@astrale-domains/services 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.3.4](https://github.com/astrale-os/domains/compare/services-v0.3.3...services-v0.3.4) (2026-09-05)
+
+
+### Bug Fixes
+
+* **services:** bind Workers to their canonical public URL ([#182](https://github.com/astrale-os/domains/issues/182)) ([fc8be8e](https://github.com/astrale-os/domains/commit/fc8be8eb10fc81491665d076daa8d12c6d2fe63f))
+* **services:** explain interrupted deployment recovery ([#180](https://github.com/astrale-os/domains/issues/180)) ([d65f814](https://github.com/astrale-os/domains/commit/d65f814603202ff5769c2c2bcc5f86bc703f9b44))
+
+## [0.3.3](https://github.com/astrale-os/domains/compare/services-v0.3.2...services-v0.3.3) (2026-09-05)
+
+
+### Features
+
+* **services:** adopt Project environments with published SDK ([#175](https://github.com/astrale-os/domains/issues/175)) ([4e90698](https://github.com/astrale-os/domains/commit/4e906982ecafb6d9d660ba0c52e421b7a7a760f8))
+* **services:** verify private candidate startup before promotion ([#173](https://github.com/astrale-os/domains/issues/173)) ([271424e](https://github.com/astrale-os/domains/commit/271424ee1c2296c4d090b32881d8951ec7834e1d))
+
+
+### Bug Fixes
+
+* **schema:** migrate downstream Class Policy contracts ([#174](https://github.com/astrale-os/domains/issues/174)) ([15abf49](https://github.com/astrale-os/domains/commit/15abf49f3c8ecc1e23313f9fdde8d7c85085d3a3))
+* **services:** align development launcher with domain layout ([#177](https://github.com/astrale-os/domains/issues/177)) ([707eee1](https://github.com/astrale-os/domains/commit/707eee16bf7fbb34148581341622c8b22781cdc0))
+* **services:** reconcile Identity-owned Services and recover deletion ([#168](https://github.com/astrale-os/domains/issues/168)) ([44f0bf8](https://github.com/astrale-os/domains/commit/44f0bf83d7bf8bb1ef852590e61720b4b8ed41e2))
+
 ## [0.3.2](https://github.com/astrale-os/domains/compare/services-v0.3.1...services-v0.3.2) (2026-09-04)
 
 

package/README.md

@@ -1,29 +1,41 @@
 # Services
 
-`services.astrale.ai` turns an authored module artifact into an owner-scoped, Cloudflare-backed
-Service. It keeps provider protocols behind a neutral SDK Integration and stores only admitted
-deployment evidence in the graph.
+`services.astrale.ai` owns provider-backed compute resources. It keeps provider
+protocols behind neutral SDK Integrations and stores only admitted lifecycle evidence in the graph.
 
 ## Model
 
 - `Service` records one opaque provider name, its owner-scoped stable `serviceKey`, deployment mode,
   URL, lifecycle, provider digest, operation receipt, and exact cleanup locators.
 - `service_owned_by` connects each Service to its owning Identity and governs graph visibility.
+- Owners may be Shell users, local Kernel roots, or application/CI identities. Services requires only
+  the Kernel Schema; a Shell installation is not required to deploy. Ownership
+  remains exact-subject scoped, and existing Shell-user ownership edges remain valid.
 - secret values stay write-only at Cloudflare and never enter Astrale mutations or graph state.
 - schedules remain provider state; only the owner may read or replace them.
 - logs are remote evidence admitted by the Cloudflare Provider before a Workflow returns them.
 - the only admitted Worker service binding is the logical platform router; the provider resolves
   it to the selected environment and callers cannot name arbitrary same-account Workers.
+- the provider supplies `WORKER_URL` as the Service's canonical HTTPS URL to both candidate and
+  public Workers. It is reserved provider metadata, not a caller variable or secret. Applications
+  therefore keep one issuer even when requests arrive over HTTP or through a dispatcher alias.
 
 The View, CLI, and agent consumers read the named Service Queries directly; there is intentionally
 no list Function wrapping `listServicesQuery`. Deployment, secrets, schedules, logs, and deletion
 are Workflows because they coordinate admitted caller intent with external effects. Receiver Methods
 are authorized by the ownership Policy before their Workflows begin. `service-hosting`
-is the provider-neutral Integration contract; Cloudflare is its first Provider.
+is the provider-neutral compute Integration contract. Cloudflare is its first Provider.
 
 ## Development
 
-Copy `.env.example` to `.env.dev`, fill the Cloudflare values, then run:
+Copy `.env.example` to `.env.dev` and fill the Cloudflare values.
+
+`pnpm dev` watches and deploys the development Environment remotely. `pnpm dev beta`
+selects beta; `pnpm beta` and `pnpm prod` deploy once. These bootstrap Environments
+are deliberately deploy-only: install the resulting URL on the intended Kernel explicitly.
+Stopping development leaves the remote Worker available. No local Worker or tunnel is started.
+
+To validate without deploying:
 
 ```sh
 pnpm typecheck
@@ -41,7 +53,41 @@ distinct modes and cannot replace each other at one Service record. Five-field c
 supported when `CLOUDFLARE_SCHEDULE_KV_ID` is configured.
 
 SDK-authored Applications should deploy through `@astrale-os/adapter-astrale`, which projects the
-admitted Cloudflare artifact into the revisioned Services request, verifies the live Publication,
-and deliberately installs the exact Release on its configured Kernel. Services never interprets or
+admitted Cloudflare artifact into the revisioned Services request and verifies the live Publication.
+Project tooling installs the exact Release only when that environment declares installation.
+Services never interprets or
 caches Application, Publication, Schema revision, issuer, or callable inventory. Manual callers may
 deploy provider compute first and then use the ordinary Domain installation command themselves.
+
+Revisioned deployments may request `readiness: { paths: ['/health'] }`. Services executes these
+bounded local GET paths through its private candidate dispatch binding and requires HTTP 200 before
+public promotion. It never follows redirects or reads the response body as Application metadata.
+For an existing Service, required checks need every retained secret supplied in the candidate
+configuration. Missing values fail before staging or promotion. A caller may explicitly request
+`readiness: { paths: ['/health'], required: false }` to preserve updates with Worker-only secrets:
+Services then retains those secrets on the serving Worker and returns
+`candidateReadiness: 'unavailable-retained-secrets'` without invoking the incomplete candidate.
+An executed, successful check returns `candidateReadiness: 'passed'`. Failed checks still refuse
+promotion even when `required` is false; this is not a fallback for broken candidates.
+Checks share a 30-second budget, shortened by invocation cancellation/deadline. A failed check leaves
+the public Worker unchanged and removes the newly owned candidate. Unchecked provider-only requests
+retain their existing contract.
+
+The updated Astrale adapter requests optional `/health` preflight automatically: SDK Workers
+initialize their Runtime before serving it. No Project option is needed. The adapter reports
+unavailable preflight explicitly and always verifies the public Publication, Bundle, and identity
+after deployment. Private preflight alone never proves complete product correctness.
+Provision and deploy the updated Services Runtime before using this adapter cohort. Older strict
+Services schemas reject the new field; the adapter must not retry without the safety check.
+
+An uncertain provider promotion is adopted only after observing its exact, non-secret attempt
+receipt alongside the artifact tag. Matching code alone is insufficient: Cloudflare's script ETag
+can remain unchanged when only secrets change. Services-owned operation leases serialize callers;
+operators making direct provider changes must coordinate with those operations. The code ETag is
+not a lock for concurrent configuration changes.
+
+If a Kernel interruption prevents recording a deployment outcome, the Service can remain busy
+until its retained operation lease expires (currently 30 minutes from acquisition or renewal).
+Retry the same deployment after the expiry reported in the rejection; it reuses the Service and
+provider identity. Do not clear the lease or create another Service to bypass an uncertain outcome.
+An operation without a recorded expiry needs operator inspection, not a guessed retry deadline.

package/dist/schema/index.d.ts

@@ -2,4 +2,4 @@ export { schema } from './schema.js';
 export type { ServicesDomain, ServicesSchema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './modules/service/index.js';
-export { CloudflareWorker, OwnService, ServicesShell, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';

package/dist/schema/index.js

@@ -1,3 +1,3 @@
 export { schema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
-export { CloudflareWorker, OwnService, ServicesShell, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
+export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';