@astrale-os/sdk 0.6.0-beta.21 → 0.6.0-beta.23

package/dist/deployment/address/summary.js

@@ -1,117 +1 @@
-import { json } from '@astrale-os/kernel-dsl/value';
-import { deploymentUrl, parseDeploymentLabel } from './label.js';
-/** The owner every summary of a platform namespace names: the platform holds all of its lines. */
-export const PLATFORM_OWNER = 'platform';
-const REQUIRED = [
-    'id',
-    'url',
-    'label',
-    'line',
-    'owner',
-    'state',
-    'retention',
-    'createdAt',
-    'signingKeyId',
-];
-const RETIREMENT = ['retiredAt', 'retirement'];
-const STATES = ['active', 'retiring', 'retired'];
-const RETENTIONS = ['preview', 'published'];
-/** An instant as `Date.prototype.toISOString` writes it, in UTC. */
-const INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
-/** An RFC 7638 JWK thumbprint: the base64url SHA-256 of the public key, 43 characters. */
-const KEY_ID = /^[A-Za-z0-9_-]{43}$/u;
-/**
- * Admit one platform deployment summary exactly. Any member outside its shape is refused, a
- * provider version id or a clock among them; so is a summary whose id, line or URL is not its
- * label's, whose owner is not the platform, or whose state and retirement disagree. A reader that
- * meets a refused summary lists that label apart, never acting on it.
- */
-export function acceptPlatformDeploymentSummary(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        invalid('members');
-    const value = input;
-    const keys = Reflect.ownKeys(value);
-    const retired = RETIREMENT.some((key) => Object.hasOwn(value, key));
-    const expected = retired ? [...REQUIRED, ...RETIREMENT] : REQUIRED;
-    if (keys.length !== expected.length || expected.some((key) => !Object.hasOwn(value, key))) {
-        invalid('members');
-    }
-    const label = text(value.label, 'label');
-    let line;
-    try {
-        line = parseDeploymentLabel(label).line;
-    }
-    catch {
-        invalid('label');
-    }
-    if (value.id !== label)
-        invalid('id');
-    if (value.line !== line)
-        invalid('line');
-    const url = text(value.url, 'url');
-    if (!sameDeploymentUrl(url, label))
-        invalid('url');
-    if (value.owner !== PLATFORM_OWNER)
-        invalid('owner');
-    const state = value.state;
-    if (typeof state !== 'string' || !STATES.includes(state))
-        invalid('state');
-    if (retired !== (state !== 'active'))
-        invalid('state');
-    const retention = value.retention;
-    if (typeof retention !== 'string' || !RETENTIONS.includes(retention))
-        invalid('retention');
-    const createdAt = instant(value.createdAt, 'createdAt');
-    const signingKeyId = text(value.signingKeyId, 'signingKeyId');
-    if (!KEY_ID.test(signingKeyId))
-        invalid('signingKeyId');
-    if (retired && value.retirement !== 'withdrawn')
-        invalid('retirement');
-    return Object.freeze({
-        id: label,
-        url,
-        label,
-        line,
-        owner: PLATFORM_OWNER,
-        state: state,
-        retention: retention,
-        createdAt,
-        signingKeyId,
-        ...(retired
-            ? { retiredAt: instant(value.retiredAt, 'retiredAt'), retirement: 'withdrawn' }
-            : {}),
-    });
-}
-/**
- * The canonical JSON (RFC 8785) of one admitted platform summary, as `summary:<label>` holds it:
- * one summary has one text, so a writer that reads it back compares texts.
- */
-export function encodePlatformDeploymentSummary(summary) {
-    return json.serialize(acceptPlatformDeploymentSummary(summary));
-}
-/** Whether `url` is exactly `https://<label>.<routing domain>` for some routing domain. */
-function sameDeploymentUrl(url, label) {
-    const prefix = `https://${label}.`;
-    if (!url.startsWith(prefix))
-        return false;
-    try {
-        return deploymentUrl(label, url.slice(prefix.length)) === url;
-    }
-    catch {
-        return false;
-    }
-}
-function text(input, member) {
-    if (typeof input !== 'string' || input.length === 0)
-        invalid(member);
-    return input;
-}
-function instant(input, member) {
-    const value = text(input, member);
-    if (!INSTANT.test(value) || new Date(value).toISOString() !== value)
-        invalid(member);
-    return value;
-}
-function invalid(member) {
-    throw new TypeError(`Platform deployment summary has invalid ${member}.`);
-}
+export {};

package/dist/deployment/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
+export type { Adapter, AdapterCommand, AdapterCommandContext, AdapterCommandResult, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, Bundle, BundleContext, Bundler, BundleSource, ConfigureContext, DeployContext, DeploymentCallTarget, DeploymentPhase, DeploymentProgress, DeploymentSecretsState, DeployResult, FailedDeployResult, FailedReleaseDeployResult, LegacyAdapter, LegacyAdapterInput, ListContext, ListedDeployment, MutationKnowledge, Placement, PlacementContext, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, ReadyReleaseDeployResult, ReleaseDeployContext, ReleaseDeploymentPhase, ReleaseDeployResult, RetainContext, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildDigest, BuildManifestV1, BuildSchema, } from './build/index.js';
 export { deploy } from './deploy.js';

package/dist/deployment/verify/index.d.ts

@@ -2,4 +2,4 @@ export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
 export type { BundleInput, PreflightInput } from './preflight/index.js';
-export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';
+export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';

package/dist/deployment/verify/index.js

@@ -1,4 +1,4 @@
 export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
-export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';
+export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';

package/dist/deployment/verify/readiness/index.d.ts

@@ -11,4 +11,11 @@ export { verifyRelease } from './release.js';
  * deployment's `release.json` (release digest and build digest), or a stable target's
  * `domain.json` (deprecated, `legacy/`).
  */
+/**
+ * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
+ * deployment serves its release: its `release.json`, its Bundle and its issuer documents (the
+ * OpenID configuration and its key set). A host that probes paths before it activates a
+ * deployment probes these.
+ */
+export declare function readinessPaths(deployed: Release): readonly string[];
 export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,3 +1,5 @@
+import { issuer } from '@astrale-os/kernel-protocol';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { verifyIdentity } from './identity.js';
 import { verifyPublication } from './legacy/index.js';
 import { verifyRelease } from './release.js';
@@ -10,6 +12,21 @@ export { verifyRelease } from './release.js';
  * deployment's `release.json` (release digest and build digest), or a stable target's
  * `domain.json` (deprecated, `legacy/`).
  */
+/**
+ * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
+ * deployment serves its release: its `release.json`, its Bundle and its issuer documents (the
+ * OpenID configuration and its key set). A host that probes paths before it activates a
+ * deployment probes these.
+ */
+export function readinessPaths(deployed) {
+    const { configuration, keys } = issuer.paths(deployed.url);
+    return Object.freeze([
+        new URL(release.url(deployed.url)).pathname,
+        new URL(deployed.document.schema.bundle.href).pathname,
+        configuration,
+        keys,
+    ]);
+}
 export async function readiness(release, options = {}) {
     if (release.kind === 'release') {
         await verifyRelease(release, options);

package/dist/deployment/worker/address.d.ts

@@ -0,0 +1,26 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/**
+ * The name of a project a Worker host keeps Services for: lower-case letters, digits, `.`, `_`
+ * and `-`, starting and ending with a letter or a digit, at most 253 characters. A Domain origin is
+ * one (a Domain deployer names its project by its origin).
+ */
+export declare const PROJECT_NAME: RegExp;
+/**
+ * The name of the Service of one project in one environment: the first 80 bits of
+ * `sha256(utf8(project) ‖ 0x00 ‖ utf8(environment))` in lower-case base32, 16 characters. It is
+ * opaque, so a Service's URL says nothing of whose code it serves, and it is the line fingerprint
+ * of `@astrale-os/sdk/deployment/address` (`lineFingerprint`) when the project is a Domain origin:
+ * a Domain's Service keeps its name.
+ */
+export declare function serviceName(project: string, environment: string): string;
+/**
+ * The label of one Worker deployment, `<service>-<content>`: its Service's name, then the first
+ * 80 bits of `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest))` in lower-case base32.
+ * The same code and configuration in the same Service always give the same label, so a redeploy
+ * of a release reuses its deployment; anything else gives another.
+ */
+export declare function workerDeploymentLabel(input: {
+    readonly service: string;
+    readonly buildDigest: Digest;
+    readonly configurationDigest: Digest;
+}): string;

package/dist/deployment/worker/address.js

@@ -0,0 +1,43 @@
+import { first80 } from '../address/fingerprint.js';
+import { deploymentLabel } from '../address/label.js';
+import { ENVIRONMENT_NAME } from '../environment.js';
+/**
+ * The name of a project a Worker host keeps Services for: lower-case letters, digits, `.`, `_`
+ * and `-`, starting and ending with a letter or a digit, at most 253 characters. A Domain origin is
+ * one (a Domain deployer names its project by its origin).
+ */
+export const PROJECT_NAME = /^[a-z0-9](?:[a-z0-9._-]{0,251}[a-z0-9])?$/u;
+/** The longest environment name a Service is named by. */
+const MAXIMUM_ENVIRONMENT_LENGTH = 63;
+/**
+ * The name of the Service of one project in one environment: the first 80 bits of
+ * `sha256(utf8(project) ‖ 0x00 ‖ utf8(environment))` in lower-case base32, 16 characters. It is
+ * opaque, so a Service's URL says nothing of whose code it serves, and it is the line fingerprint
+ * of `@astrale-os/sdk/deployment/address` (`lineFingerprint`) when the project is a Domain origin:
+ * a Domain's Service keeps its name.
+ */
+export function serviceName(project, environment) {
+    if (typeof project !== 'string' || !PROJECT_NAME.test(project)) {
+        throw new TypeError('Worker project must be a lower-case project name.');
+    }
+    if (typeof environment !== 'string' ||
+        environment.length > MAXIMUM_ENVIRONMENT_LENGTH ||
+        !ENVIRONMENT_NAME.test(environment)) {
+        throw new TypeError('Worker environment must be a project environment name.');
+    }
+    return first80(project, environment);
+}
+/**
+ * The label of one Worker deployment, `<service>-<content>`: its Service's name, then the first
+ * 80 bits of `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest))` in lower-case base32.
+ * The same code and configuration in the same Service always give the same label, so a redeploy
+ * of a release reuses its deployment; anything else gives another.
+ */
+export function workerDeploymentLabel(input) {
+    for (const digest of [input.buildDigest, input.configurationDigest]) {
+        if (typeof digest !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(digest)) {
+            throw new TypeError('Worker deployment digests must be sha256 digests.');
+        }
+    }
+    return deploymentLabel(input.service, first80(input.buildDigest, input.configurationDigest));
+}

package/dist/deployment/worker/build.d.ts

@@ -0,0 +1,60 @@
+import type { Value } from '@astrale-os/kernel-dsl/value';
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/** How Workers loads one module. */
+export type WorkerModuleKind = 'esm' | 'wasm' | 'text' | 'data';
+/** One module of a Worker, by the name the others import it by. */
+export interface WorkerModule {
+    readonly name: string;
+    readonly kind: WorkerModuleKind;
+    readonly bytes: Uint8Array;
+}
+/** One static asset of a Worker, by the absolute URL path it is served at. */
+export interface WorkerAsset {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    /** The media type the asset is uploaded with; not part of the build digest. */
+    readonly contentType?: string;
+}
+/**
+ * The members of a build manifest its deployer declares: at least its `format` and `version`,
+ * then whatever provenance the deployer identifies its builds by. A host never reads them: it only
+ * digests them with the `entrypoint` and `files` it computes from the uploaded bytes.
+ *
+ * A generic Worker declares `WORKER_BUILD_MANIFEST`. A Domain deployer declares its
+ * `BuildManifestV1` without `entrypoint` and `files` (`format`, `version`, `origin`, `schema`,
+ * `bundler`), so the digest is exactly the Domain's build digest.
+ */
+export type WorkerBuildManifest = Readonly<Record<string, Value>> & {
+    readonly format: string;
+    readonly version: number;
+};
+/** The build manifest members of a Worker that declares no provenance of its own. */
+export declare const WORKER_BUILD_MANIFEST: WorkerBuildManifest;
+/** The code of one Worker: its modules, its main module, its static assets and its manifest. */
+export interface WorkerCode {
+    readonly manifest: WorkerBuildManifest;
+    readonly mainModule: string;
+    readonly modules: readonly WorkerModule[];
+    readonly assets?: readonly WorkerAsset[];
+}
+/**
+ * The build manifest of one Worker: its declared members, its `entrypoint` (the main module) and
+ * its `files`, sorted by path (UTF-16 code units), each `{ path, digest, size }`. A module is the
+ * file of its own name, a static asset `/<path>` the file `assets/<path>`. A module whose kind is
+ * not the one its name implies (`wasm` for a `.wasm` name, `esm` otherwise) also records its
+ * `kind`, so a module loaded another way is another build. The code is admitted first.
+ */
+export declare function workerBuildManifest(code: WorkerCode): Readonly<Record<string, Value>>;
+/**
+ * The build digest of one Worker: `sha256` of the canonical JSON (RFC 8785) of its build manifest.
+ * A host binds it as `ASTRALE_BUILD_DIGEST`; with a Domain's declared members it is the Domain's
+ * build digest.
+ */
+export declare function workerBuildDigest(code: WorkerCode): Digest;
+/**
+ * Admit the code of one Worker: declared manifest members (a `format`, a positive `version`, no
+ * `entrypoint` nor `files`, at most `manifestSize` bytes of canonical JSON), one to `modules`
+ * modules with safe relative names, unique, the main module among them, and at most `assets`
+ * assets at unique canonical absolute paths. Sizes are bounded per file and for the whole Worker.
+ */
+export declare function acceptWorkerCode(code: WorkerCode): WorkerCode;

package/dist/deployment/worker/build.js

@@ -0,0 +1,172 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+/** The build manifest members of a Worker that declares no provenance of its own. */
+export const WORKER_BUILD_MANIFEST = Object.freeze({
+    format: 'astrale.worker.build',
+    version: 1,
+});
+const MANIFEST_MEDIA_TYPE = 'application/vnd.astrale.worker-build+json;v=1';
+const FILE_MEDIA_TYPE = 'application/octet-stream';
+const MAXIMUM_MODULE_NAME_LENGTH = 256;
+const MAXIMUM_ASSET_PATH_LENGTH = 2_048;
+const KINDS = Object.freeze(['esm', 'wasm', 'text', 'data']);
+/**
+ * The build manifest of one Worker: its declared members, its `entrypoint` (the main module) and
+ * its `files`, sorted by path (UTF-16 code units), each `{ path, digest, size }`. A module is the
+ * file of its own name, a static asset `/<path>` the file `assets/<path>`. A module whose kind is
+ * not the one its name implies (`wasm` for a `.wasm` name, `esm` otherwise) also records its
+ * `kind`, so a module loaded another way is another build. The code is admitted first.
+ */
+export function workerBuildManifest(code) {
+    const admitted = acceptWorkerCode(code);
+    const files = [
+        ...admitted.modules.map((module) => ({
+            path: module.name,
+            ...identity(module.bytes),
+            ...(module.kind === impliedKind(module.name) ? {} : { kind: module.kind }),
+        })),
+        ...(admitted.assets ?? []).map((asset) => ({
+            path: `assets${asset.path}`,
+            ...identity(asset.bytes),
+        })),
+    ].sort((left, right) => compare(left.path, right.path));
+    for (let index = 1; index < files.length; index += 1) {
+        if (files[index - 1].path === files[index].path) {
+            invalid(`the module and the asset file ${files[index].path} collide`);
+        }
+    }
+    return Object.freeze({ ...admitted.manifest, entrypoint: admitted.mainModule, files });
+}
+/**
+ * The build digest of one Worker: `sha256` of the canonical JSON (RFC 8785) of its build manifest.
+ * A host binds it as `ASTRALE_BUILD_DIGEST`; with a Domain's declared members it is the Domain's
+ * build digest.
+ */
+export function workerBuildDigest(code) {
+    return identify(json.encode(workerBuildManifest(code)), MANIFEST_MEDIA_TYPE).digest;
+}
+/**
+ * Admit the code of one Worker: declared manifest members (a `format`, a positive `version`, no
+ * `entrypoint` nor `files`, at most `manifestSize` bytes of canonical JSON), one to `modules`
+ * modules with safe relative names, unique, the main module among them, and at most `assets`
+ * assets at unique canonical absolute paths. Sizes are bounded per file and for the whole Worker.
+ */
+export function acceptWorkerCode(code) {
+    if (code === null || typeof code !== 'object')
+        invalid('it is not an object');
+    const manifest = acceptManifest(code.manifest);
+    const limits = WORKER_DEPLOYMENT_LIMITS;
+    if (!Array.isArray(code.modules) || code.modules.length === 0)
+        invalid('it has no module');
+    if (code.modules.length > limits.modules)
+        invalid('it has too many modules');
+    const assets = code.assets ?? [];
+    if (!Array.isArray(assets) || assets.length > limits.assets)
+        invalid('it has too many assets');
+    let size = 0;
+    const modules = code.modules.map((module) => {
+        if (!isModuleName(module?.name))
+            invalid('a module name is not a safe relative path');
+        if (!KINDS.includes(module.kind))
+            invalid(`module ${module.name} has an unknown kind`);
+        size += bounded(module.bytes, limits.moduleSize, `module ${module.name}`);
+        return Object.freeze({ name: module.name, kind: module.kind, bytes: module.bytes });
+    });
+    unique(modules.map((module) => module.name), 'module names');
+    if (!modules.some((module) => module.name === code.mainModule)) {
+        invalid('its main module is not one of its modules');
+    }
+    const files = assets.map((asset) => {
+        if (!isAssetPath(asset?.path))
+            invalid('an asset path is not a canonical absolute URL path');
+        if (asset.contentType !== undefined && typeof asset.contentType !== 'string') {
+            invalid(`asset ${asset.path} has an invalid content type`);
+        }
+        size += bounded(asset.bytes, limits.assetSize, `asset ${asset.path}`);
+        return Object.freeze({
+            path: asset.path,
+            bytes: asset.bytes,
+            ...(asset.contentType === undefined ? {} : { contentType: asset.contentType }),
+        });
+    });
+    unique(files.map((asset) => asset.path), 'asset paths');
+    if (size > limits.workerSize)
+        invalid('its files exceed the size of one Worker');
+    return Object.freeze({
+        manifest,
+        mainModule: code.mainModule,
+        modules: Object.freeze(modules),
+        ...(files.length === 0 ? {} : { assets: Object.freeze(files) }),
+    });
+}
+/** The kind a module's name implies: `wasm` for a `.wasm` module, `esm` otherwise. */
+function impliedKind(name) {
+    return name.endsWith('.wasm') ? 'wasm' : 'esm';
+}
+function acceptManifest(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('its manifest is not an object');
+    }
+    const manifest = input;
+    if (typeof manifest.format !== 'string' || manifest.format.length === 0) {
+        invalid('its manifest names no format');
+    }
+    if (!Number.isSafeInteger(manifest.version) || manifest.version < 1) {
+        invalid('its manifest names no version');
+    }
+    if (Object.hasOwn(manifest, 'entrypoint') || Object.hasOwn(manifest, 'files')) {
+        invalid('its manifest declares the entrypoint or the files its host computes');
+    }
+    let text;
+    try {
+        text = json.serialize(manifest);
+    }
+    catch (cause) {
+        throw new TypeError('Worker code is invalid: its manifest is not portable JSON.', { cause });
+    }
+    if (new TextEncoder().encode(text).byteLength > WORKER_DEPLOYMENT_LIMITS.manifestSize) {
+        invalid('its manifest is too large');
+    }
+    return JSON.parse(text);
+}
+function identity(bytes) {
+    const { digest, size } = identify(bytes, FILE_MEDIA_TYPE);
+    return { digest, size };
+}
+function bounded(bytes, maximum, label) {
+    if (!(bytes instanceof Uint8Array))
+        invalid(`${label} has no bytes`);
+    if (bytes.byteLength > maximum)
+        invalid(`${label} exceeds its size limit`);
+    return bytes.byteLength;
+}
+/** A safe relative module path: no leading `/`, no `\`, `?` or `#`, no empty, `.` or `..` part. */
+function isModuleName(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    if (value.length > MAXIMUM_MODULE_NAME_LENGTH || /^\/|[\\?#]/u.test(value))
+        return false;
+    return value.split('/').every((part) => part.length > 0 && part !== '.' && part !== '..');
+}
+/** An absolute canonical URL path: `/`, then non-empty parts other than `.` and `..`. */
+function isAssetPath(value) {
+    if (typeof value !== 'string' || value.length > MAXIMUM_ASSET_PATH_LENGTH)
+        return false;
+    if (!value.startsWith('/') || /[\\?#]/u.test(value))
+        return false;
+    return value
+        .slice(1)
+        .split('/')
+        .every((part) => part.length > 0 && part !== '.' && part !== '..');
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length)
+        invalid(`its ${label} are not unique`);
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid(reason) {
+    throw new TypeError(`Worker code is invalid: ${reason}.`);
+}

package/dist/deployment/worker/configuration.d.ts

@@ -0,0 +1,73 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+export declare const WORKER_CONFIGURATION_FORMAT = "astrale.worker.configuration";
+export declare const WORKER_CONFIGURATION_VERSION = 1;
+/** A Cloudflare Worker binding name. */
+export declare const WORKER_BINDING_NAME: RegExp;
+/**
+ * The bindings a Worker host binds itself on every deployment, whatever it asks: never the name
+ * of a variable or a secret.
+ *
+ * - `WORKER_URL`: the deployment URL, `https://<label>.<routing domain>`;
+ * - `ASTRALE_BUILD_DIGEST`: the build digest of the uploaded Worker (`workerBuildDigest`);
+ * - `ASTRALE_VERSION_METADATA`: the provider version metadata; a Worker that asks for readiness
+ *   answers its `id` as `x-astrale-worker-version`;
+ * - `ASTRALE_SIGNING_IDENTITY`: the private Ed25519 JWK of the deployment, with `signingIdentity`;
+ * - `ROUTER`: the host's router service, with `router`;
+ * - `ASSETS`: the deployment's static assets, when it uploads some.
+ */
+export declare const WORKER_HOST_BINDINGS: readonly string[];
+/**
+ * What one Worker deployment freezes beside its code: the Workers runtime it runs on, its plain
+ * variables, the names of its secrets (never their values) and what it asks of its host. Its
+ * digest and the build digest make the deployment's label, so a changed variable, flag, secret
+ * name or option is another deployment, and a rotated secret value is not.
+ *
+ * - `record`: the deployment serves the record its deployer publishes at
+ *   `/.well-known/astrale/deployment.json` (the record's bytes are not part of the configuration:
+ *   a deployment keeps the record it was created with);
+ * - `signingIdentity`: the host generates an Ed25519 key for the deployment alone and binds it as
+ *   `ASTRALE_SIGNING_IDENTITY`;
+ * - `router`: the host binds its own router service as `ROUTER`. A deployment never names a
+ *   service or a dispatch namespace itself.
+ *
+ * How its host probes readiness is not part of it: a probe changes nothing the deployment serves.
+ */
+export interface WorkerConfigurationV1 {
+    readonly format: typeof WORKER_CONFIGURATION_FORMAT;
+    readonly version: typeof WORKER_CONFIGURATION_VERSION;
+    readonly compatibilityDate: string;
+    /** Sorted, unique. */
+    readonly compatibilityFlags: readonly string[];
+    /** Plain variables, never secrets. */
+    readonly vars: Readonly<Record<string, string>>;
+    /** The names of the secrets the deployment binds, sorted and unique. */
+    readonly secrets: readonly string[];
+    readonly record: boolean;
+    readonly signingIdentity: boolean;
+    readonly router: boolean;
+}
+/** A configuration before its canonical order: lists in any order, options false when absent. */
+export interface WorkerConfigurationInput {
+    readonly compatibilityDate: string;
+    readonly compatibilityFlags?: readonly string[];
+    readonly vars?: Readonly<Record<string, string>>;
+    readonly secrets?: readonly string[];
+    readonly record?: boolean;
+    readonly signingIdentity?: boolean;
+    readonly router?: boolean;
+}
+/** Freeze one Worker configuration in the one canonical order its digest is taken in. */
+export declare function workerConfiguration(input: WorkerConfigurationInput): WorkerConfigurationV1;
+/**
+ * Admit one exact, canonical Worker configuration: every member, lists sorted and unique, binding
+ * names Cloudflare admits, distinct across variables and secrets, and none a host binds itself.
+ * Anything else throws.
+ */
+export declare function acceptWorkerConfiguration(input: unknown): WorkerConfigurationV1;
+/**
+ * `sha256` of the canonical JSON (RFC 8785) of one admitted Worker configuration. A deployment's
+ * label keeps 80 bits of it with the build digest.
+ */
+export declare function workerConfigurationDigest(configuration: WorkerConfigurationV1): Digest;
+/** Whether a configuration is a Worker configuration, by its format alone (not admitted). */
+export declare function isWorkerConfiguration(input: unknown): input is WorkerConfigurationV1;