v0.2.0

Added

• Rust SDK behavioral parity with JavaScript-native APIs. Added semantic lifecycle hooks through @hook, the hooks module, and HookEvent; astrid:http@1.1.0 request controls and metadata; astrid:process@1.1.0 read-only child file injection; and schema-versioned KV reads/migrations. The canonical surface is idiomatic JavaScript: http.fetch() returns a genuine WHATWG Response, the Rust-style fluent form is explicitly named RequestBuilder, process.spawn() returns a ChildProcess while spawnSync() captures output, KV results narrow on a camelCase kind, and hook events expose payload/canReply.

• SDK parity regression tests. Host-mocked Node tests verify exact WIT record encoding, response metadata, process injection placement, versioned KV migration, and fail-open scoped hook replies.

• capabilities.enumerate — list the calling capsule's own held capability names. Mirrors the Rust SDK's capabilities::enumerate. The list dual of capabilities.check: returns the capability categories declared in this capsule's [capabilities] manifest block (host_process, net_connect, fs_read, …) — the names, not the scoped arguments within them (allowlists, host:port, paths). Argument-free (the kernel already knows the caller) and infallible — an empty array is the valid "no capabilities" answer — so a reusable capsule can ground its behaviour in what it can actually do instead of hard-coding it, avoiding code-vs-manifest drift. Backed by astrid-runtime/wit#13's astrid:sys/host.enumerate-capabilities; contracts submodule bumped accordingly (the astrid:contracts events bundle is unchanged).

• process persistent-process tier — spawnPersistent, PersistentProcess, and process.{attach, listProcesses, statusMany}. Mirrors the Rust SDK and the host astrid:process@1.1.0 persistent tier: a background child that outlives the pooled, stateless instance that started it (unlike BackgroundProcessHandle, whose kernel resource is reaped on instance reset). spawnPersistent(cmd, args, options) takes the persistent knobs (label, keepStdinOpen, overflow, logRingBytes, maxLifetimeMs, idleTimeoutMs, exitRetentionMs, limits) and returns a PersistentProcess keyed by an opaque id. PersistentProcess exposes status / readLogs (drain) / readSince (non-draining cursor → byte-faithful LogChunkResult; start with logCursorStart()) / writeStdin / closeStdin / signal / wait (bounded) / stop (SIGTERM→grace→SIGKILL, frees the slot) / release. Persist proc.id (e.g. in KV) and process.attach(id) from a later invocation to reattach — attach is a thin id-wrapper, so it works without the host's deferred attach resource fn; the first id-keyed call validates ownership. process.listProcesses / statusMany enumerate the capsule+principal's persistent processes. New types: PersistentProcessInfo, SpawnPersistentOptions, LogChunkResult, ResourceLimits, ProcessPhase, LogStream, LogCursor, OverflowPolicy; ProcessSignal gains "stop" / "cont". The host's watch / unwatch lifecycle-event channel and resource-limit enforcement are not yet wired (poll via status + bounded wait). The persistent surface originated in astrid-runtime/wit#12 and now lives in the additive @1.1.0 package alongside file injection.

Changed

• npm scope migration. The packages now publish as @astrid-runtime/sdk and @astrid-runtime/build. The former @unicity-astrid/* packages remain at 0.1.0 only and will be deprecated on npm after the new packages are published.
• JavaScript standard-library makeover. HTTP ABI conversion is no longer exposed on request objects; WHATWG request input, body consumption, abort, cloning, headers, and URL behavior are preserved. env.get() now distinguishes a missing key with undefined; fs gained Node-compatible recursive options, aliases, file-handle method names, overloads, and real Dirent predicates; time.sleep() supplies the promise-shaped timer path. Resource constructors are private and public declarations define language-native types instead of importing generated astrid:* host-binding modules. Deprecated aliases retain straightforward source migration where their semantics are not misleading.
• Intentional API breaks before stabilization. process.spawn() now has Node background semantics (use spawnSync() for the previous captured behavior), process signals use Node names such as SIGTERM, fs.open() uses familiar r/r+/w/a flags, UplinkId is an opaque string rather than a Rust-style wrapper object, and versioned KV discriminants changed from status: "needs-migration" | "not-found" to kind: "needsMigration" | "notFound". The misleading HTTP Request/Response builder aliases were removed in favor of RequestBuilder/BufferedResponse; installGlobalFetch() replaces the old polyfill-named installer.
• The build world now imports astrid:http/host@1.1.0 and astrid:process/host@1.1.0, and stages each WIT package version in a separate dependency directory so frozen 1.0 and 1.1 contracts can coexist.
• Canonical IPC contract types were regenerated from the same WIT revision used by current Rust SDK main, including the additive session-management records.

Security

• Upgraded the build toolchain to patched componentize-js and esbuild lines, pinned the compatible audit-clean JCO release, and added a required dependency-audit CI job. This removes the vulnerable weval → decompress archive-extraction chain and the affected esbuild development-server version from both the workspace and downstream @astrid-runtime/build installations.

---

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw