@astrale-os/sdk 0.1.0

package/src/dispatch/validate.ts

@@ -0,0 +1,41 @@
+/**
+ * Param / result validation helpers — Zod `safeParse` wrappers returning a
+ * tagged result. Callers convert a `false` outcome into a typed error:
+ * `SdkValidationError` (input, → 422) or `SdkResultValidationError`
+ * (output, → 500).
+ */
+
+import type { z } from 'zod'
+
+export type ValidationResult =
+  | { ok: true; data: Record<string, unknown> }
+  | { ok: false; issues: unknown[] }
+
+export function validateParams(inputSchema: z.ZodType, params: unknown): ValidationResult {
+  const result = inputSchema.safeParse(params)
+  if (result.success) {
+    return { ok: true, data: result.data as Record<string, unknown> }
+  }
+  return { ok: false, issues: result.error.issues }
+}
+
+/**
+ * Result of validating a handler's output against its `outputSchema`. Unlike
+ * params, an output may be any shape (object, primitive, array), so `data` is
+ * `unknown` rather than `Record<string, unknown>`.
+ */
+export type ResultValidationResult = { ok: true; data: unknown } | { ok: false; issues: unknown[] }
+
+/**
+ * Validate a handler's return value against its `outputSchema`. Mirrors the
+ * kernel's `validateOutput` (`runtime/.../validation/output.ts`) so deployed
+ * domains enforce the same output contract as in-process methods. Returns the
+ * parsed `data` (applies Zod `default`/`transform`/coercions) on success.
+ */
+export function validateResult(outputSchema: z.ZodType, result: unknown): ResultValidationResult {
+  const parsed = outputSchema.safeParse(result)
+  if (parsed.success) {
+    return { ok: true, data: parsed.data }
+  }
+  return { ok: false, issues: parsed.error.issues }
+}

package/src/domain/build-spec.ts

@@ -0,0 +1,127 @@
+/**
+ * SDK-side spec builder: CompiledDomain → serialize → Graph.
+ *
+ * Serializes BoundMethod[] into FunctionSchema[], generates entries for
+ * inherited methods not covered by the domain's handlers, then delegates
+ * to serialize() for graph blueprint generation.
+ *
+ * Domain-side Methods are remote-bound: dispatch routes through
+ * `binding.remoteUrl` and never reaches the kernel sandbox. We therefore
+ * do NOT stamp `code` on emitted FunctionSchema entries — there is no
+ * sandbox-eval'able body. Only the kernel domain (compiled in-process)
+ * carries `code` strings.
+ *
+ * The emitted graph is absolute — the Tree produced by `serialize()` is
+ * already mounted at `/<origin>`, so `tree.toGraph()` lifts every internal
+ * relative path into its host-graph absolute form. Wire serialization is the
+ * caller's responsibility (`graph.toWire()`).
+ */
+
+import type { Graph, WireGraph } from '@astrale-os/kernel-core'
+import type { BoundMethod, FunctionSchema } from '@astrale-os/kernel-core/domain'
+import type { Schema } from '@astrale-os/kernel-dsl'
+
+import { hashInstallGraph, serialize, zodToJsonSchema } from '@astrale-os/kernel-core/domain'
+
+import type { AnyRemoteHandler } from '../method/single'
+import type { RemoteDomain } from './define'
+
+import { extractBinding } from './contract'
+import { materializeRemoteDomain } from './define'
+
+/**
+ * Build the install-ready wire graph for a domain served at `url`: materialize
+ * the domain at its real serving URL (so every binding carries the live URL —
+ * the define-time compile carries none), serialize, and emit the wire form.
+ * This is the graph the kernel installs and re-hashes to verify. There is no
+ * url-less variant: an install graph without bindings is uninstallable (the
+ * kernel install guard rejects it).
+ */
+export function buildInstallGraph<S extends Schema>(
+  domain: RemoteDomain<S>,
+  url: string,
+): WireGraph {
+  const { compiled } = materializeRemoteDomain(domain, url)
+  return buildSpecInternal(compiled, domain.methods, url).toWire() as WireGraph
+}
+
+/**
+ * Content hash of the install graph. Delegates the canonical hash to kernel-core's
+ * `hashInstallGraph` — the same algorithm the kernel re-runs on install to verify
+ * the received graph against the signed hash.
+ */
+export function buildInstallGraphHash<S extends Schema>(
+  domain: RemoteDomain<S>,
+  url: string,
+): Promise<string> {
+  return hashInstallGraph(buildInstallGraph(domain, url))
+}
+
+// ── Internal ────────────────────────────────────────────────
+
+function buildSpecInternal(
+  compiled: RemoteDomain['compiled'],
+  methods: BoundMethod<AnyRemoteHandler>[],
+  url: string,
+): Graph {
+  const serialized = serializeMethodsWithStubs(compiled, methods, url)
+  const tree = serialize(compiled, serialized)
+  // Views / RemoteFunctions are auto-materialized into the Core BEFORE
+  // `compileDomain` runs (see `extend-core.ts`). By the time we reach
+  // `serialize` here the Tree already contains their nodes/edges.
+  return tree.toGraph()
+}
+
+/**
+ * Serialize BoundMethod[] and generate stubs for methods in compiled.$.methods
+ * that have no corresponding BoundMethod (inherited-sealed, inherited-default).
+ *
+ * Every Method's binding defaults its `remoteUrl` to the serving URL: domain
+ * methods are remote-bound — the kernel dispatches them by redirecting to the
+ * worker — so a method node without a remote binding is uninstallable (the
+ * kernel install guard rejects it). An explicit per-method `remoteUrl` wins.
+ */
+function serializeMethodsWithStubs(
+  compiled: RemoteDomain['compiled'],
+  methods: BoundMethod<AnyRemoteHandler>[],
+  url: string,
+): FunctionSchema[] {
+  const bound = new Set(methods.map((m) => m.ref))
+  const result = methods.map((m) => serializeFromBoundMethod(m, url))
+
+  // Generate entries for unbound methods (replaces fillMissingCallables).
+  // No `code` is stamped — domain-side Methods are binding-only. The `ref` MUST
+  // be the QUALIFIED `ResolvedMethod.ref` (`<ns>.<Type>.method.<m>`) — the exact
+  // form `serialize`'s method-node lookup uses; re-deriving a bare `Type.method`
+  // is the F11 bug (interface methods then never resolve → MISSING_HANDLER).
+  for (const classMethods of Object.values(compiled.$.methods)) {
+    for (const rm of Object.values(classMethods)) {
+      const ref = rm.ref
+      if (bound.has(ref)) continue
+      result.push({
+        ref,
+        inputSchema: { type: 'object' },
+        outputSchema: {},
+        output: 'value',
+        binding: { remoteUrl: url },
+      })
+    }
+  }
+
+  return result
+}
+
+function serializeFromBoundMethod(
+  method: BoundMethod<AnyRemoteHandler>,
+  url: string,
+): FunctionSchema {
+  const binding = extractBinding(method.handler)
+  return {
+    ref: method.ref,
+    inputSchema: zodToJsonSchema(method.inputSchema),
+    outputSchema: zodToJsonSchema(method.outputSchema),
+    isStatic: method.isStatic || undefined,
+    output: method.output,
+    binding: binding?.remoteUrl ? binding : { ...binding, remoteUrl: url },
+  }
+}

package/src/domain/contract.ts

@@ -0,0 +1,41 @@
+/**
+ * BoundMethod → MountableContract translator.
+ *
+ * The narrow view carries only what the server's mount planner reads —
+ * `ref` plus optional `binding` — because the SDK's SdkDispatcher
+ * handles dispatch via KernelAPI.call, not via runtime contract hooks.
+ */
+
+import type {
+  AuthPolicy,
+  FunctionBinding,
+  MountableContract,
+  RouteBinding,
+} from '@astrale-os/kernel-api/routed'
+import type { BoundMethod } from '@astrale-os/kernel-core/domain'
+
+import type { AnyRemoteHandler } from '../method/single'
+
+export function toSdkContract(method: BoundMethod<AnyRemoteHandler>): MountableContract {
+  const handler = method.handler as {
+    route?: RouteBinding
+    remoteUrl?: string
+    auth?: AuthPolicy
+  }
+  const binding = extractBinding(handler)
+  return binding === undefined ? { ref: method.ref } : { ref: method.ref, binding }
+}
+
+export function extractBinding(handler: {
+  route?: RouteBinding
+  remoteUrl?: string
+  auth?: AuthPolicy
+}): FunctionBinding | undefined {
+  const { route, remoteUrl, auth } = handler
+  if (route === undefined && remoteUrl === undefined && auth === undefined) return undefined
+  const binding: FunctionBinding = {}
+  if (remoteUrl !== undefined) binding.remoteUrl = remoteUrl
+  if (route !== undefined) binding.route = route
+  if (auth !== undefined) binding.auth = auth
+  return binding
+}

package/src/domain/define.ts

@@ -0,0 +1,168 @@
+/**
+ * `defineRemoteDomain` — turn a typed schema + methods map into a mountable domain.
+ *
+ * When `views` and/or `remoteFunctions` entries are provided, the SDK
+ * auto-materializes graph nodes
+ * under reserved folders (`viewsFolder` / `functionsFolder`, defaults `'views'`
+ * / `'functions'`). Views and standalone functions materialize as canonical
+ * kernel `View` / `Function` classes by default (no per-domain class to
+ * configure). The same entries'
+ * `render` / `execute` handlers are mounted as Hono routes by
+ * `createRemoteServer`. Slug = map key.
+ *
+ * The domain definition is deployment-agnostic: it carries NO serving url. The
+ * url is supplied late by the spec producer (`createRemoteServer({ url })` at
+ * runtime, the devkit CLI offline) and stamped onto every `binding.remoteUrl`
+ * by `materializeRemoteDomain`. There is exactly one notion of `url` in the SDK
+ * — the worker serving URL, which is also `iss` and the binding base.
+ */
+
+import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
+import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain'
+import type { AnyEdgeDef, AnyNodeDef, Core, Schema } from '@astrale-os/kernel-dsl'
+
+import { bindMethods, compileDomain } from '@astrale-os/kernel-core/domain'
+
+import type { AnyRemoteFunctionDef, ViewDef } from '../define'
+import type { SchemaMethodsImpl } from '../method/class'
+import type { AnyRemoteHandler } from '../method/single'
+
+import { DEFAULT_FUNCTIONS_FOLDER, DEFAULT_VIEWS_FOLDER, extendCore } from './extend-core'
+
+export type RemoteDomainConfig<S extends Schema, TDeps> = {
+  schema: S
+  methods: SchemaMethodsImpl<S, TDeps>
+  core?: Core<S>
+
+  views?: Record<string, ViewDef<TDeps>>
+  viewClass?: AnyNodeDef
+  viewForEdgeClass?: AnyEdgeDef
+  viewsFolder?: string
+
+  remoteFunctions?: Record<string, AnyRemoteFunctionDef>
+  functionsFolder?: string
+}
+
+/** Effective bindings + folder layout for auxiliary routes, resolved against `url`. */
+export type AuxiliaryMetadata = {
+  url: string
+  viewsFolder: string
+  functionsFolder: string
+  viewBindings: Record<string, FunctionBinding>
+  remoteFunctionBindings: Record<string, FunctionBinding>
+}
+
+export type RemoteDomain<S extends Schema = Schema> = {
+  /**
+   * Define-time compile: full domain STRUCTURE (classes, methods, and the aux
+   * View/Function nodes' paths/names/refs — what identity, subs, and contract
+   * resolution need). It carries NO `binding` values: bindings derive from the
+   * serving url, which only the spec producers know — they call
+   * `materializeRemoteDomain(domain, url)` for the install-ready compile.
+   */
+  compiled: CompiledDomain<S>
+  methods: BoundMethod<AnyRemoteHandler>[]
+  // oxlint-disable-next-line no-explicit-any
+  views?: Record<string, ViewDef<any>>
+  remoteFunctions?: Record<string, AnyRemoteFunctionDef>
+  /** The original config, so `materializeRemoteDomain` re-extends from source. */
+  config: ExtendInputs
+}
+
+/** The defineRemoteDomain inputs `materializeRemoteDomain` needs to re-extend. */
+type ExtendInputs = {
+  userCore?: Core
+  viewClass?: AnyNodeDef
+  viewForEdgeClass?: AnyEdgeDef
+  viewsFolder: string
+  functionsFolder: string
+}
+
+export function defineRemoteDomain<TDeps>() {
+  return function <S extends Schema>(config: RemoteDomainConfig<S, TDeps>): RemoteDomain<S> {
+    const hasAux = Boolean(config.views || config.remoteFunctions)
+    const viewsFolder = config.viewsFolder ?? DEFAULT_VIEWS_FOLDER
+    const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER
+
+    // Structure-only extension (no url → no bindings stamped): the aux nodes
+    // exist with their paths so subs/identity/contract resolution see them.
+    const effectiveCore: Core | undefined = hasAux
+      ? extendCore({
+          schema: config.schema,
+          origin: config.schema.domain,
+          userCore: config.core,
+          viewClass: config.viewClass,
+          viewForEdgeClass: config.viewForEdgeClass,
+          viewsFolder,
+          views: config.views,
+          functionsFolder,
+          remoteFunctions: config.remoteFunctions,
+        }).core
+      : config.core
+
+    const compiled = compileDomain(config.schema, effectiveCore as Core<S> | undefined)
+    const methods = bindMethods<AnyRemoteHandler>(
+      compiled.$.schema,
+      compiled.$.methods,
+      // oxlint-disable-next-line no-explicit-any
+      config.methods as any,
+    )
+
+    return Object.freeze({
+      compiled,
+      methods,
+      ...(config.views ? { views: config.views } : {}),
+      ...(config.remoteFunctions ? { remoteFunctions: config.remoteFunctions } : {}),
+      config: {
+        userCore: config.core,
+        viewClass: config.viewClass,
+        viewForEdgeClass: config.viewForEdgeClass,
+        viewsFolder,
+        functionsFolder,
+      },
+    })
+  }
+}
+
+/**
+ * Materialize a `RemoteDomain` at its real serving `url`: re-runs `extendCore`
+ * so every aux View/Function `binding.remoteUrl` points at the actual host,
+ * and returns the binding maps the auxiliary routes mount from. Called by the
+ * only two spec producers — `createRemoteServer` (`config.url`) and the devkit
+ * CLI. Returns the define-time `compiled` untouched when there is no aux to
+ * stamp. `extendCore`/`compileDomain` are pure, so this is safe to call
+ * repeatedly (and is memoized per cold isolate by the callers).
+ */
+export function materializeRemoteDomain<S extends Schema>(
+  domain: RemoteDomain<S>,
+  url: string,
+): { compiled: CompiledDomain<S>; auxiliary: AuxiliaryMetadata | undefined } {
+  const hasAux = Boolean(domain.views || domain.remoteFunctions)
+  if (!hasAux) return { compiled: domain.compiled, auxiliary: undefined }
+
+  const { config } = domain
+  const schema = domain.compiled.$.schema as S
+  const result = extendCore({
+    schema,
+    origin: schema.domain,
+    userCore: config.userCore,
+    url,
+    viewClass: config.viewClass,
+    viewForEdgeClass: config.viewForEdgeClass,
+    viewsFolder: config.viewsFolder,
+    views: domain.views,
+    functionsFolder: config.functionsFolder,
+    remoteFunctions: domain.remoteFunctions,
+  })
+  const compiled = compileDomain(schema, result.core as Core<S>)
+  return {
+    compiled,
+    auxiliary: {
+      url,
+      viewsFolder: config.viewsFolder,
+      functionsFolder: config.functionsFolder,
+      viewBindings: result.viewBindings,
+      remoteFunctionBindings: result.remoteFunctionBindings,
+    },
+  }
+}

package/src/domain/extend-core.ts

@@ -0,0 +1,287 @@
+/**
+ * Build an augmented `Core<S>` that includes auto-materialized View and
+ * standalone-function nodes (one per entry in `defineRemoteDomain`'s `views` /
+ * `remoteFunctions` config), plus their parent Folder + optional `view_for`
+ * edges. Returns the resolved effective bindings alongside so callers don't
+ * recompute them.
+ *
+ * Standalone callables (the former `RemoteFunction` class) are materialized as
+ * the canonical kernel `Function` node class — "remote" is just a `binding`,
+ * not a distinct kind, so there is no per-domain class to configure.
+ *
+ * Conflicts: if the user core already declares a top-level node at
+ * `<viewsFolder>` or `<functionsFolder>`, throws — the auto-materialization
+ * reserves those slugs.
+ */
+
+import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
+import type {
+  AnyEdgeDef,
+  AnyNodeDef,
+  Core,
+  CoreEdgeEntry,
+  CoreNodeEntry,
+  Schema,
+} from '@astrale-os/kernel-dsl'
+
+import { Folder, K, KernelSchema } from '@astrale-os/kernel-core'
+import { buildCorePath } from '@astrale-os/kernel-dsl'
+
+/** Canonical node class for standalone callables (the former `RemoteFunction`). */
+const FUNCTION_CLASS = KernelSchema.classes.Function as unknown as AnyNodeDef
+/** Canonical node class for GUI views. */
+const VIEW_CLASS = KernelSchema.classes.View as unknown as AnyNodeDef
+/** Canonical edge class linking a View to its target. */
+const VIEW_FOR_EDGE_CLASS = KernelSchema.classes.view_for as unknown as AnyEdgeDef
+
+import type { AnyRemoteFunctionDef } from '../define/remote-function'
+import type { ViewDef } from '../define/view'
+
+export const DEFAULT_VIEWS_FOLDER = 'views'
+export const DEFAULT_FUNCTIONS_FOLDER = 'functions'
+const SLUG_RE = /^[a-z][a-z0-9-]*$/
+
+export type ExtendCoreConfig = {
+  schema: Schema
+  origin: string
+  userCore?: Core
+  /**
+   * The worker's serving URL — the base every auto-materialized binding
+   * resolves against. OMITTED at define time (the URL is known only to the
+   * spec producers): the aux nodes then materialize structure-only (paths,
+   * names, refs — what identity/subs resolution needs) with no `binding`
+   * stamped and empty binding maps. Every install graph comes from a
+   * `materializeRemoteDomain(domain, url)` call where it is present.
+   */
+  url?: string
+
+  viewClass?: AnyNodeDef
+  viewForEdgeClass?: AnyEdgeDef
+  viewsFolder?: string
+  // oxlint-disable-next-line no-explicit-any
+  views?: Record<string, ViewDef<any>>
+
+  functionsFolder?: string
+  remoteFunctions?: Record<string, AnyRemoteFunctionDef>
+}
+
+export type ExtendCoreResult = {
+  core: Core
+  viewBindings: Record<string, FunctionBinding>
+  remoteFunctionBindings: Record<string, FunctionBinding>
+}
+
+export function extendCore(config: ExtendCoreConfig): ExtendCoreResult {
+  const {
+    schema,
+    origin,
+    userCore,
+    url,
+    viewClass = VIEW_CLASS,
+    viewForEdgeClass = VIEW_FOR_EDGE_CLASS,
+    viewsFolder = DEFAULT_VIEWS_FOLDER,
+    views,
+    functionsFolder = DEFAULT_FUNCTIONS_FOLDER,
+    remoteFunctions,
+  } = config
+
+  validateInputs(config)
+
+  const nodes: CoreNodeEntry[] = userCore ? [...userCore.__nodes] : []
+  const edges: CoreEdgeEntry[] = userCore ? [...userCore.__edges] : []
+  const viewBindings: Record<string, FunctionBinding> = {}
+  const remoteFunctionBindings: Record<string, FunctionBinding> = {}
+
+  if (views && viewClass) {
+    // Enforce ViewDef's documented exclusivity: `mount` (SPA route) cannot be
+    // combined with `render` (inline HTML handler) or an explicit `binding` —
+    // silently ignoring one of them would deploy a view that behaves
+    // differently than its definition reads.
+    for (const [slug, def] of Object.entries(views)) {
+      if (def.mount && (def.render || def.binding)) {
+        throw new Error(
+          `defineRemoteDomain: view "${slug}" sets \`mount\` together with ` +
+            `${def.render ? '`render`' : '`binding`'} — they are mutually exclusive.`,
+        )
+      }
+    }
+    assertNoConflict(nodes, origin, viewsFolder)
+    addFolderAndEntries({
+      origin,
+      folderSlug: viewsFolder,
+      nodes,
+      entries: Object.entries(views).map(([slug, def]) => {
+        const binding = url
+          ? def.mount
+            ? { remoteUrl: joinWorkerPath(url, def.mount) }
+            : resolveBinding(def.binding, url, viewsFolder, slug)
+          : undefined
+        if (binding) viewBindings[slug] = binding
+        return {
+          slug,
+          nodeClass: viewClass,
+          data: buildFunctionData(slug, binding),
+          edges: buildViewForEdges(slug, def, viewForEdgeClass, viewsFolder, origin),
+        }
+      }),
+      edges,
+    })
+  }
+
+  if (remoteFunctions) {
+    assertNoConflict(nodes, origin, functionsFolder)
+    addFolderAndEntries({
+      origin,
+      folderSlug: functionsFolder,
+      nodes,
+      entries: Object.entries(remoteFunctions).map(([slug, def]) => {
+        const binding = url ? resolveBinding(def.binding, url, functionsFolder, slug) : undefined
+        if (binding) remoteFunctionBindings[slug] = binding
+        return {
+          slug,
+          // Standalone callables materialize as the canonical kernel Function class.
+          nodeClass: FUNCTION_CLASS,
+          data: {
+            ...buildFunctionData(slug, binding),
+            [K.$.i('Function').ref.key]: def.ref ?? `function.${slug}`,
+          },
+          edges: [],
+        }
+      }),
+      edges,
+    })
+  }
+
+  return {
+    core: { schema, domain: origin, __nodes: nodes, __edges: edges },
+    viewBindings,
+    remoteFunctionBindings,
+  }
+}
+
+/** Join a worker-relative mount path onto the serving url (single slash). */
+function joinWorkerPath(url: string, mount: string): string {
+  const base = url.replace(/\/+$/, '')
+  return `${base}/${mount.replace(/^\/+/, '')}`
+}
+
+export function resolveBinding(
+  override: FunctionBinding | undefined,
+  url: string,
+  folderSlug: string,
+  slug: string,
+): FunctionBinding {
+  // Same trailing-slash discipline as `joinWorkerPath` — a `url` ending in `/`
+  // must not produce `//` in the binding (the kernel pins iss by exact string).
+  const base = url.replace(/\/+$/, '')
+  if (override) {
+    return {
+      ...override,
+      remoteUrl: override.remoteUrl ?? `${base}/${folderSlug}/${slug}`,
+    }
+  }
+  return { remoteUrl: `${base}/${folderSlug}/${slug}` }
+}
+
+// ── Internal ───────────────────────────────────────────────────────────────
+
+function validateInputs(config: ExtendCoreConfig): void {
+  if (config.views) {
+    for (const slug of Object.keys(config.views)) {
+      if (!SLUG_RE.test(slug)) {
+        throw new Error(`defineRemoteDomain: invalid view slug "${slug}" — must match ${SLUG_RE}.`)
+      }
+    }
+  }
+  if (config.remoteFunctions) {
+    for (const slug of Object.keys(config.remoteFunctions)) {
+      if (!SLUG_RE.test(slug)) {
+        throw new Error(
+          `defineRemoteDomain: invalid remote-function slug "${slug}" — must match ${SLUG_RE}.`,
+        )
+      }
+    }
+  }
+}
+
+function assertNoConflict(
+  nodes: readonly CoreNodeEntry[],
+  origin: string,
+  folderSlug: string,
+): void {
+  const folderPath = buildCorePath(origin, [folderSlug])
+  if (nodes.some((n) => n.path === folderPath)) {
+    throw new Error(
+      `defineRemoteDomain: top-level core slug "${folderSlug}" is reserved by ` +
+        'SDK auto-materialization. Move the conflicting node or rename the ' +
+        '`viewsFolder` / `functionsFolder` config.',
+    )
+  }
+}
+
+type EntryDescriptor = {
+  slug: string
+  nodeClass: AnyNodeDef
+  data: Record<string, unknown>
+  edges: CoreEdgeEntry[]
+}
+
+function addFolderAndEntries(args: {
+  origin: string
+  folderSlug: string
+  entries: EntryDescriptor[]
+  nodes: CoreNodeEntry[]
+  edges: CoreEdgeEntry[]
+}): void {
+  const { origin, folderSlug, entries, nodes, edges } = args
+
+  const folderPath = buildCorePath(origin, [folderSlug])
+  nodes.push({
+    path: folderPath,
+    def: Folder as unknown as AnyNodeDef,
+    data: { [K.Named.name.key]: folderSlug },
+  })
+
+  for (const entry of entries) {
+    nodes.push({
+      path: buildCorePath(origin, [folderSlug, entry.slug]),
+      def: entry.nodeClass,
+      data: entry.data,
+      parent: folderPath,
+    })
+    for (const e of entry.edges) edges.push(e)
+  }
+}
+
+function buildFunctionData(
+  slug: string,
+  binding: FunctionBinding | undefined,
+): Record<string, unknown> {
+  // Match the kernel-core schema serializer which JSON-stringifies the
+  // `Function.binding` value on Function nodes (see
+  // kernel/core/domain/serialize/schema.ts). The kernel install validator
+  // checks `typeof binding === 'string'` then parses; storing a raw object
+  // trips the validator with "missing remote binding" even when the object IS
+  // the binding. No binding at all (define-time, no url) → no prop stamped.
+  return {
+    [K.Named.name.key]: slug,
+    ...(binding ? { [K.$.i('Function').binding.key]: JSON.stringify(binding) } : {}),
+  }
+}
+
+function buildViewForEdges(
+  slug: string,
+  def: ViewDef,
+  edgeClass: AnyEdgeDef | undefined,
+  viewsFolder: string,
+  origin: string,
+): CoreEdgeEntry[] {
+  if (!def.viewFor || !edgeClass) return []
+  const targets = Array.isArray(def.viewFor) ? def.viewFor : [def.viewFor]
+  const from = buildCorePath(origin, [viewsFolder, slug])
+  return targets.map((target) => ({
+    from,
+    edge: edgeClass,
+    to: target as CoreEdgeEntry['to'],
+  }))
+}

package/src/domain/index.ts

@@ -0,0 +1,4 @@
+export { defineRemoteDomain } from './define'
+export type { RemoteDomain, RemoteDomainConfig } from './define'
+export { buildInstallGraph, buildInstallGraphHash } from './build-spec'
+export { toSdkContract } from './contract'