@astrale-os/sdk 0.1.10 → 0.3.0

package/src/domain/define.ts

@@ -1,33 +1,30 @@
 /**
- * `defineRemoteDomain` — turn a typed schema + methods map into a mountable domain.
- *
- * When `views` and/or `remoteFunctions` entries are provided, the SDK
- * auto-materializes graph nodes
- * under reserved folders (`viewsFolder` / `functionsFolder`, defaults `'views'`
- * / `'functions'`). Views and standalone functions materialize as canonical
- * kernel `View` / `Function` classes by default (no per-domain class to
- * configure). The same entries'
- * `render` / `execute` handlers are mounted as Hono routes by
- * `createRemoteServer`. Slug = map key.
- *
- * The domain definition is deployment-agnostic: it carries NO serving url. The
- * url is supplied late by the spec producer (`createRemoteServer({ url })` at
- * runtime, the `astrale-domain` CLI offline) and stamped onto every `binding.remoteUrl`
- * by `materializeRemoteDomain`. There is exactly one notion of `url` in the SDK
- * — the worker serving URL, which is also `iss` and the binding base.
+ * Define a remote domain. Views/functions are first-class domain members; their
+ * serving URL is stamped later by spec producers and is also the worker issuer.
  */
 
 import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
-import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain'
-import type { AnyEdgeDef, AnyNodeDef, Core, Schema } from '@astrale-os/kernel-dsl'
+import type {
+  BoundMethod,
+  CompiledDomain,
+  FunctionSchema,
+  ViewSchema,
+} from '@astrale-os/kernel-core/domain'
+import type { Core, Schema } from '@astrale-os/kernel-dsl'
 
 import { bindMethods, compileDomain } from '@astrale-os/kernel-core/domain'
 
+import type { DomainManifest } from '../config/define-domain'
 import type { AnyRemoteFunctionDef, ViewDef } from '../define'
 import type { SchemaMethodsImpl } from '../method/class'
 import type { AnyRemoteHandler } from '../method/single'
 
-import { DEFAULT_FUNCTIONS_FOLDER, DEFAULT_VIEWS_FOLDER, extendCore } from './extend-core'
+import {
+  assertFunctionsMatchSchema,
+  buildFunctionSchemas,
+  DEFAULT_FUNCTIONS_FOLDER,
+} from './extend-functions'
+import { buildViewDeclarations, buildViewSchemas, DEFAULT_VIEWS_FOLDER } from './extend-views'
 
 export type RemoteDomainConfig<S extends Schema, TDeps> = {
   schema: S
@@ -35,72 +32,72 @@ export type RemoteDomainConfig<S extends Schema, TDeps> = {
   core?: Core<S>
 
   views?: Record<string, ViewDef<TDeps>>
-  viewClass?: AnyNodeDef
-  viewForEdgeClass?: AnyEdgeDef
   viewsFolder?: string
 
   remoteFunctions?: Record<string, AnyRemoteFunctionDef>
   functionsFolder?: string
+
+  /** Presentation metadata for `/meta` (logo / entry view). Carried verbatim. */
+  manifest?: DomainManifest
+
+  /** Physical tree path for the Domain node (absolute, e.g. `/domains/acme`); default `/domains/<origin>`. */
+  path?: string
 }
 
-/** Effective bindings + folder layout for auxiliary routes, resolved against `url`. */
+/** Effective bindings + folder layout + member schemas for auxiliary routes, resolved against `url`. */
 export type AuxiliaryMetadata = {
   url: string
   viewsFolder: string
   functionsFolder: string
   viewBindings: Record<string, FunctionBinding>
   remoteFunctionBindings: Record<string, FunctionBinding>
+  /** Function members' impl/binding half (`function.<slug>`) for `serialize`. */
+  functionSchemas: FunctionSchema[]
+  /** View members' impl/binding half (`view.<slug>`) for `serialize`. */
+  viewSchemas: ViewSchema[]
 }
 
 export type RemoteDomain<S extends Schema = Schema> = {
-  /**
-   * Define-time compile: full domain STRUCTURE (classes, methods, and the aux
-   * View/Function nodes' paths/names/refs — what identity, subs, and contract
-   * resolution need). It carries NO `binding` values: bindings derive from the
-   * serving url, which only the spec producers know — they call
-   * `materializeRemoteDomain(domain, url)` for the install-ready compile.
-   */
+  /** Define-time compile has structure only; bindings are stamped at materialization. */
   compiled: CompiledDomain<S>
   methods: BoundMethod<AnyRemoteHandler>[]
   // oxlint-disable-next-line no-explicit-any
   views?: Record<string, ViewDef<any>>
   remoteFunctions?: Record<string, AnyRemoteFunctionDef>
-  /** The original config, so `materializeRemoteDomain` re-extends from source. */
-  config: ExtendInputs
+  /** Presentation metadata for `/meta` (logo / entry view); `createRemoteServer` stamps it. */
+  manifest?: DomainManifest
+  /** The original config, so `materializeRemoteDomain` re-materializes from source. */
+  config: MaterializeInputs
+  /**
+   * Physical tree path for the Domain node (absolute string, e.g. `/domains/acme`).
+   * Read by `buildInstallGraph` and passed to `serialize` as `treeMount`; unset =>
+   * `/domains/<origin>` (applied in build-spec). Addressing is unaffected.
+   */
+  path?: string
 }
 
-/** The defineRemoteDomain inputs `materializeRemoteDomain` needs to re-extend. */
-type ExtendInputs = {
+/** The defineRemoteDomain inputs `materializeRemoteDomain` needs to re-materialize. */
+type MaterializeInputs = {
   userCore?: Core
-  viewClass?: AnyNodeDef
-  viewForEdgeClass?: AnyEdgeDef
   viewsFolder: string
   functionsFolder: string
 }
 
 export function defineRemoteDomain<TDeps>() {
   return function <S extends Schema>(config: RemoteDomainConfig<S, TDeps>): RemoteDomain<S> {
-    const hasAux = Boolean(config.views || config.remoteFunctions)
     const viewsFolder = config.viewsFolder ?? DEFAULT_VIEWS_FOLDER
     const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER
 
-    // Structure-only extension (no url → no bindings stamped): the aux nodes
-    // exist with their paths so subs/identity/contract resolution see them.
-    const effectiveCore: Core | undefined = hasAux
-      ? extendCore({
-          schema: config.schema,
-          origin: config.schema.domain,
-          userCore: config.core,
-          viewClass: config.viewClass,
-          viewForEdgeClass: config.viewForEdgeClass,
-          viewsFolder,
-          views: config.views,
-          functionsFolder,
-          remoteFunctions: config.remoteFunctions,
-        }).core
-      : config.core
-
-    const compiled = compileDomain(config.schema, effectiveCore as Core<S> | undefined)
+    // Standalone function handlers must match schema-declared function members.
+    assertFunctionsMatchSchema(config.schema, config.remoteFunctions)
+    // Standalone function handlers must match schema-declared function members.
+    assertFunctionsMatchSchema(config.schema, config.remoteFunctions)
+    const compiled = compileDomain(
+      config.schema,
+      config.core,
+      undefined,
+      config.views ? buildViewDeclarations(config.views) : undefined,
+    )
     const methods = bindMethods<AnyRemoteHandler>(
       compiled.$.schema,
       compiled.$.methods,
@@ -113,10 +110,10 @@ export function defineRemoteDomain<TDeps>() {
       methods,
       ...(config.views ? { views: config.views } : {}),
       ...(config.remoteFunctions ? { remoteFunctions: config.remoteFunctions } : {}),
+      ...(config.manifest ? { manifest: config.manifest } : {}),
+      ...(config.path ? { path: config.path } : {}),
       config: {
         userCore: config.core,
-        viewClass: config.viewClass,
-        viewForEdgeClass: config.viewForEdgeClass,
         viewsFolder,
         functionsFolder,
       },
@@ -124,15 +121,7 @@ export function defineRemoteDomain<TDeps>() {
   }
 }
 
-/**
- * Materialize a `RemoteDomain` at its real serving `url`: re-runs `extendCore`
- * so every aux View/Function `binding.remoteUrl` points at the actual host,
- * and returns the binding maps the auxiliary routes mount from. Called by the
- * only two spec producers — `createRemoteServer` (`config.url`) and the
- * `astrale-domain` CLI. Returns the define-time `compiled` untouched when there is no aux to
- * stamp. `extendCore`/`compileDomain` are pure, so this is safe to call
- * repeatedly (and is memoized per cold isolate by the callers).
- */
+/** Materialize aux member bindings against the real serving URL. Pure and repeatable. */
 export function materializeRemoteDomain<S extends Schema>(
   domain: RemoteDomain<S>,
   url: string,
@@ -142,27 +131,31 @@ export function materializeRemoteDomain<S extends Schema>(
 
   const { config } = domain
   const schema = domain.compiled.$.schema as S
-  const result = extendCore({
+
+  const compiled = compileDomain(
     schema,
-    origin: schema.domain,
-    userCore: config.userCore,
-    url,
-    viewClass: config.viewClass,
-    viewForEdgeClass: config.viewForEdgeClass,
-    viewsFolder: config.viewsFolder,
-    views: domain.views,
-    functionsFolder: config.functionsFolder,
-    remoteFunctions: domain.remoteFunctions,
-  })
-  const compiled = compileDomain(schema, result.core as Core<S>)
+    config.userCore as Core<S> | undefined,
+    undefined,
+    domain.views ? buildViewDeclarations(domain.views) : undefined,
+  )
+
+  const fns = domain.remoteFunctions
+    ? buildFunctionSchemas(domain.remoteFunctions, url, config.functionsFolder)
+    : { schemas: [], bindings: {} }
+  const vws = domain.views
+    ? buildViewSchemas(domain.views, url, config.viewsFolder, schema)
+    : { schemas: [], bindings: {} }
+
   return {
     compiled,
     auxiliary: {
       url,
       viewsFolder: config.viewsFolder,
       functionsFolder: config.functionsFolder,
-      viewBindings: result.viewBindings,
-      remoteFunctionBindings: result.remoteFunctionBindings,
+      viewBindings: vws.bindings,
+      remoteFunctionBindings: fns.bindings,
+      functionSchemas: fns.schemas,
+      viewSchemas: vws.schemas,
     },
   }
 }

package/src/domain/extend-functions.ts

@@ -0,0 +1,106 @@
+/**
+ * Materialize the `functions` map (`defineRemoteFunction` entries) into the two
+ * halves a standalone-function DOMAIN MEMBER contributes — mirroring how a class
+ * method splits across compile + serialize:
+ *
+ *   - the CONTRACT half — a `func({ input, output })` per slug, declared in the
+ *     schema's `functions` group so the compiled domain carries `function.<slug>`
+ *     on `refs.functions` (the kernel owns the ref/layout/of_domain mapping).
+ *   - `FunctionSchema[]` + per-slug `FunctionBinding` — the IMPL/BINDING half,
+ *     fed to `serialize` (url-stamped). The worker route is
+ *     `<url>/<functionsFolder>/<slug>`, DECOUPLED from the graph layout — so
+ *     `functionsFolder` only names the URL segment, not the node position.
+ *
+ * A standalone function is NOT a core/instance node: it is attached directly to
+ * the Domain via `of_domain` by the kernel-core serializer, so this module never
+ * touches `Core`.
+ */
+
+import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
+import type { FunctionSchema } from '@astrale-os/kernel-core/domain'
+import type { Schema } from '@astrale-os/kernel-dsl'
+
+import { zodToJsonSchema } from '@astrale-os/kernel-core/domain'
+
+import type { AnyRemoteFunctionDef } from '../define/remote-function'
+
+import { resolveBinding } from './binding'
+
+/**
+ * Default URL segment for a function's worker route (`<url>/functions/<slug>`).
+ * Names the HTTP route only — the graph layout (`/<origin>/functions/<slug>`) is
+ * a fixed kernel convention, independent of this.
+ */
+export const DEFAULT_FUNCTIONS_FOLDER = 'functions'
+const SLUG_RE = /^[a-z][a-z0-9-]*$/
+
+function assertValidSlugs(functions: Record<string, AnyRemoteFunctionDef>): void {
+  for (const slug of Object.keys(functions)) {
+    if (!SLUG_RE.test(slug)) {
+      throw new Error(
+        `defineRemoteDomain: invalid function slug "${slug}" — must match ${SLUG_RE}.`,
+      )
+    }
+  }
+}
+
+/**
+ * Contract half — since "functions as first-class defineSchema members", a
+ * standalone function's CONTRACT is declared in the SCHEMA (`defineSchema(...,
+ * { functions: { seed: func({ input, output }) } })`) and `compileDomain` builds
+ * the member refs from it; the SDK map supplies the HANDLER half. This check
+ * pins the two halves together at define time: every schema-declared function
+ * needs a handler, every handler a declaration — a drifted key fails loudly at
+ * authoring, never as a boot-time missing-identity or a dangling graph member.
+ */
+export function assertFunctionsMatchSchema(
+  schema: Schema,
+  functions: Record<string, AnyRemoteFunctionDef> | undefined,
+): void {
+  if (functions) assertValidSlugs(functions)
+  const declared = Object.keys(schema.functions ?? {})
+  const handled = Object.keys(functions ?? {})
+  const missingHandler = declared.filter((slug) => !handled.includes(slug))
+  const missingDecl = handled.filter((slug) => !declared.includes(slug))
+  if (missingHandler.length === 0 && missingDecl.length === 0) return
+  const parts: string[] = []
+  if (missingHandler.length > 0) {
+    parts.push(
+      `schema declares function(s) with no handler: ${missingHandler.map((s) => `"${s}"`).join(', ')}`,
+    )
+  }
+  if (missingDecl.length > 0) {
+    parts.push(
+      `handler(s) with no schema declaration: ${missingDecl.map((s) => `"${s}"`).join(', ')} ` +
+        `(declare them in defineSchema's \`functions\` group via \`func({ input, output })\`)`,
+    )
+  }
+  throw new Error(`defineRemoteDomain: functions/schema mismatch — ${parts.join('; ')}.`)
+}
+
+/**
+ * Impl/binding half — `FunctionSchema[]` for `serialize` plus the per-slug
+ * `FunctionBinding` map the worker mounts routes from. `ref` is the canonical
+ * `function.<slug>` member ref (matching `compiled.$.refs.functions`), so the
+ * serializer's per-member impl lookup finds it.
+ */
+export function buildFunctionSchemas(
+  functions: Record<string, AnyRemoteFunctionDef>,
+  url: string,
+  functionsFolder: string,
+): { schemas: FunctionSchema[]; bindings: Record<string, FunctionBinding> } {
+  const schemas: FunctionSchema[] = []
+  const bindings: Record<string, FunctionBinding> = {}
+  for (const [slug, def] of Object.entries(functions)) {
+    const binding = resolveBinding(def.binding, url, functionsFolder, slug)
+    bindings[slug] = binding
+    schemas.push({
+      ref: `function.${slug}`,
+      inputSchema: zodToJsonSchema(def.inputSchema),
+      outputSchema: zodToJsonSchema(def.outputSchema),
+      output: 'value',
+      binding,
+    })
+  }
+  return { schemas, bindings }
+}

package/src/domain/extend-views.ts

@@ -0,0 +1,151 @@
+/**
+ * Materialize the `views` map (`defineView` entries) into the two halves a view
+ * DOMAIN MEMBER contributes — mirroring `extend-functions.ts`:
+ *
+ *   - `ViewDeclarations` — the CONTRACT half, fed to `compileDomain`'s members
+ *     arg. The member ref (`view.<slug>`), the layout (`/<origin>/views/<slug>`),
+ *     and the `of_domain` edge slug all derive from the map key.
+ *   - `ViewSchema[]` + per-slug `FunctionBinding` — the IMPL half, fed to
+ *     `serialize`. A view carries more than a function: a `UI.handshake` mode and
+ *     `view_for` target edges (resolved here to graph paths). The worker route is
+ *     `<url>/<viewsFolder>/<slug>`, DECOUPLED from the graph layout.
+ *
+ * A view is NOT a core/instance node: the kernel-core serializer attaches it to
+ * the Domain via `of_domain` (slug `view.<slug>`) and emits its `view_for` edges,
+ * so this module never touches `Core`.
+ */
+
+import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
+import type { ViewDeclarations, ViewSchema } from '@astrale-os/kernel-core/domain'
+import type { Schema } from '@astrale-os/kernel-dsl'
+
+import { DomainPaths } from '@astrale-os/kernel-core/domain'
+import { buildDefOriginMap, scanImportedDefs } from '@astrale-os/kernel-core/domain'
+import {
+  buildDefDescriptorMap,
+  isAbstract,
+  isCorePath,
+  isSelfMarker,
+  type EdgeEndpoint,
+} from '@astrale-os/kernel-dsl'
+
+import type { ViewDef } from '../define/view'
+
+import { joinWorkerPath, resolveBinding } from './binding'
+
+/**
+ * Default URL segment for a view's worker route (`<url>/views/<slug>`). Names the
+ * HTTP route only — the graph layout (`/<origin>/views/<slug>`) is a fixed kernel
+ * convention, independent of this.
+ */
+export const DEFAULT_VIEWS_FOLDER = 'views'
+const SLUG_RE = /^[a-z][a-z0-9-]*$/
+
+// oxlint-disable-next-line no-explicit-any
+type AnyViewDef = ViewDef<any>
+
+function assertValidSlugs(views: Record<string, AnyViewDef>): void {
+  for (const slug of Object.keys(views)) {
+    if (!SLUG_RE.test(slug)) {
+      throw new Error(`defineRemoteDomain: invalid view slug "${slug}" — must match ${SLUG_RE}.`)
+    }
+  }
+}
+
+/** Enforce ViewDef's documented exclusivity: `mount` cannot combine with `render`/`binding`. */
+function assertExclusivity(slug: string, def: AnyViewDef): void {
+  if (def.mount && (def.render || def.binding)) {
+    throw new Error(
+      `defineRemoteDomain: view "${slug}" sets \`mount\` together with ` +
+        `${def.render ? '`render`' : '`binding`'} — they are mutually exclusive.`,
+    )
+  }
+}
+
+/**
+ * Contract half — one declaration per `views` map key, for `compileDomain`'s
+ * `views` arg. The slug drives ref/path/of_domain; impl/binding/view_for arrive
+ * at serialize.
+ */
+export function buildViewDeclarations(views: Record<string, AnyViewDef>): ViewDeclarations {
+  assertValidSlugs(views)
+  const out: Record<string, { slug: string }> = {}
+  for (const slug of Object.keys(views)) out[slug] = { slug }
+  return out
+}
+
+/**
+ * Impl half — `ViewSchema[]` for `serialize` plus the per-slug `FunctionBinding`
+ * map the worker mounts routes from. `viewFor` markers are resolved here to
+ * concrete target paths (class meta-nodes) because the kernel-core serializer is
+ * pure and does not resolve `defineCore` endpoints.
+ */
+export function buildViewSchemas(
+  views: Record<string, AnyViewDef>,
+  url: string,
+  viewsFolder: string,
+  schema: Schema,
+): { schemas: ViewSchema[]; bindings: Record<string, FunctionBinding> } {
+  const schemas: ViewSchema[] = []
+  const bindings: Record<string, FunctionBinding> = {}
+  for (const [slug, def] of Object.entries(views)) {
+    assertExclusivity(slug, def)
+    // `mount` is a worker-relative SPA path → `<url><mount>`; otherwise the
+    // default/overridden `<url>/<viewsFolder>/<slug>`.
+    const binding = def.mount
+      ? { remoteUrl: joinWorkerPath(url, def.mount) }
+      : resolveBinding(def.binding, url, viewsFolder, slug)
+    bindings[slug] = binding
+    // Inline `render` views ship no shell client → default handshake 'none'.
+    const handshake = def.handshake ?? (def.render ? 'none' : undefined)
+    schemas.push({
+      ref: `view.${slug}`,
+      name: slug,
+      binding,
+      ...(handshake ? { handshake } : {}),
+      viewFor: resolveViewForTargets(def.viewFor, schema),
+    })
+  }
+  return { schemas, bindings }
+}
+
+/**
+ * Resolve `defineView`'s `viewFor` endpoints to concrete graph path raws.
+ * Mirrors kernel-core `compileCore`'s endpoint resolution (the old channel that
+ * carried view_for as core edges): `selfOf(Def)` → the def's class/interface
+ * meta-node `/<declaringDomain>/{class,interface}.<Name>/self`; a `CorePath`
+ * string → its anchored graph path. Empty when the view targets nothing.
+ */
+function resolveViewForTargets(
+  viewFor: EdgeEndpoint | readonly EdgeEndpoint[] | undefined,
+  schema: Schema,
+): string[] {
+  if (!viewFor) return []
+  const targets = Array.isArray(viewFor) ? viewFor : [viewFor]
+  if (targets.length === 0) return []
+
+  const descriptorMap = buildDefDescriptorMap(schema)
+  const defOrigins = buildDefOriginMap(schema, scanImportedDefs(schema))
+
+  return targets.map((target) => {
+    if (isSelfMarker(target)) {
+      const def = target.__def
+      const desc = descriptorMap.get(def)
+      if (!desc) {
+        throw new Error(
+          'defineView: `viewFor: selfOf(...)` references a def that is neither in this ' +
+            "schema nor any of its `imports`. Add the def's schema to `imports`.",
+        )
+      }
+      const origin = defOrigins.get(def) ?? schema.domain
+      const dp = DomainPaths.of(origin)
+      return isAbstract(def) ? dp.interface(desc.name).raw : dp.class(desc.name).raw
+    }
+    if (isCorePath(target)) {
+      return DomainPaths.of(schema.domain).corePath(target).raw
+    }
+    throw new Error(
+      'defineView: unsupported `viewFor` endpoint — use `selfOf(Class)` or a CorePath.',
+    )
+  })
+}

package/src/index.ts

@@ -1,6 +1,9 @@
 // ─── Method authoring ────────────────────────────────────────────────────
 export type {
+  MethodParams,
+  MethodResult,
   AuthForPolicy,
+  GraphApi,
   Kernel,
   KernelForAuth,
   RemoteContext,
@@ -19,9 +22,9 @@ export { remoteMethod, remoteClassMethods, remoteInterfaceMethods } from './meth
 // (preferred) use `domainWorkerEntry` from `@astrale-os/sdk/server`.
 export { defineDomain, deploy, defineAdapter } from './config'
 export type {
-  ClientBinding,
   DefineDomainConfig,
   DomainDefinition,
+  DomainManifest,
   DeployConfig,
   AdapterSpec,
   DeployCtx,
@@ -35,6 +38,25 @@ export type {
 // ─── Install graph (advanced) ────────────────────────────────────────────
 export { buildInstallGraph, buildInstallGraphHash } from './domain'
 
+// ─── Graph patching (advanced) ────────────────────────────────────────
+// Author-facing patch types, re-exported from kernel-core (the single source).
+// Build a `Patch` and feed it straight to `ctx.kernel.mutate(patch)` (it implements
+// `PatchData`); the graph sugar itself lives in `@astrale-os/kernel-client/graph`,
+// flattened onto `ctx.kernel`, and `function.mutate` validates every patch kernel-side
+// against kernel-core's `patchDataSchema` — no client-side re-validation needed.
+export { AbsolutePath, Patch, Path } from '@astrale-os/kernel-core'
+export { ClassPath } from '@astrale-os/kernel-core/domain'
+export type {
+  EdgeCreate,
+  EdgeDelete,
+  EdgeMatcher,
+  EdgeUpdate,
+  NodeCreate,
+  NodeDelete,
+  NodeUpdate,
+  PatchData,
+} from '@astrale-os/kernel-core'
+
 // ─── Declarative resource helpers ────────────────────────────────────────
 // Author Views (iframe-mountable) and RemoteFunctions (standalone callables)
 // at the domain definition site. Each `defineView` / `defineRemoteFunction`
@@ -54,10 +76,10 @@ export type { ViewDef, ViewRenderContext, RemoteFunctionDef, RemoteFunctionConte
 // runtime import from '@astrale-os/sdk/server' directly.
 
 // ─── Deploy ──────────────────────────────────────────────────────────────
-// `deployCheck` and `hashSpecFile` use Node-only modules (`node:crypto`,
-// `node:fs`, `node:child_process`) at module load time. Exporting them from
-// the barrel poisons browser bundlers (Vite/esbuild) that transitively load
-// every re-export. Consumers that need them import from './deploy' directly.
+// `deployCheck` uses Node-only modules (`node:path`, `node:child_process`) at
+// module load time. Exporting it from the barrel poisons browser bundlers
+// (Vite/esbuild) that transitively load every re-export. Consumers that need it
+// import from './deploy' directly.
 export { MetaSchema } from './deploy/meta'
 export type { Meta } from './deploy/meta'
 
@@ -75,7 +97,14 @@ export type {
 
 // ─── Auth ────────────────────────────────────────────────────────────────
 export type { RemoteIdentityConfig, AuthenticateResult } from './auth'
-export { authenticateRequest, buildComposedGrant, signCredential } from './auth'
+export type { DomainIssuer, MintIssuedParams } from './auth'
+export {
+  authenticateRequest,
+  bindSelfKernel,
+  buildComposedGrant,
+  makeSelfKernel,
+  signCredential,
+} from './auth'
 export { AuthMissingError, AuthInvalidError } from './auth'
 export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './auth'
 export type {
@@ -96,4 +125,4 @@ export {
   SdkValidationError,
   SdkResultValidationError,
 } from './dispatch'
-export type { SelfResult, CallRemoteFn, KernelCaller } from './dispatch'
+export type { SelfResult, TypedSelf, CallRemoteFn, KernelCaller } from './dispatch'

package/src/method/class.ts

@@ -25,7 +25,7 @@ import type {
 } from '@astrale-os/kernel-core/domain'
 import type { ImplementableOwnKeys, Schema } from '@astrale-os/kernel-dsl'
 
-import type { SelfResult } from '../dispatch/self'
+import type { TypedSelf } from '../dispatch/self'
 import type { MethodImpl, RemoteHandler } from './single'
 
 /** Per-class method implementations for a remote domain. */
@@ -51,12 +51,16 @@ type InterfaceMethodHandler<
   ? InterfaceMethodDefs<S, K>[M] extends { readonly config: infer MC }
     ? MC extends { readonly static: true }
       ? RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, undefined, TDeps>
-      : // Non-static interface methods receive the same `self` the dispatcher
-        // actually delivers — `SelfResult` ({ path, id?, node() }) — exactly as
-        // the class-method path (`MethodImpl`) does. Declared props are NOT
-        // hydrated onto `self` (a node-typed self would be unsound); a handler
-        // that needs the node's class/props reads them via `self.node()`.
-        RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, SelfResult, TDeps>
+      : // Non-static interface methods receive the schema-typed `self` keyed by
+        // THIS interface's def — `self.node()` binds to a `BoundNode<D>` with
+        // short-keyed, def-typed `props`, `self.call` is typed, exactly as the
+        // class-method path (`MethodImpl`) does.
+        RemoteHandler<
+          ResolveParams<MC>,
+          ResolveReturn<MC>,
+          TypedSelf<DefForInterface<S, K>, S>,
+          TDeps
+        >
     : never
   : never
 

package/src/method/context.ts

@@ -12,8 +12,11 @@ import type { FnMap } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
 import type { AuthContext } from '@astrale-os/kernel-core'
 
+import type { DomainIssuer } from '../auth/issuer-mint'
 import type { CallRemoteFn } from '../dispatch/call-remote'
 
+export type { GraphApi } from '@astrale-os/kernel-client/graph'
+
 /**
  * The kernel session a handler holds: a credential-bound view over the parent
  * kernel — the FULL dispatch surface (`call`/`stream`/`binary`/`signal`,
@@ -80,11 +83,24 @@ export type RemoteContext<
    * credential `union(delegation, self)`. Its nullability is `{@link
    * KernelForAuth}` of the method's `auth`: non-null for the default
    * `'required'`, `… | null` for `'optional'`, `null` for `'public'`. Use for
-   * kernel syscalls + same-domain methods. For ANOTHER worker's remote method
-   * use {@link RemoteContext.callRemote} — `kernel.call` to a remote method
-   * fails the audience check.
+   * kernel syscalls + same-domain methods, and for the typed graph read/write
+   * sugar flattened onto it (`kernel.get` / `kernel.children` / `kernel.query`,
+   * plus `kernel.createNode` / `kernel.updateNode` /
+   * `kernel.deleteNode` / `kernel.createEdge` / `kernel.updateEdge` /
+   * `kernel.deleteEdge` / `kernel.mutate(patch)`) over the `function.get` /
+   * `function.mutate` syscalls. For ANOTHER worker's remote method use
+   * {@link RemoteContext.callRemote} — `kernel.call` to a remote method fails the
+   * audience check.
    */
   kernel: TKernel
+  /**
+   * Mint seam for identities THIS DOMAIN issues (`iss` = this worker): sign a
+   * credential for a domain-owned principal (an App identity, a role umbrella,
+   * a managed user) and optionally open a kernel session AS it. See
+   * {@link DomainIssuer}. The kernel enforces trust/frozen/grant rules — this
+   * only signs under the worker's own issuer.
+   */
+  issuer: DomainIssuer
   /**
    * Call another worker's remote method (a Function with `binding.remoteUrl`),
    * re-minting the credential for the target's audience so it isn't rejected at

package/src/method/index.ts

@@ -1,5 +1,11 @@
-export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext } from './context'
-export type { RemoteHandler, AnyRemoteHandler, MethodImpl } from './single'
+export type { AuthForPolicy, GraphApi, Kernel, KernelForAuth, RemoteContext } from './context'
+export type {
+  RemoteHandler,
+  AnyRemoteHandler,
+  MethodImpl,
+  MethodParams,
+  MethodResult,
+} from './single'
 export { remoteMethod } from './single'
 export type { ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl } from './class'
 export { remoteClassMethods, remoteInterfaceMethods } from './class'