@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/workflow/define.js

@@ -0,0 +1,57 @@
+export function defineWorkflow(definition) {
+    if (definition === null || typeof definition !== 'object' || Array.isArray(definition)) {
+        throw new TypeError('Workflow definition must be an object.');
+    }
+    const allowed = new Set(['id', 'triggers', 'run']);
+    if (Reflect.ownKeys(definition).some((key) => !allowed.has(key))) {
+        throw new TypeError('Workflow definition contains an unknown field.');
+    }
+    acceptId(definition.id, 'Workflow id');
+    if (typeof definition.run !== 'function')
+        throw new TypeError('Workflow run must be a function.');
+    const triggers = definition.triggers === undefined ? undefined : acceptTriggers(definition.triggers);
+    const run = definition.run.bind(definition);
+    return Object.freeze({
+        id: definition.id,
+        ...(triggers === undefined ? {} : { triggers }),
+        run,
+    });
+}
+export function acceptTriggers(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError('Workflow triggers must be an object.');
+    }
+    if (Reflect.ownKeys(input).some((key) => key !== 'schedule')) {
+        throw new TypeError('Workflow triggers contain an unsupported field.');
+    }
+    if (input.schedule === undefined)
+        return Object.freeze({});
+    if (!Array.isArray(input.schedule))
+        throw new TypeError('Workflow schedule must be an array.');
+    const ids = new Set();
+    const schedule = input.schedule.map((trigger) => {
+        if (trigger === null || typeof trigger !== 'object' || Array.isArray(trigger)) {
+            throw new TypeError('Schedule trigger must be an object.');
+        }
+        const keys = Reflect.ownKeys(trigger);
+        if (keys.length !== 3 ||
+            !keys.every((key) => key === 'id' || key === 'cron' || key === 'input')) {
+            throw new TypeError('Schedule trigger must contain exactly id, cron, and input.');
+        }
+        acceptId(trigger.id, 'Schedule trigger id');
+        if (ids.has(trigger.id))
+            throw new TypeError(`Schedule trigger id ${trigger.id} occurs more than once.`);
+        ids.add(trigger.id);
+        if (typeof trigger.cron !== 'string' || trigger.cron.trim().length === 0) {
+            throw new TypeError('Schedule trigger cron must be a non-empty string.');
+        }
+        return Object.freeze({ ...trigger });
+    });
+    return Object.freeze({ schedule: Object.freeze(schedule) });
+}
+function acceptId(id, label) {
+    if (typeof id !== 'string' || id.length === 0 || id.trim() !== id) {
+        throw new TypeError(`${label} must be a non-empty stable string.`);
+    }
+}
+//# sourceMappingURL=define.js.map

package/dist/workflow/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../src/workflow/define.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,cAAc,CAC5B,UAA2D;IAE3D,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;IACvE,CAAC;IACD,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,CAAA;IACtC,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACjG,MAAM,QAAQ,GACZ,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAQ,KAA8B;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAA;QACnF,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAC3C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAAC,uBAAuB,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnB,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAa;IACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAA;IACpE,CAAC;AACH,CAAC"}

package/dist/workflow/index.d.ts

@@ -0,0 +1,7 @@
+export { bindWorkflow, isTriggeredHandler, isWorkflowBinding, withTriggers } from './binding.js';
+export { defineWorkflow } from './define.js';
+export { createInlineWorkflowRunner } from './runner.js';
+export type { CallableWorkflowActivation, DirectWorkflowActivation, ScheduleTrigger, WorkflowActivation, WorkflowContext, WorkflowDefinition, WorkflowExecution, WorkflowRunner, WorkflowTriggers, } from './contract.js';
+export type { AuthenticatedCallable, CallableAuthenticationMode, TriggeredHandler, WorkflowBinding, } from './binding.js';
+export type { WorkflowStep } from './step/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACxD,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/workflow/index.js

@@ -0,0 +1,4 @@
+export { bindWorkflow, isTriggeredHandler, isWorkflowBinding, withTriggers } from './binding.js';
+export { defineWorkflow } from './define.js';
+export { createInlineWorkflowRunner } from './runner.js';
+//# sourceMappingURL=index.js.map

package/dist/workflow/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA"}

package/dist/workflow/runner.d.ts

@@ -0,0 +1,4 @@
+import type { WorkflowRunner } from './contract.js';
+/** Explicit process-local runner for tests and non-durable embeddings. */
+export declare function createInlineWorkflowRunner(): WorkflowRunner;
+//# sourceMappingURL=runner.d.ts.map

package/dist/workflow/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/workflow/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyC,cAAc,EAAE,MAAM,eAAe,CAAA;AAM1F,0EAA0E;AAC1E,wBAAgB,0BAA0B,IAAI,cAAc,CA0B3D"}

package/dist/workflow/runner.js

@@ -0,0 +1,24 @@
+import { createInlineStep } from './step/index.js';
+const DIRECT_ACTIVATION = Object.freeze({ kind: 'direct' });
+/** Explicit process-local runner for tests and non-durable embeddings. */
+export function createInlineWorkflowRunner() {
+    return Object.freeze({
+        run(workflow, execution) {
+            const control = execution.execution ??
+                Object.freeze({
+                    deadline: Number.MAX_SAFE_INTEGER,
+                    signal: execution.signal ?? new AbortController().signal,
+                });
+            control.signal.throwIfAborted();
+            return workflow.run(Object.freeze({
+                activation: execution.activation ?? DIRECT_ACTIVATION,
+                execution: control,
+                step: createInlineStep({ signal: control.signal }),
+                query: execution.query,
+                mutate: execution.mutate,
+                capabilities: execution.capabilities,
+            }), execution.input);
+        },
+    });
+}
+//# sourceMappingURL=runner.js.map

package/dist/workflow/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/workflow/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAA;AAEpE,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CACD,QAAyD,EACzD,SAAiD;YAEjD,MAAM,OAAO,GACX,SAAS,CAAC,SAAS;gBACnB,MAAM,CAAC,MAAM,CAAC;oBACZ,QAAQ,EAAE,MAAM,CAAC,gBAAgB;oBACjC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;iBACzD,CAAC,CAAA;YACJ,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,CACjB,MAAM,CAAC,MAAM,CAAC;gBACZ,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,iBAAiB;gBACrD,SAAS,EAAE,OAAO;gBAClB,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClD,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,YAAY,EAAE,SAAS,CAAC,YAAY;aACrC,CAAC,EACF,SAAS,CAAC,KAAK,CAChB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/workflow/step/index.d.ts

@@ -0,0 +1,3 @@
+export { createInlineStep } from './inline.js';
+export type { WorkflowStep } from './step.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow/step/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA"}

package/dist/workflow/step/index.js

@@ -0,0 +1,2 @@
+export { createInlineStep } from './inline.js';
+//# sourceMappingURL=index.js.map

package/dist/workflow/step/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/workflow/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/workflow/step/inline.d.ts

@@ -0,0 +1,6 @@
+import type { WorkflowStep } from './step.js';
+/** Process-local Step profile for tests and explicitly non-durable embeddings. */
+export declare function createInlineStep(options?: {
+    readonly signal?: AbortSignal;
+}): WorkflowStep;
+//# sourceMappingURL=inline.d.ts.map

package/dist/workflow/step/inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/inline.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAI7C,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,YAAY,CAgC9F"}

package/dist/workflow/step/inline.js

@@ -0,0 +1,44 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+const MAXIMUM_STEP_ID_LENGTH = 128;
+/** Process-local Step profile for tests and explicitly non-durable embeddings. */
+export function createInlineStep(options = {}) {
+    const signal = options.signal;
+    const occurrences = new Map();
+    let active = false;
+    return Object.freeze({
+        async run(id, execute) {
+            const accepted = acceptStepId(id);
+            signal?.throwIfAborted();
+            if (active) {
+                throw new TypeError('step.run does not allow nested or concurrent inline steps');
+            }
+            const occurrence = occurrences.get(accepted) ?? 0;
+            occurrences.set(accepted, occurrence + 1);
+            active = true;
+            try {
+                const result = await execute();
+                if (result === undefined)
+                    return result;
+                try {
+                    return portable.accept(result);
+                }
+                catch (cause) {
+                    throw new TypeError(`step.run("${accepted}"${occurrence === 0 ? '' : ` #${occurrence + 1}`}): result must be a portable value`, { cause });
+                }
+            }
+            finally {
+                active = false;
+            }
+        },
+    });
+}
+function acceptStepId(id) {
+    if (typeof id !== 'string' ||
+        id.length === 0 ||
+        id.length > MAXIMUM_STEP_ID_LENGTH ||
+        id.trim() !== id) {
+        throw new TypeError('step.run id must contain 1-128 characters with no surrounding whitespace');
+    }
+    return id;
+}
+//# sourceMappingURL=inline.js.map

package/dist/workflow/step/inline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.js","sourceRoot":"","sources":["../../../src/workflow/step/inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAA;AAIxD,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAElC,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsC,EAAE;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,GAAG,CAAS,EAAU,EAAE,OAAuC;YACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAA;YAClF,CAAC;YAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACjD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;gBAC9B,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAA;gBACvC,IAAI,CAAC;oBACH,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAW,CAAA;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,SAAS,CACjB,aAAa,QAAQ,IAAI,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,EAAE,oCAAoC,EAC1G,EAAE,KAAK,EAAE,CACV,CAAA;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,GAAG,KAAK,CAAA;YAChB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,CAAC,MAAM,KAAK,CAAC;QACf,EAAE,CAAC,MAAM,GAAG,sBAAsB;QAClC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC"}

package/dist/workflow/step/step.d.ts

@@ -0,0 +1,5 @@
+/** Durable operation boundary supplied by the selected Workflow runner. */
+export interface WorkflowStep {
+    run<Result>(id: string, execute: () => Result | Promise<Result>): Promise<Result>;
+}
+//# sourceMappingURL=step.d.ts.map

package/dist/workflow/step/step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/step.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAClF"}

package/dist/workflow/step/step.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=step.js.map

package/dist/workflow/step/step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.js","sourceRoot":"","sources":["../../../src/workflow/step/step.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.4.19",
-  "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
+  "version": "0.5.0-beta.2",
+  "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
     "domain",
@@ -19,8 +19,7 @@
     "astrale-domain": "./dist/cli/bin.js"
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "type": "module",
   "main": "./dist/index.js",
@@ -34,48 +33,141 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
     },
+    "./server/node": {
+      "types": "./dist/server/node/index.d.ts",
+      "import": "./dist/server/node/index.js"
+    },
     "./domain": {
       "types": "./dist/domain/index.d.ts",
       "import": "./dist/domain/index.js"
     },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema/index.d.ts",
+      "import": "./dist/schema/index.js"
+    },
+    "./schema/v1": {
+      "types": "./dist/schema/v1/index.d.ts",
+      "import": "./dist/schema/v1/index.js"
+    },
+    "./schema/kernel": {
+      "types": "./dist/schema/kernel/index.d.ts",
+      "import": "./dist/schema/kernel/index.js"
+    },
+    "./value": {
+      "types": "./dist/value/index.d.ts",
+      "import": "./dist/value/index.js"
+    },
+    "./graph": {
+      "types": "./dist/graph/index.d.ts",
+      "import": "./dist/graph/index.js"
+    },
+    "./graph/class": {
+      "types": "./dist/graph/class/index.d.ts",
+      "import": "./dist/graph/class/index.js"
+    },
+    "./graph/node": {
+      "types": "./dist/graph/node/index.d.ts",
+      "import": "./dist/graph/node/index.js"
+    },
+    "./graph/edge": {
+      "types": "./dist/graph/edge/index.d.ts",
+      "import": "./dist/graph/edge/index.js"
+    },
+    "./graph/model": {
+      "types": "./dist/graph/model/index.d.ts",
+      "import": "./dist/graph/model/index.js"
+    },
+    "./graph/properties": {
+      "types": "./dist/graph/properties/index.d.ts",
+      "import": "./dist/graph/properties/index.js"
+    },
+    "./graph/path": {
+      "types": "./dist/graph/path/index.d.ts",
+      "import": "./dist/graph/path/index.js"
+    },
+    "./capability": {
+      "types": "./dist/capability/index.d.ts",
+      "import": "./dist/capability/index.js"
+    },
+    "./deployment": {
+      "types": "./dist/deployment/index.d.ts",
+      "import": "./dist/deployment/index.js"
+    },
+    "./deployment/artifact": {
+      "types": "./dist/deployment/artifact/index.d.ts",
+      "import": "./dist/deployment/artifact/index.js"
+    },
+    "./deployment/check": {
+      "types": "./dist/deployment/check/index.d.ts",
+      "import": "./dist/deployment/check/index.js"
+    },
+    "./deployment/provider": {
+      "types": "./dist/deployment/provider/index.d.ts",
+      "import": "./dist/deployment/provider/index.js"
+    },
     "./cli": {
       "types": "./dist/cli/index.d.ts",
       "import": "./dist/cli/index.js"
     },
-    "./deploy": {
-      "types": "./dist/deploy/index.d.ts",
-      "import": "./dist/deploy/index.js"
+    "./query": {
+      "types": "./dist/query/index.d.ts",
+      "import": "./dist/query/index.js"
+    },
+    "./mutation": {
+      "types": "./dist/mutation/index.d.ts",
+      "import": "./dist/mutation/index.js"
+    },
+    "./result": {
+      "types": "./dist/result/index.d.ts",
+      "import": "./dist/result/index.js"
+    },
+    "./state": {
+      "types": "./dist/state/index.d.ts",
+      "import": "./dist/state/index.js"
     },
-    "./step": {
-      "types": "./dist/step/index.d.ts",
-      "import": "./dist/step/index.js"
+    "./view": {
+      "types": "./dist/view/index.d.ts",
+      "import": "./dist/view/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js"
+    },
+    "./workflow": {
+      "types": "./dist/workflow/index.d.ts",
+      "import": "./dist/workflow/index.js"
+    },
+    "./workflow/step": {
+      "types": "./dist/workflow/step/index.d.ts",
+      "import": "./dist/workflow/step/index.js"
     },
     "./linter": {
       "types": "./dist/linter/index.d.ts",
       "import": "./dist/linter/index.js"
     },
     "./linter/oxlint-config": {
-      "types": "./dist/linter/oxlint/config.d.ts",
-      "import": "./dist/linter/oxlint/config.js"
-    },
-    "./linter/oxlint-plugin": {
-      "types": "./dist/linter/oxlint/plugin.d.ts",
-      "import": "./dist/linter/oxlint/plugin.js"
+      "types": "./dist/linter/oxlint-config/index.d.ts",
+      "import": "./dist/linter/oxlint-config/index.js"
     },
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@astrale-os/kernel-api": ">=0.4.16 <1.0.0",
-    "@astrale-os/kernel-client": ">=0.4.11 <1.0.0",
-    "@astrale-os/kernel-core": ">=0.7.7 <1.0.0",
-    "@astrale-os/kernel-dsl": ">=0.1.4 <1.0.0",
-    "@astrale-os/kernel-server": ">=0.4.15 <1.0.0",
+    "@astrale-os/kernel-client": "0.6.0-beta.2",
+    "@astrale-os/kernel-core": "0.9.0-beta.2",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.2",
+    "@astrale-os/kernel-ports": "0.6.0-beta.2",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.2",
+    "@astrale-os/kernel-server": "0.5.0-beta.2",
     "hono": "^4.6.20",
     "jose": "^6.1.3",
+    "typescript": "~6.0.1-rc",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@astrale-os/kernel-test": ">=0.1.0 <1.0.0",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
@@ -89,7 +181,6 @@
     "oxfmt": "0.52.0",
     "oxlint": "latest",
     "tsx": "^4.21.0",
-    "typescript": "~6.0.1-rc",
     "vitest": "^3.0.0"
   },
   "peerDependencies": {
@@ -133,11 +224,13 @@
     "typecheck": "tsgo --noEmit && pnpm run typecheck:types",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "test": "vitest run --config __tests__/vitest.config.ts",
+    "test:file": "vitest run --config __tests__/vitest.config.ts",
     "verify:package": "node ./verify-package.mjs",
     "test:watch": "vitest --config __tests__/vitest.config.ts",
     "lint": "oxlint --disable-nested-config .",
     "lint:fix": "oxlint --disable-nested-config --fix .",
     "format": "pnpm exec oxfmt --write .",
-    "format:check": "pnpm exec oxfmt --check ."
+    "format:check": "pnpm exec oxfmt --check .",
+    "sync:linter-policy": "node scripts/sync-domain-policy.mjs"
   }
 }

package/dist/auth/authenticate.d.ts

@@ -1,24 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type AuthenticateResult = {
-    authenticated: Authenticated;
-    kernel: BoundClientSessionView<FnMap> | null;
-};
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export declare function authenticateRequest(credential: CredentialInput, config: RemoteIdentityConfig): Promise<AuthenticateResult>;
-//# sourceMappingURL=authenticate.d.ts.map

package/dist/auth/authenticate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAI7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAA;IAC5B,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;CAC7C,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B"}

package/dist/auth/authenticate.js

@@ -1,29 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-import { IdentityId, selfGrant } from '@astrale-os/kernel-core';
-import { bindKernel } from './kernel-client.js';
-import { verifyInboundCredential } from './verify.js';
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export async function authenticateRequest(credential, config) {
-    const { verified, issuer, attestation, delegation } = await verifyInboundCredential(credential, config);
-    const authenticated = {
-        credential: { raw: credential, verified },
-        grant: selfGrant(IdentityId(verified.sub)),
-        attestation,
-        delegation,
-    };
-    const kernel = await bindKernel(delegation, issuer, config);
-    return { authenticated, kernel };
-}
-//# sourceMappingURL=authenticate.js.map

package/dist/auth/authenticate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAOrD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA2B,EAC3B,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CACjF,UAAU,EACV,MAAM,CACP,CAAA;IAED,MAAM,aAAa,GAAkB;QACnC,UAAU,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE;QACzC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,WAAW;QACX,UAAU;KACX,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC"}

package/dist/auth/check.d.ts

@@ -1,38 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { IdentityId } from '@astrale-os/kernel-core';
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core';
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export declare function assertPerm(kernel: BoundClientSessionView<FnMap> | null, target: string, principal: IdentityId | null | undefined, requiredBits: number): Promise<void>;
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export declare function requireOwnership(kernel: BoundClientSessionView<FnMap> | null, target: string, principal: IdentityId | null | undefined): Promise<void>;
-//# sourceMappingURL=check.d.ts.map

package/dist/auth/check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/auth/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAMzD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAErE;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,sFAAsF;AACtF,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth/check.js

@@ -1,50 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-import { SHARE } from '@astrale-os/kernel-core';
-import { AuthorizationDeniedError } from '../dispatch/errors.js';
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core';
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export async function assertPerm(kernel, target, principal, requiredBits) {
-    if (!kernel) {
-        throw new AuthorizationDeniedError('No kernel client — cannot verify permissions');
-    }
-    if (!principal) {
-        throw new AuthorizationDeniedError('No authenticated principal');
-    }
-    const ok = await kernel.auth.check({ who: principal, on: target, perms: requiredBits });
-    if (!ok) {
-        throw new AuthorizationDeniedError(`Permission denied on "${target}" — required bits=${requiredBits} for principal "${principal}"`);
-    }
-}
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export async function requireOwnership(kernel, target, principal) {
-    await assertPerm(kernel, target, principal, SHARE);
-}
-//# sourceMappingURL=check.js.map

package/dist/auth/check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/auth/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAE/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAA4C,EAC5C,MAAc,EACd,SAAwC,EACxC,YAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,wBAAwB,CAAC,8CAA8C,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,4BAA4B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;IACvF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,wBAAwB,CAChC,yBAAyB,MAAM,qBAAqB,YAAY,mBAAmB,SAAS,GAAG,CAChG,CAAA;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA4C,EAC5C,MAAc,EACd,SAAwC;IAExC,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AACpD,CAAC"}

package/dist/auth/compose.d.ts

@@ -1,41 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-import type { Delegation } from '@astrale-os/kernel-core';
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export declare function buildComposedExpr(delegation: Delegation): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export declare function buildComposedGrant(delegation: Delegation): {
-    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
-};
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export declare function buildSelfExpr(): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
-/** Self-only grant for function-owned credentials. */
-export declare function buildSelfGrant(): {
-    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
-};
-//# sourceMappingURL=compose.d.ts.map

package/dist/auth/compose.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AASzD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,4DAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU;IAC9C,KAAK;EACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,6DAE5B;AAED,sDAAsD;AACtD,wBAAgB,cAAc;IACnB,KAAK;EACf"}