@astrale-os/sdk 0.1.6 → 0.1.8

package/dist/cli/spec.js

@@ -0,0 +1,31 @@
+/**
+ * Build a diagnostic spec (wire graph + schema hash) from the project's
+ * `defineDomain` definition. This mirrors what the codegen'd worker assembles —
+ * but only for inspection / `/meta` provenance. The live install bundle is
+ * always produced by the worker at request time, so a failure here is non-fatal
+ * for dev/deploy (the CLI logs and continues) and fatal only for
+ * `astrale-domain build`, where the spec IS the product.
+ *
+ * The modules (`schema` / `methods` / `views` / `functions`) come straight off
+ * the definition — the SAME values the author wired into `defineDomain`, which
+ * the adapter codegen also assembles. One source, no second filesystem probe to
+ * drift from it.
+ */
+import { hashInstallGraph } from '@astrale-os/kernel-core/domain';
+import { buildInstallGraph, defineRemoteDomain } from '../domain';
+export async function buildProjectSpec(def, url) {
+    // The definition's module values are untyped against `RemoteDomainConfig` by
+    // nature (deps/schema generics erased on `DomainDefinition`); funnel them
+    // through ONE cast into the config shape `defineRemoteDomain` validates.
+    const config = {
+        schema: def.schema,
+        methods: def.methods,
+        ...(def.views ? { views: def.views } : {}),
+        ...(def.functions ? { remoteFunctions: def.functions } : {}),
+    };
+    const domain = defineRemoteDomain()(config);
+    const wire = buildInstallGraph(domain, url);
+    const schemaHash = await hashInstallGraph(wire);
+    return { wire: wire, schemaHash };
+}
+//# sourceMappingURL=spec.js.map

package/dist/cli/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../src/cli/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAKjE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAEjE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,GAAW;IAEX,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtB,CAAA;IAExC,MAAM,MAAM,GAAG,kBAAkB,EAAW,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,EAAE,IAAI,EAAE,IAA0C,EAAE,UAAU,EAAE,CAAA;AACzE,CAAC"}

package/dist/config/adapter.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The deployment-adapter contract.
+ *
+ * A deployment target = one npm package implementing `DomainAdapter<Params>`.
+ * The adapter is GENERIC over its own `Params` so envs AND provider settings
+ * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
+ * nothing like a Node adapter's `{ port }`). The CLI resolves
+ * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
+ * with the resolved params — install of the resulting URL and the `requires`
+ * check are generic and live in the CLI, never in the adapter.
+ *
+ * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
+ * what the CLI prints, what `astrale domain install <url>` consumes, and
+ * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
+ * in the contract asks an adapter to predict it ahead of time.
+ */
+/**
+ * Generic, target-independent domain metadata the CLI hands every adapter so
+ * it can codegen the worker entry. (Extends the bare `WatchCtx`/`DeployCtx` of
+ * the spec with the fields a real codegen needs.)
+ */
+export interface DomainInfo {
+    /**
+     * The domain's addressing name — the graph slug it mounts under (e.g.
+     * `'crm.acme.dev'`). NOT the cryptographic identity: the JWT `iss` is the
+     * worker's serving URL, pinned by the kernel at install time.
+     */
+    origin: string;
+    /** Cross-domain deps by origin — verified at install (CLI/kernel), not here. */
+    requires: readonly string[];
+    /** Optional Astrale Path called by the kernel after install (as __SYSTEM__). */
+    postInstall?: string;
+    /**
+     * Whether the domain declares any Views / standalone Functions / a client SPA
+     * — read from the `defineDomain` definition, NOT probed from the filesystem.
+     * The adapter codegen imports the corresponding module / mounts the SPA hook
+     * only when true. `hasClient` governs the WORKER's `/ui` hook specifically
+     * (present whenever the domain has a client, even on managed deploys that ship
+     * the built assets separately and pass no `clientDir`); the wrangler
+     * `assets.directory` binding tracks `clientDir` instead.
+     */
+    hasViews: boolean;
+    hasFunctions: boolean;
+    hasClient: boolean;
+    /**
+     * Whether the domain declares a `deps` mapper (`defineDomain({ deps })`).
+     * When true the adapter codegen imports it from the domain's fixed `deps`
+     * module and passes it to the worker entry; when false the worker passes the
+     * raw env straight through as `ctx.deps`. Read from the definition, never
+     * probed from the filesystem.
+     */
+    hasDeps: boolean;
+}
+export interface WatchCtx {
+    /** Absolute path to the domain project root. */
+    projectDir: string;
+    /** Absolute path where the CLI writes the diagnostic `spec.json`. */
+    specPath: string;
+    /** Absolute path to the client SPA dir, when the domain declares a `client`. */
+    clientDir?: string;
+    /** Flat secret map loaded from the env's `secrets` file — injected locally in dev. */
+    secrets: Record<string, string>;
+    /** Domain metadata for codegen. */
+    domain: DomainInfo;
+    /** The env key being watched (e.g. 'dev'). */
+    env: string;
+    /** Invoked by the adapter on every hot-reload so the CLI can re-log. */
+    onReload(): void;
+}
+export interface DeployCtx {
+    projectDir: string;
+    specPath: string;
+    /** Flat secret map loaded from the env's `secrets` file (gitignored). */
+    secrets: Record<string, string>;
+    clientDir?: string;
+    domain: DomainInfo;
+    /** The env key being deployed (e.g. 'dev' | 'prod' | 'canary'). */
+    env: string;
+}
+/** A running local watch — exposes its URL and a stop handle. */
+export interface WatchHandle {
+    /** Local URL the worker is reachable at (e.g. http://localhost:8787). */
+    url: string;
+    stop(): Promise<void>;
+}
+/** A completed deploy — the authoritative public URL. */
+export interface DeployResult {
+    url: string;
+    /**
+     * Adapter-specific next-steps block printed INSTEAD of the CLI's default
+     * "install on an instance" footer — managed deploys already installed the
+     * domain, so the default hint is wrong there. Pre-indented plain lines.
+     */
+    nextSteps?: string;
+}
+export interface DomainAdapter<Params> {
+    /** 'astrale-host' | 'cloudflare' | 'node' | … */
+    name: string;
+    /** Resolve an env key to this adapter's typed params. Throws on unknown key. */
+    params(env: string): Params;
+    /** Local + hot-reload (watch) → controllable handle. Orthogonal to env. */
+    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
+    /**
+     * Optional: re-run codegen for an ALREADY-RUNNING `watch` after
+     * `astrale.config.ts` changed — same shape as `watch` but it must NOT spawn
+     * anything: it only rewrites the generated files, and the running dev server
+     * (which watches them, e.g. `wrangler dev` on its `--config`) picks them up.
+     * Adapters without it fall back to "restart to apply config changes".
+     */
+    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
+    /** Build + bundle + ship (the adapter owns ITS build) → authoritative URL. */
+    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
+    /**
+     * Optional: the path (relative to the project root) of the gitignored secrets
+     * file for these params. The CLI loads it and passes the parsed map as
+     * `ctx.secrets` — keeping secret-file loading generic while the path stays
+     * provider-typed. Return `undefined` for "no secrets file".
+     */
+    secretsFile?(params: Params): string | undefined;
+}
+/**
+ * Spec passed to `defineAdapter` — identical to `DomainAdapter` minus the
+ * `params(env)` resolver, which the helper attaches from `envs`. Custom adapter
+ * authors use this so they never re-implement env→params resolution.
+ */
+export interface AdapterSpec<Params> {
+    name: string;
+    /** The provider-typed env map (`{ dev: {...}, prod: {...}, … }`). */
+    envs: Record<string, Params>;
+    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
+    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
+    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
+    secretsFile?(params: Params): string | undefined;
+}
+/**
+ * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
+ * resolver that throws a clear error on an unknown key (listing the valid ones).
+ */
+export declare function defineAdapter<Params>(spec: AdapterSpec<Params>): DomainAdapter<Params>;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/config/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,mCAAmC;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,QAAQ,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa,CAAC,MAAM;IACnC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IAEZ,gFAAgF;IAChF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAE3B,2EAA2E;IAC3E,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAE1D;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzD,8EAA8E;IAC9E,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1D,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7D,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAoBtF"}

package/dist/config/adapter.js

@@ -0,0 +1,40 @@
+/**
+ * The deployment-adapter contract.
+ *
+ * A deployment target = one npm package implementing `DomainAdapter<Params>`.
+ * The adapter is GENERIC over its own `Params` so envs AND provider settings
+ * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
+ * nothing like a Node adapter's `{ port }`). The CLI resolves
+ * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
+ * with the resolved params — install of the resulting URL and the `requires`
+ * check are generic and live in the CLI, never in the adapter.
+ *
+ * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
+ * what the CLI prints, what `astrale domain install <url>` consumes, and
+ * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
+ * in the contract asks an adapter to predict it ahead of time.
+ */
+/**
+ * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
+ * resolver that throws a clear error on an unknown key (listing the valid ones).
+ */
+export function defineAdapter(spec) {
+    const keys = Object.keys(spec.envs);
+    return {
+        name: spec.name,
+        params(env) {
+            const params = spec.envs[env];
+            if (params === undefined) {
+                const known = keys.length ? keys.join(', ') : '(none)';
+                throw new Error(`Adapter "${spec.name}": unknown env "${env}". Known envs: ${known}. ` +
+                    `Add it to the adapter's env map in astrale.config.ts.`);
+            }
+            return params;
+        },
+        watch: spec.watch,
+        deploy: spec.deploy,
+        ...(spec.regenerate ? { regenerate: spec.regenerate } : {}),
+        ...(spec.secretsFile ? { secretsFile: spec.secretsFile } : {}),
+    };
+}
+//# sourceMappingURL=adapter.js.map

package/dist/config/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoIH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAS,IAAyB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAW;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;gBACtD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,IAAI,mBAAmB,GAAG,kBAAkB,KAAK,IAAI;oBACpE,uDAAuD,CAC1D,CAAA;YACH,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAA;AACH,CAAC"}

package/dist/config/define-domain.d.ts

@@ -0,0 +1,112 @@
+/**
+ * `defineDomain` — the WORKER-SAFE definition of a domain: what the domain *is*
+ * (its `schema`, `methods`, `deps`, `views`, standalone `functions`, `client`
+ * SPA) plus its addressing identity (`origin`, `requires`, `postInstall`). It
+ * deliberately carries NO deployment adapter — the adapter (`cloudflare(...)`,
+ * `astrale(...)`) is node-only code (filesystem, wrangler) that must never enter
+ * the worker bundle. The author wires this in a `domain.ts` the generated worker
+ * imports directly, then attaches the adapter separately with `deploy(domain,
+ * adapter)` in `astrale.config.ts` (see `./deploy`).
+ *
+ * The modules are wired EXPLICITLY here — imported and passed in — not
+ * discovered from magic folder names. A renamed or mistyped module is a compile
+ * error at this call site, never a silently-missing worker route. The adapter
+ * reads this one definition for everything it codegens; there is no second
+ * filesystem probe to drift from it. `defineDomain` itself builds no server and
+ * boots no kernel — it validates and packages the declaration.
+ */
+import type { Schema } from '@astrale-os/kernel-dsl';
+import type { RemoteFunctionDef, ViewDef } from '../define';
+import type { SchemaMethodsImpl } from '../method';
+type AnyViewDef = ViewDef<any>;
+type AnyFunctionDef = RemoteFunctionDef<any, any, any>;
+/**
+ * The domain's client SPA binding. Its presence is the whole signal — there is
+ * no `existsSync('client/')` probe. `dir` is the project-relative source folder
+ * (e.g. `'client'`); the worker serves its built SPA under `/ui` via its Assets
+ * binding. Always written out explicitly (`client: { dir: 'client' }`) — there
+ * is no boolean shorthand, so the source folder is never implicit.
+ */
+export type ClientBinding = {
+    dir: string;
+};
+export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
+    /** The domain schema (from `schema/`). Its `.domain` seeds the default origin. */
+    schema: S;
+    /**
+     * The domain's method implementations (from `methods/`), one per schema
+     * method. Typed against `schema` — an unimplemented or misnamed method is a
+     * compile error here.
+     */
+    methods: SchemaMethodsImpl<S, TDeps>;
+    /**
+     * Map the worker `env` to the handler dependency container (`ctx.deps`).
+     * Run ONCE per cold isolate per serving URL (the built app is cached), NOT
+     * per request — so it's the place to construct ports/clients once instead of
+     * re-deriving them in every handler. Its return type IS `TDeps`: type it the
+     * shape your `methods` read (e.g. `(env) => ({ platform: buildPlatform(env) })`)
+     * and the methods get the rich container, not raw env. The same value reaches
+     * view/function handlers and the `install.authorize` hook.
+     *
+     * Omit for the common case: `env` is passed straight through (`TDeps = TEnv`),
+     * so existing domains are unaffected. The function itself is imported by the
+     * generated worker from a fixed `deps` module, mirroring `methods` — wire it
+     * here so the type check binds `env → TDeps` and the adapter knows to emit it.
+     */
+    deps?: (env: TEnv, url: string) => TDeps;
+    /**
+     * The domain's Views (iframe-mountable UIs), keyed by slug. Omit when the
+     * domain has none. Each becomes a `View` node + a worker route.
+     */
+    views?: Record<string, AnyViewDef>;
+    /**
+     * The domain's standalone Functions (callables not bound to a class), keyed
+     * by slug. Omit when the domain has none.
+     */
+    functions?: Record<string, AnyFunctionDef>;
+    /**
+     * The domain's client SPA, e.g. `{ dir: 'client' }`. Its presence enables it
+     * (no folder probing); `dir` is the project-relative source folder, built and
+     * served under `/ui`. Omit for a domain with no SPA.
+     */
+    client?: ClientBinding;
+    /**
+     * The domain's **addressing name** (the graph slug it mounts under, e.g.
+     * `'crm.acme.dev'`). Defaults to `schema.domain`. Must be a name, never a
+     * URL. This is **NOT** the cryptographic identity: the `iss` is the worker's
+     * **serving URL**, pinned by the kernel to the URL it fetched the domain at
+     * during install (and verified against that URL's JWKS). `origin` is a free
+     * addressing label, only required to be unique in the graph.
+     */
+    origin?: string;
+    /** Cross-domain deps, by origin. Verified present on the instance at install. */
+    requires?: readonly string[];
+    /**
+     * Astrale Path (usually an AbsolutePath to a `functions/` entry) the kernel
+     * calls once after install, as __SYSTEM__ — where the domain posts its own
+     * grants / seed.
+     */
+    postInstall?: string;
+}
+export interface DomainDefinition {
+    schema: Schema;
+    methods: SchemaMethodsImpl<Schema, any>;
+    /**
+     * env → deps mapper, when the author supplied one. Held loosely (the worker
+     * imports the real function from its own `deps` module); the CLI reads only
+     * its PRESENCE to set `DomainInfo.hasDeps`, the codegen signal.
+     */
+    deps?: (env: any, url: string) => any;
+    views?: Record<string, ViewDef>;
+    functions?: Record<string, AnyFunctionDef>;
+    /** Normalized client binding (resolved `dir`), or absent when the domain has no SPA. */
+    client?: {
+        dir: string;
+    };
+    origin: string;
+    requires: readonly string[];
+    postInstall?: string;
+}
+export declare function defineDomain<S extends Schema, TDeps, TEnv = unknown>(config: DefineDomainConfig<S, TDeps, TEnv>): DomainDefinition;
+export {};
+//# sourceMappingURL=define-domain.d.ts.map

package/dist/config/define-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-domain.d.ts","sourceRoot":"","sources":["../../src/config/define-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAIpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAQlD,KAAK,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;AAC9B,KAAK,cAAc,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3C,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO;IACzE,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAA;IACT;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,OAAO,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC;;;;OAIG;IAEH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,GAAG,CAAA;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC1C,wFAAwF;IACxF,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,EAClE,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GACzC,gBAAgB,CAsDlB"}

package/dist/config/define-domain.js

@@ -0,0 +1,98 @@
+/**
+ * `defineDomain` — the WORKER-SAFE definition of a domain: what the domain *is*
+ * (its `schema`, `methods`, `deps`, `views`, standalone `functions`, `client`
+ * SPA) plus its addressing identity (`origin`, `requires`, `postInstall`). It
+ * deliberately carries NO deployment adapter — the adapter (`cloudflare(...)`,
+ * `astrale(...)`) is node-only code (filesystem, wrangler) that must never enter
+ * the worker bundle. The author wires this in a `domain.ts` the generated worker
+ * imports directly, then attaches the adapter separately with `deploy(domain,
+ * adapter)` in `astrale.config.ts` (see `./deploy`).
+ *
+ * The modules are wired EXPLICITLY here — imported and passed in — not
+ * discovered from magic folder names. A renamed or mistyped module is a compile
+ * error at this call site, never a silently-missing worker route. The adapter
+ * reads this one definition for everything it codegens; there is no second
+ * filesystem probe to drift from it. `defineDomain` itself builds no server and
+ * boots no kernel — it validates and packages the declaration.
+ */
+import { DomainOrigin, extractDomainSlug } from '@astrale-os/kernel-core/domain';
+export function defineDomain(config) {
+    const rawOrigin = config.origin ?? schemaDomain(config.schema);
+    if (!rawOrigin) {
+        throw new Error('defineDomain: could not resolve `origin`. Set it explicitly or give the ' +
+            'schema a base domain (`defineSchema("crm.acme.dev", …)`).');
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(rawOrigin)) {
+        throw new Error(`defineDomain: \`origin\` must be a stable name (e.g. "crm.acme.dev"), not a URL — got "${rawOrigin}". ` +
+            'The deployment URL is an output of deploy, not the identity.');
+    }
+    // Canonicalize + validate the origin exactly as the kernel does (lowercased,
+    // FQDN-like, matches DOMAIN_ORIGIN_RE). Failing HERE gives a clear authoring-
+    // time error instead of a cryptic failure deep in codegen / install, and makes
+    // `origin` the same lowercased form the kernel stores graph nodes under.
+    let origin;
+    try {
+        origin = DomainOrigin(rawOrigin);
+    }
+    catch {
+        throw new Error(`defineDomain: invalid \`origin\` "${rawOrigin}". Use a lowercase FQDN-like slug ` +
+            '(letters, digits, ".", "_", "-"), e.g. "crm.acme.dev".');
+    }
+    // `requires` entries are domain origins — validate them with the same rule as
+    // `origin` so a URL or mixed-case entry fails at authoring time, not install.
+    const requires = (config.requires ?? []).map((dep) => {
+        try {
+            return DomainOrigin(dep);
+        }
+        catch {
+            throw new Error(`defineDomain: invalid \`requires\` entry "${dep}". Use the dependency's origin slug ` +
+                '(lowercase FQDN-like, e.g. "dist.astrale.ai"), not a URL.');
+        }
+    });
+    return {
+        schema: config.schema,
+        methods: config.methods,
+        ...(config.deps ? { deps: config.deps } : {}),
+        ...(config.views ? { views: config.views } : {}),
+        ...(config.functions ? { functions: config.functions } : {}),
+        ...(config.client ? { client: config.client } : {}),
+        origin,
+        requires,
+        ...(config.postInstall
+            ? { postInstall: normalizePostInstall(config.postInstall, origin) }
+            : {}),
+    };
+}
+/**
+ * Validate a `postInstall` hook path and align its leading origin segment with
+ * the canonical (lowercased) origin. Only the typed colon forms are accepted
+ * (`/:<origin>:class.X:seed`, `/:<origin>:interface.Ops:seed`) — mirroring the
+ * kernel's own origin guard, which refuses absolute tree paths because they
+ * cannot prove their origin from the string alone. The hook is often authored
+ * as `` `/:${schema.domain}:…` `` where `schema.domain` keeps its source
+ * casing, but the kernel stores graph nodes (and runs its guard) under the
+ * lowercased origin — so the origin segment is re-stamped canonical. Rejects a
+ * tree path or one pointing at a different domain (the kernel calls the hook
+ * as __SYSTEM__ and refuses a foreign target).
+ */
+function normalizePostInstall(postInstall, origin) {
+    const slug = extractDomainSlug(postInstall);
+    if (slug === null) {
+        throw new Error(`defineDomain: \`postInstall\` must be a typed colon-path under "/:${origin}" ` +
+            `(e.g. "/:${origin}:class.Note:seed" or "/:${origin}:interface.Ops:seed"); ` +
+            `absolute tree paths are not accepted — got "${postInstall}".`);
+    }
+    if (slug.toLowerCase() !== origin) {
+        throw new Error(`defineDomain: \`postInstall\` "${postInstall}" must resolve under the domain origin ` +
+            `"/${origin}" — the kernel calls it as __SYSTEM__ and refuses a hook pointing at another domain.`);
+    }
+    // Re-stamp the origin segment with its canonical (lowercased) form.
+    return postInstall.startsWith('/:')
+        ? `/:${origin}${postInstall.slice(2 + slug.length)}`
+        : `/${origin}${postInstall.slice(1 + slug.length)}`;
+}
+function schemaDomain(schema) {
+    const value = schema.domain;
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=define-domain.js.map

package/dist/config/define-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-domain.js","sourceRoot":"","sources":["../../src/config/define-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAuGhF,MAAM,UAAU,YAAY,CAC1B,MAA0C;IAE1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0FAA0F,SAAS,KAAK;YACtG,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qCAAqC,SAAS,oCAAoC;YAChF,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,sCAAsC;gBACpF,2DAA2D,CAC9D,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAsC;QACtD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAgC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAgC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,WAAmB,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qEAAqE,MAAM,IAAI;YAC7E,YAAY,MAAM,2BAA2B,MAAM,yBAAyB;YAC5E,+CAA+C,WAAW,IAAI,CACjE,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kCAAkC,WAAW,yCAAyC;YACpF,KAAK,MAAM,sFAAsF,CACpG,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,KAAK,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE;QACpD,CAAC,CAAC,IAAI,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAI,MAA0C,CAAC,MAAM,CAAA;IAChE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC"}

package/dist/config/deploy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `deploy` — bind a worker-safe `DomainDefinition` to a deployment adapter,
+ * producing the value `astrale.config.ts` default-exports for the CLI.
+ *
+ * The split exists to keep the worker bundle clean: `defineDomain` (in the
+ * author's `domain.ts`) carries only worker-safe modules and is what the
+ * generated worker imports; the adapter (`cloudflare(...)` / `astrale(...)`) is
+ * node-only code that the worker must never pull in. `deploy(domain, adapter)`
+ * is authored in `astrale.config.ts` — a Node-only module the CLI loads but the
+ * worker never imports — so the adapter stays out of the bundle.
+ *
+ *   export const domain = defineDomain({ schema, methods, deps, views, client })
+ *
+ *   import { domain } from './domain'
+ *   export default deploy(domain, cloudflare({ dev, prod }))
+ *
+ * The returned shape is just the definition with `adapter` attached — exactly
+ * what the CLI already reads (`def.adapter`, `def.origin`, `def.schema`, …), so
+ * the loader is unchanged.
+ */
+import type { DomainAdapter } from './adapter';
+import type { DomainDefinition } from './define-domain';
+/** A domain definition bound to its deployment adapter — the CLI's input. */
+export interface DeployConfig<Params = unknown> extends DomainDefinition {
+    adapter: DomainAdapter<Params>;
+}
+export declare function deploy<Params>(domain: DomainDefinition, adapter: DomainAdapter<Params>): DeployConfig<Params>;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/config/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/config/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,YAAY,CAAC,MAAM,GAAG,OAAO,CAAE,SAAQ,gBAAgB;IACtE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC/B;AAED,wBAAgB,MAAM,CAAC,MAAM,EAC3B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAC7B,YAAY,CAAC,MAAM,CAAC,CAEtB"}

package/dist/config/deploy.js

@@ -0,0 +1,24 @@
+/**
+ * `deploy` — bind a worker-safe `DomainDefinition` to a deployment adapter,
+ * producing the value `astrale.config.ts` default-exports for the CLI.
+ *
+ * The split exists to keep the worker bundle clean: `defineDomain` (in the
+ * author's `domain.ts`) carries only worker-safe modules and is what the
+ * generated worker imports; the adapter (`cloudflare(...)` / `astrale(...)`) is
+ * node-only code that the worker must never pull in. `deploy(domain, adapter)`
+ * is authored in `astrale.config.ts` — a Node-only module the CLI loads but the
+ * worker never imports — so the adapter stays out of the bundle.
+ *
+ *   export const domain = defineDomain({ schema, methods, deps, views, client })
+ *
+ *   import { domain } from './domain'
+ *   export default deploy(domain, cloudflare({ dev, prod }))
+ *
+ * The returned shape is just the definition with `adapter` attached — exactly
+ * what the CLI already reads (`def.adapter`, `def.origin`, `def.schema`, …), so
+ * the loader is unchanged.
+ */
+export function deploy(domain, adapter) {
+    return { ...domain, adapter };
+}
+//# sourceMappingURL=deploy.js.map

package/dist/config/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/config/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,MAAM,UAAU,MAAM,CACpB,MAAwB,EACxB,OAA8B;IAE9B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@astrale-os/sdk` config surface — the author-facing declaration of a
+ * standalone domain (`astrale.config.ts`) and the deployment-adapter contract.
+ *
+ *   import { defineDomain, deploy } from '@astrale-os/sdk'
+ *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
+ *
+ * `defineDomain` (in `domain.ts`) declares the WORKER-SAFE domain — what it is +
+ * its identity, no adapter. `deploy(domain, adapter)` (in `astrale.config.ts`)
+ * binds it to a deployment target; the `astrale-domain` bin (folded into this
+ * package — see `../cli`) reads that default export and drives the adapter.
+ * Neither builds a server nor boots a kernel — they validate and package the
+ * declaration.
+ */
+export { defineDomain } from './define-domain';
+export type { ClientBinding, DefineDomainConfig, DomainDefinition } from './define-domain';
+export { deploy } from './deploy';
+export type { DeployConfig } from './deploy';
+export { defineAdapter } from './adapter';
+export type { AdapterSpec, DeployCtx, DeployResult, DomainAdapter, DomainInfo, WatchCtx, WatchHandle, } from './adapter';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE1F,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,YAAY,EACV,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,WAAW,CAAA"}

package/dist/config/index.js

@@ -0,0 +1,18 @@
+/**
+ * `@astrale-os/sdk` config surface — the author-facing declaration of a
+ * standalone domain (`astrale.config.ts`) and the deployment-adapter contract.
+ *
+ *   import { defineDomain, deploy } from '@astrale-os/sdk'
+ *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
+ *
+ * `defineDomain` (in `domain.ts`) declares the WORKER-SAFE domain — what it is +
+ * its identity, no adapter. `deploy(domain, adapter)` (in `astrale.config.ts`)
+ * binds it to a deployment target; the `astrale-domain` bin (folded into this
+ * package — see `../cli`) reads that default export and drives the adapter.
+ * Neither builds a server nor boots a kernel — they validate and package the
+ * declaration.
+ */
+export { defineDomain } from './define-domain';
+export { deploy } from './deploy';
+export { defineAdapter } from './adapter';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAG9C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAGjC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}

package/dist/define/remote-function.d.ts

@@ -22,7 +22,8 @@ import type { AuthContext } from '@astrale-os/kernel-core';
 import type { Context } from 'hono';
 import type { z } from 'zod';
 import type { CallRemoteFn } from '../dispatch/call-remote';
-export type RemoteFunctionContext<TParams, TDeps = unknown> = {
+import type { KernelForAuth } from '../method/context';
+export type RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null> = {
     /** Validated params (Zod-checked against `inputSchema`). */
     params: TParams;
     /** Hono request context — escape hatch for headers, raw body, etc. */
@@ -34,10 +35,12 @@ export type RemoteFunctionContext<TParams, TDeps = unknown> = {
     /**
      * `BoundClientSessionView` to the parent kernel, bound to the composed
      * credential `union(delegation, self)` — same shape as `RemoteContext.kernel`
-     * for `remoteMethod`. `null` when `auth: 'public'`, or `auth: 'optional'`
-     * with no inbound credential.
+     * for `remoteMethod`. Nullability follows {@link KernelForAuth} of the
+     * function's `auth`: non-null for the default `'required'`, `… | null` for
+     * `'optional'`, `null` for `'public'` (use {@link RemoteFunctionContext.selfKernel}
+     * there, after verifying the upstream).
      */
-    kernel: BoundClientSessionView<FnMap> | null;
+    kernel: TKernel;
     /**
      * Call another worker's remote method, re-minting the credential for the
      * target's audience. Same contract as {@link RemoteContext.callRemote}: throws
@@ -56,7 +59,7 @@ export type RemoteFunctionContext<TParams, TDeps = unknown> = {
      */
     selfKernel: (kernelUrl?: string) => Promise<BoundClientSessionView<FnMap>>;
 };
-export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unknown> = {
+export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unknown, TAuth extends AuthPolicy = 'required'> = {
     /**
      * Canonical callable identity. Auto-derived as `function.<slug>` (where
      * `<slug>` is the map key) when omitted. Stored as `Function.ref` on the
@@ -78,19 +81,24 @@ export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unkn
      * placeholders both supported.
      */
     binding?: FunctionBinding;
-    /** Authentication policy. Defaults to `'required'`. */
-    auth?: AuthPolicy;
+    /**
+     * Authentication policy. Defaults to `'required'`. Captured as a literal type
+     * so it drives {@link KernelForAuth} on the `execute`/`authorize` context:
+     * omit it (or `'required'`) → `ctx.kernel` non-null; `'optional'` → `… | null`;
+     * `'public'` → `null` (webhooks reach the graph via `ctx.selfKernel`).
+     */
+    auth?: TAuth;
     /** Optional pre-execute authorization. Throw to deny. */
-    authorize?: (ctx: RemoteFunctionContext<TParams, TDeps>) => void | Promise<void>;
+    authorize?: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>) => void | Promise<void>;
     /** The function body. May be async. */
-    execute: (ctx: RemoteFunctionContext<TParams, TDeps>) => TResult | Promise<TResult>;
+    execute: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>) => TResult | Promise<TResult>;
     /** Optional human-readable description. */
     description?: string;
 };
-export type AnyRemoteFunctionDef = RemoteFunctionDef<any, any, any>;
+export type AnyRemoteFunctionDef = RemoteFunctionDef<any, any, any, AuthPolicy>;
 /**
  * Identity helper for authoring a RemoteFunction. Returns its argument
  * unchanged — `defineRemoteDomain` consumes the typed shape.
  */
-export declare function defineRemoteFunction<TParams, TResult, TDeps = unknown>(def: RemoteFunctionDef<TParams, TResult, TDeps>): RemoteFunctionDef<TParams, TResult, TDeps>;
+export declare function defineRemoteFunction<TParams, TResult, TDeps = unknown, TAuth extends AuthPolicy = 'required'>(def: RemoteFunctionDef<TParams, TResult, TDeps, TAuth>): RemoteFunctionDef<TParams, TResult, TDeps, TAuth>;
 //# sourceMappingURL=remote-function.d.ts.map