@astrale-os/sdk 0.6.0-beta.23 → 0.6.0-beta.24

package/dist/platform/release/index.d.ts

@@ -1,27 +1,2 @@
-/**
- * Canonical `DomainRelease` v4 wire contract and admission owned by the Astrale platform: the
- * document a deployment serves at `release.json`, its release digest and `ReleaseRef`.
- */
+/** Canonical DomainRelease v4 and Delivery v2 wire contracts. */
 export * from '@astrale-os/kernel-protocol/release';
-/**
- * The Kernel's Publication v2/v3 codec (`@astrale-os/kernel-protocol/release/legacy`): `accept`,
- * `seal`, `encode`, `url`/`PATH`, the bundle helpers, `PublicationError` and Delivery v1, which
- * stable targets and pre-v4 Kernels still serve and read.
- *
- * @deprecated Read and seal `DomainRelease` v4 with this module's root exports.
- *
- * Short-term consumers, which took it from the removed `@astrale-os/sdk/publication`:
- * - cli `src/lib/domain-publication.ts` and its test (C1a: `accept`, `PATH`, `PublicationError`);
- * - admin `domain/providers/http-publication/resolver.ts`,
- *   `domain/providers/remote-kernel/instance-gateway.ts`,
- *   `domain/providers/scaleway/machine-provider.ts`, `domain/scripts/admin-bootstrap/cli.ts`,
- *   `domain/scripts/e2e/install-domain-set.ts`, their tests and two `worker/src` tests, which also
- *   seal v2/v3 fixtures (A10a);
- * - domains issues `tests/deployment/archived-errors.test.ts` (SV16).
- *
- * Removal, in a breaking SDK release: once those consumers no longer import it (the CLI and Admin
- * read `release.json`), at the latest with the Kernel folder it re-exports, which the Kernel
- * removes once no supported Kernel predates v4, no installation pins a v2/v3 document and no
- * stable Worker serves one (D10).
- */
-export { legacy } from '@astrale-os/kernel-protocol/release';

package/dist/platform/release/index.js

@@ -1,27 +1,2 @@
-/**
- * Canonical `DomainRelease` v4 wire contract and admission owned by the Astrale platform: the
- * document a deployment serves at `release.json`, its release digest and `ReleaseRef`.
- */
+/** Canonical DomainRelease v4 and Delivery v2 wire contracts. */
 export * from '@astrale-os/kernel-protocol/release';
-/**
- * The Kernel's Publication v2/v3 codec (`@astrale-os/kernel-protocol/release/legacy`): `accept`,
- * `seal`, `encode`, `url`/`PATH`, the bundle helpers, `PublicationError` and Delivery v1, which
- * stable targets and pre-v4 Kernels still serve and read.
- *
- * @deprecated Read and seal `DomainRelease` v4 with this module's root exports.
- *
- * Short-term consumers, which took it from the removed `@astrale-os/sdk/publication`:
- * - cli `src/lib/domain-publication.ts` and its test (C1a: `accept`, `PATH`, `PublicationError`);
- * - admin `domain/providers/http-publication/resolver.ts`,
- *   `domain/providers/remote-kernel/instance-gateway.ts`,
- *   `domain/providers/scaleway/machine-provider.ts`, `domain/scripts/admin-bootstrap/cli.ts`,
- *   `domain/scripts/e2e/install-domain-set.ts`, their tests and two `worker/src` tests, which also
- *   seal v2/v3 fixtures (A10a);
- * - domains issues `tests/deployment/archived-errors.test.ts` (SV16).
- *
- * Removal, in a breaking SDK release: once those consumers no longer import it (the CLI and Admin
- * read `release.json`), at the latest with the Kernel folder it re-exports, which the Kernel
- * removes once no supported Kernel predates v4, no installation pins a v2/v3 document and no
- * stable Worker serves one (D10).
- */
-export { legacy } from '@astrale-os/kernel-protocol/release';

package/dist/platform/schema/class-icon-svg.d.ts

@@ -0,0 +1,9 @@
+declare const CLASS_ICON: unique symbol;
+/** An admitted, self-contained SVG suitable for a Node Class presentation icon. */
+export type ClassIcon = string & {
+    readonly [CLASS_ICON]: true;
+};
+/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
+export declare const NEUTRAL_CLASS_ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\"></svg>";
+export declare function admitClassIconSvg(source: string): ClassIcon;
+export {};

package/dist/platform/schema/class-icon-svg.js

@@ -0,0 +1,29 @@
+const MAX_CLASS_ICON_LENGTH = 8_000;
+const SVG_ROOT = /^<svg(?:\s[^>]*)?>[\s\S]*<\/svg>$/u;
+const SVG_ROOT_OPEN = /<svg(?:\s|>)/gu;
+const SVG_ROOT_CLOSE = /<\/svg\s*>/gu;
+const SVG_GRAPHIC = /<(?:circle|ellipse|line|path|polygon|polyline|rect)\b/iu;
+const UNSAFE_SVG = /<\s*(?:animate|discard|embed|foreignObject|iframe|image|object|script|set|style|use)\b|<!DOCTYPE\b|<!ENTITY\b|\son[a-z][\w:.-]*\s*=|(?:href|xlink:href)\s*=|javascript\s*:|url\s*\(/iu;
+/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
+export const NEUTRAL_CLASS_ICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>';
+export function admitClassIconSvg(source) {
+    if (typeof source !== 'string') {
+        throw new TypeError('Class icon must be an inline SVG string.');
+    }
+    const value = source.trim();
+    if (Array.from(value).length > MAX_CLASS_ICON_LENGTH) {
+        throw new TypeError(`Class icon must contain at most ${MAX_CLASS_ICON_LENGTH} characters.`);
+    }
+    if (!SVG_ROOT.test(value) ||
+        (value.match(SVG_ROOT_OPEN)?.length ?? 0) !== 1 ||
+        (value.match(SVG_ROOT_CLOSE)?.length ?? 0) !== 1) {
+        throw new TypeError('Class icon must be one complete inline <svg> element.');
+    }
+    if (UNSAFE_SVG.test(value)) {
+        throw new TypeError('Class icon SVG must be self-contained and contain no executable content.');
+    }
+    if (value !== NEUTRAL_CLASS_ICON_SVG && !SVG_GRAPHIC.test(value)) {
+        throw new TypeError('Class icon SVG must contain a visible vector element.');
+    }
+    return value;
+}

package/dist/platform/schema/class-icon.d.ts

@@ -1,15 +1,10 @@
 import type { LucideIconData } from '@lucide/icons';
-declare const CLASS_ICON: unique symbol;
-/** An admitted, self-contained SVG suitable for a Node Class presentation icon. */
-export type ClassIcon = string & {
-    readonly [CLASS_ICON]: true;
-};
-/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
-export declare const NEUTRAL_CLASS_ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\"></svg>";
+import type { ClassIcon } from './class-icon-svg.js';
+export type { ClassIcon } from './class-icon-svg.js';
+export { NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
 /** Framework-neutral constructors for canonical Node Class icons. */
 export declare const classIcon: Readonly<{
     readonly neutral: ClassIcon;
     svg(source: string): ClassIcon;
     lucide(icon: LucideIconData): ClassIcon;
 }>;
-export {};

package/dist/platform/schema/class-icon.js

@@ -1,33 +1,6 @@
 import { buildLucideSvg } from '@lucide/icons/build';
-const MAX_CLASS_ICON_LENGTH = 8_000;
-const SVG_ROOT = /^<svg(?:\s[^>]*)?>[\s\S]*<\/svg>$/u;
-const SVG_ROOT_OPEN = /<svg(?:\s|>)/gu;
-const SVG_ROOT_CLOSE = /<\/svg\s*>/gu;
-const SVG_GRAPHIC = /<(?:circle|ellipse|line|path|polygon|polyline|rect)\b/iu;
-const UNSAFE_SVG = /<\s*(?:animate|discard|embed|foreignObject|iframe|image|object|script|set|style|use)\b|<!DOCTYPE\b|<!ENTITY\b|\son[a-z][\w:.-]*\s*=|(?:href|xlink:href)\s*=|javascript\s*:|url\s*\(/iu;
-/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
-export const NEUTRAL_CLASS_ICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>';
-function svg(source) {
-    if (typeof source !== 'string') {
-        throw new TypeError('Class icon must be an inline SVG string.');
-    }
-    const value = source.trim();
-    if (Array.from(value).length > MAX_CLASS_ICON_LENGTH) {
-        throw new TypeError(`Class icon must contain at most ${MAX_CLASS_ICON_LENGTH} characters.`);
-    }
-    if (!SVG_ROOT.test(value) ||
-        (value.match(SVG_ROOT_OPEN)?.length ?? 0) !== 1 ||
-        (value.match(SVG_ROOT_CLOSE)?.length ?? 0) !== 1) {
-        throw new TypeError('Class icon must be one complete inline <svg> element.');
-    }
-    if (UNSAFE_SVG.test(value)) {
-        throw new TypeError('Class icon SVG must be self-contained and contain no executable content.');
-    }
-    if (value !== NEUTRAL_CLASS_ICON_SVG && !SVG_GRAPHIC.test(value)) {
-        throw new TypeError('Class icon SVG must contain a visible vector element.');
-    }
-    return value;
-}
+import { admitClassIconSvg as svg, NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
+export { NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
 function lucide(icon) {
     let source;
     try {

package/dist/platform/schema/index.d.ts

@@ -16,7 +16,7 @@ export type { ClassIcon } from './class-icon.js';
 export type { StoredPropertyInputOf } from './property-input.js';
 export type { CallablePolicyBuilder, CallablePolicyContext, CallableProjection, AuthoredMethodProjection, AuthoredPropertyProjection, ClassIdentityProjection, ClassOwnerProjection, CoreEdge, CoreEndpoint, CoreNode, DefinedSchema, DirectedEdgeClass, ClassReferenceProjection, ClassProjection, FunctionProjection, EdgeClass, Function, Method, MethodProjection, Lazy, NodeClass, Policy, PolicyExistsContext, PolicyNodeBinder, PolicyPatternContext, Property, PropertyProjection, ResolvedDomainOfInput, View, } from '@astrale-os/kernel-dsl/v1/builder';
 export type { Array, Object, Value } from '@astrale-os/kernel-dsl/value';
-export type { CallableExecution, ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
+export type { CallableExecution, ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, PropertyImmutability, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
 export type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
 /** Kernel-owned Schema values used by authored product Schemas and graph operations. */
 export { AuthorityOperationOrder, AuthorityOperations, AuthorityRelations, KernelRootFunctions, OperationCore, operationOf, } from '@astrale-os/kernel-core/schema';

package/dist/platform/schema/schema-authoring.d.ts

@@ -1,9 +1,8 @@
-import type { DefinedSchema, ResolvedDomainOfInput } from '@astrale-os/kernel-dsl/v1/builder';
+import type { DefinedSchema, EntrypointOf, ResolvedDomainOfInput, SchemaInput } from '@astrale-os/kernel-dsl/v1/builder';
 import type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
-import { defineSchema as kernelDefineSchema } from '@astrale-os/kernel-dsl/v1';
-type DomainSchemaInput = Parameters<typeof kernelDefineSchema>[1];
+type DomainSchemaInput = SchemaInput;
 declare const authoredGraph: unique symbol;
-/** Opaque legacy Schemas retain their witness; SDK Schemas retain authored input and edges. */
+/** Resolved Schemas retain their witness; authored Schemas retain input and dependency edges. */
 type Entry = readonly [origin: string, schema: DomainSchema] | readonly [
     origin: string,
     input: DomainSchemaInput,
@@ -34,7 +33,7 @@ type InputOf<Origin extends string, Graph extends Entry> = Extract<Graph, readon
         readonly [Alias in keyof Dependencies]: SchemaOf<Dependencies[Alias], Graph>;
     };
 } : never;
-type SchemaOf<Origin extends string, Graph extends Entry> = Extract<Graph, readonly [Origin, DomainSchema]> extends infer Legacy ? [Legacy] extends [never] ? AuthoredSchema<Origin, Graph> : Legacy extends readonly [string, infer Schema extends DomainSchema] ? Schema : never : never;
+type SchemaOf<Origin extends string, Graph extends Entry> = Extract<Graph, readonly [Origin, DomainSchema]> extends infer Resolved ? [Resolved] extends [never] ? AuthoredSchema<Origin, Graph> : Resolved extends readonly [string, infer Schema extends DomainSchema] ? Schema : never : never;
 /** Resolve a dependency graph without expanding a shared Schema at each dependency edge. */
 export interface AuthoredDomain<Origin extends string, Graph extends Entry> extends ResolvedDomainOfInput<Origin, InputOf<Origin, Graph>> {
 }
@@ -42,7 +41,15 @@ export interface AuthoredDomain<Origin extends string, Graph extends Entry> exte
 export interface AuthoredSchema<Origin extends string, Graph extends Entry> extends DefinedSchema<Origin, AuthoredDomain<Origin, Graph>> {
     readonly [authoredGraph]?: Graph;
 }
-type DefineSchema = <const Origin extends string, const Input extends DomainSchemaInput>(origin: Origin, input: Input) => string extends Origin | Extract<Dependencies<Input>[keyof Dependencies<Input>], DomainSchema>['origin'] ? DefinedSchema<Origin, ResolvedDomainOfInput<Origin, Input>> : AuthoredSchema<Origin, Extract<UniqueEntries<GraphOfInput<Origin, Input>>, Entry>>;
-/** The canonical implementation with a portable, automatically inferred declaration. */
+type DefineSchema = <const Origin extends string, const Input extends DomainSchemaInput & {
+    readonly name: string;
+}>(origin: Origin, input: Input & {
+    readonly entrypoint?: EntrypointOf<Input>;
+}) => string extends Origin | Extract<Dependencies<Input>[keyof Dependencies<Input>], DomainSchema>['origin'] ? DefinedSchema<Origin, ResolvedDomainOfInput<Origin, Input>> : AuthoredSchema<Origin, Extract<UniqueEntries<GraphOfInput<Origin, Input>>, Entry>>;
+/**
+ * The canonical implementation with a portable, automatically inferred declaration. Its type
+ * requires the Domain `name`, which the Kernel requires to install a new revision; `defineDomain`
+ * refuses an unnamed root Schema at runtime. `entrypoint` names one of the declared Views.
+ */
 export declare const defineSchema: DefineSchema;
 export {};

package/dist/platform/schema/schema-authoring.js

@@ -1,3 +1,7 @@
 import { defineSchema as kernelDefineSchema } from '@astrale-os/kernel-dsl/v1';
-/** The canonical implementation with a portable, automatically inferred declaration. */
+/**
+ * The canonical implementation with a portable, automatically inferred declaration. Its type
+ * requires the Domain `name`, which the Kernel requires to install a new revision; `defineDomain`
+ * refuses an unnamed root Schema at runtime. `entrypoint` names one of the declared Views.
+ */
 export const defineSchema = kernelDefineSchema;

package/dist/project/admit.js

@@ -1,4 +1,3 @@
-import { isLegacyDeployment } from '../deployment/deploy.js';
 import { isProject } from './define.js';
 export const PROJECT_EXPORT_HINT = 'astrale.config.ts must export exactly one default Project:\n' +
     "  import { defineProject } from '@astrale-os/sdk/project'\n" +
@@ -15,8 +14,5 @@ export function admitProjectModule(loaded) {
     const value = Reflect.get(loaded, 'default');
     if (isProject(value))
         return value;
-    if (isLegacyDeployment(value)) {
-        throw new TypeError(`astrale.config.ts exports the legacy deploy() aggregate; migrate the Domain and Environments into defineProject().\n${PROJECT_EXPORT_HINT}`);
-    }
     throw new TypeError(`Default export must be created by defineProject().\n${PROJECT_EXPORT_HINT}`);
 }

package/dist/project/install-command.d.ts

@@ -2,9 +2,5 @@
  * The command that installs a deployed URL on an instance, as every SDK refusal and help text
  * names it. A deploy never installs (DX [.81399], AM-72): `astrale-domain deploy <environment>`
  * prints a URL, and this command installs it.
- *
- * `--direct` sends a URL install to the instance Kernel, which the astrale CLI requires today and
- * accepts until D13. When the CLI retires it, this is the one SDK text to change; the adapter and
- * scaffold READMEs and templates repeat it as prose.
  */
 export declare function installCommand(instance?: string, identity?: string): string;

package/dist/project/install-command.js

@@ -2,12 +2,8 @@
  * The command that installs a deployed URL on an instance, as every SDK refusal and help text
  * names it. A deploy never installs (DX [.81399], AM-72): `astrale-domain deploy <environment>`
  * prints a URL, and this command installs it.
- *
- * `--direct` sends a URL install to the instance Kernel, which the astrale CLI requires today and
- * accepts until D13. When the CLI retires it, this is the one SDK text to change; the adapter and
- * scaffold READMEs and templates repeat it as prose.
  */
 export function installCommand(instance = '<instance>', identity) {
-    return (`astrale domain install <url> --direct -i ${instance}` +
+    return (`astrale domain install <url> -i ${instance}` +
         (identity === undefined ? '' : ` --as ${identity}`));
 }

package/dist/tooling/cli/deploy-mode.d.ts

@@ -1,75 +1,19 @@
-/**
- * The deploy mode of one Environment for one command (CT33), chosen by the configuration itself:
- * an unchanged configuration keeps its mode, and so its behaviour, across an SDK upgrade, as long as
- * that mode still has a consumer (AM-16, AM-72).
- *
- * - `canonical`: an immutable deployment of one sealed release through the adapter's
- *   `deployRelease`, with a key generated for it, and no call to any instance.
- * - `legacy-direct`: today's stable target, replaced in place through `prepare` and `deploy`, which
- *   serves a v3 Publication only. Its `reasons` name what selected it.
- * - `refused`: a shape no deploy of this SDK serves, refused before any effect. Each refusal
- *   carries the configuration or command to write instead.
- *
- * A deploy never installs, so two shapes are refused before a mode is selected at all: an
- * Environment that declares `installation` by `defineProject`, and `--deploy-only` by the
- * command-line parser (AM-72).
- */
+/** A supported immutable deployment, or a configuration refused before provider effects. */
 export type DeployMode = {
     readonly kind: 'canonical';
-} | {
-    readonly kind: 'legacy-direct';
-    readonly reasons: readonly LegacyDirectReason[];
 } | {
     readonly kind: 'refused';
     readonly refusals: readonly DeployRefusal[];
 };
-/** What puts an Environment on the legacy direct-mode path. */
-export type LegacyDirectReason = 
-/** An adapter-cloudflare parameter of direct mode. */
-{
-    readonly reason: 'direct-parameter';
-    readonly parameter: CloudflareDirectParameter;
-}
-/** adapter-cloudflare without a dispatch `namespace`: direct mode is its default. */
- | {
-    readonly reason: 'no-namespace';
-}
-/** An adapter that declares no `deployRelease`: the contract before adapter interface v2. */
- | {
-    readonly reason: 'no-deploy-release';
-};
-export type CloudflareDirectParameter = 'route' | 'workerName' | 'identityIssuer' | 'addressing' | 'signingIdentity';
 export interface DeployRefusal {
-    readonly reason: 'astrale-instance' | 'astrale-signing-identity' | 'mixed-parameters' | 'scheduled-triggers' | 'publish-legacy-direct';
-    /** The configuration or command to write instead, for the author. */
+    readonly reason: 'invalid-parameters' | 'missing-namespace' | 'scheduled-triggers' | 'unsupported-adapter';
     readonly guidance: string;
 }
-/**
- * The commands that select a deploy mode. `publish` names only an immutable deployment, so it
- * refuses every Environment that is not canonical (CT33, R-G03).
- */
 export type DeployModeCommand = 'deploy' | 'publish';
-/**
- * Select the deploy mode of one Environment (CT33). It reads the configuration and the command
- * only, and has no effect.
- *
- * A refusal wins over every other reason. adapter-astrale deploys immutable deployments only
- * (`deployRelease`): its removed instance mode's `instance` and `signingIdentity` are refused
- * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
- * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
- * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * and `publish` refuses the legacy direct-mode path: a stable target serves no release, so no
- * version can name it.
- *
- * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
- * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable
- * deployment runs no cron of its own (D13). The bundling-affecting `wrangler` keys are refused by
- * adapter-cloudflare itself for every Environment (AM-51).
- */
+/** Inspect one Environment's deployment contract without building or changing any provider. */
 export declare function selectDeployMode(input: {
     readonly command: DeployModeCommand;
     readonly environment: string;
-    /** The Environment's definition, of which selection reads only the adapter and its parameters. */
     readonly definition: {
         readonly deployment: {
             readonly adapter: {

package/dist/tooling/cli/deploy-mode.js

@@ -1,135 +1,59 @@
-import { installCommand } from '../../project/install-command.js';
-/** The adapter names of the first-party adapters whose parameters CT33 classifies. */
-const CLOUDFLARE = 'cloudflare';
-const ASTRALE = 'astrale';
-/** The parameters that named the stable Service of adapter-astrale's removed instance mode. */
-const ASTRALE_SERVICE_PARAMETERS = ['serviceKey', 'name'];
-const CLOUDFLARE_DIRECT_PARAMETERS = [
-    'route',
-    'workerName',
-    'identityIssuer',
-    'addressing',
-    'signingIdentity',
-];
-/**
- * Select the deploy mode of one Environment (CT33). It reads the configuration and the command
- * only, and has no effect.
- *
- * A refusal wins over every other reason. adapter-astrale deploys immutable deployments only
- * (`deployRelease`): its removed instance mode's `instance` and `signingIdentity` are refused
- * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
- * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
- * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * and `publish` refuses the legacy direct-mode path: a stable target serves no release, so no
- * version can name it.
- *
- * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
- * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable
- * deployment runs no cron of its own (D13). The bundling-affecting `wrangler` keys are refused by
- * adapter-cloudflare itself for every Environment (AM-51).
- */
+/** Inspect one Environment's deployment contract without building or changing any provider. */
 export function selectDeployMode(input) {
-    const { command, environment, definition } = input;
-    const { adapter } = definition.deployment;
-    const parameters = definition.deployment.parameters;
+    const { adapter, parameters } = input.definition.deployment;
+    const values = parameters;
     const refusals = [];
-    const reasons = [];
-    const releases = 'deployRelease' in adapter && typeof adapter.deployRelease === 'function';
-    if (adapter.name === ASTRALE && releases) {
-        if (declares(parameters, 'instance')) {
+    if (typeof adapter.deployRelease !== 'function') {
+        refusals.push({
+            reason: 'unsupported-adapter',
+            guidance: `Adapter ${adapter.name} must implement configure, placement and deployRelease for immutable deployments.`,
+        });
+    }
+    if (adapter.name === 'cloudflare') {
+        if (values.namespace === undefined) {
             refusals.push({
-                reason: 'astrale-instance',
-                guidance: astraleInstanceGuidance(parameters, environment),
+                reason: 'missing-namespace',
+                guidance: 'cloudflare requires namespace: { name, routingDomain }. Use astrale() for managed deployments.',
             });
         }
-        if (declares(parameters, 'signingIdentity')) {
+        const allowed = [
+            'namespace',
+            'secrets',
+            'vars',
+            'maximumRequestBytes',
+            'invocationTimeoutMs',
+            'tokenExchange',
+            'durable',
+            'wrangler',
+            'router',
+        ];
+        const unknown = Reflect.ownKeys(values).filter((key) => typeof key !== 'string' || !allowed.includes(key));
+        if (unknown.length > 0)
+            refusals.push({
+                reason: 'invalid-parameters',
+                guidance: `Cloudflare Environment ${input.environment} declares unknown parameters ${unknown.map(String).join(', ')}.`,
+            });
+        const wrangler = values.wrangler;
+        if (wrangler !== undefined && Object.hasOwn(wrangler, 'triggers')) {
             refusals.push({
-                reason: 'astrale-signing-identity',
-                guidance: 'astrale({ signingIdentity }) is no longer accepted: each deployment gets a signing key ' +
-                    'generated when it is deployed. Remove `signingIdentity`.',
+                reason: 'scheduled-triggers',
+                guidance: 'Immutable deployments run no cron of their own. Remove wrangler.triggers.',
             });
         }
     }
-    if (adapter.name === CLOUDFLARE) {
-        const direct = CLOUDFLARE_DIRECT_PARAMETERS.filter((name) => declares(parameters, name));
-        if (declares(parameters, 'namespace')) {
-            if (direct.length > 0) {
-                refusals.push({
-                    reason: 'mixed-parameters',
-                    guidance: `cloudflare({ namespace }) deploys immutable deployments and cannot also name ` +
-                        `${direct.join(', ')}, which select the legacy direct mode. Keep \`namespace\` and ` +
-                        `remove ${direct.join(', ')}, or remove \`namespace\` to stay on the direct mode.`,
-                });
-            }
-            const wrangler = parameters.wrangler;
-            if (wrangler !== undefined && declares(wrangler, 'triggers')) {
-                refusals.push({
-                    reason: 'scheduled-triggers',
-                    guidance: 'cloudflare({ namespace }) refuses `wrangler.triggers`: an immutable deployment runs ' +
-                        'no cron of its own. Remove `wrangler.triggers`, or keep the cron on a direct-mode ' +
-                        'Environment.',
-                });
-            }
-        }
-        else {
-            reasons.push(...direct.map((parameter) => ({ reason: 'direct-parameter', parameter })), { reason: 'no-namespace' });
-        }
+    if (adapter.name === 'astrale') {
+        const allowed = ['admin', 'secrets', 'vars', 'maximumRequestBytes', 'tokenExchange', 'durable'];
+        const unknown = Reflect.ownKeys(values).filter((key) => typeof key !== 'string' || !allowed.includes(key));
+        if (unknown.length > 0)
+            refusals.push({
+                reason: 'invalid-parameters',
+                guidance: `Astrale Environment ${input.environment} declares unknown parameters ${unknown.map(String).join(', ')}.`,
+            });
     }
-    if (!releases)
-        reasons.push({ reason: 'no-deploy-release' });
-    if (refusals.length > 0)
-        return Object.freeze({ kind: 'refused', refusals: freeze(refusals) });
-    if (reasons.length > 0 && command === 'publish') {
-        return Object.freeze({
+    return refusals.length === 0
+        ? Object.freeze({ kind: 'canonical' })
+        : Object.freeze({
             kind: 'refused',
-            refusals: freeze([
-                { reason: 'publish-legacy-direct', guidance: publishGuidance(environment, reasons) },
-            ]),
+            refusals: Object.freeze(refusals.map((r) => Object.freeze(r))),
         });
-    }
-    if (reasons.length > 0)
-        return Object.freeze({ kind: 'legacy-direct', reasons: freeze(reasons) });
-    return Object.freeze({ kind: 'canonical' });
-}
-/**
- * How an adapter-astrale Environment of the removed instance mode deploys now: without `instance`
- * (nor `serviceKey` and `name`, which named its stable Service), then installed by URL on the
- * instance it used to deploy through.
- */
-function astraleInstanceGuidance(parameters, environment) {
-    const instance = String(parameters.instance);
-    const service = ASTRALE_SERVICE_PARAMETERS.filter((name) => declares(parameters, name));
-    const removed = service.length === 0
-        ? 'Remove `instance`'
-        : `Remove \`instance\` with ${service.map((name) => `\`${name}\``).join(' and ')}, ` +
-            `which named its stable Service`;
-    return (`astrale({ instance: '${instance}' }) deployed through that instance's Services, which no ` +
-        `longer hosts deployments. ${removed}: \`astrale-domain deploy ${environment}\` ` +
-        `makes an immutable deployment on Admin's Services, and \`${installCommand(instance)}\` ` +
-        'installs it.');
-}
-/**
- * Why a legacy direct-mode Environment cannot be published, and the configuration that makes it
- * publishable: a version names an immutable deployment's release, which a stable target never
- * serves.
- */
-function publishGuidance(environment, reasons) {
-    const deploys = `\`astrale-domain publish ${environment}\` names an immutable deployment's release, and ${environment} deploys`;
-    if (reasons.some(({ reason }) => reason === 'no-deploy-release')) {
-        return (`${deploys} through an adapter without deployRelease, which replaces a stable target in ` +
-            'place and serves no release. Use an adapter that implements deployRelease (adapter ' +
-            "interface v2), such as astrale() on Admin's Services.");
-    }
-    const direct = reasons.flatMap((reason) => reason.reason === 'direct-parameter' ? [reason.parameter] : []);
-    return (`${deploys} on cloudflare()'s legacy direct mode, which serves no release. Deploy it into a ` +
-        'dispatch namespace with cloudflare({ namespace })' +
-        (direct.length === 0 ? '' : ` and remove ${direct.join(', ')}`) +
-        ", or on Admin's Services with astrale().");
-}
-/** A parameter is declared when its value is not `undefined`, as optional adapter parameters read. */
-function declares(parameters, name) {
-    return Object.hasOwn(parameters, name) && parameters[name] !== undefined;
-}
-function freeze(values) {
-    return Object.freeze(values.map((value) => Object.freeze(value)));
 }

package/dist/tooling/cli/deploy-result.d.ts

@@ -15,23 +15,21 @@ export interface DeployResultV1 {
     readonly environment: string;
     /**
      * The URL `astrale domain install <url>` takes: an immutable deployment's URL, which is also its
-     * issuer, or the public URL of a stable target.
+     * issuer.
      */
     readonly url: string;
     /**
-     * The digest of the `DomainRelease` v4 the deployment serves at `release.json`. `null` for a
-     * stable target, which serves a v3 Publication and no release.
+     * The digest of the DomainRelease v4 served at release.json.
      */
     readonly release: {
         readonly digest: ReleaseDigest;
-    } | null;
+    };
     /**
-     * The build digest of the code the deployment runs, as `astrale-domain build` prints it. `null`
-     * for a stable target, which never serves a build digest.
+     * The build digest of the code the deployment runs, as astrale-domain build prints it.
      */
     readonly build: {
         readonly digest: BuildDigest;
-    } | null;
+    };
     readonly schema: {
         readonly revision: Revision;
     };
@@ -40,24 +38,21 @@ export interface DeployResultV1 {
         readonly adapter: string;
         /**
          * The provider script that serves this deployment: an immutable deployment's label, which is
-         * also the first label of its URL. `null` for a stable target, whose legacy adapter operations
-         * never report the script they replace.
+         * also the first label of its URL.
          */
-        readonly script: string | null;
+        readonly script: string;
         /**
          * `created`: a new immutable deployment. `reused`: the immutable deployment of this exact
-         * release already existed. `replaced`: a stable target now runs this code in place of what it
-         * ran, if anything (the legacy direct-mode path cannot tell a first deploy from a later one);
-         * only that path replaces.
+         * release already existed.
          */
-        readonly state: 'created' | 'reused' | 'replaced';
+        readonly state: 'created' | 'reused';
     };
     /**
      * Immutable deployments only: the environment's current secrets were `bound` to a new
      * deployment, or `updated` or left `unchanged` in place on the reused one. A deploy never writes
      * the secrets of any other deployment.
      */
-    readonly secrets?: {
+    readonly secrets: {
         readonly state: DeploymentSecretsState;
     };
     /**

package/dist/tooling/cli/help.js

@@ -101,16 +101,11 @@ Behavior:
   does, loads declared secrets, and deploys through the selected adapter. It never
   installs the Domain: install the URL it prints with
   ${installCommand()}.
-  The Environment's configuration selects how it deploys. An adapter that implements
-  deployRelease makes one immutable deployment per release and calls no instance: the
-  SDK seals the release for the deployment's URL, records the commit it was built
-  from, and the adapter creates that deployment or reuses it (adapter-astrale on
-  Admin's Services, through astrale call --admin). A new deployment binds the
-  Environment's current secrets; a reused one has its own secrets updated in place,
-  served once propagated; no other deployment's secrets change. Any other Environment
-  replaces its stable target in place (legacy direct mode, deprecated), warns on
-  stderr, serves a v3 Publication only, and warns when the uploaded code has another
-  build digest than the Bundle.
+  Each Environment deploys one immutable release through configure, placement and
+  deployRelease. The SDK seals the release at the deployment URL and records the
+  source commit. Its adapter creates that deployment or reuses it. A new deployment
+  binds the Environment's current secrets; reuse updates only that deployment's
+  secrets. Cloudflare requires a dispatch namespace; astrale() uses Admin's Services.
   With --json, stdout holds only one DeployResultV1: the deployment's URL, which
   astrale domain install takes, its digests, adapter and state. Exit status: 0 deployed,
   1 failed or refused, 2 usage error; a failed run prints nothing on stdout.
@@ -131,8 +126,7 @@ Options:
 Behavior:
   Asks the adapter of each Environment that deploys immutable deployments for the
   deployments its host keeps for the caller, and prints each one's release, its version
-  or name, Environment and state, the instances it is installed on, its last call and
-  its expiry, and the URL ${installCommand()} takes.
+  or name, Environment and state, the instances it is installed on, and the URL ${installCommand()} takes.
   A deployment is named by the registry's version of its release (1.5.0) or of its build
   (1.5.0 · staging), else from its record's commit, such as 1.4.2 + 7 commits · a1b2c3d ·
   staging. Names are computed, never stored, and printed whole.
@@ -144,11 +138,10 @@ Behavior:
   The registry and the instances are read through the Astrale CLI (${MINIMUM_INSTALLATIONS_CLI_VERSION} or
   newer) with the caller's identity, only once a deployment is listed.
   A registry that cannot be read fails the listing; an unknown instance never does.
-  Admin's Services and a Cloudflare dispatch namespace keep every deployment until its
-  owner retires it, and report no last call or expiry; LAST CALL and EXPIRES show one
-  only when an older adapter reports it.
+  Admin's Services and a Cloudflare dispatch namespace keep deployments until their
+  owner retires them.
   Listing changes nothing, at any host, registry or instance.
-  An Environment in legacy direct mode, refused by deploy, or whose adapter lists no
+  An Environment refused by deploy, or whose adapter lists no
   deployments is reported on stderr and, with --json, under unlisted. A deployment
   whose record this SDK does not admit is still listed, from what its host knows.
   With --json, each deployment carries its installedOn and its call target: the path of