@astrale-os/sdk 0.6.0-beta.3 → 0.6.0-beta.31

package/dist/deployment/adapter/release/context.d.ts

@@ -0,0 +1,94 @@
+import type { DeploymentCommitV1, DeploymentConfiguration, LineAddressing } from '../../address/index.js';
+import type { Release } from '../../release/index.js';
+import type { Bundle } from '../bundle/index.js';
+/**
+ * What `configure` receives: the Environment whose configuration it freezes, and the names of the
+ * secrets its deployment binds. Never a secret value: a rotated value is not another configuration,
+ * a name added or removed is.
+ */
+export interface ConfigureContext {
+    readonly environment: string;
+    /**
+     * The names of the Environment's current secrets (the adapter's `secretsFile`), sorted and
+     * unique: exactly the secrets `deployRelease` receives, which the configuration declares.
+     */
+    readonly secrets: readonly string[];
+}
+/**
+ * Where the host places the deployments of one Environment. `routingDomain` is the DNS name every
+ * deployment URL ends with, `https://<label>.<routingDomain>`; `addressing` is how its line reads:
+ * `readable` for platform lines, `opaque` (the fingerprint alone) for tenant lines.
+ */
+export interface Placement {
+    readonly addressing: LineAddressing;
+    readonly routingDomain: string;
+}
+/** What `placement` receives. It answers without any effect at the host. */
+export interface PlacementContext {
+    readonly environment: string;
+    /** Parent-owned lifecycle cancellation. */
+    readonly signal: AbortSignal;
+    /** Optional command-scoped identity override (`--as`). */
+    readonly identity?: string;
+}
+/**
+ * Everything `deployRelease` deploys: one sealed release as one immutable deployment at
+ * `release.url`, which is `deploymentUrl(label, placement.routingDomain)` and the release's issuer.
+ * The SDK computes each value before the call, from the Build, `configure` and `placement`, so the
+ * adapter never derives an address or seals anything itself.
+ */
+export interface ReleaseDeployContext {
+    readonly projectDir: string;
+    readonly environment: string;
+    /** Optional command-scoped identity override (`--as`). */
+    readonly identity?: string;
+    /** Optional command-scoped credential; trusted adapters must neither retain nor disclose it. */
+    readonly credential?: string;
+    /**
+     * The Environment's current secrets. A new deployment binds them; a reused deployment has its
+     * own declared secrets rewritten in place. A deploy never writes another deployment's secrets.
+     */
+    readonly secrets: Readonly<Record<string, string>>;
+    /** The environment-free bytes of the adapter's `bundler`, identified by `bundle.digest`. */
+    readonly bundle: Bundle;
+    /** What `configure` froze for this Environment. */
+    readonly configuration: DeploymentConfiguration;
+    /** Where `placement` said the host places the deployment. */
+    readonly placement: Placement;
+    /**
+     * `<line>-<content>`: the DNS label of the deployment, which is also its provider script. Its
+     * content covers `bundle.digest` and `configuration`, so one label serves one release.
+     */
+    readonly label: string;
+    /**
+     * The release the SDK sealed for this deployment before the call: its `document` is the
+     * `DomainRelease` v4 the deployment serves at `release.json`, its `url` the deployment URL.
+     */
+    readonly release: Release;
+    /**
+     * The commit this deploy runs from, which the record of a deployment it creates declares. The
+     * label does not cover it: a reused deployment keeps the record, and so the commit, of the deploy
+     * that created it, and an adapter never refuses a reuse for another commit.
+     */
+    readonly commit: DeploymentCommitV1 | null;
+    /** Parent-owned lifecycle cancellation shared by every provider effect. */
+    readonly signal: AbortSignal;
+}
+/**
+ * What `list` receives: the origin and the Environment whose deployments the host lists for the
+ * caller. It answers without any effect at the host.
+ */
+export interface ListContext {
+    readonly origin: string;
+    readonly environment: string;
+    /** Parent-owned lifecycle cancellation. */
+    readonly signal: AbortSignal;
+    /** Optional command-scoped identity override (`--as`). */
+    readonly identity?: string;
+}
+/** What `retain` receives: the label of the published deployment to keep. */
+export interface RetainContext {
+    readonly label: string;
+    readonly signal: AbortSignal;
+    readonly identity?: string;
+}

package/dist/deployment/adapter/release/index.d.ts

@@ -0,0 +1,4 @@
+export type { ConfigureContext, ListContext, Placement, PlacementContext, ReleaseDeployContext, RetainContext, } from './context.js';
+export type { AdapterCommand, AdapterCommandContext, AdapterCommandResult } from './command.js';
+export type { DeploymentCallTarget, ListedDeployment } from './list.js';
+export type { DeploymentSecretsState, FailedReleaseDeployResult, MutationKnowledge, ReadyReleaseDeployResult, ReleaseDeploymentPhase, ReleaseDeployResult, } from './result.js';

package/dist/deployment/adapter/release/index.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/release/list.d.ts

@@ -0,0 +1,53 @@
+import type { DeploymentSummaryV1 } from '../../address/index.js';
+/**
+ * Where one listed deployment is called on its host, so that an operator can act on it:
+ *
+ * - `services`: a deployment Admin's Services hosts, called on the Admin instance with
+ *   `astrale call "<node>.method.<method>" --admin` (`--admin=<admin>` when `admin` names the
+ *   Admin bookmark). `path` is the deployment's node, `@<id>`, qualified by its class,
+ *   `@<id>::services.astrale.ai:class.CloudflareDeployment`, whose only Method is `retire`.
+ *   `service` is the node of the Service it is a version of,
+ *   `@<serviceId>::services.astrale.ai:class.CloudflareService`, whose Methods act on the Service
+ *   and the deployment it currently serves: `promote` (this deployment's label rolls the Service
+ *   back or forward to it), `setSecret` and `secrets`, `setSchedule` and `schedules`, `logs`,
+ *   `transfer` and `delete`.
+ * - `namespace`: a deployment of a Cloudflare dispatch namespace (adapter-cloudflare's namespace
+ *   mode), which has no Services node: the namespace and the script, which the hosting kit
+ *   (`@astrale-os/adapter-cloudflare/hosting`) retires, points a name at or schedules.
+ */
+export type DeploymentCallTarget = {
+    readonly kind: 'services';
+    readonly path: string;
+    readonly service: string;
+    /** The Admin bookmark the deployment is reached through; the CLI's own Admin target when absent. */
+    readonly admin?: string;
+} | {
+    readonly kind: 'namespace';
+    readonly namespace: string;
+    readonly script: string;
+};
+/**
+ * One deployment as an adapter's `list` returns it: what its host knows of it, its record as the
+ * host stores it, and where it is called. Admin's Services keeps every deployment until it is
+ * retired and counts no call: its deployments are `published` and `withdrawn` once retiring. A
+ * Cloudflare dispatch namespace keeps no retention: its rows carry none, and carry their creation
+ * instant and key only while their script exists. Deployments have no last-call or expiry clock.
+ *
+ * The adapter does not admit the record. The listing admits it with `acceptDeploymentRecord`, and a
+ * record it refuses (one a host on an older SDK still admits, say) never fails the listing: that
+ * deployment is listed from the facts its host owns.
+ */
+export interface ListedDeployment extends Omit<DeploymentSummaryV1, 'record'> {
+    /**
+     * The record as the host stores it, unadmitted, whatever value that is (JSON `null` included).
+     * Absent when the host keeps no record of the deployment: a dispatch namespace keeps none for a
+     * label it only retired.
+     */
+    readonly record?: unknown;
+    /**
+     * Whether the stable URL of the deployment's Service serves it. Present only where the host has
+     * Services (Admin's Services); a dispatch namespace has none.
+     */
+    readonly current?: boolean;
+    readonly callTarget: DeploymentCallTarget;
+}

package/dist/deployment/adapter/release/list.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/release/refusal.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Why the host can no longer keep one published deployment (`Adapter.retain`): it is `absent`
+ * (the host holds no deployment of that label, or it was deleted) or `retired` (withdrawn, never
+ * served again). No rerun keeps it; a new version publishes a new deployment. Any other rejection
+ * of `retain` is transient: once it has passed, a rerun keeps the deployment.
+ */
+export declare class RetainRefusal extends Error {
+    readonly reason: 'absent' | 'retired';
+    constructor(reason: RetainRefusal['reason'], message: string);
+}

package/dist/deployment/adapter/release/refusal.js

@@ -0,0 +1,14 @@
+/**
+ * Why the host can no longer keep one published deployment (`Adapter.retain`): it is `absent`
+ * (the host holds no deployment of that label, or it was deleted) or `retired` (withdrawn, never
+ * served again). No rerun keeps it; a new version publishes a new deployment. Any other rejection
+ * of `retain` is transient: once it has passed, a rerun keeps the deployment.
+ */
+export class RetainRefusal extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'RetainRefusal';
+        this.reason = reason;
+    }
+}

package/dist/deployment/adapter/release/result.d.ts

@@ -0,0 +1,56 @@
+import type { DeploymentRecordV1 } from '../../address/index.js';
+/** What one operation knows it changed at a provider. */
+export type MutationKnowledge<Evidence = unknown> = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'partial';
+    readonly evidence?: Evidence;
+} | {
+    readonly kind: 'applied';
+    readonly evidence: Evidence;
+} | {
+    readonly kind: 'unknown';
+};
+/**
+ * How a deploy left the Environment's secrets on the deployment it made or reused: `bound` to a
+ * new deployment, or `updated` or left `unchanged` in place on the reused one.
+ */
+export type DeploymentSecretsState = 'bound' | 'updated' | 'unchanged';
+/**
+ * The immutable deployment of one release, ready at its URL.
+ *
+ * - `created`: a new deployment now serves the release, and the Environment's secrets are `bound`
+ *   to it.
+ * - `reused`: the deployment of this exact release (same label, build and configuration) already
+ *   existed; its own declared secrets were `updated` or left `unchanged` in place.
+ */
+export interface ReadyReleaseDeployResult {
+    readonly status: 'ready';
+    readonly state: 'created' | 'reused';
+    /** The record the deployment declares, as the host stored it. */
+    readonly record: DeploymentRecordV1;
+    /** The deployment URL, which is also the issuer of the release it serves. */
+    readonly url: string;
+    readonly secrets: {
+        readonly state: DeploymentSecretsState;
+    };
+}
+/**
+ * Where a deploy of one release stopped:
+ * - `prerequisite`: before any effect at the host (a missing tool, credential or hosting answer);
+ * - `provider`: at the host, while it created or reused the deployment;
+ * - `readiness`: the deployment exists but did not serve its release before the deadline.
+ */
+export type ReleaseDeploymentPhase = 'prerequisite' | 'provider' | 'readiness';
+/**
+ * A deploy of one release that did not reach a ready deployment. Rerunning the same deploy
+ * converges: the deployment's label is its content, so a partial or applied deployment is reused.
+ */
+export interface FailedReleaseDeployResult {
+    readonly status: 'failed';
+    readonly phase: ReleaseDeploymentPhase;
+    /** What the host may now hold of the deployment. */
+    readonly provider: MutationKnowledge;
+    readonly error: Error;
+}
+export type ReleaseDeployResult = ReadyReleaseDeployResult | FailedReleaseDeployResult;

package/dist/deployment/adapter/release/result.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/address/configuration.d.ts

@@ -0,0 +1,95 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+import type { WorkerConfigurationV1 } from '../worker/configuration.js';
+export declare const FROZEN_CONFIGURATION_FORMAT = "astrale.deployment.configuration";
+export declare const FROZEN_CONFIGURATION_VERSION = 1;
+/**
+ * What a deploy freezes into one deployment beside its build: the author's plain variables and the
+ * execution settings, defaults resolved, the durable Workflow options it declares, and the services
+ * and dispatch namespaces it binds. It names the secrets a deployment binds, never their values,
+ * and leaves out what the host derives (the deployment URL, the build digest, the signing key). A
+ * changed variable, setting or binding is another configuration, so another address; a rotated
+ * secret is not.
+ *
+ * Its admission is canonical form only. Whether a Worker can run under it stays with the host that
+ * binds it: `encodeWorkerSettings` (`@astrale-os/adapter-cloudflare/worker`) refuses settings past
+ * the Worker bounds when the host writes `ASTRALE_SETTINGS`, before anything is uploaded, and the
+ * host's binding namespace admits the binding names.
+ */
+export interface FrozenConfigurationV1 {
+    readonly format: typeof FROZEN_CONFIGURATION_FORMAT;
+    readonly version: typeof FROZEN_CONFIGURATION_VERSION;
+    /** The author's plain variables, never secrets. */
+    readonly vars: Readonly<Record<string, string>>;
+    readonly settings: {
+        readonly maximumRequestBytes: number;
+        readonly invocationTimeoutMs: number;
+        readonly tokenExchange: false | {
+            readonly maximumLifetimeSeconds: number;
+        };
+        /** The durable Workflow options the Environment declares; absent when it declares none. */
+        readonly durableOptions?: FrozenDurableOptions;
+    };
+    readonly runtime: {
+        readonly compatibilityDate: string;
+        /** Sorted, unique. */
+        readonly compatibilityFlags: readonly string[];
+    };
+    readonly bindings: {
+        /** Sorted by name, unique; never the `ROUTER` binding, which `router` describes. */
+        readonly services: readonly {
+            readonly name: string;
+            readonly service: string;
+        }[];
+        /**
+         * Dispatch namespaces the deployment binds, sorted by binding name, unique; empty when it binds
+         * none. A binding name is a Worker binding name other than `ROUTER`, a namespace a Cloudflare
+         * dispatch namespace name. Which namespaces a deployment may bind is the host's to decide.
+         */
+        readonly dispatchNamespaces: readonly {
+            readonly name: string;
+            readonly namespace: string;
+        }[];
+        /** Names of the secrets the deployment binds, sorted, unique. */
+        readonly secrets: readonly string[];
+    };
+    readonly router: false | {
+        readonly service: string;
+        readonly hostSuffix: string;
+        readonly minLabels: number;
+    };
+}
+/**
+ * The durable Workflow options of one deployment, as declared: every field optional, each a
+ * positive integer. The SDK's durable serving bounds and defaults them when the Worker runs.
+ */
+export interface FrozenDurableOptions {
+    readonly retentionMs?: number;
+    readonly retry?: {
+        readonly initialIntervalMs?: number;
+        readonly maxAttempts?: number;
+        readonly maxIntervalMs?: number;
+    };
+    readonly stepTimeoutMs?: number;
+}
+/**
+ * What one deployment freezes beside its build, as its adapter's `configure` returns it: a
+ * `FrozenConfigurationV1`, which a Cloudflare dispatch namespace binds (namespace mode), or a
+ * `WorkerConfigurationV1` (`@astrale-os/sdk/deployment/worker`), which a Worker host binds
+ * (Admin's Services). Its digest and the build digest make the deployment's label.
+ */
+export type DeploymentConfiguration = FrozenConfigurationV1 | WorkerConfigurationV1;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export declare function deploymentConfigurationDigest(configuration: DeploymentConfiguration): Digest;
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export declare function isFrozenConfiguration(configuration: DeploymentConfiguration): configuration is FrozenConfigurationV1;
+/** A configuration before its canonical order: lists in any order, no format header. */
+export type FrozenConfigurationInput = Omit<FrozenConfigurationV1, 'format' | 'version'>;
+/** Freeze one deployment configuration in the one canonical order its digest is taken in. */
+export declare function frozenConfiguration(input: FrozenConfigurationInput): FrozenConfigurationV1;
+/**
+ * `sha256` of the canonical JSON (RFC 8785) of one exact, canonical frozen configuration. A
+ * deployment record keeps it whole; the deployment address keeps 80 bits of it with the build.
+ * It refuses a configuration that is not canonical, and checks nothing past that: a configuration
+ * it digests may still be one no Worker runs under (see `FrozenConfigurationV1`).
+ */
+export declare function configurationDigest(configuration: FrozenConfigurationV1): Digest;

package/dist/deployment/address/configuration.js

@@ -0,0 +1,273 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { isWorkerConfiguration, workerConfigurationDigest } from '../worker/configuration.js';
+export const FROZEN_CONFIGURATION_FORMAT = 'astrale.deployment.configuration';
+export const FROZEN_CONFIGURATION_VERSION = 1;
+/** Service binding through which an immutable deployment reaches the instance router. */
+const ROUTER_BINDING = 'ROUTER';
+const MEDIA_TYPE = 'application/vnd.astrale.deployment-configuration+json;v=1';
+const COMPATIBILITY_DATE = /^\d{4}-\d{2}-\d{2}$/u;
+/** A Cloudflare Worker binding name. */
+const BINDING_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+/** A Cloudflare dispatch namespace name. */
+const NAMESPACE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export function deploymentConfigurationDigest(configuration) {
+    return isWorkerConfiguration(configuration)
+        ? workerConfigurationDigest(configuration)
+        : configurationDigest(configuration);
+}
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export function isFrozenConfiguration(configuration) {
+    return configuration?.format === FROZEN_CONFIGURATION_FORMAT;
+}
+/** Freeze one deployment configuration in the one canonical order its digest is taken in. */
+export function frozenConfiguration(input) {
+    if (input === null || typeof input !== 'object')
+        invalid();
+    const { settings, runtime, bindings } = input;
+    if (settings === null || typeof settings !== 'object')
+        invalid();
+    if (runtime === null || typeof runtime !== 'object')
+        invalid();
+    if (bindings === null || typeof bindings !== 'object')
+        invalid();
+    if (!Array.isArray(runtime.compatibilityFlags))
+        invalid();
+    if (!Array.isArray(bindings.services) ||
+        !Array.isArray(bindings.dispatchNamespaces) ||
+        !Array.isArray(bindings.secrets)) {
+        invalid();
+    }
+    return admit({
+        format: FROZEN_CONFIGURATION_FORMAT,
+        version: FROZEN_CONFIGURATION_VERSION,
+        vars: input.vars,
+        settings: declaredSettings(settings),
+        runtime: {
+            compatibilityDate: runtime.compatibilityDate,
+            compatibilityFlags: [...runtime.compatibilityFlags].sort(compare),
+        },
+        bindings: {
+            services: [...bindings.services].sort(byName),
+            dispatchNamespaces: [...bindings.dispatchNamespaces].sort(byName),
+            secrets: [...bindings.secrets].sort(compare),
+        },
+        router: input.router,
+    });
+}
+/**
+ * `sha256` of the canonical JSON (RFC 8785) of one exact, canonical frozen configuration. A
+ * deployment record keeps it whole; the deployment address keeps 80 bits of it with the build.
+ * It refuses a configuration that is not canonical, and checks nothing past that: a configuration
+ * it digests may still be one no Worker runs under (see `FrozenConfigurationV1`).
+ */
+export function configurationDigest(configuration) {
+    return identify(json.encode(admit(configuration)), MEDIA_TYPE).digest;
+}
+function admit(input) {
+    exact(input, ['format', 'version', 'vars', 'settings', 'runtime', 'bindings', 'router']);
+    if (input.format !== FROZEN_CONFIGURATION_FORMAT ||
+        input.version !== FROZEN_CONFIGURATION_VERSION) {
+        invalid();
+    }
+    const vars = variables(input.vars);
+    exact(input.settings, ['maximumRequestBytes', 'invocationTimeoutMs', 'tokenExchange'], ['durableOptions']);
+    const { tokenExchange } = input.settings;
+    if (tokenExchange !== false)
+        exact(tokenExchange, ['maximumLifetimeSeconds']);
+    exact(input.runtime, ['compatibilityDate', 'compatibilityFlags']);
+    const { compatibilityDate } = input.runtime;
+    if (!isDate(compatibilityDate))
+        invalid();
+    exact(input.bindings, ['services', 'dispatchNamespaces', 'secrets']);
+    if (!Array.isArray(input.bindings.services))
+        invalid();
+    if (!Array.isArray(input.bindings.dispatchNamespaces))
+        invalid();
+    const services = input.bindings.services.map((binding) => {
+        exact(binding, ['name', 'service']);
+        if (binding.name === ROUTER_BINDING) {
+            throw new TypeError('Frozen configuration service bindings never include ROUTER.');
+        }
+        return Object.freeze({
+            name: stable(binding.name, 'Service binding name'),
+            service: stable(binding.service, 'Service binding target'),
+        });
+    });
+    ordered(services.map((binding) => binding.name), 'Service bindings');
+    const dispatchNamespaces = input.bindings.dispatchNamespaces.map((binding) => {
+        exact(binding, ['name', 'namespace']);
+        if (binding.name === ROUTER_BINDING) {
+            throw new TypeError('Frozen configuration dispatch namespace bindings never include ROUTER.');
+        }
+        if (typeof binding.name !== 'string' || !BINDING_NAME.test(binding.name)) {
+            throw new TypeError('Dispatch namespace binding name must be a Worker binding name.');
+        }
+        if (typeof binding.namespace !== 'string' || !NAMESPACE_NAME.test(binding.namespace)) {
+            throw new TypeError('Dispatch namespace must be a Cloudflare dispatch namespace name.');
+        }
+        return Object.freeze({ name: binding.name, namespace: binding.namespace });
+    });
+    ordered(dispatchNamespaces.map((binding) => binding.name), 'Dispatch namespace bindings');
+    const secrets = names(input.bindings.secrets, 'Secret names');
+    const router = input.router === false ? false : routerOf(input.router);
+    const bound = [
+        ...Object.keys(vars),
+        ...services.map((binding) => binding.name),
+        ...dispatchNamespaces.map((binding) => binding.name),
+        ...secrets,
+        ...(router === false ? [] : [ROUTER_BINDING]),
+    ];
+    if (new Set(bound).size !== bound.length) {
+        throw new TypeError('Frozen configuration binding names must be unique.');
+    }
+    return Object.freeze({
+        format: FROZEN_CONFIGURATION_FORMAT,
+        version: FROZEN_CONFIGURATION_VERSION,
+        vars,
+        settings: Object.freeze({
+            maximumRequestBytes: positive(input.settings.maximumRequestBytes),
+            invocationTimeoutMs: positive(input.settings.invocationTimeoutMs),
+            tokenExchange: tokenExchange === false
+                ? false
+                : Object.freeze({
+                    maximumLifetimeSeconds: positive(tokenExchange.maximumLifetimeSeconds),
+                }),
+            ...(Object.hasOwn(input.settings, 'durableOptions')
+                ? { durableOptions: durableOptionsOf(input.settings.durableOptions) }
+                : {}),
+        }),
+        runtime: Object.freeze({
+            compatibilityDate,
+            compatibilityFlags: names(input.runtime.compatibilityFlags, 'Compatibility flags'),
+        }),
+        bindings: Object.freeze({
+            services: Object.freeze(services),
+            dispatchNamespaces: Object.freeze(dispatchNamespaces),
+            secrets,
+        }),
+        router,
+    });
+}
+/** A calendar date written `YYYY-MM-DD`, as a Worker compatibility date is. */
+function isDate(input) {
+    if (typeof input !== 'string' || !COMPATIBILITY_DATE.test(input))
+        return false;
+    const time = Date.parse(`${input}T00:00:00Z`);
+    return !Number.isNaN(time) && new Date(time).toISOString().slice(0, 10) === input;
+}
+function variables(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const entries = Reflect.ownKeys(input).map((name) => {
+        if (typeof name !== 'string')
+            invalid();
+        const value = input[name];
+        if (typeof value !== 'string')
+            invalid();
+        return [stable(name, 'Variable name'), value];
+    });
+    return Object.freeze(Object.fromEntries(entries));
+}
+/** The settings as written, without a `durableOptions` or durable field left `undefined`. */
+function declaredSettings(settings) {
+    const { durableOptions, ...rest } = settings;
+    if (durableOptions === undefined)
+        return rest;
+    const { retry, ...options } = defined(durableOptions);
+    return {
+        ...rest,
+        durableOptions: {
+            ...options,
+            ...(retry === undefined ? {} : { retry: defined(retry) }),
+        },
+    };
+}
+function defined(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined));
+}
+/** The declared durable options in their canonical form: sorted keys, positive integers. */
+function durableOptionsOf(input) {
+    exact(input, [], ['retentionMs', 'retry', 'stepTimeoutMs']);
+    const options = input;
+    let retry;
+    if (Object.hasOwn(options, 'retry')) {
+        exact(options.retry, [], ['initialIntervalMs', 'maxAttempts', 'maxIntervalMs']);
+        const value = options.retry;
+        retry = Object.freeze({
+            ...optional(value, 'initialIntervalMs'),
+            ...optional(value, 'maxAttempts'),
+            ...optional(value, 'maxIntervalMs'),
+        });
+    }
+    return Object.freeze({
+        ...optional(options, 'retentionMs'),
+        ...(retry === undefined ? {} : { retry }),
+        ...optional(options, 'stepTimeoutMs'),
+    });
+}
+function optional(input, key) {
+    return Object.hasOwn(input, key)
+        ? { [key]: positive(input[key]) }
+        : {};
+}
+function routerOf(input) {
+    exact(input, ['service', 'hostSuffix', 'minLabels']);
+    const router = input;
+    if (typeof router.hostSuffix !== 'string')
+        invalid();
+    if (!Number.isSafeInteger(router.minLabels) || router.minLabels < 0)
+        invalid();
+    return Object.freeze({
+        service: stable(router.service, 'Router service'),
+        hostSuffix: router.hostSuffix,
+        minLabels: router.minLabels,
+    });
+}
+function names(input, label) {
+    if (!Array.isArray(input))
+        invalid();
+    const values = input.map((value) => stable(value, label));
+    ordered(values, label);
+    return Object.freeze(values);
+}
+function ordered(values, label) {
+    for (let index = 1; index < values.length; index += 1) {
+        if (compare(values[index - 1], values[index]) >= 0) {
+            throw new TypeError(`${label} must be unique and sorted.`);
+        }
+    }
+}
+/** Exactly `keys`, plus any of `optional`, and nothing else. */
+function exact(input, keys, optionalKeys = []) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => typeof key !== 'string' || (!keys.includes(key) && !optionalKeys.includes(key))) ||
+        keys.some((key) => !Object.hasOwn(input, key))) {
+        invalid();
+    }
+}
+function positive(input) {
+    if (!Number.isSafeInteger(input) || input < 1)
+        invalid();
+    return input;
+}
+function stable(input, label) {
+    if (typeof input !== 'string' || input.length === 0 || input.trim() !== input) {
+        throw new TypeError(`${label} must be non-empty stable text.`);
+    }
+    return input;
+}
+function byName(left, right) {
+    return compare(String(left?.name), String(right?.name));
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid() {
+    throw new TypeError('Frozen configuration is invalid.');
+}

package/dist/deployment/address/fingerprint.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The first 80 bits of `sha256(utf8(parts[0]) ‖ 0x00 ‖ utf8(parts[1]) ‖ …)` as 16 characters of
+ * RFC 4648 base32, lower case and unpadded. Callers admit every part first, so no part holds 0x00.
+ */
+export declare function first80(...parts: readonly string[]): string;

package/dist/deployment/address/fingerprint.js

@@ -0,0 +1,27 @@
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+const encoder = new TextEncoder();
+const ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+const PREIMAGE_MEDIA_TYPE = 'application/octet-stream';
+/**
+ * The first 80 bits of `sha256(utf8(parts[0]) ‖ 0x00 ‖ utf8(parts[1]) ‖ …)` as 16 characters of
+ * RFC 4648 base32, lower case and unpadded. Callers admit every part first, so no part holds 0x00.
+ */
+export function first80(...parts) {
+    const encoded = parts.map((part) => encoder.encode(part));
+    const preimage = new Uint8Array(encoded.reduce((size, part) => size + part.byteLength, encoded.length - 1));
+    let offset = 0;
+    for (const [index, part] of encoded.entries()) {
+        if (index > 0)
+            offset += 1;
+        preimage.set(part, offset);
+        offset += part.byteLength;
+    }
+    // `sha256:` then 20 hexadecimal digits: the first 10 bytes of the hash.
+    let bits = BigInt(`0x${identify(preimage, PREIMAGE_MEDIA_TYPE).digest.slice(7, 27)}`);
+    let text = '';
+    for (let index = 0; index < 16; index += 1) {
+        text = ALPHABET[Number(bits & 31n)] + text;
+        bits >>= 5n;
+    }
+    return text;
+}

package/dist/deployment/address/index.d.ts

@@ -0,0 +1,5 @@
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, type DeploymentConfiguration, type FrozenConfigurationInput, type FrozenDurableOptions, type FrozenConfigurationV1, } from './configuration.js';
+export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
+export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, type DeploymentCommitV1, type DeploymentRecordDocument, type DeploymentRecordV1, } from './record.js';
+export type { DeploymentSummaryV1 } from './summary.js';

package/dist/deployment/address/index.js

@@ -0,0 +1,4 @@
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, } from './configuration.js';
+export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
+export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, } from './record.js';