@fabrika/provider-contract 0.0.26 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-contract",
-	"version": "0.0.26",
+	"version": "0.3.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -19,6 +19,11 @@
 			"bun": "./src/index.ts",
 			"types": "./src/index.ts",
 			"default": "./src/index.ts"
+		},
+		"./installation": {
+			"bun": "./src/installation.ts",
+			"types": "./src/installation.ts",
+			"default": "./src/installation.ts"
 		}
 	},
 	"scripts": {
@@ -26,6 +31,6 @@
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@fabrika/auth-core": "^0.0.26"
+		"@fabrika/auth-core": "^0.3.1"
 	}
 }

package/src/control.ts

@@ -1,6 +1,22 @@
-import type { ProviderManagedEnvironment, ProviderRunEvents } from './deploy'
 import type { JsonValue, ProviderEnvelope } from './json'
 
+/** Events whose persistence and presentation belong to the control plane. */
+export interface ProviderRunEvents {
+	log(line: string): void
+	/** Atomically persist the external operation id and, when supplied, its credential-free checkpoint. */
+	externalId(id: string, state?: JsonValue): Promise<void>
+	/** Replace the credential-free checkpoint while this run remains active. */
+	checkpoint(state: JsonValue): Promise<void>
+	/**
+	 * A step boundary: Control checks its lease and reads the run's cancellation request. Rejects with a
+	 * `ProviderInvocationAbort` after aborting the run's signal. A long step calls it at its own boundaries.
+	 */
+	boundary(): Promise<void>
+}
+
+/** Complete platform-owned runtime state. A null value removes the key from persistent targets. */
+export type ProviderManagedEnvironment = Readonly<Record<string, string | null>>
+
 /** Provider-neutral coordinates for obtaining one app revision. */
 export interface ProviderSource {
 	readonly repoUrl: string
@@ -8,8 +24,6 @@ export interface ProviderSource {
 	readonly workerDir?: string
 	readonly buildCommand?: string
 	readonly configPath?: string
-	readonly githubConnectionId?: string
-	readonly githubInstallationId?: number
 }
 
 /** App data needed by a control provider. */
@@ -54,6 +68,7 @@ export interface ProviderSourceResolutionInput {
 	readonly environment: ProviderEnvironment
 	/** An immutable commit already recorded by the trigger, which resolution must verify exactly. */
 	readonly expectedCommitSha?: string
+	readonly sourceBinding?: ProviderSourceBinding
 	readonly signal: AbortSignal
 }
 
@@ -62,6 +77,20 @@ export interface ProviderSourceResolution {
 	readonly commitSha: string
 }
 
+/**
+ * Credential-free selector of the GitHub connection and installation that read a private source
+ * (ADR-0029). Absent means a public source; an installation id alone never selects a credential.
+ */
+export interface ProviderSourceBinding {
+	readonly connectionId: string
+	readonly installationId: number
+}
+
+/** How private GitHub sources reach a provider (ADR-0029): one keyed connection's App and installation. */
+export interface ProviderSourceCapabilities {
+	readonly binding: 'connection'
+}
+
 /** One control-plane deploy invocation. */
 export interface ProviderDeployInput {
 	readonly runId: string
@@ -72,12 +101,13 @@ export interface ProviderDeployInput {
 	/** Platform-owned runtime configuration, separate from operator-managed application vars. */
 	readonly managedEnvironment: ProviderManagedEnvironment
 	/**
-	 * Every origin IAM may hand this app a session at (ADR-0021). App-wide, not per-environment:
+	 * Every origin IAM may hand this app a session at (ADR-0022). App-wide, not per-environment:
 	 * IAM's registry is keyed by app id, so the set is assembled from every environment of the app.
 	 * Absent when the app has no public origin at all, which leaves IAM's registry untouched.
 	 */
 	readonly returnOrigins?: readonly string[]
 	readonly dryRun: boolean
+	readonly sourceBinding?: ProviderSourceBinding
 	/** Optional short-lived, run-scoped Operations artifact destination. */
 	readonly artifactUpload?: {
 		readonly url: string
@@ -100,28 +130,81 @@ export interface ProviderTerminalOutcome {
 	readonly artifactState?: 'complete' | 'incomplete' | 'not_applicable'
 }
 
+/** Running means external settlement is unresolved, including an ambiguous submission response. */
+export type ProviderDeployOutcome = ProviderTerminalOutcome | { readonly state: 'running' }
+
+/** Settled does not imply rollback: when activation won before cancellation, `outcome` is `succeeded`. */
+export type ProviderCancelOutcome = { readonly state: 'pending' } | { readonly state: 'settled'; readonly outcome?: 'succeeded' | 'failed' }
+
+/** Losing invocation ownership must never be interpreted as permission to cancel external work. */
+export class ProviderInvocationAbort extends Error {
+	constructor(readonly kind: 'lease_lost' | 'cancel_requested') {
+		super(kind === 'lease_lost' ? 'provider invocation lost its lease' : 'provider cancellation requested')
+		this.name = 'ProviderInvocationAbort'
+	}
+}
+
+export const isLeaseLoss = (reason: unknown): boolean => reason instanceof ProviderInvocationAbort && reason.kind === 'lease_lost'
+
+/** A signal that aborts with `signal`'s reason only when the lease is lost, never on a cancel. */
+export const followLeaseLoss = (signal: AbortSignal): AbortSignal => {
+	const controller = new AbortController()
+	const follow = (): void => {
+		if (isLeaseLoss(signal.reason)) controller.abort(signal.reason)
+	}
+	if (signal.aborted) follow()
+	else signal.addEventListener('abort', follow, { once: true })
+	return controller.signal
+}
+
+/** Resolve after `ms`, or reject with the signal's reason once it aborts. */
+export const abortableWait = (ms: number, signal: AbortSignal): Promise<void> =>
+	new Promise((resolve, reject) => {
+		signal.throwIfAborted()
+		const abort = (): void => {
+			clearTimeout(timer)
+			reject(signal.reason)
+		}
+		const timer = setTimeout(() => {
+			signal.removeEventListener('abort', abort)
+			resolve()
+		}, ms)
+		signal.addEventListener('abort', abort, { once: true })
+	})
+
 /** A platform-owned run that can be cancelled or reconciled. */
 export interface ProviderRunReference {
 	readonly runId: string
 	readonly externalId: string
 	readonly environment: ProviderEnvironment
-	/** Credential-free provider-owned progress needed to resume the external operation. */
+	/** Credential-free provider-owned checkpoint recorded by the run's last owner. */
 	readonly providerState?: JsonValue
+	/** When the run started (`started_at`, else `created_at`), in epoch milliseconds; bounds how long a provider polls. */
+	readonly startedAtMs?: number
 }
 
-export type ProviderCancelInput = ProviderRunReference
+export interface ProviderCancelInput extends ProviderRunReference {
+	readonly signal: AbortSignal
+	/** See `ProviderDeployInput.returnOrigins`; a cancel that settles an activated deploy projects the same set. */
+	readonly returnOrigins?: readonly string[]
+}
 
 export interface ProviderReconcileInput extends ProviderRunReference {
-	/** See `ProviderDeployInput.returnOrigins`; a provider that finishes a resumed deploy projects the same set. */
+	readonly signal: AbortSignal
+	/** See `ProviderDeployInput.returnOrigins`; a provider that settles a deploy here projects the same set. */
 	readonly returnOrigins?: readonly string[]
-	/** Persist a credential-free recovery checkpoint before the next irreversible provider call. */
-	checkpoint(state: JsonValue): Promise<void>
+	/** Append a line to the run's log. */
+	log?(line: string): Promise<void>
 }
 
 /** The latest state reported while reconciling a platform-owned run. */
 export interface ProviderReconcileOutcome {
 	readonly state: 'running' | 'succeeded' | 'failed'
 	readonly exitCode?: number
+	/** See `ProviderTerminalOutcome.artifactState`. */
+	readonly artifactState?: 'complete' | 'incomplete' | 'not_applicable'
+	/** The settled run was a preview: core projects it as a dry run. */
+	readonly dryRun?: boolean
 }
 
 /** Write one secret value to provider-managed storage. */
@@ -164,18 +247,54 @@ export class ProviderNamespaceError extends Error {
 	}
 }
 
+/**
+ * A provider-managed secret write the provider refuses on the app's own terms — a value naming a
+ * service the app does not own, say. `message` carries the secret's name and the offending host,
+ * never the value, so core may hand it to the caller as a 4xx.
+ */
+export class ProviderSecretError extends Error {
+	constructor(message: string, readonly code: string) {
+		super(message)
+		this.name = 'ProviderSecretError'
+	}
+}
+
 /** Persist a canonical namespace target immediately after one external mutation succeeds. */
 export interface ProviderNamespaceEvents {
 	checkpoint(namespace: ProviderDeploymentNamespace): Promise<void>
+	/** A step boundary: Control checks the namespace lease and, for a deploy, the run's cancellation request. */
+	boundary(): Promise<void>
+}
+
+/** One app environment assigned to a namespace, as its proxy routes it. */
+export interface ProviderNamespaceMember {
+	readonly appId: string
+	readonly env: string
+	readonly domain?: string
+	readonly artifact: ProviderEnvelope
 }
 
 /** One idempotent namespace lifecycle invocation. */
 export interface ProviderNamespaceMutationInput {
 	readonly namespace: ProviderDeploymentNamespace
+	/** Every app environment assigned to the namespace, read under its lease. */
+	readonly members: readonly ProviderNamespaceMember[]
 	readonly signal: AbortSignal
 	readonly events: ProviderNamespaceEvents
 }
 
+/** `settled` is false while the rebuild is still in flight; core then hands it to a `reconcile` job. */
+export interface ProviderNamespaceRepublishResult {
+	readonly namespace: ProviderDeploymentNamespace
+	readonly settled: boolean
+}
+
+/** Rebuild a ready namespace's entry point from its current members. */
+export interface ProviderNamespaceRepublishInput extends ProviderNamespaceMutationInput {
+	/** `started`: return once the rebuild is submitted. `active`: return once it is live. */
+	readonly wait: 'started' | 'active'
+}
+
 /** One registration whose provider coordinates do not exist until namespace services are prepared. */
 export interface ProviderRegistrationPreparationInput {
 	readonly registration: ProviderRegistration
@@ -261,6 +380,8 @@ export interface ProviderNamespaceCapabilities {
 	prepareRegistration?(input: ProviderRegistrationPreparationInput): Promise<ProviderRegistration>
 	provision(input: ProviderNamespaceMutationInput): Promise<ProviderDeploymentNamespace>
 	reconcile(input: ProviderNamespaceMutationInput): Promise<ProviderDeploymentNamespace>
+	/** Absent means the namespace has no entry point that follows its members. */
+	republish?(input: ProviderNamespaceRepublishInput): Promise<ProviderNamespaceRepublishResult>
 	readonly operator?: ProviderNamespaceOperator
 }
 
@@ -272,13 +393,16 @@ export interface ProviderNamespaceCapabilities {
  */
 export interface ControlProvider {
 	readonly id: string
-	normalizeRegistration(input: ProviderRegistrationInput): ProviderRegistration
+	/** Absent means core stores the registration as submitted. */
+	normalizeRegistration?(input: ProviderRegistrationInput): ProviderRegistration
 	resolveSource?(input: ProviderSourceResolutionInput): Promise<ProviderSourceResolution>
-	deploy(input: ProviderDeployInput): Promise<ProviderTerminalOutcome>
-	cancel?(input: ProviderCancelInput): Promise<void>
+	deploy(input: ProviderDeployInput): Promise<ProviderDeployOutcome>
+	cancel?(input: ProviderCancelInput): Promise<ProviderCancelOutcome>
 	reconcile?(input: ProviderReconcileInput): Promise<ProviderReconcileOutcome>
 	readonly secrets?: ProviderManagedSecrets
 	readonly namespaces?: ProviderNamespaceCapabilities
+	/** Absent means the provider deploys public sources only. */
+	readonly source?: ProviderSourceCapabilities
 	/**
 	 * The variable names this artifact declares, so core can refuse one it would silently ignore
 	 * ([ADR-0035](../../../docs/decisions/0035-the-platform-owns-the-application-iam-issuer.md)).

package/src/index.ts

@@ -1,6 +1,5 @@
 export * from './authoring'
 export * from './control'
-export * from './deploy'
 export * from './json'
-export * from './provider'
 export * from './schema'
+export * from './steps'

package/src/installation.ts

@@ -0,0 +1,66 @@
+/**
+ * The platform commands a provider MAY offer. Every one of them is optional — a provider declares the
+ * subset it implements and the CLI prints its usage for anything else.
+ *
+ * `install` is the newest and the narrowest in support: it BRINGS UP an installation that does not
+ * exist yet, generating and placing every credential it needs. Only Zerops declares it, because only
+ * there is a from-scratch bring-up a sequence of API calls; on Cloudflare the same ground is covered by
+ * `init` plus the workflow it scaffolds.
+ *
+ * `admin` admits the FIRST HUMAN to an installation that already runs. It is a verb of its own rather
+ * than a step of `install`, because it is the one command that is useful long after the bring-up: an
+ * installation whose only administrator left needs it, and a bring-up that got as far as the console
+ * does not need to be repeated to use it.
+ *
+ * `upgrade` rolls a RUNNING installation onto a newer published fabrika release. It is separate from
+ * `deploy` because the two run in different places: `deploy` runs inside the operator's own pipeline
+ * and brings an installation to the checkout it was handed, while `upgrade` runs on the operator's
+ * machine and moves the pin that pipeline reads. A provider whose operator edits no pin does not
+ * declare it.
+ */
+export type InstallationCommand = 'init' | 'install' | 'plan' | 'deploy' | 'admin' | 'upgrade'
+
+export const isInstallationCommand = (value: unknown): value is InstallationCommand =>
+	value === 'init' || value === 'install' || value === 'plan' || value === 'deploy' || value === 'admin' || value === 'upgrade'
+
+export interface InstallationCli {
+	readonly provider: string
+	readonly commands: readonly InstallationCommand[]
+	readonly usage: string
+	run(command: InstallationCommand, argv: readonly string[]): Promise<void>
+}
+
+export interface InstallationCliModule {
+	readonly installationCli: InstallationCli
+}
+
+export const isInstallationCli = (value: unknown): value is InstallationCli =>
+	typeof value === 'object'
+	&& value !== null
+	&& 'provider' in value
+	&& typeof value.provider === 'string'
+	&& value.provider.trim() !== ''
+	&& 'commands' in value
+	&& Array.isArray(value.commands)
+	&& value.commands.length > 0
+	&& value.commands.every(isInstallationCommand)
+	&& new Set(value.commands).size === value.commands.length
+	&& 'usage' in value
+	&& typeof value.usage === 'string'
+	&& 'run' in value
+	&& typeof value.run === 'function'
+
+export const supportsInstallationCommand = (installation: InstallationCli, command: InstallationCommand): boolean =>
+	installation.commands.some((supported) => supported === command)
+
+export const installationCliFromModule = (value: unknown, expectedProvider?: string): InstallationCli => {
+	if (typeof value !== 'object' || value === null || !('installationCli' in value) || !isInstallationCli(value.installationCli)) {
+		throw new Error('Installation package must export a valid `installationCli`')
+	}
+	if (expectedProvider !== undefined && value.installationCli.provider !== expectedProvider) {
+		throw new Error(
+			`Installation package provides "${value.installationCli.provider}", expected "${expectedProvider}"`,
+		)
+	}
+	return value.installationCli
+}

package/src/json.ts

@@ -14,3 +14,13 @@ export interface ProviderCodec<T> {
 	encode(value: T): JsonValue
 	decode(payload: JsonValue): T
 }
+
+export const decodeEnvelope = <T>(kind: string, provider: string, envelope: ProviderEnvelope, codec: ProviderCodec<T>): T => {
+	if (envelope.provider !== provider) {
+		throw new Error(`${kind} belongs to provider "${envelope.provider}", expected "${provider}"`)
+	}
+	if (envelope.version !== codec.version) {
+		throw new Error(`${kind} schema version ${envelope.version} is not supported by provider "${provider}"`)
+	}
+	return codec.decode(envelope.payload)
+}

package/src/steps.ts

@@ -0,0 +1,72 @@
+/** What happened to one provider deploy step. */
+export interface DeployStepResult {
+	readonly id: string
+	readonly status: 'succeeded' | 'failed' | 'skipped'
+	readonly error?: string
+	readonly startedAt?: number
+	readonly finishedAt?: number
+}
+
+export interface RunStepsOptions {
+	readonly appId: string
+	readonly env: string
+	readonly dryRun: boolean
+	readonly signal: AbortSignal
+	readonly log: (line: string) => void
+}
+
+const CANCELLED = 'deploy cancelled'
+
+/** Stop waiting as soon as the run is cancelled; the step receives the same signal and stops its own work. */
+const untilCancelled = <T>(promise: Promise<T>, signal: AbortSignal): Promise<T> =>
+	new Promise<T>((resolve, reject) => {
+		const onAbort = (): void => reject(new Error(CANCELLED))
+		if (signal.aborted) onAbort()
+		else signal.addEventListener('abort', onAbort, { once: true })
+		// Always observed, so a step that fails after it was abandoned is not an unhandled rejection.
+		void promise.then(resolve, reject).finally(() => {
+			signal.removeEventListener('abort', onAbort)
+		})
+	})
+
+/** Run a provider's steps in order. The first failure or a cancellation skips every later step. */
+export const runSteps = async <TStep extends { readonly id: string; readonly description: string }>(
+	steps: readonly TStep[],
+	options: RunStepsOptions,
+	runOne: (step: TStep) => Promise<void>,
+): Promise<{ readonly status: 'succeeded' | 'failed'; readonly steps: readonly DeployStepResult[] }> => {
+	const { log, signal } = options
+	log(`Deploy ${options.appId} → ${options.env}${options.dryRun ? ' (dry-run)' : ''} — ${steps.length} step(s):`)
+	for (const step of steps) {
+		log(`  • ${step.id} — ${step.description}`)
+	}
+
+	const results: DeployStepResult[] = []
+	let stopped = false
+	for (const step of steps) {
+		if (stopped) {
+			results.push({ id: step.id, status: 'skipped' })
+			continue
+		}
+		if (signal.aborted) {
+			stopped = true
+			results.push({ id: step.id, status: 'skipped' })
+			log(`∅ ${step.id}: ${CANCELLED}`)
+			continue
+		}
+
+		const startedAt = Date.now()
+		log(`→ ${step.id}`)
+		try {
+			await untilCancelled(runOne(step), signal)
+			results.push({ id: step.id, status: 'succeeded', startedAt, finishedAt: Date.now() })
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error)
+			stopped = true
+			log(`✗ ${step.id}: ${message}`)
+			results.push({ id: step.id, status: 'failed', error: message, startedAt, finishedAt: Date.now() })
+		}
+	}
+
+	return { status: stopped ? 'failed' : 'succeeded', steps: results }
+}

package/src/deploy.ts

@@ -1,88 +0,0 @@
-import type { JsonValue, ProviderEnvelope } from './json'
-
-/** One provider-owned unit of deploy work. Core treats `kind` as an open string. */
-export interface ProviderJobSpec {
-	readonly id: string
-	readonly kind: string
-	readonly description: string
-	readonly dependsOn?: readonly string[]
-}
-
-/** Shared deploy state used for whole runs and individual steps. */
-export type ProviderRunStatus = 'pending' | 'running' | 'succeeded' | 'failed' | 'skipped'
-
-/** A provider job plus its observed runtime state. */
-export interface ProviderDeployStep {
-	readonly spec: ProviderJobSpec
-	readonly status: ProviderRunStatus
-	readonly error?: string
-	readonly startedAt?: number
-	readonly finishedAt?: number
-}
-
-/** The ordered work derived by a provider before it starts mutation. */
-export interface ProviderDeployPlan {
-	readonly appId: string
-	readonly env: string
-	readonly steps: readonly ProviderJobSpec[]
-}
-
-/** A provider-owned deploy session opened from one target and artifact. */
-export interface ProviderDeploySession {
-	readonly plan: ProviderDeployPlan
-	execute(stepId: string): Promise<void>
-}
-
-/** The final provider-neutral representation of a deploy execution. */
-export interface ProviderDeployResult {
-	readonly appId: string
-	readonly env: string
-	readonly status: ProviderRunStatus
-	readonly plan: ProviderDeployPlan
-	readonly steps: readonly ProviderDeployStep[]
-}
-
-/** Events whose persistence and presentation belong to the control plane. */
-export interface ProviderRunEvents {
-	log(line: string): void
-	/** Atomically persist the external operation id and, when supplied, its credential-free resume state. */
-	externalId(id: string, state?: JsonValue): Promise<void>
-	/** Replace the credential-free resume state while this run remains active. */
-	checkpoint(state: JsonValue): Promise<void>
-}
-
-/** Complete platform-owned runtime state. A null value removes the key from persistent targets. */
-export type ProviderManagedEnvironment = Readonly<Record<string, string | null>>
-
-/** Universal inputs shared by every provider deploy. */
-export interface ProviderRunBase {
-	readonly appId: string
-	readonly env: string
-	readonly domain?: string
-	/**
-	 * Every origin IAM may hand this app a session at, as known by the control plane. App-wide rather
-	 * than per-environment, because IAM's registry is keyed by app id and a deploy of one environment
-	 * must not un-register the others.
-	 */
-	readonly returnOrigins?: readonly string[]
-	readonly cwd: string
-	readonly secrets: Readonly<Record<string, string>>
-	readonly vars: Readonly<Record<string, string>>
-	/** Platform-owned runtime configuration, separate from operator-managed application vars. */
-	readonly managedEnvironment: ProviderManagedEnvironment
-	readonly dryRun: boolean
-	readonly signal: AbortSignal
-	readonly events: ProviderRunEvents
-}
-
-/** The run shape seen by a provider after its envelopes have been decoded. */
-export interface TypedProviderRun<TTarget, TArtifact> extends ProviderRunBase {
-	readonly target: TTarget
-	readonly artifact: TArtifact
-}
-
-/** The provider-neutral run shape stored and passed by the control plane. */
-export interface RuntimeProviderRun extends ProviderRunBase {
-	readonly target: ProviderEnvelope
-	readonly artifact: ProviderEnvelope
-}

package/src/provider.ts

@@ -1,78 +0,0 @@
-import type { ProviderDeploySession, RuntimeProviderRun, TypedProviderRun } from './deploy'
-import type { ProviderCodec, ProviderEnvelope } from './json'
-
-/** A provider implementation with its target and artifact types preserved. */
-export interface ProviderDefinition<TId extends string, TTarget, TArtifact> {
-	readonly id: TId
-	readonly target: ProviderCodec<TTarget>
-	readonly artifact: ProviderCodec<TArtifact>
-	open(run: TypedProviderRun<TTarget, TArtifact>): Promise<ProviderDeploySession>
-}
-
-/** The opaque interface consumed by a provider-specific composition root. */
-export interface RuntimeProvider {
-	readonly id: string
-	open(run: RuntimeProviderRun): Promise<ProviderDeploySession>
-}
-
-/**
- * A provider module exposes typed encoders to its authoring side and an opaque runtime adapter to
- * its control-plane side.
- */
-export interface ProviderModule<TId extends string, TTarget, TArtifact> {
-	readonly id: TId
-	encodeTarget(value: TTarget): ProviderEnvelope
-	encodeArtifact(value: TArtifact): ProviderEnvelope
-	readonly runtime: RuntimeProvider
-}
-
-const decodeEnvelope = <T>(kind: string, provider: string, envelope: ProviderEnvelope, codec: ProviderCodec<T>): T => {
-	if (envelope.provider !== provider) {
-		throw new Error(`${kind} belongs to provider "${envelope.provider}", expected "${provider}"`)
-	}
-	if (envelope.version !== codec.version) {
-		throw new Error(`${kind} schema version ${envelope.version} is not supported by provider "${provider}"`)
-	}
-	return codec.decode(envelope.payload)
-}
-
-/**
- * Closes over a provider's concrete types and exposes only JSON envelopes at runtime.
- *
- * A new provider calls this factory in its own package. No central platform map or discriminated
- * union changes when a provider id is added.
- */
-export const createProvider = <TId extends string, TTarget, TArtifact>(
-	definition: ProviderDefinition<TId, TTarget, TArtifact>,
-): ProviderModule<TId, TTarget, TArtifact> => {
-	const envelope = <T>(codec: ProviderCodec<T>, value: T): ProviderEnvelope => ({
-		provider: definition.id,
-		version: codec.version,
-		payload: codec.encode(value),
-	})
-
-	return {
-		id: definition.id,
-		encodeTarget: (value) => envelope(definition.target, value),
-		encodeArtifact: (value) => envelope(definition.artifact, value),
-		runtime: {
-			id: definition.id,
-			open: async (run) =>
-				definition.open({
-					appId: run.appId,
-					env: run.env,
-					domain: run.domain,
-					returnOrigins: run.returnOrigins,
-					cwd: run.cwd,
-					secrets: run.secrets,
-					vars: run.vars,
-					managedEnvironment: run.managedEnvironment,
-					dryRun: run.dryRun,
-					signal: run.signal,
-					events: run.events,
-					target: decodeEnvelope('target', definition.id, run.target, definition.target),
-					artifact: decodeEnvelope('artifact', definition.id, run.artifact, definition.artifact),
-				}),
-		},
-	}
-}