@astrale-os/sdk 0.5.0-beta.143 → 0.5.0-beta.144

package/README.md

@@ -46,6 +46,31 @@ Stop development watchers first, then run the project's checks and validate on d
 Nothing is committed or deployed. A Shell update also requires checking the installed Shell revision.
 Rerunning an upgrade synchronizes installation even when the manifest versions are already current.
 
+## Move a runtime without changing its Domain identity
+
+A Domain issuer is retained across installation upgrades. To deploy a new Cloudflare runtime for
+selected instances, keep the existing signing identity and issuer while selecting a new public origin:
+
+```ts
+cloudflare({
+  route: 'services-v2.example.com',
+  workerName: 'services-v2',
+  identityIssuer: 'https://services.example.com',
+  signingIdentity: '.astrale/identity.json',
+})
+```
+
+The new Publication places its Bundle, Delivery, callables, Views and routes at the new origin.
+Install that public URL on each intended instance. The Kernel verifies its Delivery against the
+retained issuer's keys and preserves the Domain installation identity and owned data. Keep the
+original issuer discovery endpoints and keys available; unadopted instances continue to use their
+previous bindings. Deployment readiness checks the exact new Worker version separately from issuer
+discovery. No uninstall or identity rotation is involved.
+
+At the provider-neutral release boundary, use
+`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })`.
+The one-argument form continues to use the issuer as the public URL.
+
 ## Handler authority and dependencies
 
 Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.

package/dist/deployment/release/addressing.d.ts

@@ -1,7 +1,11 @@
 import type { IssuerId } from '../../platform/auth/index.js';
-/** Intended serving identity, independent of how a provider obtains it. */
+/** Stable Domain identity and public placement, independent of how a provider obtains them. */
 export interface Addressing {
     readonly issuer: IssuerId;
+    /** Public origin serving this Release; the issuer can remain on an older deployment. */
+    readonly publicUrl: IssuerId;
 }
-export declare function addressing(input: string): Addressing;
+export declare function addressing(input: string, options?: {
+    readonly publicUrl?: string;
+}): Addressing;
 export declare function isAddressing(input: unknown): input is Addressing;

package/dist/deployment/release/addressing.js

@@ -1,6 +1,13 @@
 import { issuer } from '../../platform/auth/index.js';
 const admittedAddressing = new WeakSet();
-export function addressing(input) {
+export function addressing(input, options = {}) {
+    const admitted = origin(input);
+    const publicUrl = options.publicUrl === undefined ? admitted : origin(options.publicUrl);
+    const value = Object.freeze({ issuer: admitted, publicUrl });
+    admittedAddressing.add(value);
+    return value;
+}
+function origin(input) {
     let admitted;
     let url;
     try {
@@ -18,9 +25,7 @@ export function addressing(input) {
         url.hash !== '') {
         throw new TypeError('Addressing issuer must be an origin-only absolute HTTP(S) issuer.');
     }
-    const value = Object.freeze({ issuer: admitted });
-    admittedAddressing.add(value);
-    return value;
+    return admitted;
 }
 export function isAddressing(input) {
     return input !== null && typeof input === 'object' && admittedAddressing.has(input);

package/dist/deployment/release/publication/callables.js

@@ -2,7 +2,7 @@ import * as publication from '@astrale-os/kernel-protocol/publication';
 import { invocationPath } from '../invocation.js';
 export function callables(build, addressing) {
     const endpoint = publication.acceptInvocationEndpoints({
-        http: new URL(invocationPath(), addressing.issuer).href,
+        http: new URL(invocationPath(), addressing.publicUrl).href,
     });
     return Object.freeze(build.callables.map((callable) => Object.freeze({ callable, endpoint })));
 }

package/dist/deployment/release/publication/routes.js

@@ -1,4 +1,4 @@
 import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
 export function routes(build, addressing) {
-    return protocolRoutes.place(build.routes, addressing.issuer);
+    return protocolRoutes.place(build.routes, addressing.publicUrl);
 }

package/dist/deployment/release/publication/seal.js

@@ -18,7 +18,7 @@ export function seal(build, addressing) {
         schema: {
             revision: root.revision,
             bundle: {
-                href: publication.bundleUrl(addressing.issuer, build.schema.bundle.ref),
+                href: publication.bundleUrl(addressing.publicUrl, build.schema.bundle.ref),
                 ref: build.schema.bundle.ref,
             },
         },
@@ -28,12 +28,12 @@ export function seal(build, addressing) {
             callables: callables(build, addressing),
             views: views(build, addressing),
         },
-        delivery: publication.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.issuer, publication.bundleUrl(addressing.issuer, build.schema.bundle.ref)),
+        delivery: publication.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.publicUrl, publication.bundleUrl(addressing.publicUrl, build.schema.bundle.ref)),
         routes: routes(build, addressing),
     });
     const { domain } = evidenceOf(build);
     return Object.freeze({
         publication: sealed,
-        routes: protocolRoutes.bind(build.routes, sealed, domain),
+        routes: protocolRoutes.bind(build.routes, sealed, domain, addressing.publicUrl),
     });
 }

package/dist/deployment/release/publication/views.js

@@ -3,7 +3,7 @@ export function views(build, addressing) {
         return Object.freeze([]);
     const base = build.frontend.source.kind === 'external'
         ? `${build.frontend.source.origin}/`
-        : `${addressing.issuer.replace(/\/+$/u, '')}/`;
+        : `${addressing.publicUrl.replace(/\/+$/u, '')}/`;
     return Object.freeze(build.frontend.routes.map((route) => Object.freeze({
         view: route.view,
         href: new URL(route.path.replace(/^\//u, ''), base).href,

package/dist/deployment/verify/preflight/artifact.js

@@ -89,7 +89,7 @@ function evidenceBytes(build, source) {
             bundle: build.schema.bundle.ref.digest,
             entrypoint: source.entrypoint,
             addressing: source.addressing.kind === 'configured'
-                ? { kind: 'configured', issuer: source.addressing.addressing.issuer }
+                ? { kind: 'configured', ...source.addressing.addressing }
                 : source.addressing,
         })),
     ];

package/dist/deployment/verify/readiness/deployment.js

@@ -50,7 +50,8 @@ function verifyRelease(artifact, release) {
         throw new TypeError('DeployResult Release differs from the PreparedArtifact Build.');
     }
     if (artifact.addressing.kind === 'configured' &&
-        release.addressing.issuer !== artifact.addressing.addressing.issuer) {
+        (release.addressing.issuer !== artifact.addressing.addressing.issuer ||
+            release.addressing.publicUrl !== artifact.addressing.addressing.publicUrl)) {
         throw new TypeError('DeployResult Release differs from configured Addressing.');
     }
     return release;

package/dist/deployment/verify/readiness/publication.js

@@ -4,7 +4,7 @@ const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
 /** Fetch and verify the exact live Publication and Bundle for one Release. */
 export async function verifyPublication(release, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const publicationUrl = publication.url(release.addressing.issuer);
+    const publicationUrl = publication.url(release.addressing.publicUrl);
     const response = await fetchRequired(fetcher, publicationUrl, options.signal);
     const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_PUBLICATION_BYTES)));
     if (!publication.matchesReference(deployed, publication.reference(release.publication))) {

package/dist/execution/service/create.js

@@ -33,6 +33,7 @@ export function createService(input) {
         const prepared = prepareServer({
             ...serverOptions(input.server),
             path: invocationPath(),
+            publicOrigin: release.addressing.publicUrl,
             invocation: {
                 source: selectedIdentity.issuer,
                 next: () => crypto.randomUUID(),
@@ -92,6 +93,7 @@ function serverOptions(input) {
         'path',
         'invocation',
         'issuer',
+        'publicOrigin',
         'tokenExchange',
         'publication',
         'delivery',

package/dist/execution/service/service.d.ts

@@ -5,7 +5,7 @@ import type { WorkflowRunner } from '../../application/workflow/runner/index.js'
 import type { Release } from '../../deployment/release/index.js';
 import type { Identity } from '../identity/index.js';
 import type { ReleaseLoader } from './release.js';
-export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'tokenExchange' | 'publication' | 'delivery'>;
+export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'publication' | 'delivery'>;
 export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtime> {
     readonly runtime: RuntimeValue;
     readonly environment: Environment;

package/dist/tooling/cli/development/report.js

@@ -6,7 +6,7 @@ export function reportDevelopmentDeployment(deployed, installation, adapter, inp
     if (deployed.progress.provider.evidence.preflight !== undefined) {
         info(`Preflight: ${deployed.progress.provider.evidence.preflight}; public readiness verified`);
     }
-    info(`Public: ${deployed.release.addressing.issuer}`);
+    info(`Public: ${deployed.release.addressing.publicUrl}`);
     info(`Publication: ${deployed.release.publication.schema.revision} · ${deployed.release.publication.etag}`);
     info(installation === undefined
         ? `Installation: skipped${input.deployOnly ? ' (--deploy-only)' : ''}`

package/dist/tooling/cli/evidence.js

@@ -17,6 +17,7 @@ export async function writeDeploymentEvidence(input) {
             id: provider.deployment,
             artifact: provider.artifact,
             issuer: input.deployment.release.addressing.issuer,
+            publicUrl: input.deployment.release.addressing.publicUrl,
             origin: input.deployment.release.publication.origin,
             revision: input.deployment.release.publication.schema.revision,
             etag: input.deployment.release.publication.etag,

package/dist/tooling/cli/installation/reconcile.js

@@ -35,7 +35,7 @@ export async function reconcileInstallation(input, dependencies = {
                 '--no-prompt',
                 'domain',
                 'install',
-                issuer,
+                input.release.addressing.publicUrl,
                 '--direct',
                 '--allow-identity-override',
                 '-i',

package/dist/tooling/cli/orchestrate.js

@@ -113,7 +113,7 @@ export async function run(argv) {
         if (result.progress.provider.evidence.preflight !== undefined) {
             info(`Preflight: ${result.progress.provider.evidence.preflight}; public readiness verified`);
         }
-        info(`Public: ${result.release.addressing.issuer}`);
+        info(`Public: ${result.release.addressing.publicUrl}`);
         info(`Publication: ${result.release.publication.schema.revision} · ${result.release.publication.etag}`);
         const installed = await reconcileEnvironmentRelease({
             projectDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.143",
+  "version": "0.5.0-beta.144",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -237,11 +237,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.62",
-    "@astrale-os/kernel-core": "0.9.0-beta.47",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.33",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.53",
-    "@astrale-os/kernel-server": "0.5.0-beta.55",
+    "@astrale-os/kernel-client": "0.6.0-beta.64",
+    "@astrale-os/kernel-core": "0.9.0-beta.49",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.34",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.55",
+    "@astrale-os/kernel-server": "0.5.0-beta.57",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",