@astrale-os/kernel-core 0.9.0-beta.8 → 0.9.0

package/dist/schema/identity/identity.d.ts

@@ -1,132 +1,234 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Identity: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly description: "A principal that can be authenticated and can originate persistent authority facts.";
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        readonly frozen: builder.Property<{
-            readonly type: "boolean";
-        }, {
-            readonly required: false;
-            readonly visibility: "private";
-        }>;
-        readonly iss: {
-            readonly type: "string";
-            readonly minLength: 1;
-        };
-        readonly requiredClaims: builder.Property<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"contains">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"eq">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"exists">;
-        }, import("zod/v4/core").$strict>], "op">>, {
-            readonly required: false;
-            readonly visibility: "private";
-        }>;
-        readonly sub: {
-            readonly type: "string";
-            readonly minLength: 1;
-        };
+        readonly iss: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "iss", "self", never>;
+        readonly sub: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "sub", "self", never>;
+        readonly frozen: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "frozen", "self", never>;
+        readonly requiredClaims: builder.AuthoredPropertyProjection<({
+            claim: string;
+            op: "contains";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "eq";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "exists";
+        })[], ({
+            claim: string;
+            op: "contains";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "eq";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "exists";
+        })[], false, "requiredClaims", "self", never>;
     };
     readonly methods: Readonly<{
-        delegate: builder.Method<{
-            readonly description: "Issue one strictly attenuated credential from this authenticated Identity.";
-            readonly auth: "authenticated";
-            readonly input: import("zod").ZodObject<{
-                audience: import("zod").ZodString;
-                ttlSeconds: import("zod").ZodNumber;
-                attenuation: import("zod").ZodUnknown;
-            }, import("zod/v4/core").$strict>;
-            readonly output: import("zod").ZodString;
-            readonly inheritance: "default";
-        }>;
-        can: builder.Method<{
-            readonly description: "Determine whether the current authenticated Identity satisfies one installed Policy for one object.";
-            readonly auth: "authenticated";
-            readonly input: import("zod").ZodObject<{
-                policy: import("zod").ZodString;
-                object: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-            readonly output: import("zod").ZodObject<{
-                allowed: import("zod").ZodBoolean;
-            }, import("zod/v4/core").$strict>;
-            readonly static: true;
-            readonly inheritance: "default";
-        }>;
-        whoami: builder.Method<{
-            readonly description: "Return the Identity authenticated for this invocation.";
-            readonly auth: "authenticated";
-            readonly input: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
-            readonly output: import("zod").ZodObject<{
-                id: import("zod").ZodString;
-                issuer: import("zod").ZodString;
-                subject: import("zod").ZodString;
-                frozen: import("zod").ZodBoolean;
-                requiredClaims: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"contains">;
-                    value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"eq">;
-                    value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"exists">;
-                }, import("zod/v4/core").$strict>], "op">>;
-            }, import("zod/v4/core").$strict>;
-            readonly static: true;
-            readonly inheritance: "default";
-        }>;
-        whois: builder.Method<{
-            readonly description: "Resolve one issuer-and-subject Identity.";
-            readonly auth: "authorized";
-            readonly input: import("zod").ZodObject<{
-                issuer: import("zod").ZodString;
-                subject: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-            readonly output: import("zod").ZodNullable<import("zod").ZodObject<{
-                id: import("zod").ZodString;
-                issuer: import("zod").ZodString;
-                subject: import("zod").ZodString;
-                frozen: import("zod").ZodBoolean;
-                requiredClaims: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"contains">;
-                    value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"eq">;
-                    value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    claim: import("zod").ZodString;
-                    op: import("zod").ZodLiteral<"exists">;
-                }, import("zod/v4/core").$strict>], "op">>;
-            }, import("zod/v4/core").$strict>>;
-            readonly static: true;
-            readonly inheritance: "default";
-        }>;
-        mint: builder.Method<{
-            readonly description: "Resolve and sign one authorized Grant credential.";
-            readonly auth: "authorized";
-            readonly input: import("zod").ZodObject<{
-                audience: import("zod").ZodOptional<import("zod").ZodString>;
-                ttlSeconds: import("zod").ZodNumber;
-                grant: import("zod").ZodOptional<import("zod").ZodUnknown>;
-            }, import("zod/v4/core").$strict>;
-            readonly output: import("zod").ZodString;
-            readonly static: true;
-            readonly inheritance: "default";
-        }>;
+        delegate: builder.Method<builder.CallableProjection<{
+            principal: string;
+            audience: string;
+            ttlSeconds: number;
+        }, {
+            readonly mode: 'value';
+            readonly value: string;
+        }, "authenticated", true, false, undefined>>;
+        can: builder.Method<builder.CallableProjection<{
+            policy: string;
+            object: string;
+        } | {
+            checks: {
+                policy: string;
+                object: string;
+            }[];
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                allowed: boolean;
+            } | {
+                decisions: {
+                    allowed: boolean;
+                }[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        whoami: builder.Method<builder.CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                id: string;
+                iss: string;
+                sub: string;
+                frozen: boolean;
+                requiredClaims: ({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        whois: builder.Method<builder.CallableProjection<{
+            iss: string;
+            sub: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                id: string;
+                iss: string;
+                sub: string;
+                frozen: boolean;
+                requiredClaims: ({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[];
+            } | null;
+        }, "authorized", true, false, undefined>>;
+        mint: builder.Method<builder.CallableProjection<{
+            audience?: string | undefined;
+            ttlSeconds: number;
+        }, {
+            readonly mode: 'value';
+            readonly value: string;
+        }, "authenticated", true, false, undefined>>;
+        impersonate: builder.Method<builder.CallableProjection<{
+            audience?: string | undefined;
+            ttlSeconds: number;
+            identity: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: string;
+        }, "authorized", true, false, undefined>>;
     }>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "frozen", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "iss", "self", never> | builder.AuthoredPropertyProjection<({
+        claim: string;
+        op: "contains";
+        value: unknown;
+    } | {
+        claim: string;
+        op: "eq";
+        value: unknown;
+    } | {
+        claim: string;
+        op: "exists";
+    })[], ({
+        claim: string;
+        op: "contains";
+        value: unknown;
+    } | {
+        claim: string;
+        op: "eq";
+        value: unknown;
+    } | {
+        claim: string;
+        op: "exists";
+    })[], false, "requiredClaims", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "sub", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<Record<string, never>, {
+        readonly mode: 'value';
+        readonly value: {
+            id: string;
+            iss: string;
+            sub: string;
+            frozen: boolean;
+            requiredClaims: ({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[];
+        };
+    }, "authenticated", true, false, undefined>>, "whoami", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+        principal: string;
+        audience: string;
+        ttlSeconds: number;
+    }, {
+        readonly mode: 'value';
+        readonly value: string;
+    }, "authenticated", true, false, undefined>>, "delegate", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+        iss: string;
+        sub: string;
+    }, {
+        readonly mode: 'value';
+        readonly value: {
+            id: string;
+            iss: string;
+            sub: string;
+            frozen: boolean;
+            requiredClaims: ({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[];
+        } | null;
+    }, "authorized", true, false, undefined>>, "whois", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+        audience?: string | undefined;
+        ttlSeconds: number;
+    }, {
+        readonly mode: 'value';
+        readonly value: string;
+    }, "authenticated", true, false, undefined>>, "mint", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+        audience?: string | undefined;
+        ttlSeconds: number;
+        identity: string;
+    }, {
+        readonly mode: 'value';
+        readonly value: string;
+    }, "authorized", true, false, undefined>>, "impersonate", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+        policy: string;
+        object: string;
+    } | {
+        checks: {
+            policy: string;
+            object: string;
+        }[];
+    }, {
+        readonly mode: 'value';
+        readonly value: {
+            allowed: boolean;
+        } | {
+            decisions: {
+                allowed: boolean;
+            }[];
+        };
+    }, "authenticated", true, false, undefined>>, "can", "self">;
 }>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/schema/identity/identity.js

@@ -7,14 +7,12 @@ export const Identity = nodeClass({
     description: 'A principal that can be authenticated and can originate persistent authority facts.',
     extends: [Node],
     properties: {
-        frozen: property({ type: 'boolean' }, { required: false, visibility: 'private' }),
-        iss: { type: 'string', minLength: 1 },
+        iss: property({ type: 'string', minLength: 1 }, { required: false }),
+        sub: property({ type: 'string', minLength: 1 }, { required: false }),
+        frozen: property({ type: 'boolean' }, { required: false }),
         requiredClaims: property(requiredClaimsSchema, {
             required: false,
-            visibility: 'private',
         }),
-        sub: { type: 'string', minLength: 1 },
     },
     methods: IdentityMethods,
 });
-//# sourceMappingURL=identity.js.map

package/dist/schema/identity/index.d.ts

@@ -2,4 +2,3 @@ export { ConstrainedBy } from './constrained-by.js';
 export { ExcludedFrom } from './excluded-from.js';
 export { ExtendsWith } from './extends-with.js';
 export { Identity } from './identity.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/schema/identity/index.js

@@ -2,4 +2,3 @@ export { ConstrainedBy } from './constrained-by.js';
 export { ExcludedFrom } from './excluded-from.js';
 export { ExtendsWith } from './extends-with.js';
 export { Identity } from './identity.js';
-//# sourceMappingURL=index.js.map

package/dist/schema/index.d.ts

@@ -5,4 +5,4 @@ export * as graph from './kernel/projection/index.js';
 export * as introspection from './introspection/index.js';
 export * as installation from './installation/index.js';
 export { OperationCore } from './core/index.js';
-//# sourceMappingURL=index.d.ts.map
+export { authorityVocabulary } from './authority/vocabulary.js';

package/dist/schema/index.js

@@ -4,4 +4,4 @@ export * as graph from './kernel/projection/index.js';
 export * as introspection from './introspection/index.js';
 export * as installation from './installation/index.js';
 export { OperationCore } from './core/index.js';
-//# sourceMappingURL=index.js.map
+export { authorityVocabulary } from './authority/vocabulary.js';

package/dist/schema/installation/index.d.ts

@@ -1,2 +1 @@
 export { acceptOperationId, type OperationId } from './operation-id.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/schema/installation/index.js

@@ -1,2 +1 @@
 export { acceptOperationId } from './operation-id.js';
-//# sourceMappingURL=index.js.map

package/dist/schema/installation/operation-id.d.ts

@@ -1,4 +1,3 @@
-import { z } from 'zod';
 declare const OPERATION_ID: unique symbol;
 /** Caller-selected identity for one retryable Schema installation operation. */
 export type OperationId = string & {
@@ -7,6 +6,5 @@ export type OperationId = string & {
 /** Accept one canonical lowercase UUIDv4 without repair or case folding. */
 export declare function acceptOperationId(input: unknown): OperationId;
 /** Internal schema shared by Kernel-owned callable contracts. */
-export declare const operationIdSchema: z.ZodString;
+export declare const operationIdSchema: import("zod").ZodString;
 export {};
-//# sourceMappingURL=operation-id.d.ts.map

package/dist/schema/installation/operation-id.js

@@ -1,5 +1,5 @@
 import { fullMatch } from '@astrale-os/kernel-dsl/v1/value/full-match';
-import { z } from 'zod';
+import { string } from 'zod';
 const OPERATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
 const OPERATION_ID_MESSAGE = 'OperationId must be a canonical lowercase RFC 9562 UUIDv4.';
 /** Accept one canonical lowercase UUIDv4 without repair or case folding. */
@@ -10,7 +10,4 @@ export function acceptOperationId(input) {
     return input;
 }
 /** Internal schema shared by Kernel-owned callable contracts. */
-export const operationIdSchema = z
-    .string()
-    .check(fullMatch('[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}'));
-//# sourceMappingURL=operation-id.js.map
+export const operationIdSchema = string().check(fullMatch('[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}'));

package/dist/schema/introspection/index.d.ts

@@ -1,2 +1 @@
-export type { InstallationIntrospection, InstallationSelection, Introspection } from './language.js';
-//# sourceMappingURL=index.d.ts.map
+export type { Introspection } from './language.js';

package/dist/schema/introspection/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/schema/introspection/language.d.ts

@@ -1,31 +1,14 @@
 import type { Key } from '@astrale-os/kernel-dsl/v1';
-type Fields = {
-    readonly state?: true;
-    readonly target?: true;
-    readonly source?: true;
-    readonly bundle?: true;
-    readonly readiness?: true;
-    readonly capabilities?: true;
-};
-type AtLeastOne<Value extends object> = {
-    [Field in keyof Value]-?: Required<Pick<Value, Field>> & Partial<Omit<Value, Field>>;
-}[keyof Value];
-type BundleWithSource = (AtLeastOne<Omit<Fields, 'bundle'>> & {
-    readonly bundle?: never;
-}) | (AtLeastOne<Fields> & {
-    readonly bundle: true;
-    readonly source: true;
-});
-/** Closed version-one field selection for one installed Domain origin. */
-export type InstallationSelection = BundleWithSource;
-export interface InstallationIntrospection<out Selection extends InstallationSelection = InstallationSelection> {
-    readonly from: {
-        readonly kind: 'installation';
-        readonly origin: Key.Origin;
-    };
-    readonly select: Selection;
-}
 /** One admitted read-only Schema control-plane request. */
-export type Introspection<Selection extends InstallationSelection = InstallationSelection> = InstallationIntrospection<Selection>;
-export {};
-//# sourceMappingURL=language.d.ts.map
+export type Introspection = {
+    readonly kind: 'inspect';
+    readonly origin: Key.Origin;
+} | {
+    readonly kind: 'bundle';
+    readonly origin: Key.Origin;
+} | {
+    readonly kind: 'dependencies';
+    readonly origin: Key.Origin;
+} | {
+    readonly kind: 'installed';
+};

package/dist/schema/introspection/language.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=language.js.map

package/dist/schema/kernel/index.d.ts

@@ -1,3 +1,2 @@
 export { AuthorityOperationOrder, AuthorityOperations, AuthorityRelations, K, KernelRootFunctions, KernelSchema, operationOf, } from './schema.js';
 export type { AuthorityOperation, AuthorityRelation, Kernel } from './schema.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/schema/kernel/index.js

@@ -1,2 +1 @@
 export { AuthorityOperationOrder, AuthorityOperations, AuthorityRelations, K, KernelRootFunctions, KernelSchema, operationOf, } from './schema.js';
-//# sourceMappingURL=index.js.map

package/dist/schema/kernel/projection/callables.d.ts

@@ -4,4 +4,3 @@ import type { NodePath } from '#graph/path';
 export declare function projectedCallables(domain: Domain): ReadonlyMap<NodePath, Key.Callable>;
 /** Canonical schema locator of one projected Method definition, not an invocation receiver. */
 export declare function projectedMethodPath(domain: Domain, method: ResolvedMethod): NodePath;
-//# sourceMappingURL=callables.d.ts.map

package/dist/schema/kernel/projection/callables.js

@@ -12,8 +12,7 @@ export function projectedCallables(domain) {
         if (!('methods' in definition) || definition.kind !== 'node')
             continue;
         for (const method of [...definition.methods, ...definition.static.methods]) {
-            if (method.owner.ref.origin !== domain.origin ||
-                method.definition.inheritance === 'abstract') {
+            if (method.owner.ref.origin !== domain.origin || !method.executable) {
                 continue;
             }
             result.set(projectedMethodPath(domain, method), method.key);
@@ -29,6 +28,5 @@ export function projectedMethodPath(domain, method) {
     const owner = Path.project(method.owner.ref);
     return (method.definition.static
         ? Path.staticMethod(owner, method.name)
-        : Path.instanceMethod(owner, method.name)).raw;
+        : Path.instanceMethod(owner, method.key)).raw;
 }
-//# sourceMappingURL=callables.js.map

package/dist/schema/kernel/projection/compile.d.ts

@@ -2,4 +2,3 @@ import { schema, type Key, type SourceDomain } from '@astrale-os/kernel-dsl/v1';
 import type { Graph } from '#graph/graph';
 /** Compile one canonical kernel graph projection back into its exact rich Domain. */
 export declare function compile(graph: Graph, origin: Key.Origin, lookup?: schema.Lookup): SourceDomain<schema.DomainSchema>;
-//# sourceMappingURL=compile.d.ts.map

package/dist/schema/kernel/projection/compile.js

@@ -44,4 +44,3 @@ export function compile(graph, origin, lookup = EMPTY_LOOKUP) {
     }
     return schema.resolve(domainSchema);
 }
-//# sourceMappingURL=compile.js.map

package/dist/schema/kernel/projection/core.d.ts

@@ -0,0 +1,7 @@
+import type { SourceDomain, schema } from '@astrale-os/kernel-dsl/v1';
+import { type Edge, type Part, type Payload } from './part.js';
+/**
+ * Declare each authored Core Node, then each authored Core Edge, and return the locators that
+ * associate every Core Node with its Domain.
+ */
+export declare function projectCore<Extra extends object>(domain: SourceDomain<schema.DomainSchema>, core: Part<Extra>, payload: Payload<Extra>): Edge<Extra>[];

package/dist/schema/kernel/projection/core.js

@@ -0,0 +1,51 @@
+import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { Path } from '#graph/path';
+import { K } from '../index.js';
+import { projectedMethodPath } from './callables.js';
+import { ProjectionError } from './diagnostics.js';
+import { edge } from './part.js';
+import { memberProperties } from './properties.js';
+/**
+ * Declare each authored Core Node, then each authored Core Edge, and return the locators that
+ * associate every Core Node with its Domain.
+ */
+export function projectCore(domain, core, payload) {
+    // The Domain Node is persisted before its Core part, so locators address it by its Path.
+    const domainEndpoint = Object.freeze({ path: Path.domain(domain.origin).raw });
+    const locators = [];
+    for (const [slug, declaration] of Object.entries(domain.source.core.nodes)) {
+        assertAuthenticationUnowned(domain, declaration.class, declaration.properties, slug);
+        const created = core.node(Path.project({ origin: domain.origin, kind: 'core', name: slug }).raw, ClassKey.of(declaration.class), payload(() => declaration.properties));
+        locators.push(edge(created, domainEndpoint, K.classes.of_domain.ref, payload(() => memberProperties(`core.${slug}`))));
+    }
+    // Resolved edges carry each endpoint's own identity; the source IR only names it.
+    for (const authored of domain.core.edges) {
+        core.edges.push(edge(endpoint(authored.source, domain, core, domainEndpoint), endpoint(authored.target, domain, core, domainEndpoint), authored.class.ref, payload(() => authored.properties)));
+    }
+    return locators;
+}
+/** Authentication of a Core Identity is established only by the credential-evidenced lifecycle. */
+function assertAuthenticationUnowned(domain, classRef, properties, slug) {
+    const definition = domain.definition(classRef);
+    if (definition?.ref.kind !== 'class' ||
+        definition.kind !== 'node' ||
+        !definition.satisfies(K.classes.Identity)) {
+        return;
+    }
+    const hasIssuer = Object.hasOwn(properties, K.classes.Identity.properties.iss.key);
+    const hasSubject = Object.hasOwn(properties, K.classes.Identity.properties.sub.key);
+    if (hasIssuer || hasSubject) {
+        throw new ProjectionError('PROJECTION_INVALID', `Core Identity ${domain.origin}:core.${slug} cannot declare protected Authentication properties iss or sub.`);
+    }
+}
+/**
+ * A Core Node binds inside the Core part; every other local Definition is already projected as a
+ * managed declaration, so it is addressed by its canonical Path exactly like the owning Domain.
+ */
+function endpoint(value, domain, core, domainEndpoint) {
+    if ('ref' in value)
+        return core.endpoint(Path.project(value.ref).raw);
+    if ('owner' in value)
+        return core.endpoint(projectedMethodPath(domain, value));
+    return domainEndpoint;
+}

package/dist/schema/kernel/projection/definitions.d.ts

@@ -0,0 +1,13 @@
+import type { SourceDomain, schema } from '@astrale-os/kernel-dsl/v1';
+import type { ResolvedDefinition, ResolvedDefinitionOf } from '@astrale-os/kernel-dsl/v1/language';
+import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { GraphSpecEndpoint } from '#graph/graph';
+import { type Part, type Payload } from './part.js';
+/** Declare the Domain Node, the target of every of_domain locator. */
+export declare function projectDomain<Extra extends object>(domain: SourceDomain<schema.DomainSchema>, managed: Part<Extra>, payload: Payload<Extra>): GraphSpecEndpoint;
+/** Declare each local Definition's Node and its of_domain locator. */
+export declare function projectDefinitions<Extra extends object>(domain: SourceDomain<schema.DomainSchema>, managed: Part<Extra>, domainEndpoint: GraphSpecEndpoint, payload: Payload<Extra>): void;
+/** Each local Definition projected as a managed declaration, with the Kernel Class it projects to. */
+export declare function projectedDefinitions(domain: SourceDomain<schema.DomainSchema>): Generator<readonly [ResolvedDefinition, ClassKey]>;
+/** Whether a resolved Definition is of the given kind. */
+export declare function is<Kind extends ResolvedDefinition['ref']['kind']>(definition: ResolvedDefinition, kind: Kind): definition is ResolvedDefinitionOf<Kind>;