@astrale-os/sdk 0.5.0-beta.142 → 0.5.0-beta.143

package/README.md

@@ -224,3 +224,26 @@ coherent Publication, bundle, and View catalog observation.
 ## License
 
 Apache License 2.0 — see [LICENSE](LICENSE) for details.
+
+## View host requirements
+
+A frontend route can declare the exact external origins its View needs to open:
+
+```ts
+routes: {
+  application: {
+    path: '/',
+    host: {
+      navigation: {
+        external: { origins: ['https://provider.example'] },
+      },
+    },
+  },
+}
+```
+
+These requirements are publication metadata, so changing them updates the publication ETag without
+changing the Application's business Schema. They require the `shell` handshake. Origins must use
+HTTPS without credentials, paths, queries, fragments, or wildcards; authoring normalizes and sorts
+them. Supporting hosts admit them per mount and execute the existing `browser.openExternal`
+intent. Nested Views cannot expand their parent's grant.

package/dist/application/index.d.ts

@@ -5,5 +5,5 @@ export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation,
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
-export type { Frontend, FrontendInput, FrontendSource, IframeRequirements } from './view/index.js';
+export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
 export type { Application, ApplicationIdentity, RuntimeOfApplication, SchemaOfApplication, SchemaOfRuntime, } from './application.js';

package/dist/application/view/index.d.ts

@@ -1,6 +1,6 @@
 export { isFrontend } from './admission.js';
 export { defineFrontend } from './define.js';
 export type { Frontend, FrontendInput, FrontendRouteInputs, FrontendRoutes, ViewName, } from './frontend.js';
-export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, IframeRequirements, } from './route.js';
+export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, IframeRequirements, ViewHostRequirements, } from './route.js';
 export { external, isFrontendSource, vite } from './source.js';
 export type { ExternalSource, FrontendSource, ViteSource } from './source.js';

package/dist/application/view/route.d.ts

@@ -1,3 +1,5 @@
+import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
+export type { ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type FrontendHandshake = 'shell' | 'none';
 export interface IframeRequirements {
     readonly sandbox?: readonly string[];
@@ -8,12 +10,14 @@ export type FrontendRouteInput = string | {
     readonly document?: string;
     readonly handshake?: FrontendHandshake;
     readonly iframe?: IframeRequirements;
+    readonly host?: ViewHostRequirements;
 };
 export interface FrontendRoute {
     readonly path: string;
     readonly document: string;
     readonly handshake: FrontendHandshake;
     readonly iframe?: IframeRequirements;
+    readonly host?: ViewHostRequirements;
 }
 export declare function normalizeRoute(input: FrontendRouteInput | undefined, fallback: string): FrontendRoute;
 export declare function defaultRoute(name: string): string;

package/dist/application/view/route.js

@@ -1,3 +1,4 @@
+import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 const TOKEN = /^[a-z][a-z0-9-]*$/u;
 const BASELINES = Object.freeze({
     none: iframeRequirements(['allow-scripts'], []),
@@ -8,7 +9,8 @@ export function normalizeRoute(input, fallback) {
         return Object.freeze({ path: routePath(input), document: 'index.html', handshake: 'shell' });
     }
     const value = plainRecord(input ?? {});
-    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' || !['path', 'document', 'handshake', 'iframe'].includes(key))) {
+    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' ||
+        !['path', 'document', 'handshake', 'iframe', 'host'].includes(key))) {
         invalid();
     }
     const authoredHandshake = dataValue(value, 'handshake');
@@ -19,11 +21,13 @@ export function normalizeRoute(input, fallback) {
     }
     const handshake = authoredHandshake ?? 'shell';
     const iframe = normalizeIframeRequirements(dataValue(value, 'iframe'), handshake);
+    const host = acceptViewHostRequirements(dataValue(value, 'host'), handshake, true);
     return Object.freeze({
         path: routePath(dataValue(value, 'path') ?? fallback),
         document: filePath(dataValue(value, 'document') ?? 'index.html'),
         handshake,
         ...(iframe === undefined ? {} : { iframe }),
+        ...(host === undefined ? {} : { host }),
     });
 }
 function normalizeIframeRequirements(input, handshake) {

package/dist/deployment/build/frontend/compilation.d.ts

@@ -1,5 +1,5 @@
 import type { Frontend, FrontendSource } from '../../../application/view/index.js';
-import type { FrontendHandshake, IframeRequirements } from '../../../application/view/index.js';
+import type { FrontendHandshake, IframeRequirements, ViewHostRequirements } from '../../../application/view/index.js';
 import type { Key, ViewRef } from '../../../platform/schema/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 export interface CompiledFrontendRoute {
@@ -8,6 +8,7 @@ export interface CompiledFrontendRoute {
     readonly document: string;
     readonly handshake: FrontendHandshake;
     readonly iframe?: IframeRequirements;
+    readonly host?: ViewHostRequirements;
 }
 export interface FrontendCompilation {
     readonly source: FrontendSource;

package/dist/deployment/build/frontend/compilation.js

@@ -16,6 +16,7 @@ export function compileFrontend(frontend, domain) {
             document: route.document,
             handshake: route.handshake,
             ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
+            ...(route.host === undefined ? {} : { host: route.host }),
         });
     });
     const entrypoint = domain.views[frontend.entrypoint];

package/dist/deployment/release/publication/views.js

@@ -9,5 +9,6 @@ export function views(build, addressing) {
         href: new URL(route.path.replace(/^\//u, ''), base).href,
         handshake: route.handshake,
         ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
+        ...(route.host === undefined ? {} : { host: route.host }),
     })));
 }

package/dist/deployment/verify/readiness/identity.js

@@ -21,7 +21,7 @@ async function json(fetcher, url, signal) {
         throw new Error(`GET ${url} exceeded ${MAXIMUM_IDENTITY_BYTES} bytes.`);
     }
     try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes));
     }
     catch (cause) {
         throw new Error(`GET ${url} returned invalid JSON.`, { cause });

package/dist/deployment/verify/readiness/publication.js

@@ -33,7 +33,7 @@ async function bounded(response, url, maximum) {
 async function text(response, url, maximum) {
     const bytes = await bounded(response, url, maximum);
     try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
     }
     catch (cause) {
         throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });

package/dist/execution/identity/jwks.js

@@ -244,7 +244,7 @@ async function json(response, signal) {
         throw new CredentialRejected('Issuer discovery document exceeds its byte limit.');
     }
     try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes));
     }
     catch (cause) {
         throw new CredentialRejected('Issuer discovery document is invalid.', cause);

package/dist/execution/service/create.js

@@ -35,7 +35,7 @@ export function createService(input) {
             path: invocationPath(),
             invocation: {
                 source: selectedIdentity.issuer,
-                next: () => globalThis.crypto.randomUUID(),
+                next: () => crypto.randomUUID(),
             },
             issuer: selectedIdentity,
             ...(selectedIdentity.tokenExchange === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.142",
+  "version": "0.5.0-beta.143",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -237,11 +237,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.61",
-    "@astrale-os/kernel-core": "0.9.0-beta.46",
+    "@astrale-os/kernel-client": "0.6.0-beta.62",
+    "@astrale-os/kernel-core": "0.9.0-beta.47",
     "@astrale-os/kernel-dsl": "0.2.0-beta.33",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.52",
-    "@astrale-os/kernel-server": "0.5.0-beta.54",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.53",
+    "@astrale-os/kernel-server": "0.5.0-beta.55",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -253,6 +253,7 @@
     "@astrale-os/ox": "0.1.3",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.5",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.3",
+    "@cloudflare/workers-types": "^5.20260820.1",
     "@commitlint/cli": "~21.2.2",
     "@commitlint/config-conventional": "~21.2.2",
     "@hono/node-server": "^2.1.1",
@@ -310,7 +311,8 @@
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsgo && node scripts/verify-no-source-maps.mjs dist && pnpm run verify:package",
     "e2e": "node __e2e__/flagship/runner.mjs",
-    "typecheck": "tsgo --noEmit && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
+    "typecheck": "tsgo --noEmit && pnpm run typecheck:workers && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
+    "typecheck:workers": "tsgo --noEmit -p tsconfig.workers.json",
     "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "typecheck:tests": "tsgo --noEmit -p tsconfig.test.json",