@astrale-domains/services 0.4.4 → 0.4.5

package/README.md

@@ -16,6 +16,9 @@ protocols behind neutral SDK Integrations and stores only admitted lifecycle evi
 - logs are remote evidence admitted by the Cloudflare Provider before a Workflow returns them.
 - the only admitted Worker service binding is the logical platform router; the provider resolves
   it to the selected environment and callers cannot name arbitrary same-account Workers.
+- tenant Workers do not receive namespace dispatch authority. Inter-Service requests use public
+  ingress, including its retirement and private-route checks. Only the platform dispatcher and
+  candidate-readiness operator retain their respective native dispatch bindings.
 - the provider supplies `WORKER_URL` as the Service's canonical HTTPS URL to both candidate and
   public Workers. It is reserved provider metadata, not a caller variable or secret. Applications
   therefore keep one issuer even when requests arrive over HTTP or through a dispatcher alias.
@@ -27,12 +30,80 @@ are authorized by the ownership Policy before their Workflows begin. `service-ho
 is the provider-neutral compute Integration contract. Cloudflare is its first Provider.
 
 `Service` declares seven abstract management contracts. `CloudflareWorker` owns their executable
-Methods (`setSecret`, `deleteSecret`, `secrets`, `setSchedule`, `schedules`, `logs`, `delete`) and
+Methods (`setSecret`, `deleteSecret`, `secrets`, `setSchedule`, `schedules`, `logs`, `migrateIngress`, `delete`) and
 applies `OwnService` to each one. Workflow addresses are `CloudflareWorker.*`; abstract `Service.*`
 keys are not executable. A future provider Class must supply its own concrete declarations and
 implementations. Properties and ownership relationships retain their inherited meaning.
 
-## Development
+## Shared public ingress
+
+New Services use the environment's proxied wildcard DNS, wildcard Worker route and wildcard
+certificate. Services observes the expected dispatcher route and probes a never-registered hostname
+before uploading a Worker without an existing Custom Domain. It never creates a per-Service Custom
+Domain or certificate. Missing shared ingress is an operator provisioning issue; it is not repaired
+by consuming another certificate during a Service deployment.
+
+After activating routing, deployment waits for public dispatcher visibility with a bounded budget.
+This is separate from optional candidate application health checks. An uncertain activation retains
+the Service record and can be retried with the same owner-scoped service key.
+
+Existing exact Custom Domains and their immutable certificate locators are retained on ordinary
+updates. Detaching old hostnames is a separate migration, coordinated with Service operations;
+upgrading this Runtime does not perform that migration. A Service without an exact domain persists
+`tenantDomainState: 'absent'`.
+Deletion handles both placements and never removes shared ingress infrastructure.
+
+Cloudflare callers that must traverse same-zone public Worker routes need
+`global_fetch_strictly_public`. Audit existing callers before migrating their exact hostnames;
+explicit runtime flags retain their authored meaning. A rollback after creating wildcard Services
+must use a Runtime that understands explicit absent placement, not an older certificate-required
+implementation.
+
+### Migrating existing Services
+
+The owner calls `CloudflareWorker.migrateIngress` with an `action` (`detach`, `complete`, or
+`restore`) and a deterministic public health `probe`: a local GET `path`, expected successful
+`status`, and the exact response body's SHA-256 in `bodySha256`. The Workflow acquires the existing
+Service operation lease and verifies provider ownership, active dispatch, wildcard TLS and health
+before detaching the exact Custom Domain. It does not redeploy the Worker or alter its routing KV,
+secrets or schedules.
+
+After `detach`, observe real traffic for at least 30 minutes before calling `complete`. Until
+completion, the graph retains the previous domain and certificate locators with
+`tenantDomainDetachedAt`; completion clears them after provider cleanup and another successful
+health check. Cloudflare can automatically delete the generated certificate as soon as its Custom
+Domain is detached. `restore` recreates the exact domain, waits for active TLS and records the actual
+replacement certificate locator. A `pending` result requires a later retry; it is not completion.
+
+The beta replacement serves at `https://services-v2.beta.astrale.ai` with the retained
+`https://services.beta.astrale.ai` issuer and signing key. Keep the original runtime and identity
+discovery available for existing installations. Adopt the replacement's public URL per instance
+before invoking its additive migration API; do not uninstall Services or replace the shared R1
+runtime underneath installations that still use its Schema. An instance rollback must restore any
+detached domain before reinstalling the original endpoint, and must first be qualified with real
+retained Service data.
+
+## Plain background Service starter
+
+The package also ships an isolated scaffolding binary (the root import remains Schema-only):
+
+```sh
+npm exec --package @astrale-domains/services -- create-astrale-service my-worker
+cd my-worker
+npm install
+# Edit service.json and src/job.js for the existing business Domain.
+npm run deploy -- --instance development --as developer
+```
+
+The generator creates local source only and refuses an existing destination. It does not install
+dependencies, create/register accounts, grant permissions, set secrets, enable schedules or deploy.
+The generated project owns a plain HTTP/cron entry, an ES256 account session, a job implementation
+and build/deploy scripts. No Application, Schema, Publication, Domain signer or frontend is generated.
+Deployment calls the public Services API through the installed Astrale CLI and requires an explicit
+instance or URL. The project README explains account setup, secret custody, private cron and cleanup.
+No tooling dependency is added to the Schema runtime or imported from the package root.
+
+## Domain development
 
 Copy `.env.example` to `.env.dev` and fill the Cloudflare values.
 
@@ -58,6 +129,18 @@ unique and secrets use environment-variable identifiers. Plain and revisioned ar
 distinct modes and cannot replace each other at one Service record. Five-field cron expressions are
 supported when `CLOUDFLARE_SCHEDULE_KV_ID` is configured.
 
+Plain deployments that omit `compatibilityFlags` use `nodejs_compat`,
+`nodejs_compat_populate_process_env`, and `global_fetch_strictly_public`. Public `fetch()` calls
+therefore traverse Cloudflare's public routes, including same-zone Astrale endpoints, instead of
+bypassing those routes for the zone's origin. This changes routing, not Kernel authorization.
+An explicitly supplied flags array replaces these defaults, including `[]`; low-level callers
+own that complete runtime configuration. Existing Workers change only on redeployment.
+
+Revisioned deployments require explicit runtime configuration and upload it unchanged to both the
+candidate and the serving Worker. Those exact flags participate in the deployment identity;
+Services must not inject defaults after its computation. The Cloudflare adapter already includes
+public-fetch routing in the generated configuration before building the artifact and its digest.
+
 SDK-authored Applications should deploy through `@astrale-os/adapter-astrale`, which projects the
 admitted Cloudflare artifact into the revisioned Services request and verifies the live Publication.
 Project tooling installs the exact Release only when that environment declares installation.

package/dist/scaffold/create-service.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import { cp, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises'
+import { basename, resolve } from 'node:path'
+
+const [directory, ...extra] = process.argv.slice(2)
+if (directory === '--help' || directory === '-h') {
+  console.log(
+    'Usage: create-astrale-service <new-directory>\nCreates local source only. Does not install dependencies, register identities or deploy.',
+  )
+} else {
+  try {
+    if (!directory || directory.startsWith('-') || extra.length) {
+      throw new Error('Usage: create-astrale-service <new-directory>')
+    }
+    const destination = resolve(directory)
+    const name = basename(destination)
+    if (!/^[a-z][a-z0-9-]{0,62}$/.test(name)) {
+      throw new Error(
+        'Use a lowercase project name beginning with a letter (maximum 63 characters).',
+      )
+    }
+    const owner = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'))
+    // Exclusive creation preserves existing projects and refuses symlink targets.
+    await mkdir(destination)
+    const template = new URL('./template/', import.meta.url)
+    for (const entry of await readdir(template)) {
+      await cp(new URL(entry, template), resolve(destination, entry), {
+        recursive: true,
+        force: false,
+        errorOnExist: true,
+      })
+    }
+    await rename(resolve(destination, 'gitignore'), resolve(destination, '.gitignore'))
+    await writeFile(
+      resolve(destination, 'package.json'),
+      JSON.stringify(
+        {
+          name,
+          version: '0.0.0',
+          private: true,
+          type: 'module',
+          scripts: { build: 'node scripts/build.mjs', deploy: 'node scripts/deploy.mjs' },
+          dependencies: {
+            '@astrale-os/sdk': owner.dependencies['@astrale-os/sdk'],
+            zod: owner.dependencies.zod,
+            jose: '6.2.3',
+          },
+          devDependencies: { esbuild: '0.28.2' },
+          engines: { node: '>=22.13' },
+        },
+        null,
+        2,
+      ) + '\n',
+      { flag: 'wx' },
+    )
+    await writeFile(
+      resolve(destination, 'service.json'),
+      JSON.stringify(
+        {
+          serviceKey: name,
+          vars: { KERNEL: '', TARGET: '' },
+        },
+        null,
+        2,
+      ) + '\n',
+      { flag: 'wx' },
+    )
+    console.log(
+      `Created ${destination}\nInstall dependencies, edit service.json and src/job.js, then run npm run deploy -- --instance <instance> --as <identity>.`,
+    )
+  } catch (error) {
+    console.error(
+      error.code === 'EEXIST' ? 'Destination already exists; no files overwritten.' : error.message,
+    )
+    process.exitCode = 1
+  }
+}

package/dist/scaffold/template/.env.example

@@ -0,0 +1,2 @@
+# Bind this through Services.setSecret; deployment does not read this file.
+ACCOUNT_PRIVATE_JWK=

package/dist/scaffold/template/README.md

@@ -0,0 +1,37 @@
+# Background Service
+
+This is plain compute, not a Domain. It does not publish or install an Application.
+
+1. Install dependencies with `npm install` (Node22.13+), and install the Astrale CLI separately.
+2. Edit `service.json`: KERNEL is the exact Kernel issuer (including /api when present); TARGET is
+   the canonical callable Path. Edit `src/job.js` to match that callable's input and business intent.
+3. Create a dedicated Identity in its business Domain, register its ES256 key on the same Node,
+   and grant only the required callable authority and business permissions. Use Shell.Group.assignMember
+   for supported custom groups; do not use Root or admin credentials in this Worker.
+4. Run `npm run deploy -- --instance <instance> --as <owner>`. It builds first and calls Services.
+   The returned Service ID belongs to compute; it is not the registered Identity Node ID.
+5. Use `CloudflareWorker.setSecret` on that Service ID to bind ACCOUNT_PRIVATE_JWK. Send its value
+   through stdin, not shell arguments or service.json. `.env.example` only names the secret.
+6. Verify the account's real call, then enable the cron through `CloudflareWorker.setSchedule`.
+
+```sh
+astrale call @SERVICE_ID::services.astrale.ai:class.CloudflareWorker.method.setSchedule \
+  --data '{"crons":["* * * * *"]}' -i INSTANCE --as OWNER --json
+astrale call @SERVICE_ID::services.astrale.ai:class.CloudflareWorker.method.logs \
+  tail=20 -i INSTANCE --as OWNER --json
+```
+
+The cron is a private Services-dispatched POST to /__scheduled, not a native Cloudflare scheduled
+export. The public dispatcher rejects that path; headers alone are not authentication. The job
+awaits the remote result before success and uses a 9s call budget under the current 10s dispatcher
+deadline. Health indicates compute is reachable, not that the account is registered or authorized.
+No exactly-once guarantee: design repeated or uncertain calls in the business Domain.
+
+Deployment uses the Services provider's default public-fetch routing. It requires the Services
+Runtime containing Domains PR210; publishing a schema package alone does not deploy that fix.
+Explicit compatibilityFlags in service.json replace defaults completely. Configuration changes
+require redeployment; no automatic fallback or provider-specific transport is embedded here.
+
+To stop, set crons to [] and observe convergence. Delete the Service through its public delete
+method, resuming a deleting result at retryAfterMs if necessary. Account/group/data retirement is
+a separate business operation. Never delete shared groups or uninstall another Domain implicitly.

package/dist/scaffold/template/gitignore

@@ -0,0 +1,6 @@
+node_modules/
+.dist/
+.env
+.env.*
+!.env.example
+*.private.jwk

package/dist/scaffold/template/scripts/build.mjs

@@ -0,0 +1,10 @@
+import { build } from 'esbuild'
+
+await build({
+  entryPoints: ['src/index.js'],
+  outfile: '.dist/worker.mjs',
+  bundle: true,
+  platform: 'browser',
+  format: 'esm',
+  target: 'es2022',
+})

package/dist/scaffold/template/scripts/deploy.mjs

@@ -0,0 +1,50 @@
+import { spawn } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+
+const args = process.argv.slice(2)
+if (args[0] === '--') args.shift()
+if (!args.some((arg) => arg === '-i' || /^(--instance|--url)(=|$)/.test(arg))) {
+  throw new Error(
+    'Select a Services instance explicitly: npm run deploy -- --instance <instance> --as <identity>',
+  )
+}
+const configuration = JSON.parse(await readFile('service.json', 'utf8'))
+await import('./build.mjs')
+const content = (await readFile('.dist/worker.mjs')).toString('base64')
+const request = {
+  ...configuration,
+  entry: 'index.mjs',
+  modules: [{ name: 'index.mjs', kind: 'esm', contentBase64Chunks: content.match(/.{1,524288}/g) }],
+}
+const child = spawn(
+  'astrale',
+  ['call', '/:services.astrale.ai:class.CloudflareWorker:deploy', ...args, '--json'],
+  {
+    stdio: ['pipe', 'pipe', 'inherit'],
+  },
+)
+let output = ''
+child.stdout.on('data', (chunk) => {
+  output += chunk
+})
+child.on('error', () => {
+  console.error('Could not start the Astrale CLI. Install @astrale-os/cli first.')
+  process.exitCode = 1
+})
+child.on('close', (code) => {
+  process.stdout.write(output)
+  if (code !== 0) {
+    process.exitCode = 1
+    return
+  }
+  try {
+    const result = JSON.parse(output)
+    if (result.state !== 'ready') process.exitCode = 1
+  } catch {
+    process.exitCode = 1
+  }
+})
+child.stdin.on('error', () => {
+  process.exitCode = 1
+})
+child.stdin.end(JSON.stringify(request))

package/dist/scaffold/template/src/account.js

@@ -0,0 +1,26 @@
+import { issuer, jwk, register } from '@astrale-os/sdk/auth'
+import { connect } from '@astrale-os/sdk/client/session'
+import { importJWK, SignJWT } from 'jose'
+
+export function openAccount(kernel, privateJwk) {
+  if (privateJwk.kty !== 'EC' || privateJwk.crv !== 'P-256' || !privateJwk.d) {
+    throw new TypeError('Expected a registered ES256 private JWK')
+  }
+  const publicKey = jwk.acceptPublic({ kty: 'EC', crv: 'P-256', x: privateJwk.x, y: privateJwk.y })
+  return connect({
+    url: kernel,
+    auth: {
+      ttlSeconds: 60,
+      resolve: async () => ({
+        credential: await new SignJWT({})
+          .setProtectedHeader({ alg: 'ES256', kid: privateJwk.kid, typ: 'JWT' })
+          .setIssuer(await register.selfIssuer(issuer.accept(kernel), publicKey))
+          .setSubject('self')
+          .setAudience(kernel)
+          .setIssuedAt()
+          .setExpirationTime('3m')
+          .sign(await importJWK(privateJwk, 'ES256')),
+      }),
+    },
+  })
+}

package/dist/scaffold/template/src/index.js

@@ -0,0 +1,32 @@
+import { runJob } from './job.js'
+
+export default {
+  async fetch(request, env) {
+    const path = new URL(request.url).pathname
+    if (path === '/health' && request.method === 'GET') return Response.json({ status: 'ok' })
+    if (path !== '/__scheduled' || request.method !== 'POST')
+      return new Response(null, { status: 404 })
+    // Services invokes this through private dispatch and blocks the public path.
+    const scheduledAt = Number(request.headers.get('x-astrale-scheduled-time'))
+    if (!Number.isSafeInteger(scheduledAt) || scheduledAt <= 0)
+      return new Response(null, { status: 400 })
+    const started = Date.now()
+    try {
+      await runJob({ scheduledAt, env, signal: AbortSignal.timeout(9000) })
+      console.log(
+        JSON.stringify({ event: 'job.completed', scheduledAt, elapsedMs: Date.now() - started }),
+      )
+      return Response.json({ status: 'completed' })
+    } catch (error) {
+      // Do not log credentials, provider envelopes or business result values.
+      console.error(
+        JSON.stringify({
+          event: 'job.failed',
+          scheduledAt,
+          code: typeof error?.code === 'number' ? error.code : undefined,
+        }),
+      )
+      return Response.json({ status: 'failed' }, { status: 503 })
+    }
+  },
+}

package/dist/scaffold/template/src/job.js

@@ -0,0 +1,19 @@
+import { Path } from '@astrale-os/sdk/graph/path'
+
+import { openAccount } from './account.js'
+
+// Adapt this input to the target Domain's contract. Repeat safety belongs there.
+export async function runJob({ scheduledAt, env, signal }) {
+  if (!env.KERNEL || !env.TARGET || !env.ACCOUNT_PRIVATE_JWK) {
+    throw new Error('Configure KERNEL, TARGET and the ACCOUNT_PRIVATE_JWK secret')
+  }
+  const session = openAccount(env.KERNEL, JSON.parse(env.ACCOUNT_PRIVATE_JWK))
+  try {
+    return await session.call(
+      { target: Path.parse(env.TARGET), input: { scheduledAt } },
+      { signal },
+    )
+  } finally {
+    session.close()
+  }
+}

package/dist/schema/modules/service/classes/cloudflare-worker.d.ts

@@ -10,9 +10,9 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
         readonly properties: {
             providerName: z.ZodString;
             serviceKey: z.ZodString;
-            url: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+            url: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
                 readonly required: false;
-            }, never>;
+            }>;
             state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
                 readonly deploying: {
                     readonly recordProviderDeployment: "reconciling";
@@ -38,21 +38,21 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
                 required?: boolean;
                 description?: string;
             }>;
-            digest: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+            digest: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
                 readonly required: false;
-            }, never>;
-            deploymentReceipt: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+            }>;
+            deploymentReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
                 readonly required: false;
-            }, never>;
-            operationExpiresAt: import("@astrale-os/sdk/schema").Property<Readonly<{
+            }>;
+            operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
                 readonly type: 'string';
                 readonly 'x-astrale-value-kind': 'instant';
             }>, {
                 readonly required: false;
-            }, never>;
-            error: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+            }>;
+            error: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
                 readonly required: false;
-            }, never>;
+            }>;
         };
         readonly methods: {
             setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -61,10 +61,10 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
             }, {
                 readonly mode: 'value';
                 readonly value: {
-                    name: string;
-                } | {
                     kind: "rejected";
                     reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
+                } | {
+                    name: string;
                 };
             }, "authorized", false, true>>;
             deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -72,10 +72,10 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
             }, {
                 readonly mode: 'value';
                 readonly value: {
+                    ok: true;
+                } | {
                     kind: "rejected";
                     reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-                } | {
-                    ok: true;
                 };
             }, "authorized", false, true>>;
             secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
@@ -125,22 +125,28 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
             plain: "plain";
             revisioned: "revisioned";
         }>;
-        tenantDomainState: import("@astrale-os/sdk/schema").Property<z.ZodEnum<{
+        tenantDomainDetachedAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
+        tenantDomainState: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodEnum<{
             absent: "absent";
             attached: "attached";
             unresolved: "unresolved";
         }>, {
             readonly required: false;
-        }, never>;
-        tenantDomainId: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        }>;
+        tenantDomainId: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
-        tenantCertificatePackId: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        }>;
+        tenantCertificatePackId: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
-        tenantZoneId: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        }>;
+        tenantZoneId: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
+        }>;
     };
     readonly methods: {
         deploy: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -216,16 +222,40 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
                 message: string;
             };
         }, "authenticated", true, false>>;
+        migrateIngress: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            action: "complete" | "detach" | "restore";
+            probe: {
+                path: string;
+                status: number;
+                bodySha256: string;
+            };
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                kind: "detached";
+                detachedAt: string;
+            } | {
+                kind: "migrated";
+            } | {
+                kind: "restored";
+            } | {
+                kind: "pending";
+                retryAfterMs: number;
+            } | {
+                kind: "rejected";
+                reason: "missing-location" | "not-detached" | "service-unavailable";
+            };
+        }, "authorized", false, false>>;
         setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             name: string;
             value: string;
         }, {
             readonly mode: 'value';
             readonly value: {
-                name: string;
-            } | {
                 kind: "rejected";
                 reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
+            } | {
+                name: string;
             };
         }, "authorized", false, false>>;
         deleteSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -233,10 +263,10 @@ export declare const CloudflareWorker: import("@astrale-os/sdk/schema").Authored
         }, {
             readonly mode: 'value';
             readonly value: {
+                ok: true;
+            } | {
                 kind: "rejected";
                 reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-            } | {
-                ok: true;
             };
         }, "authorized", false, false>>;
         secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {

package/dist/schema/modules/service/classes/cloudflare-worker.js

@@ -1,4 +1,4 @@
-import { classIcon, nodeClass, property } from '@astrale-os/sdk/schema';
+import { classIcon, nodeClass, property, schema as valueSchema } from '@astrale-os/sdk/schema';
 import { CloudCog } from '@astrale-os/sdk/schema/icons';
 import { z } from 'zod';
 import { deleteWorkerSecret } from '../functions/delete-worker-secret.js';
@@ -7,6 +7,7 @@ import { deployCloudflareWorker } from '../functions/deploy-cloudflare-worker.js
 import { listWorkerLogs } from '../functions/list-worker-logs.js';
 import { listWorkerSchedules } from '../functions/list-worker-schedules.js';
 import { listWorkerSecretNames } from '../functions/list-worker-secret-names.js';
+import { migrateWorkerIngress } from '../functions/migrate-worker-ingress.js';
 import { replaceWorkerSchedules } from '../functions/replace-worker-schedules.js';
 import { setWorkerSecret } from '../functions/set-worker-secret.js';
 import { OwnService } from '../policies/own-service.js';
@@ -17,6 +18,7 @@ export const CloudflareWorker = nodeClass({
     extends: [Service],
     properties: {
         deploymentMode: z.enum(['plain', 'revisioned']),
+        tenantDomainDetachedAt: property(valueSchema.values.instant, { required: false }),
         tenantDomainState: property(z.enum(['unresolved', 'absent', 'attached']), {
             required: false,
         }),
@@ -26,6 +28,7 @@ export const CloudflareWorker = nodeClass({
     },
     methods: {
         deploy: deployCloudflareWorker,
+        migrateIngress: migrateWorkerIngress,
         setSecret: setWorkerSecret,
         deleteSecret: deleteWorkerSecret,
         secrets: listWorkerSecretNames,

package/dist/schema/modules/service/classes/service.d.ts

@@ -8,9 +8,9 @@ export declare const Service: import("@astrale-os/sdk/schema").AuthoredNodeClass
     readonly properties: {
         providerName: z.ZodString;
         serviceKey: z.ZodString;
-        url: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        url: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
+        }>;
         state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
             readonly deploying: {
                 readonly recordProviderDeployment: "reconciling";
@@ -36,21 +36,21 @@ export declare const Service: import("@astrale-os/sdk/schema").AuthoredNodeClass
             required?: boolean;
             description?: string;
         }>;
-        digest: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        digest: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
-        deploymentReceipt: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        }>;
+        deploymentReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
-        operationExpiresAt: import("@astrale-os/sdk/schema").Property<Readonly<{
+        }>;
+        operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
             readonly type: 'string';
             readonly 'x-astrale-value-kind': 'instant';
         }>, {
             readonly required: false;
-        }, never>;
-        error: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+        }>;
+        error: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
-        }, never>;
+        }>;
     };
     readonly methods: {
         setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{

package/dist/schema/modules/service/functions/index.d.ts

@@ -1,3 +1,4 @@
+export { migrateWorkerIngress } from './migrate-worker-ingress.js';
 export { deleteServiceSecret } from './delete-service-secret.js';
 export { deleteService } from './delete-service.js';
 export { deployCloudflareWorker } from './deploy-cloudflare-worker.js';

package/dist/schema/modules/service/functions/index.js

@@ -1,3 +1,4 @@
+export { migrateWorkerIngress } from './migrate-worker-ingress.js';
 export { deleteServiceSecret } from './delete-service-secret.js';
 export { deleteService } from './delete-service.js';
 export { deployCloudflareWorker } from './deploy-cloudflare-worker.js';

package/dist/schema/modules/service/functions/migrate-worker-ingress.d.ts

@@ -0,0 +1,24 @@
+export declare const migrateWorkerIngress: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    action: "complete" | "detach" | "restore";
+    probe: {
+        path: string;
+        status: number;
+        bodySha256: string;
+    };
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        kind: "detached";
+        detachedAt: string;
+    } | {
+        kind: "migrated";
+    } | {
+        kind: "restored";
+    } | {
+        kind: "pending";
+        retryAfterMs: number;
+    } | {
+        kind: "rejected";
+        reason: "missing-location" | "not-detached" | "service-unavailable";
+    };
+}, "authorized", false, false>>;

package/dist/schema/modules/service/functions/migrate-worker-ingress.js

@@ -0,0 +1,26 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { OwnService } from '../policies/own-service.js';
+export const migrateWorkerIngress = method({
+    description: 'Migrate legacy ingress to the shared wildcard, retaining cleanup evidence until verified; optionally restore the domain before finalization.',
+    auth: 'authorized',
+    input: z.strictObject({
+        action: z.enum(['detach', 'complete', 'restore']),
+        probe: z.strictObject({
+            path: z.string().min(1).max(1024),
+            status: z.number().int().min(200).max(299),
+            bodySha256: z.string().min(64).max(64),
+        }),
+    }),
+    output: z.discriminatedUnion('kind', [
+        z.strictObject({ kind: z.literal('detached'), detachedAt: z.string().min(20).max(30) }),
+        z.strictObject({ kind: z.literal('migrated') }),
+        z.strictObject({ kind: z.literal('restored') }),
+        z.strictObject({ kind: z.literal('pending'), retryAfterMs: z.number().int().positive() }),
+        z.strictObject({
+            kind: z.literal('rejected'),
+            reason: z.enum(['service-unavailable', 'missing-location', 'not-detached']),
+        }),
+    ]),
+    policy: ({ check, self }) => check(OwnService, self),
+});

package/dist/schema/modules/service/functions/set-worker-secret.d.ts

@@ -4,9 +4,9 @@ export declare const setWorkerSecret: import("@astrale-os/sdk/schema").Method<im
 }, {
     readonly mode: 'value';
     readonly value: {
+        name: string;
+    } | {
         kind: "rejected";
         reason: "binding-unavailable" | "invalid-secret-name" | "service-unavailable";
-    } | {
-        name: string;
     };
 }, "authorized", false, false>>;

package/dist/schema/schema.d.ts

@@ -10,9 +10,9 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
             readonly properties: {
                 providerName: import("zod").ZodString;
                 serviceKey: import("zod").ZodString;
-                url: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                url: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
+                }>;
                 state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
                     readonly deploying: {
                         readonly recordProviderDeployment: "reconciling";
@@ -38,21 +38,21 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
                     required?: boolean;
                     description?: string;
                 }>;
-                digest: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                digest: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
-                deploymentReceipt: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                }>;
+                deploymentReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
-                operationExpiresAt: import("@astrale-os/sdk/schema").Property<Readonly<{
+                }>;
+                operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
                     readonly type: 'string';
                     readonly 'x-astrale-value-kind': 'instant';
                 }>, {
                     readonly required: false;
-                }, never>;
-                error: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                }>;
+                error: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
+                }>;
             };
             readonly methods: {
                 setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -131,9 +131,9 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
                 readonly properties: {
                     providerName: import("zod").ZodString;
                     serviceKey: import("zod").ZodString;
-                    url: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                    url: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                         readonly required: false;
-                    }, never>;
+                    }>;
                     state: import("@astrale-os/sdk/schema").StateProperty<import("@astrale-os/sdk/schema").StateMachine<{
                         readonly deploying: {
                             readonly recordProviderDeployment: "reconciling";
@@ -159,21 +159,21 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
                         required?: boolean;
                         description?: string;
                     }>;
-                    digest: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                    digest: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                         readonly required: false;
-                    }, never>;
-                    deploymentReceipt: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                    }>;
+                    deploymentReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                         readonly required: false;
-                    }, never>;
-                    operationExpiresAt: import("@astrale-os/sdk/schema").Property<Readonly<{
+                    }>;
+                    operationExpiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
                         readonly type: 'string';
                         readonly 'x-astrale-value-kind': 'instant';
                     }>, {
                         readonly required: false;
-                    }, never>;
-                    error: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                    }>;
+                    error: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                         readonly required: false;
-                    }, never>;
+                    }>;
                 };
                 readonly methods: {
                     setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -246,22 +246,28 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
                     plain: "plain";
                     revisioned: "revisioned";
                 }>;
-                tenantDomainState: import("@astrale-os/sdk/schema").Property<import("zod").ZodEnum<{
+                tenantDomainDetachedAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                    readonly type: 'string';
+                    readonly 'x-astrale-value-kind': 'instant';
+                }>, {
+                    readonly required: false;
+                }>;
+                tenantDomainState: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodEnum<{
                     absent: "absent";
                     attached: "attached";
                     unresolved: "unresolved";
                 }>, {
                     readonly required: false;
-                }, never>;
-                tenantDomainId: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                }>;
+                tenantDomainId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
-                tenantCertificatePackId: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                }>;
+                tenantCertificatePackId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
-                tenantZoneId: import("@astrale-os/sdk/schema").Property<import("zod").ZodString, {
+                }>;
+                tenantZoneId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                     readonly required: false;
-                }, never>;
+                }>;
             };
             readonly methods: {
                 deploy: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
@@ -337,6 +343,30 @@ export declare const schema: import("@astrale-os/sdk/schema").AuthoredSchema<"se
                         message: string;
                     };
                 }, "authenticated", true, false>>;
+                migrateIngress: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    action: "complete" | "detach" | "restore";
+                    probe: {
+                        path: string;
+                        status: number;
+                        bodySha256: string;
+                    };
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        kind: "detached";
+                        detachedAt: string;
+                    } | {
+                        kind: "migrated";
+                    } | {
+                        kind: "restored";
+                    } | {
+                        kind: "pending";
+                        retryAfterMs: number;
+                    } | {
+                        kind: "rejected";
+                        reason: "missing-location" | "not-detached" | "service-unavailable";
+                    };
+                }, "authorized", false, false>>;
                 setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     name: string;
                     value: string;

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@astrale-domains/services",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/astrale-os/domains.git",
     "directory": "services"
   },
+  "bin": {
+    "create-astrale-service": "./dist/scaffold/create-service.mjs"
+  },
   "files": [
     "dist"
   ],
@@ -28,11 +31,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.131",
+    "@astrale-os/sdk": "0.5.0-beta.144",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@astrale-os/adapter-cloudflare": "0.5.0-beta.134",
+    "@astrale-os/adapter-cloudflare": "0.5.0-beta.147",
     "@astrale-os/ox": ">=0.1.4 <1.0.0",
     "@astrale-os/shell": "0.5.0-beta.18",
     "@astrale-os/shell-react": "0.4.0-beta.17",
@@ -75,7 +78,7 @@
     "build": "astrale-domain build",
     "lint": "astrale-domain lint",
     "lint:fix": "astrale-domain lint --fix",
-    "package": "astrale-domain package",
+    "package": "astrale-domain package && node tooling/package-scaffolder.mjs",
     "provider:bootstrap": "bun providers/cloudflare/operator/provision/bootstrap.ts",
     "provider:doctor": "bun providers/cloudflare/operator/maintenance/doctor.ts",
     "provider:orphan-audit": "bun providers/cloudflare/operator/maintenance/orphan-audit.ts",