@astrale-os/sdk 0.6.0-beta.17 → 0.6.0-beta.18

package/dist/execution/identity/jwks.js

@@ -8,6 +8,17 @@ const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
 const MAXIMUM_VERIFICATION_BASES = 64;
 const VERIFICATION_BASIS_TTL_MS = 60_000;
 const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+const DISCOVERY_RETRY_DELAY_MS = 250;
+// Only typed transport failures are replayable. Browser TypeError, TLS, HTTP and document
+// admission failures carry no evidence that repeating the request can safely recover.
+const TRANSIENT_TRANSPORT_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNRESET',
+    'ETIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
 /**
  * Retain only recently admitted public issuer material for one execution Identity.
  * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
@@ -220,21 +231,55 @@ async function discover(issuer, fetch, signal, policy) {
     });
 }
 async function request(fetch, url, signal) {
-    try {
-        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+    for (let attempt = 0;; attempt += 1) {
+        signal.throwIfAborted();
+        try {
+            const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+            }
+            return response;
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw signal.reason;
+            if (cause instanceof IssuerUnavailable)
+                throw cause;
+            // One retry belongs to the shared issuer load, never to each observer or business call.
+            if (attempt !== 0 || !transientTransport(cause)) {
+                throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+            }
+            await retryDelay(signal);
         }
-        return response;
     }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        if (cause instanceof IssuerUnavailable)
-            throw cause;
-        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+}
+function transientTransport(cause) {
+    // Node fetch wraps its transport Error; Bun may expose the code directly. Bound traversal
+    // of an external cause chain, including cycles, and do not look past a classified refusal.
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (cause === null || typeof cause !== 'object')
+            return false;
+        const code = Reflect.get(cause, 'code');
+        if (typeof code === 'string')
+            return TRANSIENT_TRANSPORT_CODES.has(code);
+        cause = Reflect.get(cause, 'cause');
     }
+    return false;
+}
+function retryDelay(signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const cancel = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', cancel);
+            resolve();
+        }, DISCOVERY_RETRY_DELAY_MS);
+        signal.addEventListener('abort', cancel, { once: true });
+    });
 }
 async function json(response, signal) {
     const bytes = new Uint8Array(await response.arrayBuffer());

package/dist/platform/schema/property.d.ts

@@ -3,6 +3,11 @@ import { type Property as CanonicalProperty, type ValueSchemaInput } from '@astr
 export interface PropertyOptions {
     readonly required?: boolean;
     readonly description?: string;
+    /**
+     * `create` freezes the value when its node or edge is created. `once` admits one write while the
+     * value is absent; neither can be changed or unset afterwards, only removed with the element.
+     */
+    readonly immutable?: 'create' | 'once';
 }
 /** Keep canonical generic inference: ordinary properties carry no state machine. */
 export type AuthoredProperty<Schema extends ValueSchemaInput, Options extends PropertyOptions = Record<never, never>> = CanonicalProperty<Schema, Options, never>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.17",
+  "version": "0.6.0-beta.18",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -253,11 +253,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.84",
-    "@astrale-os/kernel-core": "0.9.0-beta.63",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.69",
-    "@astrale-os/kernel-server": "0.5.0-beta.71",
+    "@astrale-os/kernel-client": "0.6.0-beta.85",
+    "@astrale-os/kernel-core": "0.9.0-beta.64",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.46",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.70",
+    "@astrale-os/kernel-server": "0.5.0-beta.72",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",