@astrale-os/sdk 0.6.0-beta.21 → 0.6.0-beta.23

package/README.md

@@ -345,10 +345,6 @@ did not derive.
 - **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
   script is the label that its own fields derive. A host admits the record a deploy declares with
   it before storing it, so every stored record decodes.
-- **Platform summary.** `acceptPlatformDeploymentSummary` admits the `summary:<label>` a platform
-  dispatch namespace keeps beside `record:<label>`: the deployment's `DeploymentSummaryV1` without
-  its record, owned by `platform`, named by its label, with no provider version id and no
-  `lastCallAt` or `expiresAt`. `encodePlatformDeploymentSummary` gives its one canonical text.
 
 ```ts
 import {

package/dist/application/workflow/durable.d.ts

@@ -36,25 +36,29 @@ export interface DurableExecution {
  */
 export interface DurableStepAuthority<DomainValue extends Domain = Domain> {
     /**
-     * Kernel Session acting as the Domain. Each `invoke` without an explicit `idempotencyKey` carries
-     * one derived from the Execution, the Step and its position, so a retried Step reaches the same
-     * durable child Execution.
+     * Kernel Session acting as the Domain. Each `invoke` of a durable callable without an explicit
+     * `idempotencyKey` carries one derived from the Execution, the Step and its position, so a
+     * retried Step reaches the same durable child Execution. An `invoke` of any other callable
+     * carries no key, which the Kernel would refuse, and runs again when the Step is retried.
      */
     readonly kernel: BoundClientSession;
     readonly query: QueryExecutor<DomainValue>;
-    /** Each Mutation carries a key derived from the Execution, the Step and its position. */
+    /**
+     * Each Mutation carries a key derived from the Execution, the Step and its position. The Kernel
+     * commits a receipt with the write and answers a retried Step with its first result.
+     */
     readonly mutate: MutationExecutor<DomainValue>;
 }
 export interface DurableStep<DomainValue extends Domain = Domain> {
     /**
      * Run `execute` once and journal its portable output; a replay returns the journaled output. A
-     * Step may run again when its outcome was not journaled, so its effects must be idempotent.
+     * Step may run again when its outcome was not journaled: its Mutations and durable calls are
+     * answered from their keys, and any other effect must be idempotent.
      */
     run<Output>(id: string, execute: (authority: DurableStepAuthority<DomainValue>) => Output | Promise<Output>): Promise<Output>;
     /**
-     * One journaled Mutation. Give it a zero-match precondition on a natural key (for example the
-     * Execution id) and map that failure in `reject`, so a Step replayed after its commit finds its
-     * own effect instead of repeating it.
+     * One journaled Mutation. A Step replayed after its commit receives the result of that commit
+     * from the Kernel's receipt instead of writing again.
      */
     mutate<Input, Output>(id: string, mutation: Mutation<DomainValue, Input, Output>, input: Input): Promise<Output>;
 }

package/dist/deployment/adapter/adapter.d.ts

@@ -1,7 +1,7 @@
-import type { FrozenConfigurationV1 } from '../address/index.js';
+import type { DeploymentConfiguration } from '../address/index.js';
 import type { Bundler } from './bundle/index.js';
 import type { ArtifactSource, DeployContext, DeployResult, PrepareContext } from './legacy/index.js';
-import type { ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
+import type { AdapterCommand, ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
 /** What `admit` receives when `defineProject` binds an adapter to one Environment. */
 export interface AdapterEnvironmentContext {
     readonly environment: string;
@@ -26,8 +26,12 @@ export interface Adapter<Parameters extends object = object> {
     readonly bundler: Bundler;
     /** Refuse parameters that cannot serve this Environment, before any effect. */
     admit?(parameters: Parameters, context: AdapterEnvironmentContext): void;
-    /** Freeze what a deployment of this Environment binds beside its build. Pure. */
-    configure(parameters: Parameters, context: ConfigureContext): FrozenConfigurationV1;
+    /**
+     * Freeze what a deployment of this Environment binds beside its build: a `FrozenConfigurationV1`
+     * for a host that binds a generated Worker's settings itself, a `WorkerConfigurationV1` for a
+     * Worker host that binds only what it is asked (Admin's Services). Pure.
+     */
+    configure(parameters: Parameters, context: ConfigureContext): DeploymentConfiguration;
     /** Where the host places this Environment's deployments. No effect at the host. */
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     /** Create, or reuse, the immutable deployment of one sealed release. */
@@ -44,6 +48,12 @@ export interface Adapter<Parameters extends object = object> {
      * transient. Absent: the registry marks it (Admin's Services).
      */
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
+    /**
+     * Provider commands, by name: `astrale-domain <adapter name> <command> <environment>` runs one
+     * on an Environment this adapter deploys (adapter-cloudflare's `plan` and `init` provision the
+     * host on the operator's own account). Every effect is the adapter's; the CLI only routes.
+     */
+    readonly commands?: Readonly<Record<string, AdapterCommand<Parameters>>>;
     /**
      * @deprecated Legacy direct-mode path (CT33) only: place a build at a stable target. Replacement:
      * `bundler`, `configure` and `placement`. Deleted with the legacy path (D10).
@@ -62,11 +72,12 @@ export interface AdapterInput<Parameters extends object> {
     readonly version: string;
     readonly bundler: Bundler;
     admit?(parameters: Parameters, context: AdapterEnvironmentContext): void;
-    configure(parameters: Parameters, context: ConfigureContext): FrozenConfigurationV1;
+    configure(parameters: Parameters, context: ConfigureContext): DeploymentConfiguration;
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     deployRelease(parameters: Parameters, context: ReleaseDeployContext): Promise<ReleaseDeployResult>;
     list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
+    readonly commands?: Readonly<Record<string, AdapterCommand<Parameters>>>;
     /** @deprecated Legacy direct-mode path (CT33) only. Replacement: `configure`, `placement`. */
     prepare?(parameters: Parameters, context: PrepareContext): Promise<ArtifactSource>;
     /** @deprecated Legacy direct-mode path (CT33) only. Replacement: `deployRelease`. */

package/dist/deployment/adapter/define.d.ts

@@ -3,7 +3,7 @@ import type { Adapter, AdapterInput } from './adapter.js';
 import type { LegacyAdapter, LegacyAdapterInput } from './legacy/index.js';
 /**
  * Capture one receiver-bound provider adapter (adapter interface v2): a required `bundler`,
- * `configure`, `placement` and `deployRelease`, optionally `list` and `retain`, and `prepare` with
+ * `configure`, `placement` and `deployRelease`, optionally `list`, `retain` and provider `commands`, and `prepare` with
  * `deploy` only while it also serves the legacy direct-mode path.
  */
 export declare function defineAdapter<Parameters extends object>(input: AdapterInput<Parameters>): Adapter<Parameters>;

package/dist/deployment/adapter/define.js

@@ -12,6 +12,7 @@ const FIELDS = [
     'deployRelease',
     'list',
     'retain',
+    'commands',
     'prepare',
     'deploy',
     'secretsFile',
@@ -22,7 +23,9 @@ const OPTIONAL_RELEASE_OPERATIONS = ['list', 'retain'];
 /** The operations of the legacy direct-mode path. */
 const STABLE_TARGET_OPERATIONS = ['prepare', 'deploy'];
 /** Every operation an adapter may declare, in the order an admitted adapter lists them. */
-const OPERATIONS = FIELDS.filter((key) => key !== 'name' && key !== 'version' && key !== 'bundler');
+const OPERATIONS = FIELDS.filter((key) => key !== 'name' && key !== 'version' && key !== 'bundler' && key !== 'commands');
+/** A provider command name, `astrale-domain <adapter> <command>`, and an option name. */
+const COMMAND_NAME = /^[a-z][a-z0-9-]{0,31}$/u;
 export function defineAdapter(input) {
     const value = record(input, 'Adapter definition');
     if (Reflect.ownKeys(value).some((key) => !FIELDS.includes(key))) {
@@ -47,12 +50,16 @@ export function defineAdapter(input) {
         key,
         capture(receiver, key),
     ]));
+    if (value.commands !== undefined && !release) {
+        throw new TypeError(`Adapter ${name} declares commands without adapter interface v2.`);
+    }
     const adapter = Object.freeze({
         kind: 'adapter',
         name,
         version,
         bundler,
         ...operations,
+        ...(value.commands === undefined ? {} : { commands: admitCommands(name, value.commands) }),
     });
     admittedAdapters.add(adapter);
     return adapter;
@@ -131,6 +138,38 @@ function missingBundler(name) {
         'to the adapter as its Bundle (a Cloudflare Worker adapter declares ' +
         '`cloudflareWorkerBundler` from `@astrale-os/adapter-cloudflare/build`).');
 }
+/**
+ * Capture the provider commands of one adapter: each a lower-case name, a one-line `summary`,
+ * optional `options` (name to one line of help) and a receiver-bound `run`.
+ */
+function admitCommands(adapter, input) {
+    const commands = record(input, `Adapter ${adapter} commands`);
+    const admitted = {};
+    for (const name of Reflect.ownKeys(commands)) {
+        if (typeof name !== 'string' || !COMMAND_NAME.test(name)) {
+            throw new TypeError(`Adapter ${adapter} declares an invalid command name.`);
+        }
+        const command = record(commands[name], `Adapter ${adapter} command ${name}`);
+        const options = command.options === undefined ? {} : record(command.options, 'Command options');
+        if (Reflect.ownKeys(command).some((key) => key !== 'summary' && key !== 'options' && key !== 'run') ||
+            typeof command.summary !== 'string' ||
+            command.summary.length === 0 ||
+            typeof command.run !== 'function' ||
+            Reflect.ownKeys(options).some((key) => typeof key !== 'string' ||
+                !COMMAND_NAME.test(key) ||
+                key === 'json' ||
+                typeof options[key] !== 'string')) {
+            throw new TypeError(`Adapter ${adapter} command ${name} must declare a summary, string options other than ` +
+                'json and run.');
+        }
+        admitted[name] = Object.freeze({
+            summary: command.summary,
+            options: Object.freeze({ ...options }),
+            run: command.run.bind(command),
+        });
+    }
+    return Object.freeze(admitted);
+}
 function invalidFields() {
     throw new TypeError('Adapter definition contains missing or unknown fields.');
 }

package/dist/deployment/adapter/release/command.d.ts

@@ -0,0 +1,33 @@
+/**
+ * One command an adapter declares for its provider (`astrale-domain <adapter> <command>
+ * <environment>`), such as adapter-cloudflare's `plan` and `init`, which provision the host on the
+ * operator's own account. The CLI only routes: it loads the Project, selects the Environment, checks
+ * that its adapter is the one named and declares the command, and admits the options the command
+ * declares; everything the command does is the adapter's.
+ */
+export interface AdapterCommand<Parameters extends object = object> {
+    /** One line: what the command does, for help. */
+    readonly summary: string;
+    /** The options it takes, `--<name> <value>`, each with one line of help. */
+    readonly options?: Readonly<Record<string, string>>;
+    run(parameters: Parameters, context: AdapterCommandContext): Promise<AdapterCommandResult>;
+}
+/** What an adapter command receives. */
+export interface AdapterCommandContext {
+    readonly environment: string;
+    /** Parent-owned lifecycle cancellation. */
+    readonly signal: AbortSignal;
+    /** The options given, each one the command declares. */
+    readonly options: Readonly<Record<string, string>>;
+}
+/** What an adapter command answers; a command that cannot run rejects instead. */
+export interface AdapterCommandResult {
+    /** 0 done; 1 refused or blocked (the command ran, and says why in `warnings`). */
+    readonly exitCode: 0 | 1;
+    /** Lines for a person, printed on stdout without `--json`. */
+    readonly lines: readonly string[];
+    /** Lines for stderr, printed in either case. */
+    readonly warnings?: readonly string[];
+    /** The JSON-serializable result `--json` prints. */
+    readonly result: unknown;
+}

package/dist/deployment/adapter/release/command.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/release/context.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentCommitV1, FrozenConfigurationV1, LineAddressing } from '../../address/index.js';
+import type { DeploymentCommitV1, DeploymentConfiguration, LineAddressing } from '../../address/index.js';
 import type { Release } from '../../release/index.js';
 import type { Bundle } from '../bundle/index.js';
 /**
@@ -10,8 +10,7 @@ export interface ConfigureContext {
     readonly environment: string;
     /**
      * The names of the Environment's current secrets (the adapter's `secretsFile`), sorted and
-     * unique: exactly the secrets `deployRelease` receives, which the configuration declares in
-     * `bindings.secrets`.
+     * unique: exactly the secrets `deployRelease` receives, which the configuration declares.
      */
     readonly secrets: readonly string[];
 }
@@ -53,7 +52,7 @@ export interface ReleaseDeployContext {
     /** The environment-free bytes of the adapter's `bundler`, identified by `bundle.digest`. */
     readonly bundle: Bundle;
     /** What `configure` froze for this Environment. */
-    readonly configuration: FrozenConfigurationV1;
+    readonly configuration: DeploymentConfiguration;
     /** Where `placement` said the host places the deployment. */
     readonly placement: Placement;
     /**

package/dist/deployment/adapter/release/index.d.ts

@@ -1,3 +1,4 @@
 export type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, RetainContext, } from './context.js';
+export type { AdapterCommand, AdapterCommandContext, AdapterCommandResult } from './command.js';
 export type { DeploymentCallTarget, ListedDeployment } from './list.js';
 export type { DeploymentSecretsState, FailedReleaseDeployResult, MutationKnowledge, ReadyReleaseDeployResult, ReleaseDeploymentPhase, ReleaseDeployResult, } from './result.js';

package/dist/deployment/adapter/release/list.d.ts

@@ -11,8 +11,9 @@ import type { DeploymentSummaryV1 } from '../../address/index.js';
  *   and the deployment it currently serves: `promote` (this deployment's label rolls the Service
  *   back or forward to it), `setSecret` and `secrets`, `setSchedule` and `schedules`, `logs`,
  *   `transfer` and `delete`.
- * - `namespace`: a deployment of a platform dispatch namespace, which has no Services node: the
- *   namespace and the script the per-script tooling of that namespace takes.
+ * - `namespace`: a deployment of a Cloudflare dispatch namespace (adapter-cloudflare's namespace
+ *   mode), which has no Services node: the namespace and the script, which the hosting kit
+ *   (`@astrale-os/adapter-cloudflare/hosting`) retires, points a name at or schedules.
  */
 export type DeploymentCallTarget = {
     readonly kind: 'services';
@@ -27,11 +28,11 @@ export type DeploymentCallTarget = {
 };
 /**
  * One deployment as an adapter's `list` returns it: what its host knows of it, its record as the
- * host stores it, and where it is called. `lastCallAt`, and a preview's `expiresAt`, are as of the
- * listing: an adapter whose host records calls only now and then reads the calls counted since, and
- * one that cannot read them for want of a permission omits both rather than print stale values.
- * Admin's Services keeps every deployment until it is retired and counts no call: its deployments
- * are `published`, `withdrawn` once retiring, and carry neither clock.
+ * host stores it, and where it is called. Admin's Services keeps every deployment until it is
+ * retired and counts no call: its deployments are `published` and `withdrawn` once retiring. A
+ * Cloudflare dispatch namespace keeps no retention: its rows carry none, and carry their creation
+ * instant and key only while their script exists. No first-party adapter reports a last call or an
+ * expiry any more; the CLI still prints one an older adapter reports.
  *
  * The adapter does not admit the record. The listing admits it with `acceptDeploymentRecord`, and a
  * record it refuses (one a host on an older SDK still admits, say) never fails the listing: that
@@ -40,13 +41,13 @@ export type DeploymentCallTarget = {
 export interface ListedDeployment extends Omit<DeploymentSummaryV1, 'record'> {
     /**
      * The record as the host stores it, unadmitted, whatever value that is (JSON `null` included).
-     * Absent when the host keeps no record of the deployment: a platform namespace keeps none until
-     * it activates the deployment.
+     * Absent when the host keeps no record of the deployment: a dispatch namespace keeps none for a
+     * label it only retired.
      */
     readonly record?: unknown;
     /**
      * Whether the stable URL of the deployment's Service serves it. Present only where the host has
-     * Services (Admin's Services); a platform namespace has none.
+     * Services (Admin's Services); a dispatch namespace has none.
      */
     readonly current?: boolean;
     readonly callTarget: DeploymentCallTarget;

package/dist/deployment/address/configuration.d.ts

@@ -1,4 +1,5 @@
 import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+import type { WorkerConfigurationV1 } from '../worker/configuration.js';
 export declare const FROZEN_CONFIGURATION_FORMAT = "astrale.deployment.configuration";
 export declare const FROZEN_CONFIGURATION_VERSION = 1;
 /**
@@ -70,6 +71,17 @@ export interface FrozenDurableOptions {
     };
     readonly stepTimeoutMs?: number;
 }
+/**
+ * What one deployment freezes beside its build, as its adapter's `configure` returns it: a
+ * `FrozenConfigurationV1`, which a Cloudflare dispatch namespace binds (namespace mode), or a
+ * `WorkerConfigurationV1` (`@astrale-os/sdk/deployment/worker`), which a Worker host binds
+ * (Admin's Services). Its digest and the build digest make the deployment's label.
+ */
+export type DeploymentConfiguration = FrozenConfigurationV1 | WorkerConfigurationV1;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export declare function deploymentConfigurationDigest(configuration: DeploymentConfiguration): Digest;
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export declare function isFrozenConfiguration(configuration: DeploymentConfiguration): configuration is FrozenConfigurationV1;
 /** A configuration before its canonical order: lists in any order, no format header. */
 export type FrozenConfigurationInput = Omit<FrozenConfigurationV1, 'format' | 'version'>;
 /** Freeze one deployment configuration in the one canonical order its digest is taken in. */

package/dist/deployment/address/configuration.js

@@ -1,5 +1,6 @@
 import { json } from '@astrale-os/kernel-dsl/value';
 import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { isWorkerConfiguration, workerConfigurationDigest } from '../worker/configuration.js';
 export const FROZEN_CONFIGURATION_FORMAT = 'astrale.deployment.configuration';
 export const FROZEN_CONFIGURATION_VERSION = 1;
 /** Service binding through which an immutable deployment reaches the instance router. */
@@ -10,6 +11,16 @@ const COMPATIBILITY_DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const BINDING_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
 /** A Cloudflare dispatch namespace name. */
 const NAMESPACE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export function deploymentConfigurationDigest(configuration) {
+    return isWorkerConfiguration(configuration)
+        ? workerConfigurationDigest(configuration)
+        : configurationDigest(configuration);
+}
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export function isFrozenConfiguration(configuration) {
+    return configuration?.format === FROZEN_CONFIGURATION_FORMAT;
+}
 /** Freeze one deployment configuration in the one canonical order its digest is taken in. */
 export function frozenConfiguration(input) {
     if (input === null || typeof input !== 'object')

package/dist/deployment/address/index.d.ts

@@ -1,5 +1,5 @@
-export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, type FrozenConfigurationInput, type FrozenDurableOptions, type FrozenConfigurationV1, } from './configuration.js';
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, type DeploymentConfiguration, type FrozenConfigurationInput, type FrozenDurableOptions, type FrozenConfigurationV1, } from './configuration.js';
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
-export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, type DeploymentCommitV1, type DeploymentRecordV1, } from './record.js';
-export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, type DeploymentSummaryV1, type PlatformDeploymentSummaryV1, } from './summary.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, type DeploymentCommitV1, type DeploymentRecordDocument, type DeploymentRecordV1, } from './record.js';
+export type { DeploymentSummaryV1 } from './summary.js';

package/dist/deployment/address/index.js

@@ -1,5 +1,4 @@
-export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, } from './configuration.js';
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, } from './configuration.js';
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
-export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, } from './record.js';
-export { acceptPlatformDeploymentSummary, encodePlatformDeploymentSummary, PLATFORM_OWNER, } from './summary.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, } from './record.js';

package/dist/deployment/address/label.d.ts

@@ -1,6 +1,6 @@
 import type { Digest } from '@astrale-os/kernel-protocol/artifact';
 import type { BuildDigest } from '../build/manifest.js';
-import type { FrozenConfigurationV1 } from './configuration.js';
+import type { DeploymentConfiguration } from './configuration.js';
 /**
  * Every deployment label: an optional readable part, the 16-character line fingerprint and the
  * 16-character content, both lower-case base32. A legacy provider name (a UUID, a stable Worker
@@ -16,11 +16,11 @@ export interface DeploymentLabelParts {
 }
 /**
  * The 16-character content of one deployment: the first 80 bits of
- * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest(configuration)))` in lower-case
- * base32. It covers the build and the frozen configuration, never a secret: one address serves
- * one release, and a changed variable gives another address.
+ * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(deploymentConfigurationDigest(configuration)))` in
+ * lower-case base32. It covers the build and the frozen configuration, never a secret: one address
+ * serves one release, and a changed variable gives another address.
  */
-export declare function deploymentContent(build: BuildDigest, configuration: FrozenConfigurationV1): string;
+export declare function deploymentContent(build: BuildDigest, configuration: DeploymentConfiguration): string;
 /** The content of a build and a full configuration digest, as a deployment record holds them. */
 export declare function contentOf(build: BuildDigest, configuration: Digest): string;
 /**

package/dist/deployment/address/label.js

@@ -1,4 +1,4 @@
-import { configurationDigest } from './configuration.js';
+import { deploymentConfigurationDigest } from './configuration.js';
 import { first80 } from './fingerprint.js';
 /**
  * Every deployment label: an optional readable part, the 16-character line fingerprint and the
@@ -18,12 +18,12 @@ const MAXIMUM_LABEL_LENGTH = MAXIMUM_LINE_LENGTH + 17;
 const MAXIMUM_HOST_LENGTH = 253;
 /**
  * The 16-character content of one deployment: the first 80 bits of
- * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest(configuration)))` in lower-case
- * base32. It covers the build and the frozen configuration, never a secret: one address serves
- * one release, and a changed variable gives another address.
+ * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(deploymentConfigurationDigest(configuration)))` in
+ * lower-case base32. It covers the build and the frozen configuration, never a secret: one address
+ * serves one release, and a changed variable gives another address.
  */
 export function deploymentContent(build, configuration) {
-    return contentOf(build, configurationDigest(configuration));
+    return contentOf(build, deploymentConfigurationDigest(configuration));
 }
 /** The content of a build and a full configuration digest, as a deployment record holds them. */
 export function contentOf(build, configuration) {

package/dist/deployment/address/record.d.ts

@@ -4,6 +4,11 @@ import type { ReleaseDigest } from '@astrale-os/kernel-protocol/release';
 import type { BuildDigest } from '../build/manifest.js';
 export declare const DEPLOYMENT_RECORD_FORMAT = "astrale.deployment-record";
 export declare const DEPLOYMENT_RECORD_VERSION = 1;
+/**
+ * The media type of a `DeploymentRecordV1` document: what a Domain deployer publishes it with, and
+ * what a host serves it with at `/.well-known/astrale/deployment.json`.
+ */
+export declare const DEPLOYMENT_RECORD_MEDIA_TYPE = "application/vnd.astrale.deployment-record+json;v=1";
 /** The commit a deployment was built from, as the deployer declared it. */
 export interface DeploymentCommitV1 {
     /** The full commit SHA, 40 hexadecimal digits in either case; git prints it in lower case. */
@@ -50,3 +55,19 @@ export interface DeploymentRecordV1 {
  * does, and never fails the whole listing over it.
  */
 export declare function acceptDeploymentRecord(input: unknown): DeploymentRecordV1;
+/** The document of one record: what a Domain deployer publishes and a host serves verbatim. */
+export interface DeploymentRecordDocument {
+    readonly contentType: string;
+    readonly bytes: Uint8Array;
+}
+/**
+ * The document of one record, as a Domain deployer publishes it: the record admitted, as the
+ * UTF-8 bytes of its RFC 8785 canonical JSON, with `DEPLOYMENT_RECORD_MEDIA_TYPE`. One record has
+ * one document, byte for byte, whoever writes it.
+ */
+export declare function encodeDeploymentRecord(record: DeploymentRecordV1): DeploymentRecordDocument;
+/**
+ * Admit the document of one record: `DEPLOYMENT_RECORD_MEDIA_TYPE`, and UTF-8 JSON whose value
+ * `acceptDeploymentRecord` admits. Anything else throws.
+ */
+export declare function decodeDeploymentRecord(document: DeploymentRecordDocument): DeploymentRecordV1;

package/dist/deployment/address/record.js

@@ -1,10 +1,16 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { json } from '@astrale-os/kernel-dsl/value';
 import { isVersion } from '../../platform/versioning/version.js';
 import { ENVIRONMENT_NAME } from '../environment.js';
 import { contentOf, parseDeploymentLabel } from './label.js';
 import { deploymentLine } from './line.js';
 export const DEPLOYMENT_RECORD_FORMAT = 'astrale.deployment-record';
 export const DEPLOYMENT_RECORD_VERSION = 1;
+/**
+ * The media type of a `DeploymentRecordV1` document: what a Domain deployer publishes it with, and
+ * what a host serves it with at `/.well-known/astrale/deployment.json`.
+ */
+export const DEPLOYMENT_RECORD_MEDIA_TYPE = 'application/vnd.astrale.deployment-record+json;v=1';
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 /** The full hexadecimal SHA-1 of a commit, in either case, as a deployment name reads it. */
 const SHA = /^[0-9a-f]{40}$/iu;
@@ -64,6 +70,34 @@ export function acceptDeploymentRecord(input) {
         commit: record.commit === null ? null : commit(record.commit),
     });
 }
+/**
+ * The document of one record, as a Domain deployer publishes it: the record admitted, as the
+ * UTF-8 bytes of its RFC 8785 canonical JSON, with `DEPLOYMENT_RECORD_MEDIA_TYPE`. One record has
+ * one document, byte for byte, whoever writes it.
+ */
+export function encodeDeploymentRecord(record) {
+    return Object.freeze({
+        contentType: DEPLOYMENT_RECORD_MEDIA_TYPE,
+        bytes: new TextEncoder().encode(json.serialize(acceptDeploymentRecord(record))),
+    });
+}
+/**
+ * Admit the document of one record: `DEPLOYMENT_RECORD_MEDIA_TYPE`, and UTF-8 JSON whose value
+ * `acceptDeploymentRecord` admits. Anything else throws.
+ */
+export function decodeDeploymentRecord(document) {
+    if (document?.contentType !== DEPLOYMENT_RECORD_MEDIA_TYPE) {
+        throw new TypeError('Deployment record document has another media type.');
+    }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(document.bytes));
+    }
+    catch (cause) {
+        throw new TypeError('Deployment record document is not UTF-8 JSON.', { cause });
+    }
+    return acceptDeploymentRecord(value);
+}
 function commit(input) {
     const based = input !== null && typeof input === 'object' && Object.hasOwn(input, 'base');
     const value = exact(input, based ? ['sha', 'dirty', 'base'] : ['sha', 'dirty'], 'commit');

package/dist/deployment/address/summary.d.ts

@@ -1,57 +1,34 @@
 import type { DeploymentRecordV1 } from './record.js';
 /**
  * What a host knows of one immutable deployment beside the record its deployer declared: where it
- * answers, who owns its line, its lifecycle and its retention. It names a deployment by its label
- * and URL, never by a provider version id. An adapter's `list` returns these; the host owns every
- * field but `record`, which it stores as declared.
+ * answers, who owns its line and its lifecycle. It names a deployment by its label and URL, never
+ * by a provider version id. An adapter's `list` returns these; the host owns every field but
+ * `record`, which it stores as declared.
  */
 export interface DeploymentSummaryV1 {
-    /** The host's own identifier of the deployment (a graph node id on Admin's Services). */
+    /** The host's own identifier of the deployment (a graph node id on Admin's Services, the label on a dispatch namespace). */
     readonly id: string;
     readonly url: string;
     readonly label: string;
     readonly line: string;
-    /** The Identity owning the line: a node path on Admin's Services, `platform` on a platform namespace. */
+    /** Who owns the line: a node path on Admin's Services, the dispatch namespace's name on Cloudflare. */
     readonly owner: string;
     readonly state: 'deploying' | 'active' | 'retiring' | 'retired' | 'failed';
-    readonly retention: 'preview' | 'published';
-    readonly createdAt: string;
+    /**
+     * `published` on Admin's Services, which keeps every deployment until it is retired. Absent on a
+     * dispatch namespace, which keeps no retention.
+     */
+    readonly retention?: 'preview' | 'published';
+    /** When the host created it; absent when the host no longer knows (its script is gone). */
+    readonly createdAt?: string;
+    /** An older adapter's report of the last call; no first-party adapter reports it any more. */
     readonly lastCallAt?: string;
-    /** A preview's: 30 days after its activation or its last call, whichever is later (AM-123). */
+    /** An older adapter's preview expiry; no first-party adapter reports it any more. */
     readonly expiresAt?: string;
     readonly retiredAt?: string;
+    /** `withdrawn` once its owner retired it (`expired` only from an older adapter). */
     readonly retirement?: 'expired' | 'withdrawn';
-    readonly signingKeyId: string;
+    /** The RFC 7638 thumbprint of its key; absent when the host no longer knows (its script is gone). */
+    readonly signingKeyId?: string;
     readonly record: DeploymentRecordV1;
 }
-/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
-export declare const PLATFORM_OWNER = "platform";
-/**
- * `summary:<label>` in the routing KV of a platform dispatch namespace (CT20, AM-131): the
- * `DeploymentSummaryV1` of one deployment without its record, which stays at `record:<label>`.
- *
- * Its writers are the deployer (`cloudflare({ namespace })`), which writes it at activation,
- * before `record:<label>`, names in it the new key of a script it recreates under the label after
- * an operator deleted it, and marks it published (`retain`), and the platform retirement tooling
- * (SV6), which records a withdrawal. So it names the deployment by its label (`id` is the label),
- * is owned by `platform`, is `active` until withdrawn, and carries no `lastCallAt` or `expiresAt`:
- * nothing on the platform namespace keeps those clocks, and listings read them from the calls
- * dataset (AM-133). It never carries a provider version id or a secret digest: an in-place secret
- * write mints a new version id, which identifies nothing (OPS-2 X1).
- */
-export type PlatformDeploymentSummaryV1 = Omit<DeploymentSummaryV1, 'record' | 'lastCallAt' | 'expiresAt' | 'state' | 'retirement'> & {
-    readonly state: 'active' | 'retiring' | 'retired';
-    readonly retirement?: 'withdrawn';
-};
-/**
- * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
- * provider version id or a clock among them; so is a summary whose id, line or URL is not its
- * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
- * meets a refused summary lists that label apart, never acting on it.
- */
-export declare function acceptPlatformDeploymentSummary(input: unknown): PlatformDeploymentSummaryV1;
-/**
- * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
- * one summary has one text, so a writer that reads it back compares texts.
- */
-export declare function encodePlatformDeploymentSummary(summary: PlatformDeploymentSummaryV1): string;