Découverte de services

A phone app cannot change its backend address without a new build and a store review. @krizaka/discovery removes that: the app loads a signed manifest from https://www.krizaka.com/.well-known/krizaka/services.json and asks it for getService("yomizaka").apiBase. A move of a product is an edit of one list and a deploy of krizaka.com.

const discovery = createDiscovery({ environment: "dev", appVersion, manifestUrls, publicKeys, allowedHostSuffixes, defaults, legacy, storage });
await discovery.start();
discovery.getService("yomizaka").apiBase; // live → cache → baked default → legacy host

What keeps it safeCopy Anchor Link

• Signed. Ed25519 over the canonical JSON of the document, with public keys baked in the app. A DNS or CDN hijack can serve any JSON; it cannot sign it.
• An allow-list. Even a signed address must be https on a domain the app bakes (krizaka.com, its product's own). A leaked signing key still cannot send an app to a host that is not ours.
• No replay. A document older than the one in force is refused; the cache is re-verified on load.
• Never a lock-out by our fault. Every failure keeps the previous state; an unreadable version leaves the gates open; only a verified document can ask for an update or show maintenance.

Gates and @krizaka/app-configCopy Anchor Link

The manifest carries minAppVersion, latestAppVersion, status and a bilingual message per product and environment: a coarse kill switch that works when the backend has moved or is down. @krizaka/app-config stays the backend's own, database-driven contract (soft update, contract range, 426); give its client baseUrl: () => discovery.getService("yomizaka").apiBase and it follows the manifest.

The decision and the threat model: ADR-003.