@astrale-os/sdk 0.2.0 → 0.4.0

package/src/dispatch/self.ts

@@ -1,30 +1,26 @@
 /**
- * Self resolution — pipeline step 3.
- *
- * `_self` is a path reference to the node the non-static method runs on.
- * `resolveSelf` is a thin PARSE: the caller's string becomes a `Path`, and
- * handlers build recursive paths as `${self.path}::method` (the `Path`'s
- * `toString` yields its raw form, so template literals work unchanged). It does
- * NOT touch the graph — the whole dispatch pipeline (resolve → authenticate →
- * validate → self → execute) reaches the handler without a single `Node::get`.
- *
- * `resolveSelf` receives the bare self target (`@<id>` or a tree path) — the
- * method ref travels in a separate dispatch channel, so `::method` never
- * reaches here. For the `@<id>` form the parsed `Path` is an `IdPath` which
- * already carries the node id; surfacing it on `SelfResult.id` saves every
- * worker handler from parsing `self.path.raw` by hand to recover the id of the
- * node it is already operating on.
- *
- * `withNode` enriches the parsed self with the lazy `node()` accessor — the one
- * place a handler can fetch its own node's full record (`{ id, class, props }`)
- * without hand-rolling a `::get`. Construction stays split from parsing so
- * `resolveSelf` remains pure and trivially testable; the dispatcher attaches the
- * accessor once it holds the request's kernel.
+ * Self resolution stays parse-only: `_self` becomes a Path/IdPath with no graph
+ * read. The dispatcher later attaches lazy node()/call helpers once it has a kernel.
  */
 
+import type {
+  BindCtx,
+  BoundNode,
+  InstanceDispatch,
+  NodeBinder,
+  ProxyCaller,
+  TypeMethods,
+  TypeNames,
+} from '@astrale-os/kernel-client/schema'
 import type { Node } from '@astrale-os/kernel-core/graph'
+import type { Schema } from '@astrale-os/kernel-dsl'
 
-import { IdPath, Path, type NodeId } from '@astrale-os/kernel-core'
+import {
+  createInstanceProxy,
+  defaultCaller,
+  extractMethodsByType,
+} from '@astrale-os/kernel-client/schema'
+import { IdPath, K, Path, type NodeId } from '@astrale-os/kernel-core'
 import { classPathSchema } from '@astrale-os/kernel-core/domain'
 import { absolutePathSchema } from '@astrale-os/kernel-core/tree'
 import { z } from 'zod'
@@ -43,32 +39,31 @@ export type ParsedSelf = {
 
 export type SelfResult = ParsedSelf & {
   /**
-   * Lazily read THIS node's full record via one `::get` on the handler's
-   * kernel. Memoized for the dispatch: repeated and concurrent calls share a
-   * single in-flight fetch, and a failure clears the cache so it stays
-   * retryable. Pass `{ reload: true }` to force a fresh read.
-   *
-   * The result is a point-in-time SNAPSHOT, not a live view — for
-   * read-modify-write, treat it as the value as of the read (or `reload`).
-   * `props` is returned structurally validated only, NOT typed against the
-   * node's declared schema: the kernel does not hydrate declared props at
-   * runtime, so a node-typed `self` would be unsound. Read the concrete backend
-   * off `node.class` (a `ClassPath`) — that is the persisted discriminator.
+   * Lazy point-in-time self read. Memoized per dispatch; `{ reload: true }`
+   * forces a fresh `function.get`.
    */
   node(opts?: { reload?: boolean }): Promise<ResolvedSelfNode>
 }
 
+/** Schema-typed self: short-keyed props and typed same-instance call proxy. */
+export type TypedSelf<D, S extends Schema = Schema> = ParsedSelf & {
+  /**
+   * Fetch THIS node as a typed `BoundNode<D>`. Memoized exactly like
+   * {@link SelfResult.node} — one in-flight `function.get`, rejection-clearing,
+   * `{ reload: true }` refetches — so the zero-extra-graph-read dispatch
+   * invariant holds: nothing is read until called, then at most once.
+   */
+  node(opts?: { reload?: boolean }): Promise<BoundNode<D, S>>
+  /** Own instance methods — typed, address-only (`<selfPath>::method`), no read. */
+  readonly call: InstanceDispatch<D>
+}
+
 export function resolveSelf(ref: string): ParsedSelf {
   const path = Path.parse(ref)
   return path instanceof IdPath ? { path, id: path.id } : { path }
 }
 
-/**
- * Attach the memoized `node()` accessor, binding it to the handler's kernel.
- * `kernel` is `null` for methods whose auth policy yields none (`public`, or an
- * unauthenticated `optional`) — there `node()` rejects with a clear error
- * rather than reading the graph unauthenticated.
- */
+/** Attach memoized node(); unauthenticated contexts reject instead of reading. */
 export function withNode(parsed: ParsedSelf, kernel: Kernel | null): SelfResult {
   let cached: Promise<ResolvedSelfNode> | undefined
   const node = (opts?: { reload?: boolean }): Promise<ResolvedSelfNode> => {
@@ -84,6 +79,73 @@ export function withNode(parsed: ParsedSelf, kernel: Kernel | null): SelfResult
   return { ...parsed, node }
 }
 
+const EMPTY_METHODS: TypeMethods = { kind: 'class', methods: new Set() }
+const methodMapCache = new WeakMap<object, Map<string, TypeMethods>>()
+
+/** The type's method allow-list + kind, computed once per binder. */
+function methodsFor<S extends Schema>(binder: NodeBinder<S>, typeName: string): TypeMethods {
+  let map = methodMapCache.get(binder)
+  if (!map) {
+    map = extractMethodsByType(binder.schema)
+    methodMapCache.set(binder, map)
+  }
+  return map.get(typeName) ?? EMPTY_METHODS
+}
+
+function noKernelCaller(ref: string): ProxyCaller {
+  return () =>
+    Promise.reject(
+      new Error(
+        `self.call needs an authenticated kernel to dispatch on "${ref}", but this method ran ` +
+          `without one (its auth policy yields no kernel — e.g. 'public').`,
+      ),
+    )
+}
+
+/**
+ * Schema-typed self helper: lazy BoundNode plus address-only call proxy. With no
+ * kernel, both node() and call thunks fail loudly.
+ */
+export function withBoundNode<S extends Schema>(
+  parsed: ParsedSelf,
+  kernel: Kernel | null,
+  binder: NodeBinder<S>,
+  typeName: string,
+): TypedSelf<unknown, S> {
+  const ctx: BindCtx = kernel
+    ? { caller: defaultCaller(kernel), read: kernel }
+    : { caller: null, read: null }
+
+  let cached: Promise<BoundNode<unknown, S>> | undefined
+  const node = (opts?: { reload?: boolean }): Promise<BoundNode<unknown, S>> => {
+    if (opts?.reload) cached = undefined
+    if (!cached) {
+      cached = fetchSelfNode(parsed.path, kernel)
+        .then(
+          (record) =>
+            binder.bind(typeName as TypeNames<S>, record, ctx, {
+              validate: 'warn',
+            }) as unknown as BoundNode<unknown, S>,
+        )
+        .catch((err: unknown) => {
+          cached = undefined // never cache a rejection — a later call may succeed
+          throw err
+        })
+    }
+    return cached
+  }
+
+  const info = methodsFor(binder, typeName)
+  const call = createInstanceProxy(
+    ctx.caller ?? noKernelCaller(parsed.path.raw),
+    parsed.path.raw,
+    info.methods,
+    info.kind === 'class' ? typeName : undefined,
+  ) as InstanceDispatch<unknown>
+
+  return { ...parsed, node, call }
+}
+
 /**
  * Boundary schema for a node record off the wire. Structurally identical to
  * kernel-core's `nodeSchema`, re-declared here from its public coercers
@@ -108,9 +170,23 @@ async function fetchSelfNode(path: Path, kernel: Kernel | null): Promise<Resolve
         `method whose auth is 'required', or supply a credential.`,
     )
   }
-  const record = nodeRecordSchema.parse(await kernel.call(`${path.raw}::get`, {}))
+  // function.get soft-masks missing/unreadable roots; empty page means no self node.
+  const result = (await kernel.call(K.$.f('get').path.domain.raw, {
+    roots: [path.raw],
+    depth: 0,
+  })) as {
+    nodes?: unknown[]
+  }
+  const first = result?.nodes?.[0]
+  if (first === undefined) {
+    throw new Error(
+      `self.node(): "${path.raw}" was not found or is not visible to the caller ` +
+        `(function.get returned no node).`,
+    )
+  }
+  const record = nodeRecordSchema.parse(first)
   if (record.id === undefined) {
-    throw new Error(`self.node(): "${path.raw}::get" returned a record with no id`)
+    throw new Error(`self.node(): "${path.raw}" returned a record with no id`)
   }
   // Validated at the wire boundary: id is now known-present, props are
   // structurally checked. Bridge the parse output to the canonical `Node`.

package/src/domain/build-spec.ts

@@ -21,6 +21,7 @@ import type { Graph, WireGraph } from '@astrale-os/kernel-core'
 import type { BoundMethod, FunctionSchema, ViewSchema } from '@astrale-os/kernel-core/domain'
 import type { Schema } from '@astrale-os/kernel-dsl'
 
+import { AbsolutePath } from '@astrale-os/kernel-core'
 import { hashInstallGraph, serialize, zodToJsonSchema } from '@astrale-os/kernel-core/domain'
 
 import type { AnyRemoteHandler } from '../method/single'
@@ -42,12 +43,21 @@ export function buildInstallGraph<S extends Schema>(
   url: string,
 ): WireGraph {
   const { compiled, auxiliary } = materializeRemoteDomain(domain, url)
+  // Two-axis placement: `parent` = the folder the Domain node physically lives
+  // under. `path` names the FULL node path (basename === origin);
+  // unset defaults to /domains/<origin> — the "/domains" placement policy lives
+  // HERE (the kernel default is Root → /<origin>). `mount` is deliberately NOT
+  // passed: installed_in + typed addresses stay root-mounted (kernel default).
+  const parent = domain.path
+    ? AbsolutePath.parse(domain.path).parent()
+    : AbsolutePath.from('domains')
   return buildSpecInternal(
     compiled,
     domain.methods,
     url,
     auxiliary?.functionSchemas ?? [],
     auxiliary?.viewSchemas ?? [],
+    parent,
   ).toWire() as WireGraph
 }
 
@@ -71,6 +81,7 @@ function buildSpecInternal(
   url: string,
   functionSchemas: FunctionSchema[],
   viewSchemas: ViewSchema[],
+  parent: AbsolutePath,
 ): Graph {
   const serialized = serializeMethodsWithStubs(compiled, methods, url)
   // Method impls + standalone-function-member impls travel in the same callable
@@ -79,7 +90,10 @@ function buildSpecInternal(
   // view_for, View class). The serializer emits method nodes from the IR,
   // function/view members from `compiled.$.refs.{functions,views}`, pulling each
   // impl by ref.
-  const tree = serialize(compiled, [...serialized, ...functionSchemas], { views: viewSchemas })
+  const tree = serialize(compiled, [...serialized, ...functionSchemas], {
+    views: viewSchemas,
+    parent,
+  })
   return tree.toGraph()
 }
 

package/src/domain/define.ts

@@ -1,20 +1,6 @@
 /**
- * `defineRemoteDomain` — turn a typed schema + methods map into a mountable domain.
- *
- * `views` and `functions` entries become first-class DOMAIN MEMBERS: a `View` /
- * `Function` node attached to the Domain via an `of_domain` edge (slug
- * `view.<slug>` / `function.<slug>`), laid out at `/<origin>/{views,functions}/<slug>`.
- * Their contract half (the member ref) threads through `compileDomain`; their
- * impl/binding half threads through `serialize`. The same entries'
- * `render` / `execute` handlers are mounted as Hono routes by
- * `createRemoteServer` at `<url>/<viewsFolder|functionsFolder>/<slug>` (the route
- * URL is decoupled from the graph layout). Slug = map key.
- *
- * The domain definition is deployment-agnostic: it carries NO serving url. The
- * url is supplied late by the spec producer (`createRemoteServer({ url })` at
- * runtime, the `astrale-domain` CLI offline) and stamped onto every `binding.remoteUrl`
- * by `materializeRemoteDomain`. There is exactly one notion of `url` in the SDK
- * — the worker serving URL, which is also `iss` and the binding base.
+ * Define a remote domain. Views/functions are first-class domain members; their
+ * serving URL is stamped later by spec producers and is also the worker issuer.
  */
 
 import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
@@ -28,12 +14,13 @@ import type { Core, Schema } from '@astrale-os/kernel-dsl'
 
 import { bindMethods, compileDomain } from '@astrale-os/kernel-core/domain'
 
+import type { DomainManifest } from '../config/define-domain'
 import type { AnyRemoteFunctionDef, ViewDef } from '../define'
 import type { SchemaMethodsImpl } from '../method/class'
 import type { AnyRemoteHandler } from '../method/single'
 
 import {
-  buildFunctionDeclarations,
+  assertFunctionsMatchSchema,
   buildFunctionSchemas,
   DEFAULT_FUNCTIONS_FOLDER,
 } from './extend-functions'
@@ -49,6 +36,12 @@ export type RemoteDomainConfig<S extends Schema, TDeps> = {
 
   remoteFunctions?: Record<string, AnyRemoteFunctionDef>
   functionsFolder?: string
+
+  /** Presentation metadata for `/meta` (logo / entry view). Carried verbatim. */
+  manifest?: DomainManifest
+
+  /** Physical tree path for the Domain node (absolute, e.g. `/domains/acme`); default `/domains/<origin>`. */
+  path?: string
 }
 
 /** Effective bindings + folder layout + member schemas for auxiliary routes, resolved against `url`. */
@@ -65,20 +58,22 @@ export type AuxiliaryMetadata = {
 }
 
 export type RemoteDomain<S extends Schema = Schema> = {
-  /**
-   * Define-time compile: full domain STRUCTURE (classes, methods, and the
-   * view/function members' paths/names/refs — what identity, subs, and contract
-   * resolution need). It carries NO `binding` values: bindings derive from the
-   * serving url, which only the spec producers know — they call
-   * `materializeRemoteDomain(domain, url)` for the install-ready compile.
-   */
+  /** Define-time compile has structure only; bindings are stamped at materialization. */
   compiled: CompiledDomain<S>
   methods: BoundMethod<AnyRemoteHandler>[]
   // oxlint-disable-next-line no-explicit-any
   views?: Record<string, ViewDef<any>>
   remoteFunctions?: Record<string, AnyRemoteFunctionDef>
+  /** Presentation metadata for `/meta` (logo / entry view); `createRemoteServer` stamps it. */
+  manifest?: DomainManifest
   /** The original config, so `materializeRemoteDomain` re-materializes from source. */
   config: MaterializeInputs
+  /**
+   * Physical tree path for the Domain node (absolute string, e.g. `/domains/acme`).
+   * Read by `buildInstallGraph` and passed to `serialize` as `treeMount`; unset =>
+   * `/domains/<origin>` (applied in build-spec). Addressing is unaffected.
+   */
+  path?: string
 }
 
 /** The defineRemoteDomain inputs `materializeRemoteDomain` needs to re-materialize. */
@@ -93,14 +88,14 @@ export function defineRemoteDomain<TDeps>() {
     const viewsFolder = config.viewsFolder ?? DEFAULT_VIEWS_FOLDER
     const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER
 
-    // Views + functions are domain MEMBERS — their contract enters compile via
-    // the `functions` / `views` args (no Core involvement). `config.core` is the
-    // author's own genuine genesis instance data, untouched.
+    // Standalone function handlers must match schema-declared function members.
+    assertFunctionsMatchSchema(config.schema, config.remoteFunctions)
+    // Standalone function handlers must match schema-declared function members.
+    assertFunctionsMatchSchema(config.schema, config.remoteFunctions)
     const compiled = compileDomain(
       config.schema,
       config.core,
       undefined,
-      config.remoteFunctions ? buildFunctionDeclarations(config.remoteFunctions) : undefined,
       config.views ? buildViewDeclarations(config.views) : undefined,
     )
     const methods = bindMethods<AnyRemoteHandler>(
@@ -115,6 +110,8 @@ export function defineRemoteDomain<TDeps>() {
       methods,
       ...(config.views ? { views: config.views } : {}),
       ...(config.remoteFunctions ? { remoteFunctions: config.remoteFunctions } : {}),
+      ...(config.manifest ? { manifest: config.manifest } : {}),
+      ...(config.path ? { path: config.path } : {}),
       config: {
         userCore: config.core,
         viewsFolder,
@@ -124,15 +121,7 @@ export function defineRemoteDomain<TDeps>() {
   }
 }
 
-/**
- * Materialize a `RemoteDomain` at its real serving `url`: re-compiles the domain
- * and builds every member's url-stamped impl schema + binding, returning the
- * binding maps the auxiliary routes mount from and the member schemas `serialize`
- * emits from. Called by the only two spec producers — `createRemoteServer`
- * (`config.url`) and the `astrale-domain` CLI. Returns the define-time `compiled`
- * untouched when there is no aux to stamp. Pure, so safe to call repeatedly (and
- * memoized per cold isolate by the callers).
- */
+/** Materialize aux member bindings against the real serving URL. Pure and repeatable. */
 export function materializeRemoteDomain<S extends Schema>(
   domain: RemoteDomain<S>,
   url: string,
@@ -147,7 +136,6 @@ export function materializeRemoteDomain<S extends Schema>(
     schema,
     config.userCore as Core<S> | undefined,
     undefined,
-    domain.remoteFunctions ? buildFunctionDeclarations(domain.remoteFunctions) : undefined,
     domain.views ? buildViewDeclarations(domain.views) : undefined,
   )
 

package/src/domain/extend-functions.ts

@@ -3,10 +3,9 @@
  * halves a standalone-function DOMAIN MEMBER contributes — mirroring how a class
  * method splits across compile + serialize:
  *
- *   - `FunctionDeclarations` — the CONTRACT half, fed to `compileDomain`'s 4th
- *     arg. The member ref (`function.<slug>`), the layout
- *     (`/<origin>/functions/<slug>`), and the `of_domain` edge slug all derive
- *     from the map key; the kernel owns that mapping.
+ *   - the CONTRACT half — a `func({ input, output })` per slug, declared in the
+ *     schema's `functions` group so the compiled domain carries `function.<slug>`
+ *     on `refs.functions` (the kernel owns the ref/layout/of_domain mapping).
  *   - `FunctionSchema[]` + per-slug `FunctionBinding` — the IMPL/BINDING half,
  *     fed to `serialize` (url-stamped). The worker route is
  *     `<url>/<functionsFolder>/<slug>`, DECOUPLED from the graph layout — so
@@ -18,7 +17,8 @@
  */
 
 import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
-import type { FunctionDeclarations, FunctionSchema } from '@astrale-os/kernel-core/domain'
+import type { FunctionSchema } from '@astrale-os/kernel-core/domain'
+import type { Schema } from '@astrale-os/kernel-dsl'
 
 import { zodToJsonSchema } from '@astrale-os/kernel-core/domain'
 
@@ -45,17 +45,37 @@ function assertValidSlugs(functions: Record<string, AnyRemoteFunctionDef>): void
 }
 
 /**
- * Contract half — one declaration per `functions` map key, for `compileDomain`'s
- * `functions` arg. The slug drives ref/path/of_domain; impl/binding arrive at
- * serialize.
+ * Contract half — since "functions as first-class defineSchema members", a
+ * standalone function's CONTRACT is declared in the SCHEMA (`defineSchema(...,
+ * { functions: { seed: func({ input, output }) } })`) and `compileDomain` builds
+ * the member refs from it; the SDK map supplies the HANDLER half. This check
+ * pins the two halves together at define time: every schema-declared function
+ * needs a handler, every handler a declaration — a drifted key fails loudly at
+ * authoring, never as a boot-time missing-identity or a dangling graph member.
  */
-export function buildFunctionDeclarations(
-  functions: Record<string, AnyRemoteFunctionDef>,
-): FunctionDeclarations {
-  assertValidSlugs(functions)
-  const out: Record<string, { slug: string }> = {}
-  for (const slug of Object.keys(functions)) out[slug] = { slug }
-  return out
+export function assertFunctionsMatchSchema(
+  schema: Schema,
+  functions: Record<string, AnyRemoteFunctionDef> | undefined,
+): void {
+  if (functions) assertValidSlugs(functions)
+  const declared = Object.keys(schema.functions ?? {})
+  const handled = Object.keys(functions ?? {})
+  const missingHandler = declared.filter((slug) => !handled.includes(slug))
+  const missingDecl = handled.filter((slug) => !declared.includes(slug))
+  if (missingHandler.length === 0 && missingDecl.length === 0) return
+  const parts: string[] = []
+  if (missingHandler.length > 0) {
+    parts.push(
+      `schema declares function(s) with no handler: ${missingHandler.map((s) => `"${s}"`).join(', ')}`,
+    )
+  }
+  if (missingDecl.length > 0) {
+    parts.push(
+      `handler(s) with no schema declaration: ${missingDecl.map((s) => `"${s}"`).join(', ')} ` +
+        `(declare them in defineSchema's \`functions\` group via \`func({ input, output })\`)`,
+    )
+  }
+  throw new Error(`defineRemoteDomain: functions/schema mismatch — ${parts.join('; ')}.`)
 }
 
 /**

package/src/index.ts

@@ -1,6 +1,9 @@
 // ─── Method authoring ────────────────────────────────────────────────────
 export type {
+  MethodParams,
+  MethodResult,
   AuthForPolicy,
+  GraphApi,
   Kernel,
   KernelForAuth,
   RemoteContext,
@@ -21,6 +24,7 @@ export { defineDomain, deploy, defineAdapter } from './config'
 export type {
   DefineDomainConfig,
   DomainDefinition,
+  DomainManifest,
   DeployConfig,
   AdapterSpec,
   DeployCtx,
@@ -34,6 +38,25 @@ export type {
 // ─── Install graph (advanced) ────────────────────────────────────────────
 export { buildInstallGraph, buildInstallGraphHash } from './domain'
 
+// ─── Graph patching (advanced) ────────────────────────────────────────
+// Author-facing patch types, re-exported from kernel-core (the single source).
+// Build a `Patch` and feed it straight to `ctx.kernel.mutate(patch)` (it implements
+// `PatchData`); the graph sugar itself lives in `@astrale-os/kernel-client/graph`,
+// flattened onto `ctx.kernel`, and `function.mutate` validates every patch kernel-side
+// against kernel-core's `patchDataSchema` — no client-side re-validation needed.
+export { AbsolutePath, Patch, Path } from '@astrale-os/kernel-core'
+export { ClassPath } from '@astrale-os/kernel-core/domain'
+export type {
+  EdgeCreate,
+  EdgeDelete,
+  EdgeMatcher,
+  EdgeUpdate,
+  NodeCreate,
+  NodeDelete,
+  NodeUpdate,
+  PatchData,
+} from '@astrale-os/kernel-core'
+
 // ─── Declarative resource helpers ────────────────────────────────────────
 // Author Views (iframe-mountable) and RemoteFunctions (standalone callables)
 // at the domain definition site. Each `defineView` / `defineRemoteFunction`
@@ -53,10 +76,10 @@ export type { ViewDef, ViewRenderContext, RemoteFunctionDef, RemoteFunctionConte
 // runtime import from '@astrale-os/sdk/server' directly.
 
 // ─── Deploy ──────────────────────────────────────────────────────────────
-// `deployCheck` and `hashSpecFile` use Node-only modules (`node:crypto`,
-// `node:fs`, `node:child_process`) at module load time. Exporting them from
-// the barrel poisons browser bundlers (Vite/esbuild) that transitively load
-// every re-export. Consumers that need them import from './deploy' directly.
+// `deployCheck` uses Node-only modules (`node:path`, `node:child_process`) at
+// module load time. Exporting it from the barrel poisons browser bundlers
+// (Vite/esbuild) that transitively load every re-export. Consumers that need it
+// import from './deploy' directly.
 export { MetaSchema } from './deploy/meta'
 export type { Meta } from './deploy/meta'
 
@@ -74,6 +97,7 @@ export type {
 
 // ─── Auth ────────────────────────────────────────────────────────────────
 export type { RemoteIdentityConfig, AuthenticateResult } from './auth'
+export type { DomainIssuer, MintIssuedParams } from './auth'
 export {
   authenticateRequest,
   bindSelfKernel,
@@ -101,4 +125,4 @@ export {
   SdkValidationError,
   SdkResultValidationError,
 } from './dispatch'
-export type { SelfResult, CallRemoteFn, KernelCaller } from './dispatch'
+export type { SelfResult, TypedSelf, CallRemoteFn, KernelCaller } from './dispatch'

package/src/method/class.ts

@@ -25,7 +25,7 @@ import type {
 } from '@astrale-os/kernel-core/domain'
 import type { ImplementableOwnKeys, Schema } from '@astrale-os/kernel-dsl'
 
-import type { SelfResult } from '../dispatch/self'
+import type { TypedSelf } from '../dispatch/self'
 import type { MethodImpl, RemoteHandler } from './single'
 
 /** Per-class method implementations for a remote domain. */
@@ -51,12 +51,16 @@ type InterfaceMethodHandler<
   ? InterfaceMethodDefs<S, K>[M] extends { readonly config: infer MC }
     ? MC extends { readonly static: true }
       ? RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, undefined, TDeps>
-      : // Non-static interface methods receive the same `self` the dispatcher
-        // actually delivers — `SelfResult` ({ path, id?, node() }) — exactly as
-        // the class-method path (`MethodImpl`) does. Declared props are NOT
-        // hydrated onto `self` (a node-typed self would be unsound); a handler
-        // that needs the node's class/props reads them via `self.node()`.
-        RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, SelfResult, TDeps>
+      : // Non-static interface methods receive the schema-typed `self` keyed by
+        // THIS interface's def — `self.node()` binds to a `BoundNode<D>` with
+        // short-keyed, def-typed `props`, `self.call` is typed, exactly as the
+        // class-method path (`MethodImpl`) does.
+        RemoteHandler<
+          ResolveParams<MC>,
+          ResolveReturn<MC>,
+          TypedSelf<DefForInterface<S, K>, S>,
+          TDeps
+        >
     : never
   : never
 

package/src/method/context.ts

@@ -12,8 +12,11 @@ import type { FnMap } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
 import type { AuthContext } from '@astrale-os/kernel-core'
 
+import type { DomainIssuer } from '../auth/issuer-mint'
 import type { CallRemoteFn } from '../dispatch/call-remote'
 
+export type { GraphApi } from '@astrale-os/kernel-client/graph'
+
 /**
  * The kernel session a handler holds: a credential-bound view over the parent
  * kernel — the FULL dispatch surface (`call`/`stream`/`binary`/`signal`,
@@ -80,11 +83,24 @@ export type RemoteContext<
    * credential `union(delegation, self)`. Its nullability is `{@link
    * KernelForAuth}` of the method's `auth`: non-null for the default
    * `'required'`, `… | null` for `'optional'`, `null` for `'public'`. Use for
-   * kernel syscalls + same-domain methods. For ANOTHER worker's remote method
-   * use {@link RemoteContext.callRemote} — `kernel.call` to a remote method
-   * fails the audience check.
+   * kernel syscalls + same-domain methods, and for the typed graph read/write
+   * sugar flattened onto it (`kernel.get` / `kernel.children` / `kernel.query`,
+   * plus `kernel.createNode` / `kernel.updateNode` /
+   * `kernel.deleteNode` / `kernel.createEdge` / `kernel.updateEdge` /
+   * `kernel.deleteEdge` / `kernel.mutate(patch)`) over the `function.get` /
+   * `function.mutate` syscalls. For ANOTHER worker's remote method use
+   * {@link RemoteContext.callRemote} — `kernel.call` to a remote method fails the
+   * audience check.
    */
   kernel: TKernel
+  /**
+   * Mint seam for identities THIS DOMAIN issues (`iss` = this worker): sign a
+   * credential for a domain-owned principal (an App identity, a role umbrella,
+   * a managed user) and optionally open a kernel session AS it. See
+   * {@link DomainIssuer}. The kernel enforces trust/frozen/grant rules — this
+   * only signs under the worker's own issuer.
+   */
+  issuer: DomainIssuer
   /**
    * Call another worker's remote method (a Function with `binding.remoteUrl`),
    * re-minting the credential for the target's audience so it isn't rejected at

package/src/method/index.ts

@@ -1,5 +1,11 @@
-export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext } from './context'
-export type { RemoteHandler, AnyRemoteHandler, MethodImpl } from './single'
+export type { AuthForPolicy, GraphApi, Kernel, KernelForAuth, RemoteContext } from './context'
+export type {
+  RemoteHandler,
+  AnyRemoteHandler,
+  MethodImpl,
+  MethodParams,
+  MethodResult,
+} from './single'
 export { remoteMethod } from './single'
 export type { ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl } from './class'
 export { remoteClassMethods, remoteInterfaceMethods } from './class'