSession;
     readonly query: QueryExecutor<DomainValue>;
-    /** Each Mutation carries a key derived from the Execution, the Step and its position. */
+    /**
+     * Each Mutation carries a key derived from the Execution, the Step and its position. The Kernel
+     * commits a receipt with the write and answers a retried Step with its first result.
+     */
     readonly mutate: MutationExecutor<DomainValue>;
 }
 export interface DurableStep<DomainValue extends Domain = Domain> {
     /**
      * Run `execute` once and journal its portable output; a replay returns the journaled output. A
-     * Step may run again when its outcome was not journaled, so its effects must be idempotent.
+     * Step may run again when its outcome was not journaled: its Mutations and durable calls are
+     * answered from their keys, and any other effect must be idempotent.
      */
     run<Output>(id: string, execute: (authority: DurableStepAuthority<DomainValue>) => Output | Promise<Output>): Promise<Output>;
     /**
-     * One journaled Mutation. Give it a zero-match precondition on a natural key (for example the
-     * Execution id) and map that failure in `reject`, so a Step replayed after its commit finds its
-     * own effect instead of repeating it.
+     * One journaled Mutation. A Step replayed after its commit receives the result of that commit
+     * from the Kernel's receipt instead of writing again.
      */
     mutate<Input, Output>(id: string, mutation: Mutation<DomainValue, Input, Output>, input: Input): Promise<Output>;
 }

package/dist/deployment/adapter/adapter.d.ts

@@ -1,7 +1,7 @@
 import type { FrozenConfigurationV1 } from '../address/index.js';
 import type { Bundler } from './bundle/index.js';
 import type { ArtifactSource, DeployContext, DeployResult, PrepareContext } from './legacy/index.js';
-import type { ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
+import type { AdapterCommand, ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
 /** What `admit` receives when `defineProject` binds an adapter to one Environment. */
 export interface AdapterEnvironmentContext {
     readonly environment: string;
@@ -44,6 +44,12 @@ export interface Adapter<Parameters extends object = object> {
      * transient. Absent: the registry marks it (Admin's Services).
      */
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
+    /**
+     * Provider commands, by name: `astrale-domain <adapter name> <command> <environment>` runs one
+     * on an Environment this adapter deploys (adapter-cloudflare's `plan` and `init` provision the
+     * host on the operator's own account). Every effect is the adapter's; the CLI only routes.
+     */
+    readonly commands?: Readonly<Record<string, AdapterCommand<Parameters>>>;
     /**
      * @deprecated Legacy direct-mode path (CT33) only: place a build at a stable target. Replacement:
      * `bundler`, `configure` and `placement`. Deleted with the legacy path (D10).
@@ -67,6 +73,7 @@ export interface AdapterInput<Parameters extends object> {
     deployRelease(parameters: Parameters, context: ReleaseDeployContext): Promise<ReleaseDeployResult>;
     list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
+    readonly commands?: Readonly<Record<string, AdapterCommand<Parameters>>>;
     /** @deprecated Legacy direct-mode path (CT33) only. Replacement: `configure`, `placement`. */
     prepare?(parameters: Parameters, context: PrepareContext): Promise<ArtifactSource>;
     /** @deprecated Legacy direct-mode path (CT33) only. Replacement: `deployRelease`. */

package/dist/deployment/adapter/define.d.ts

@@ -3,7 +3,7 @@ import type { Adapter, AdapterInput } from './adapter.js';
 import type { LegacyAdapter, LegacyAdapterInput } from './legacy/index.js';
 /**
  * Capture one receiver-bound provider adapter (adapter interface v2): a required `bundler`,
- * `configure`, `placement` and `deployRelease`, optionally `list` and `retain`, and `prepare` with
+ * `configure`, `placement` and `deployRelease`, optionally `list`, `retain` and provider `commands`, and `prepare` with
  * `deploy` only while it also serves the legacy direct-mode path.
  */
 export declare function defineAdapter<Parameters extends object>(input: AdapterInput<Parameters>): Adapter<Parameters>;

package/dist/deployment/adapter/define.js

@@ -12,6 +12,7 @@ const FIELDS = [
     'deployRelease',
     'list',
     'retain',
+    'commands',
     'prepare',
     'deploy',
     'secretsFile',
@@ -22,7 +23,9 @@ const OPTIONAL_RELEASE_OPERATIONS = ['list', 'retain'];
 /** The operations of the legacy direct-mode path. */
 const STABLE_TARGET_OPERATIONS = ['prepare', 'deploy'];
 /** Every operation an adapter may declare, in the order an admitted adapter lists them. */
-const OPERATIONS = FIELDS.filter((key) => key !== 'name' && key !== 'version' && key !== 'bundler');
+const OPERATIONS = FIELDS.filter((key) => key !== 'name' && key !== 'version' && key !== 'bundler' && key !== 'commands');
+/** A provider command name, `astrale-domain <adapter> <command>`, and an option name. */
+const COMMAND_NAME = /^[a-z][a-z0-9-]{0,31}$/u;
 export function defineAdapter(input) {
     const value = record(input, 'Adapter definition');
     if (Reflect.ownKeys(value).some((key) => !FIELDS.includes(key))) {
@@ -47,12 +50,16 @@ export function defineAdapter(input) {
         key,
         capture(receiver, key),
     ]));
+    if (value.commands !== undefined && !release) {
+        throw new TypeError(`Adapter ${name} declares commands without adapter interface v2.`);
+    }
     const adapter = Object.freeze({
         kind: 'adapter',
         name,
         version,
         bundler,
         ...operations,
+        ...(value.commands === undefined ? {} : { commands: admitCommands(name, value.commands) }),
     });
     admittedAdapters.add(adapter);
     return adapter;
@@ -131,6 +138,38 @@ function missingBundler(name) {
         'to the adapter as its Bundle (a Cloudflare Worker adapter declares ' +
         '`cloudflareWorkerBundler` from `@astrale-os/adapter-cloudflare/build`).');
 }
+/**
+ * Capture the provider commands of one adapter: each a lower-case name, a one-line `summary`,
+ * optional `options` (name to one line of help) and a receiver-bound `run`.
+ */
+function admitCommands(adapter, input) {
+    const commands = record(input, `Adapter ${adapter} commands`);
+    const admitted = {};
+    for (const name of Reflect.ownKeys(commands)) {
+        if (typeof name !== 'string' || !COMMAND_NAME.test(name)) {
+            throw new TypeError(`Adapter ${adapter} declares an invalid command name.`);
+        }
+        const command = record(commands[name], `Adapter ${adapter} command ${name}`);
+        const options = command.options === undefined ? {} : record(command.options, 'Command options');
+        if (Reflect.ownKeys(command).some((key) => key !== 'summary' && key !== 'options' && key !== 'run') ||
+            typeof command.summary !== 'string' ||
+            command.summary.length === 0 ||
+            typeof command.run !== 'function' ||
+            Reflect.ownKeys(options).some((key) => typeof key !== 'string' ||
+                !COMMAND_NAME.test(key) ||
+                key === 'json' ||
+                typeof options[key] !== 'string')) {
+            throw new TypeError(`Adapter ${adapter} command ${name} must declare a summary, string options other than ` +
+                'json and run.');
+        }
+        admitted[name] = Object.freeze({
+            summary: command.summary,
+            options: Object.freeze({ ...options }),
+            run: command.run.bind(command),
+        });
+    }
+    return Object.freeze(admitted);
+}
 function invalidFields() {
     throw new TypeError('Adapter definition contains missing or unknown fields.');
 }

package/dist/deployment/adapter/release/command.d.ts

@@ -0,0 +1,33 @@
+/**
+ * One command an adapter declares for its provider (`astrale-domain <adapter> <command>
+ * <environment>`), such as adapter-cloudflare's `plan` and `init`, which provision the host on the
+ * operator's own account. The CLI only routes: it loads the Project, selects the Environment, checks
+ * that its adapter is the one named and declares the command, and admits the options the command
+ * declares; everything the command does is the adapter's.
+ */
+export interface AdapterCommand<Parameters extends object = object> {
+    /** One line: what the command does, for help. */
+    readonly summary: string;
+    /** The options it takes, `--<name> <value>`, each with one line of help. */
+    readonly options?: Readonly<Record<string, string>>;
+    run(parameters: Parameters, context: AdapterCommandContext): Promise<AdapterCommandResult>;
+}
+/** What an adapter command receives. */
+export interface AdapterCommandContext {
+    readonly environment: string;
+    /** Parent-owned lifecycle cancellation. */
+    readonly signal: AbortSignal;
+    /** The options given, each one the command declares. */
+    readonly options: Readonly<Record<string, string>>;
+}
+/** What an adapter command answers; a command that cannot run rejects instead. */
+export interface AdapterCommandResult {
+    /** 0 done; 1 refused or blocked (the command ran, and says why in `warnings`). */
+    readonly exitCode: 0 | 1;
+    /** Lines for a person, printed on stdout without `--json`. */
+    readonly lines: readonly string[];
+    /** Lines for stderr, printed in either case. */
+    readonly warnings?: readonly string[];
+    /** The JSON-serializable result `--json` prints. */
+    readonly result: unknown;
+}

package/dist/deployment/adapter/release/command.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/release/index.d.ts

@@ -1,3 +1,4 @@
 export type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, RetainContext, } from './context.js';
+export type { AdapterCommand, AdapterCommandContext, AdapterCommandResult } from './command.js';
 export type { DeploymentCallTarget, ListedDeployment } from './list.js';
 export type { DeploymentSecretsState, FailedReleaseDeployResult, MutationKnowledge, ReadyReleaseDeployResult, ReleaseDeploymentPhase, ReleaseDeployResult, } from './result.js';

package/dist/deployment/adapter/release/list.d.ts

@@ -11,8 +11,9 @@ import type { DeploymentSummaryV1 } from '../../address/index.js';
  *   and the deployment it currently serves: `promote` (this deployment's label rolls the Service
  *   back or forward to it), `setSecret` and `secrets`, `setSchedule` and `schedules`, `logs`,
  *   `transfer` and `delete`.
- * - `namespace`: a deployment of a platform dispatch namespace, which has no Services node: the
- *   namespace and the script the per-script tooling of that namespace takes.
+ * - `namespace`: a deployment of a Cloudflare dispatch namespace (adapter-cloudflare's namespace
+ *   mode), which has no Services node: the namespace and the script, which the hosting kit
+ *   (`@astrale-os/adapter-cloudflare/hosting`) retires, points a name at or schedules.
  */
 export type DeploymentCallTarget = {
     readonly kind: 'services';
@@ -27,11 +28,11 @@ export type DeploymentCallTarget = {
 };
 /**
  * One deployment as an adapter's `list` returns it: what its host knows of it, its record as the
- * host stores it, and where it is called. `lastCallAt`, and a preview's `expiresAt`, are as of the
- * listing: an adapter whose host records calls only now and then reads the calls counted since, and
- * one that cannot read them for want of a permission omits both rather than print stale values.
- * Admin's Services keeps every deployment until it is retired and counts no call: its deployments
- * are `published`, `withdrawn` once retiring, and carry neither clock.
+ * host stores it, and where it is called. Admin's Services keeps every deployment until it is
+ * retired and counts no call: its deployments are `published` and `withdrawn` once retiring. A
+ * Cloudflare dispatch namespace keeps no retention: its rows carry none, and carry their creation
+ * instant and key only while their script exists. No first-party adapter reports a last call or an
+ * expiry any more; the CLI still prints one an older adapter reports.
  *
  * The adapter does not admit the record. The listing admits it with `acceptDeploymentRecord`, and a
  * record it refuses (one a host on an older SDK still admits, say) never fails the listing: that
@@ -40,13 +41,13 @@ export type DeploymentCallTarget = {
 export interface ListedDeployment extends Omit<DeploymentSummaryV1, 'record'> {
     /**
      * The record as the host stores it, unadmitted, whatever value that is (JSON `null` included).
-     * Absent when the host keeps no record of the deployment: a platform namespace keeps none until
-     * it activates the deployment.
+     * Absent when the host keeps no record of the deployment: a dispatch namespace keeps none for a
+     * label it only retired.
      */
     readonly record?: unknown;
     /**
      * Whether the stable URL of the deployment's Service serves it. Present only where the host has
-     * Services (Admin's Services); a platform namespace has none.
+     * Services (Admin's Services); a dispatch namespace has none.
      */
     readonly current?: boolean;
     readonly callTarget: DeploymentCallTarget;

package/dist/deployment/address/index.d.ts

@@ -2,4 +2,4 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, type DeploymentCommitV1, type DeploymentRecordV1, } from './record.js';
-export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, type DeploymentSummaryV1, type PlatformDeploymentSummaryV1, } from './summary.js';
+export type { DeploymentSummaryV1 } from './summary.js';

package/dist/deployment/address/index.js

@@ -2,4 +2,3 @@ export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT,
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
 export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, } from './record.js';
-export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, } from './summary.js';

package/dist/deployment/address/summary.d.ts

@@ -1,57 +1,34 @@
 import type { DeploymentRecordV1 } from './record.js';
 /**
  * What a host knows of one immutable deployment beside the record its deployer declared: where it
- * answers, who owns its line, its lifecycle and its retention. It names a deployment by its label
- * and URL, never by a provider version id. An adapter's `list` returns these; the host owns every
- * field but `record`, which it stores as declared.
+ * answers, who owns its line and its lifecycle. It names a deployment by its label and URL, never
+ * by a provider version id. An adapter's `list` returns these; the host owns every field but
+ * `record`, which it stores as declared.
  */
 export interface DeploymentSummaryV1 {
-    /** The host's own identifier of the deployment (a graph node id on Admin's Services). */
+    /** The host's own identifier of the deployment (a graph node id on Admin's Services, the label on a dispatch namespace). */
     readonly id: string;
     readonly url: string;
     readonly label: string;
     readonly line: string;
-    /** The Identity owning the line: a node path on Admin's Services, `platform` on a platform namespace. */
+    /** Who owns the line: a node path on Admin's Services, the dispatch namespace's name on Cloudflare. */
     readonly owner: string;
     readonly state: 'deploying' | 'active' | 'retiring' | 'retired' | 'failed';
-    readonly retention: 'preview' | 'published';
-    readonly createdAt: string;
+    /**
+     * `published` on Admin's Services, which keeps every deployment until it is retired. Absent on a
+     * dispatch namespace, which keeps no retention.
+     */
+    readonly retention?: 'preview' | 'published';
+    /** When the host created it; absent when the host no longer knows (its script is gone). */
+    readonly createdAt?: string;
+    /** An older adapter's report of the last call; no first-party adapter reports it any more. */
     readonly lastCallAt?: string;
-    /** A preview's: 30 days after its activation or its last call, whichever is later (AM-123). */
+    /** An older adapter's preview expiry; no first-party adapter reports it any more. */
     readonly expiresAt?: string;
     readonly retiredAt?: string;
+    /** `withdrawn` once its owner retired it (`expired` only from an older adapter). */
     readonly retirement?: 'expired' | 'withdrawn';
-    readonly signingKeyId: string;
+    /** The RFC 7638 thumbprint of its key; absent when the host no longer knows (its script is gone). */
+    readonly signingKeyId?: string;
     readonly record: DeploymentRecordV1;
 }
-/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
-export declare const PLATFORM_OWNER = "platform";
-/**
- * `summary:<label>` in the routing KV of a platform dispatch namespace (CT20, AM-131): the
- * `DeploymentSummaryV1` of one deployment without its record, which stays at `record:<label>`.
- *
- * Its writers are the deployer (`cloudflare({ namespace })`), which writes it at activation,
- * before `record:<label>`, names in it the new key of a script it recreates under the label after
- * an operator deleted it, and marks it published (`retain`), and the platform retirement tooling
- * (SV6), which records a withdrawal. So it names the deployment by its label (`id` is the label),
- * is owned by `platform`, is `active` until withdrawn, and carries no `lastCallAt` or `expiresAt`:
- * nothing on the platform namespace keeps those clocks, and listings read them from the calls
- * dataset (AM-133). It never carries a provider version id or a secret digest: an in-place secret
- * write mints a new version id, which identifies nothing (OPS-2 X1).
- */
-export type PlatformDeploymentSummaryV1 = Omit<DeploymentSummaryV1, 'record' | 'lastCallAt' | 'expiresAt' | 'state' | 'retirement'> & {
-    readonly state: 'active' | 'retiring' | 'retired';
-    readonly retirement?: 'withdrawn';
-};
-/**
- * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
- * provider version id or a clock among them; so is a summary whose id, line or URL is not its
- * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
- * meets a refused summary lists that label apart, never acting on it.
- */
-export declare function acceptPlatformDeploymentSummary(input: unknown): PlatformDeploymentSummaryV1;
-/**
- * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
- * one summary has one text, so a writer that reads it back compares texts.
- */
-export declare function encodePlatformDeploymentSummary(summary: PlatformDeploymentSummaryV1): string;

package/dist/deployment/address/summary.js

@@ -1,117 +1 @@
-import { json } from '@astrale-os/kernel-dsl/value';
-import { deploymentUrl, parseDeploymentLabel } from './label.js';
-/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
-export const PLATFORM_OWNER = 'platform';
-const REQUIRED = [
-    'id',
-    'url',
-    'label',
-    'line',
-    'owner',
-    'state',
-    'retention',
-    'createdAt',
-    'signingKeyId',
-];
-const RETIREMENT = ['retiredAt', 'retirement'];
-const STATES = ['active', 'retiring', 'retired'];
-const RETENTIONS = ['preview', 'published'];
-/** An instant as `Date.prototype.toISOString` writes it, in UTC. */
-const INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
-/** An RFC 7638 JWK thumbprint: the base64url SHA-256 of the public key, 43 characters. */
-const KEY_ID = /^[A-Za-z0-9_-]{43}$/u;
-/**
- * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
- * provider version id or a clock among them; so is a summary whose id, line or URL is not its
- * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
- * meets a refused summary lists that label apart, never acting on it.
- */
-export function acceptPlatformDeploymentSummary(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        invalid('members');
-    const value = input;
-    const keys = Reflect.ownKeys(value);
-    const retired = RETIREMENT.some((key) => Object.hasOwn(value, key));
-    const expected = retired ? [...REQUIRED, ...RETIREMENT] : REQUIRED;
-    if (keys.length !== expected.length || expected.some((key) => !Object.hasOwn(value, key))) {
-        invalid('members');
-    }
-    const label = text(value.label, 'label');
-    let line;
-    try {
-        line = parseDeploymentLabel(label).line;
-    }
-    catch {
-        invalid('label');
-    }
-    if (value.id !== label)
-        invalid('id');
-    if (value.line !== line)
-        invalid('line');
-    const url = text(value.url, 'url');
-    if (!sameDeploymentUrl(url, label))
-        invalid('url');
-    if (value.owner !== PLATFORM_OWNER)
-        invalid('owner');
-    const state = value.state;
-    if (typeof state !== 'string' || !STATES.includes(state))
-        invalid('state');
-    if (retired !== (state !== 'active'))
-        invalid('state');
-    const retention = value.retention;
-    if (typeof retention !== 'string' || !RETENTIONS.includes(retention))
-        invalid('retention');
-    const createdAt = instant(value.createdAt, 'createdAt');
-    const signingKeyId = text(value.signingKeyId, 'signingKeyId');
-    if (!KEY_ID.test(signingKeyId))
-        invalid('signingKeyId');
-    if (retired && value.retirement !== 'withdrawn')
-        invalid('retirement');
-    return Object.freeze({
-        id: label,
-        url,
-        label,
-        line,
-        owner: PLATFORM_OWNER,
-        state: state,
-        retention: retention,
-        createdAt,
-        signingKeyId,
-        ...(retired
-            ? { retiredAt: instant(value.retiredAt, 'retiredAt'), retirement: 'withdrawn' }
-            : {}),
-    });
-}
-/**
- * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
- * one summary has one text, so a writer that reads it back compares texts.
- */
-export function encodePlatformDeploymentSummary(summary) {
-    return json.serialize(acceptPlatformDeploymentSummary(summary));
-}
-/** Whether `url` is exactly `https://<label>.<routing domain>` for some routing domain. */
-function sameDeploymentUrl(url, label) {
-    const prefix = `https://${label}.`;
-    if (!url.startsWith(prefix))
-        return false;
-    try {
-        return deploymentUrl(label, url.slice(prefix.length)) === url;
-    }
-    catch {
-        return false;
-    }
-}
-function text(input, member) {
-    if (typeof input !== 'string' || input.length === 0)
-        invalid(member);
-    return input;
-}
-function instant(input, member) {
-    const value = text(input, member);
-    if (!INSTANT.test(value) || new Date(value).toISOString() !== value)
-        invalid(member);
-    return value;
-}
-function invalid(member) {
-    throw new TypeError(`Platform deployment summary has invalid ${member}.`);
-}
+export {};

package/dist/deployment/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
+export type { Adapter, AdapterCommand, AdapterCommandContext, AdapterCommandResult, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { deploy } from './deploy.js';

package/dist/execution/workflows/run.js

@@ -86,7 +86,7 @@ function durableContext(input, context, envelope) {
         const deadline = Date.now() + serving.stepTimeoutMs;
         const session = input.executor(execution.kernel, execution.id, { deadline, signal });
         try {
-            const kernel = keyed(bindSessionOf(session, deadline, signal), await keySequence(execution.id, name));
+            const kernel = keyed(bindSessionOf(session, deadline, signal), domain, await keySequence(execution.id, name));
             const output = await execute(Object.freeze({
                 kernel,
                 query: bindQuery(kernel, domain),
@@ -171,17 +171,29 @@ function bindSessionOf(session, deadline, signal) {
     return bindSession(session, { deadline, signal });
 }
 /**
- * Every `invoke` and Mutation of one Step without its own key carries the next key of the Step's
- * sequence. The sequence restarts with every attempt, so a retried Step replays the same keys and
- * the Kernel answers with the first outcome, or `IDEMPOTENCY_KEY_CONFLICT` if the request changed.
+ * Every Mutation and every `invoke` of a durable callable of one Step without its own key carries
+ * the next key of the Step's sequence. The sequence restarts with every attempt, so a retried Step
+ * replays the same keys: the Kernel answers a Mutation with its receipt and a durable call with the
+ * Execution it started, or refuses a request that changed under its key. Any other `invoke` carries
+ * no key, because the Kernel accepts one only for a durable Function, and runs again with the Step.
  */
-function keyed(session, next) {
+function keyed(session, domain, next) {
     const invokeSource = session.invoke;
     const mutateSource = session.mutate;
-    const invoke = ((reference, value, options) => invokeSource(reference, value, withKey(options, next)));
+    const invoke = ((reference, value, options) => invokeSource(reference, value, declaredDurable(domain, reference) ? withKey(options, next) : options));
     const mutate = ((author, options) => mutateSource(author, withKey(options, next)));
     return Object.freeze({ ...session, invoke, mutate });
 }
+/**
+ * Whether the Domain's Schema closure declares the referenced callable durable. An untyped Path
+ * names no declaration and a callable outside the closure has none here: both need their own key.
+ */
+function declaredDurable(domain, reference) {
+    if (reference === null || typeof reference !== 'object')
+        return false;
+    const key = reference.callable;
+    return (typeof key === 'string' && domain.callable(key)?.execution?.durable === true);
+}
 function withKey(options, next) {
     if (options?.idempotencyKey !== undefined || options?.body !== undefined)
         return options;

package/dist/tooling/cli/adapter-command.d.ts

@@ -0,0 +1,35 @@
+import type { LoadedEnvironment } from './project.js';
+/**
+ * `astrale-domain <adapter> <command> <environment> --json` on stdout: what one provider command
+ * of the Environment's adapter answered (adapter-cloudflare: `cloudflare plan` and
+ * `cloudflare init`, which provision its host on the operator's own account).
+ */
+export interface AdapterCommandReportV1 {
+    readonly format: 'astrale.adapter-command';
+    readonly version: 1;
+    /** `<adapter name>@<adapter version>` */
+    readonly adapter: string;
+    readonly command: string;
+    readonly environment: string;
+    /** 0 done; 1 refused or blocked. */
+    readonly exitCode: 0 | 1;
+    /** What the adapter's command answered, as it answered it. */
+    readonly result: unknown;
+}
+/**
+ * `astrale-domain <adapter> <command> <environment> [--<option> <value>]... [--json]`: run one
+ * provider command an adapter declares, on an Environment that adapter deploys. The CLI only
+ * routes: it refuses an Environment whose adapter has another name, a command the adapter does
+ * not declare and an option the command does not declare, each before any effect, and prints what
+ * the command answers. Exit status: the command's (0 done, 1 refused or blocked), 1 when it could
+ * not run.
+ */
+export declare function runAdapterCommand(input: {
+    readonly adapter: string;
+    readonly command: string;
+    readonly environment: string;
+    readonly definition: LoadedEnvironment;
+    readonly options: Readonly<Record<string, string>>;
+    readonly json: boolean;
+    readonly signal: AbortSignal;
+}): Promise<number>;

package/dist/tooling/cli/adapter-command.js

@@ -0,0 +1,66 @@
+import { error, info, warn } from './log.js';
+/**
+ * `astrale-domain <adapter> <command> <environment> [--<option> <value>]... [--json]`: run one
+ * provider command an adapter declares, on an Environment that adapter deploys. The CLI only
+ * routes: it refuses an Environment whose adapter has another name, a command the adapter does
+ * not declare and an option the command does not declare, each before any effect, and prints what
+ * the command answers. Exit status: the command's (0 done, 1 refused or blocked), 1 when it could
+ * not run.
+ */
+export async function runAdapterCommand(input) {
+    const { adapter, parameters } = input.definition.deployment;
+    const name = `${adapter.name}@${adapter.version}`;
+    if (adapter.name !== input.adapter) {
+        error(`Environment ${input.environment} deploys through adapter ${adapter.name}, not ` +
+            `${input.adapter}: run \`astrale-domain ${adapter.name} <command> ${input.environment}\`.`);
+        return 1;
+    }
+    const commands = 'commands' in adapter ? adapter.commands : undefined;
+    const command = commands?.[input.command];
+    if (command === undefined) {
+        const declared = Object.entries(commands ?? {}).map(([candidate, { summary }]) => `${candidate} (${summary})`);
+        error(`Adapter ${name} declares no command ${input.command}` +
+            (declared.length === 0 ? '.' : `; its commands: ${declared.join('; ')}.`));
+        return 1;
+    }
+    const declaredOptions = command.options ?? {};
+    const unknown = Object.keys(input.options).filter((option) => !Object.hasOwn(declaredOptions, option));
+    if (unknown.length > 0) {
+        const known = Object.entries(declaredOptions).map(([option, description]) => `--${option} (${description})`);
+        error(`${input.adapter} ${input.command} takes no option ${unknown.map((option) => `--${option}`).join(', ')}` +
+            (known.length === 0 ? '.' : `; its options: ${known.join('; ')}.`));
+        return 1;
+    }
+    let answered;
+    try {
+        answered = await command.run(parameters, {
+            environment: input.environment,
+            signal: input.signal,
+            options: Object.freeze({ ...input.options }),
+        });
+    }
+    catch (cause) {
+        error(`${input.adapter} ${input.command} ${input.environment} (${name}) failed: ` +
+            (cause instanceof Error ? cause.message : String(cause)));
+        return 1;
+    }
+    for (const line of answered.warnings ?? [])
+        warn(line);
+    if (input.json) {
+        const report = Object.freeze({
+            format: 'astrale.adapter-command',
+            version: 1,
+            adapter: name,
+            command: input.command,
+            environment: input.environment,
+            exitCode: answered.exitCode,
+            result: answered.result,
+        });
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else {
+        for (const line of answered.lines)
+            info(line);
+    }
+    return answered.exitCode;
+}

package/dist/tooling/cli/arguments.d.ts

@@ -3,7 +3,8 @@ import { type Version } from '../../platform/versioning/index.js';
 export declare const COMMANDS: readonly ['build', 'deploy', 'diff', 'list', 'publish', 'test', 'lint', 'package', 'upgrade', 'yank'];
 export type Command = (typeof COMMANDS)[number];
 export interface ParsedArgs {
-    readonly command: Command;
+    /** `adapter`: a provider command of an Environment's adapter (`<adapter> <command> <env>`). */
+    readonly command: Command | 'adapter';
     readonly env: string;
     readonly fix?: boolean;
     readonly format?: LintReportFormat;
@@ -19,6 +20,11 @@ export interface ParsedArgs {
     readonly allowDirty?: boolean;
     /** `list`: instances to ask what they run, in argument order. */
     readonly instances?: readonly string[];
+    /** `<adapter> <command> <env>`: the adapter name and its command. */
+    readonly adapter?: string;
+    readonly adapterCommand?: string;
+    /** `<adapter> <command> <env> --<option> <value>`: the options, by name. */
+    readonly options?: Readonly<Record<string, string>>;
 }
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/tooling/cli/arguments.js

@@ -12,11 +12,18 @@ export const COMMANDS = [
     'upgrade',
     'yank',
 ];
+/** An adapter name or one of its command and option names, as `defineAdapter` admits them. */
+const PROVIDER_NAME = /^[a-z][a-z0-9-]{0,31}$/u;
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export function parseArgs(argv) {
     const [command, ...rest] = argv;
     if (command === 'upgrade')
         return parseUpgrade(rest);
+    if (command !== undefined && !COMMANDS.includes(command)) {
+        const provider = parseAdapterCommand(command, rest);
+        if (provider !== undefined)
+            return provider;
+    }
     const fix = rest.includes('--fix');
     const deployOnly = rest.includes('--deploy-only');
     const json = rest.includes('--json');
@@ -84,7 +91,7 @@ export function parseArgs(argv) {
         command !== 'list' &&
         command !== 'publish' &&
         command !== 'yank') {
-        throw new Error('`--json` is only valid for `build`, `deploy`, `diff`, `list`, `publish` or `yank`.');
+        throw new Error('`--json` is only valid for `build`, `deploy`, `diff`, `list`, `publish`, `yank` or an adapter command.');
     }
     if (allowDirty && command !== 'publish') {
         throw new Error('`--allow-dirty` is only valid for `publish`.');
@@ -222,6 +229,51 @@ function refuseDeployOnly(command, environment) {
     throw new Error(`${refusal} Run \`astrale-domain ${command} ${environment}\` without it, then install the ` +
         `URL it prints with \`${installCommand()}\`.`);
 }
+/**
+ * `astrale-domain <adapter> <command> <environment> [--<option> <value>]... [--json]`: a provider
+ * command, routed once the Project is loaded to the adapter of that Environment. Anything that is
+ * not exactly an adapter name, a command and an Environment is no command at all (undefined).
+ */
+function parseAdapterCommand(adapter, args) {
+    if (!PROVIDER_NAME.test(adapter))
+        return undefined;
+    const positionals = [];
+    const options = {};
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--json') {
+            json = true;
+            continue;
+        }
+        if (!argument.startsWith('-')) {
+            positionals.push(argument);
+            continue;
+        }
+        const equals = argument.indexOf('=');
+        const name = argument.slice(2, equals === -1 ? undefined : equals);
+        if (!argument.startsWith('--') || !PROVIDER_NAME.test(name)) {
+            throw new Error(`Unknown flag "${argument}".`);
+        }
+        if (Object.hasOwn(options, name))
+            throw new Error(`--${name} is given twice.`);
+        options[name] =
+            equals === -1
+                ? requiredValue(`--${name}`, args[++index])
+                : requiredValue(`--${name}`, argument.slice(equals + 1));
+    }
+    const [adapterCommand, env] = positionals;
+    if (positionals.length !== 2 || !PROVIDER_NAME.test(adapterCommand))
+        return undefined;
+    return {
+        command: 'adapter',
+        env: env,
+        adapter,
+        adapterCommand: adapterCommand,
+        options,
+        ...(json ? { json: true } : {}),
+    };
+}
 function parseUpgrade(args) {
     let channel = 'beta';
     let check = false;

package/dist/tooling/cli/help.js

@@ -30,11 +30,15 @@ Commands:
   package                 Prepare public declarations for publication.
   upgrade                 Update Astrale dependencies through pnpm (default: beta).
   yank <version>          Take a published version out of resolution, or put it back.
+  <adapter> <command> <environment>
+                          Run a command the Environment's adapter declares for its provider,
+                          such as cloudflare plan production or cloudflare init production.
 
 Options:
   -h, --help              Show help.
 
-Run "astrale-domain <command> --help" for command-specific help.
+Run "astrale-domain <command> --help" for command-specific help. An adapter command that
+does not exist names the commands and options the Environment's adapter declares.
 `;
 const COMMAND_HELP = Object.freeze({
     upgrade: `Update existing Astrale dependencies in a pnpm project or workspace.
@@ -140,19 +144,18 @@ Behavior:
   The registry and the instances are read through the Astrale CLI (${MINIMUM_INSTALLATIONS_CLI_VERSION} or
   newer) with the caller's identity, only once a deployment is listed.
   A registry that cannot be read fails the listing; an unknown instance never does.
-  A preview expires 30 days after its activation or its last call, whichever is
-  later; a published deployment never does. Last calls are read from the host as it
-  counts them, so a host whose last calls cannot be read is not listed. A platform
-  dispatch namespace reads them from its calls dataset, and without Account Analytics
-  Read lists its deployments without last calls or expiries.
+  Admin's Services and a Cloudflare dispatch namespace keep every deployment until its
+  owner retires it, and report no last call or expiry; LAST CALL and EXPIRES show one
+  only when an older adapter reports it.
   Listing changes nothing, at any host, registry or instance.
   An Environment in legacy direct mode, refused by deploy, or whose adapter lists no
   deployments is reported on stderr and, with --json, under unlisted. A deployment
   whose record this SDK does not admit is still listed, from what its host knows.
   With --json, each deployment carries its installedOn and its call target: the path of
   its node on Admin's Services, for astrale call "<path>.method.setSecret" --admin, or the
-  namespace and script of a platform dispatch namespace, which its operator tooling
-  takes; installations says what of INSTALLED ON is unknown.
+  namespace and script of a dispatch namespace, which the hosting kit
+  (@astrale-os/adapter-cloudflare/hosting) retires; installations says what of
+  INSTALLED ON is unknown.
   Exit status: 0 listed, 1 a host or the registry could not be read (with --json,
   nothing on stdout), 2 usage error.
 `,

package/dist/tooling/cli/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank), its JSON results,
- * the deploy mode each command selects for an Environment (CT33), and the explicit dotenv boundary.
+ * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank, and the
+ * provider commands adapters declare), its JSON results, the deploy mode each command selects for an Environment (CT33), and the explicit
+ * dotenv boundary.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
@@ -14,6 +15,7 @@ export { run } from './run.js';
 export type { BuildResultV1 } from './build.js';
 export type { DeployResultV1, DeploymentSecretsState } from './deploy-result.js';
 export type { DiffChangeV1, DiffReportV1 } from './diff/index.js';
+export type { AdapterCommandReportV1 } from './adapter-command.js';
 export type { InstallationSourcesV1, InstallationUnknownReason, InstalledOnV1, InstanceSourceV1, ListedDeploymentV1, ListResultV1, UnlistedEnvironmentV1, } from './list.js';
 export type { PublishReportV1 } from './publish/index.js';
 export type { YankReportV1 } from './yank.js';

package/dist/tooling/cli/index.js

@@ -1,7 +1,8 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank), its JSON results,
- * the deploy mode each command selects for an Environment (CT33), and the explicit dotenv boundary.
+ * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank, and the
+ * provider commands adapters declare), its JSON results, the deploy mode each command selects for an Environment (CT33), and the explicit
+ * dotenv boundary.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is

package/dist/tooling/cli/list.d.ts

@@ -26,11 +26,11 @@ export interface ListResultV1 {
 }
 /**
  * One deployment: what its host knows (`DeploymentSummaryV1`), the Environment it was listed for
- * and its adapter, its computed name, and its call target. `lastCallAt` and a preview's `expiresAt`
- * are as of the listing: a platform namespace (adapter-cloudflare) reads every call from its calls
- * dataset, and omits both without Account Analytics Read. Admin's Services (adapter-astrale) keeps
- * every deployment until it is retired and counts no call: its rows are `published`, with neither
- * clock, and say whether their Service serves them (`current`).
+ * and its adapter, its computed name, and its call target. Admin's Services (adapter-astrale) keeps
+ * every deployment until it is retired: its rows are `published` and say whether their Service
+ * serves them (`current`). A Cloudflare dispatch namespace (adapter-cloudflare) keeps no
+ * retention, and knows a deployment's creation instant and key only while its script exists. A
+ * last call and an expiry are printed only when an older adapter still reports them.
  */
 export type ListedDeploymentV1 = Omit<DeploymentSummaryV1, 'record'> & {
     /** The Project Environment whose line holds the deployment, as its host listed it. */

package/dist/tooling/cli/list.js

@@ -189,13 +189,13 @@ function listedDeployment(hosted, publications, installations) {
         line: deployment.line,
         owner: deployment.owner,
         state: deployment.state,
-        retention: deployment.retention,
-        createdAt: deployment.createdAt,
+        ...(deployment.retention === undefined ? {} : { retention: deployment.retention }),
+        ...(deployment.createdAt === undefined ? {} : { createdAt: deployment.createdAt }),
         ...(deployment.lastCallAt === undefined ? {} : { lastCallAt: deployment.lastCallAt }),
         ...(deployment.expiresAt === undefined ? {} : { expiresAt: deployment.expiresAt }),
         ...(deployment.retiredAt === undefined ? {} : { retiredAt: deployment.retiredAt }),
         ...(deployment.retirement === undefined ? {} : { retirement: deployment.retirement }),
-        signingKeyId: deployment.signingKeyId,
+        ...(deployment.signingKeyId === undefined ? {} : { signingKeyId: deployment.signingKeyId }),
         record,
         ...(recordRefusal === undefined ? {} : { recordRefusal }),
         ...(deployment.current === undefined ? {} : { current: deployment.current }),
@@ -203,11 +203,11 @@ function listedDeployment(hosted, publications, installations) {
     });
 }
 /**
- * Why a deployment its host keeps no record of has none: the adapter lists it without `record`, as a
- * platform namespace lists a deployment it has not activated.
+ * Why a deployment its host keeps no record of has none: the adapter lists it without `record`, as
+ * a dispatch namespace lists a label it retired and never activated.
  */
-const NO_RECORD = 'Its host keeps no record of it: it has not been activated (a deploy still in progress, or one ' +
-    'that stopped before activating it).';
+const NO_RECORD = 'Its host keeps no record of it: it was never activated (a deploy still in progress, one that ' +
+    'stopped before activating it, or a label retired before it served).';
 /** Why an admitted record does not describe the listed deployment, if it does not. */
 function describesAnother(record, label, listing) {
     if (record.providerScript !== label) {
@@ -259,18 +259,21 @@ function admitListed(deployment, adapter) {
         throw new TypeError(`Adapter ${adapter} listed an invalid deployment (${member}).`);
     };
     const value = members(deployment) ?? invalid('deployment');
-    for (const key of ['id', 'url', 'label', 'line', 'owner', 'createdAt', 'signingKeyId']) {
+    for (const key of ['id', 'url', 'label', 'line', 'owner']) {
         if (!text(value[key]))
             invalid(key);
     }
-    for (const key of ['lastCallAt', 'expiresAt', 'retiredAt']) {
+    for (const key of ['createdAt', 'signingKeyId', 'lastCallAt', 'expiresAt', 'retiredAt']) {
         if (value[key] !== undefined && !text(value[key]))
             invalid(key);
     }
     if (!STATES.includes(value.state))
         invalid('state');
-    if (value.retention !== 'preview' && value.retention !== 'published')
+    if (value.retention !== undefined &&
+        value.retention !== 'preview' &&
+        value.retention !== 'published') {
         invalid('retention');
+    }
     if (value.retirement !== undefined &&
         value.retirement !== 'expired' &&
         value.retirement !== 'withdrawn') {
@@ -352,10 +355,9 @@ function shortDigest(digest) {
     return `${digest.slice(0, 'sha256:'.length + 7)}…`;
 }
 /**
- * When a deployment stops serving: `never` once published, else its preview expiry as its host
- * keeps it, 30 days after its activation or its last call, whichever is later (AM-123), with the
- * calls counted since the host recorded them; `due` once that instant passed but the host has not
- * retired it yet; for a retired deployment, why it was retired.
+ * When a deployment stops serving: `never` once published, else the expiry an older adapter
+ * reports (`due` once that instant passed), else `—` (a dispatch namespace keeps a deployment
+ * until its owner retires it); for a retired deployment, why it was retired.
  */
 function expiry(deployment, now) {
     if (deployment.state === 'retiring')

package/dist/tooling/cli/orchestrate.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { admitRuntime, compile, resolveRuntime } from '../../deployment/index.js';
 import { packageDomain } from '../packaging/index.js';
+import { runAdapterCommand } from './adapter-command.js';
 import { parseArgs } from './arguments.js';
 import { buildResult, bundleBuild, bundlerCopyWarnings, projectBundlers } from './build.js';
 import { BunRequiredError } from './bun.js';
@@ -64,6 +65,23 @@ export async function run(argv) {
     const project = await loadProject(configPath);
     if (parsed.command === 'list')
         return list(parsed, project, projectDir);
+    if (parsed.command === 'adapter') {
+        const lifecycle = deploymentLifecycle(`${parsed.adapter} ${parsed.adapterCommand} interrupted.`);
+        try {
+            return await runAdapterCommand({
+                adapter: parsed.adapter,
+                command: parsed.adapterCommand,
+                environment: parsed.env,
+                definition: selectEnvironment(project, parsed.env),
+                options: parsed.options ?? {},
+                json: parsed.json === true,
+                signal: lifecycle.signal,
+            });
+        }
+        finally {
+            lifecycle.dispose();
+        }
+    }
     if (parsed.command === 'yank')
         return yank(parsed, project);
     if (parsed.command === 'publish') {

package/dist/tooling/cli/publish/index.d.ts

@@ -63,11 +63,10 @@ export declare const VERIFY_TIMEOUT_MS = 60000;
  * 6. Ask Admin for the Publication; a version Admin gave another release meanwhile is refused,
  *    naming the winner's release, and this deployment stays a preview. Any other failure says
  *    what CT29 says of it: Admin may have created the Publication (a rerun settles it), Admin made
- *    none and a rerun can help, or Admin refused and a rerun meets the same refusal. Then, where
- *    the host has no registry principal to keep it (the platform namespace), `adapter.retain`
- *    keeps the published deployment (CT36); Admin keeps those of its Services (A7), and a
- *    Publication this run created whose mark failed warns, without changing the exit code or
- *    the report.
+ *    none and a rerun can help, or Admin refused and a rerun meets the same refusal. Then, when
+ *    the adapter declares `retain` (a host with no registry principal to keep it, CT36), it
+ *    keeps the published deployment. No first-party adapter declares it: Admin's Services and a
+ *    Cloudflare dispatch namespace keep every deployment until its owner retires it.
  *
  * Steps 0 to 3 make no deploy call. Never installs.
  */

package/dist/tooling/cli/publish/index.js

@@ -44,11 +44,10 @@ const DEFAULT_DEPENDENCIES = Object.freeze({
  * 6. Ask Admin for the Publication; a version Admin gave another release meanwhile is refused,
  *    naming the winner's release, and this deployment stays a preview. Any other failure says
  *    what CT29 says of it: Admin may have created the Publication (a rerun settles it), Admin made
- *    none and a rerun can help, or Admin refused and a rerun meets the same refusal. Then, where
- *    the host has no registry principal to keep it (the platform namespace), `adapter.retain`
- *    keeps the published deployment (CT36); Admin keeps those of its Services (A7), and a
- *    Publication this run created whose mark failed warns, without changing the exit code or
- *    the report.
+ *    none and a rerun can help, or Admin refused and a rerun meets the same refusal. Then, when
+ *    the adapter declares `retain` (a host with no registry principal to keep it, CT36), it
+ *    keeps the published deployment. No first-party adapter declares it: Admin's Services and a
+ *    Cloudflare dispatch namespace keep every deployment until its owner retires it.
  *
  * Steps 0 to 3 make no deploy call. Never installs.
  */
@@ -126,7 +125,7 @@ export async function runPublish(input, dependencies = DEFAULT_DEPENDENCIES) {
         if (existing.yanked) {
             warn(`${name} is yanked; astrale-domain yank ${declared} --undo makes it resolvable again.`);
         }
-        // A rerun after the Publication but before its retention completes the retention.
+        // A rerun after the Publication but before the adapter's `retain` completes that retention.
         const kept = await retain(plan, signal);
         if (kept.state === 'failed')
             return refuse(...notRetained(name, plan, kept.message));
@@ -195,9 +194,6 @@ export async function runPublish(input, dependencies = DEFAULT_DEPENDENCIES) {
         return refuse(...notPublished(name, origin, release.url, cause));
     }
     progress(`Published: ${name} · ${published.status}`);
-    if (published.status === 'created' && published.retention === 'failed') {
-        warn(...notMarked(name, release.url, published.replay));
-    }
     const kept = await retain(plan, signal);
     if (kept.state === 'failed')
         return refuse(...notRetained(name, plan, kept.message));
@@ -298,11 +294,10 @@ function described(cause) {
     return cause instanceof RegistryCliError ? `${cause.code}: ${cause.message}` : message(cause);
 }
 /**
- * Keep the published deployment where its host has no registry principal to mark it: the adapter
- * declares `retain` for the platform namespace only (CT36). Admin's Services keeps every
- * deployment until it is retired, so adapter-astrale declares none. A `RetainRefusal` (absent or
- * retired) is `refused`, which no rerun changes; any other rejection `failed`, which a rerun
- * retries.
+ * Keep the published deployment where its host has no registry principal to mark it, when the
+ * adapter declares `retain` (CT36); an adapter without it keeps every deployment until it is
+ * retired, as adapter-astrale and adapter-cloudflare do. A `RetainRefusal` (absent or retired) is
+ * `refused`, which no rerun changes; any other rejection `failed`, which a rerun retries.
  */
 async function retain(plan, signal) {
     const { adapter } = plan;
@@ -326,20 +321,6 @@ function notRetained(name, plan, cause) {
         'Rerun publish: it publishes nothing again and keeps the deployment.',
     ];
 }
-/**
- * Admin created the Publication, then could not mark its Services' deployment retained (A7): the
- * version stands, so the run succeeds, but the deployment can still expire as a preview. Admin
- * marks on every call that names the version, an `unchanged` one too, so sending the same request
- * again marks it; a publish rerun finds the version in the index and never asks Admin.
- */
-function notMarked(name, url, replay) {
-    return [
-        `${name} is published, but its deployment at ${url} was not marked as retained: until it is, it can expire like a preview.`,
-        'To mark it, send the same request again: Admin answers unchanged and marks the deployment ' +
-            'again (a publish rerun does not send it):',
-        replay,
-    ];
-}
 /**
  * The version names a deployment its host can no longer keep (absent or retired): publishing has
  * nothing left to do, a rerun cannot keep it, and installing the version fails, never silently.

package/dist/tooling/cli/registry/client.d.ts

@@ -39,12 +39,6 @@ export interface RegistryPublishRequest {
     /** The working tree held changes the commit does not, or no commit could be read. */
     readonly dirty: boolean;
 }
-/**
- * Admin's retention mark of the deployment a Publication names, on this call (CT29
- * `PublishRetentionV1`): `marked`, `failed`, or `not-applicable` when Admin's Services do not
- * host it. Admin marks on every call that names the version, an `unchanged` one too.
- */
-export type RegistryPublishRetention = 'marked' | 'failed' | 'not-applicable';
 /**
  * What `astrale __domain-registry publish --json` answered (CT29 `PublishResultV1`): `created` by
  * this call, or `unchanged` when the version already named this release.
@@ -54,13 +48,6 @@ export interface RegistryPublishResult {
     readonly publication: RegistryPublication & {
         readonly url: string;
     };
-    /** Absent when the CLI answered no retention mark this SDK knows. */
-    readonly retention?: RegistryPublishRetention;
-    /**
-     * The command a person runs by hand to send this same request again, its document on stdin:
-     * the one a publish that may have applied names.
-     */
-    readonly replay: string;
 }
 /** Every Publication of one Domain the caller may read, as `astrale domain versions` lists it. */
 export interface RegistryIndex {

package/dist/tooling/cli/registry/client.js

@@ -127,7 +127,7 @@ export async function openDomainRegistry(input, dependencies = {
                 stdout: DOCUMENT_LIMIT,
                 timeoutMs: PUBLISH_TIMEOUT_MS,
                 change: true,
-            }), request, commandLine(invocation));
+            }), request);
         },
         async yank(origin, version, options) {
             const reference = `${origin}@${version}`;
@@ -256,10 +256,10 @@ function publication(input, origin) {
 /**
  * Admit the CT29 `PublishResultV1` only as the answer to this request: the same version, URL and
  * release digest, so a CLI that answered for another Publication is never reported as published.
- * Its retention mark never decides that: one this SDK does not know is left out, so the
- * Publication still reads as published.
+ * Any other key is ignored, such as the `retention` mark an Admin before admin#455 still answers:
+ * Admin keeps no Services mark any more, since Services keeps every deployment until it is retired.
  */
-function decodePublishResult(document, request, replay) {
+function decodePublishResult(document, request) {
     const named = document.publication;
     if (document.format !== 'astrale.registry-publish-result' ||
         document.version !== 1 ||
@@ -277,13 +277,8 @@ function decodePublishResult(document, request, replay) {
     return Object.freeze({
         status: document.status,
         publication: Object.freeze({ ...published, url: named.url }),
-        ...(isRetention(document.retention) ? { retention: document.retention } : {}),
-        replay,
     });
 }
-function isRetention(input) {
-    return input === 'marked' || input === 'failed' || input === 'not-applicable';
-}
 function decodeBundleDocument(document, origin, expected) {
     const named = document.publication;
     if (document.format !== 'astrale.registry-bundle' ||

package/dist/tooling/cli/registry/index.d.ts

@@ -2,7 +2,7 @@
  * The Admin Domain registry as Project commands read and change it: through the Astrale CLI's
  * registry plumbing (CT29), with the caller's own credential and the CLI's configured Admin target.
  */
-export { RegistryCliError, openDomainRegistry, type DomainRegistry, type DomainRegistryDependencies, type RegistryBundle, type RegistryDigest, type RegistryIndex, type RegistryPublication, type RegistryPublishRequest, type RegistryPublishResult, type RegistryPublishRetention, type RegistryYank, } from './client.js';
+export { RegistryCliError, openDomainRegistry, type DomainRegistry, type DomainRegistryDependencies, type RegistryBundle, type RegistryDigest, type RegistryIndex, type RegistryPublication, type RegistryPublishRequest, type RegistryPublishResult, type RegistryYank, } from './client.js';
 export { MINIMUM_INSTALLATIONS_CLI_VERSION, MINIMUM_REGISTRY_CLI_VERSION, resolveRegistryExecutable, } from './executable.js';
 export { isAdminFailure } from './installations.js';
 export type { InstallationUnknownReason, InstanceInstallation, InstanceListing, } from './installations.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.20",
+  "version": "0.6.0-beta.22",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",