@astrale-os/sdk 0.5.0-beta.118 → 0.5.0-beta.119

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.5.0-beta.119](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.118...sdk-v0.5.0-beta.119) (2026-09-06)
+
+
+### ⚠ BREAKING CHANGES
+
+* **action:** add self-default capabilities and dependency invocation ([#438](https://github.com/astrale-os/sdk/issues/438))
+
+### Features
+
+* **action:** add self-default capabilities and dependency invocation ([#438](https://github.com/astrale-os/sdk/issues/438)) ([7daca62](https://github.com/astrale-os/sdk/commit/7daca6224e1532a2843f8d4bdc83ad93d8bccaa5))
+
+
+### Bug Fixes
+
+* **linter:** resolve requirements through schema dependencies ([#440](https://github.com/astrale-os/sdk/issues/440)) ([096b037](https://github.com/astrale-os/sdk/commit/096b03774c09e04cd04380c4625e437a3be905aa))
+
 ## [0.5.0-beta.118](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.117...sdk-v0.5.0-beta.118) (2026-09-06)
 
 

package/README.md

@@ -31,6 +31,13 @@ npx -y create-astrale-domain@beta my-domain --yes
 See [the release lifecycle](docs/release.md) for package-set versioning, verification, and stable
 promotion.
 
+## Handler authority and dependencies
+
+Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
+`dependencies.directory.invoke(d => d.functions.lookup, input)` calls a direct declared dependency
+with the incoming caller Grant. Explicit authority remains on `kernel` and `graph`; the former
+handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
+
 ## Node Class icons
 
 Every Node Class authored through the SDK must explicitly declare a self-contained SVG icon.

package/dist/application/action/authoring.d.ts

@@ -1,5 +1,5 @@
 export { defineAction } from './define.js';
 export type { Action, ActionDefinition } from './action.js';
-export type { ActionContext, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, } from './context.js';
+export type { ActionContext, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/action/context.d.ts

@@ -2,6 +2,7 @@ import type { AuthenticationEvidence, Grant, IdentityId } from '../../platform/a
 import type { BoundClientSession } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, Domain, ResolvedFunction, ResolvedMethod } from '../../platform/schema/index.js';
+import type { HandlerDependencies } from '../dependency/index.js';
 import type { DeclaredErrorFactory, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { IntegrationClients, Integrations } from '../integration/index.js';
 import type { MutationExecutor } from '../mutation/index.js';
@@ -37,22 +38,21 @@ export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
 }
-export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<Record<'caller' | 'self' | 'union', DomainGraphExecutor<DomainValue>>>;
-/** Explicit full Kernel sessions. No authority mode is selected implicitly. */
-export type DomainKernelSessions = Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self' | 'union', DomainGraphExecutor<DomainValue>>>;
+/** Self-default Kernel session with one level of explicit authority selection. */
+export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self' | 'union', BoundClientSession>>;
 type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
     readonly auth: 'anonymous';
 } ? {
     readonly caller: AnonymousCaller;
-    readonly client: null;
+    readonly dependencies: null;
     readonly kernel: null;
     readonly graph: null;
     readonly query?: never;
     readonly mutate?: never;
 } | {
     readonly caller: AuthenticatedCaller;
-    /** Caller-only Kernel client. Privileged Domain work must select kernel.self explicitly. */
-    readonly client: BoundClientSession;
+    readonly dependencies: HandlerDependencies<DomainValue>;
     readonly kernel: DomainKernelSessions;
     readonly graph: DomainGraphExecutors<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
@@ -61,8 +61,7 @@ type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
     readonly mutate: MutationExecutor<DomainValue>;
 } : {
     readonly caller: AuthenticatedCaller;
-    /** Caller-only Kernel client. Privileged Domain work must select kernel.self explicitly. */
-    readonly client: BoundClientSession;
+    readonly dependencies: HandlerDependencies<DomainValue>;
     readonly kernel: DomainKernelSessions;
     readonly graph: DomainGraphExecutors<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/dependency/index.d.ts

@@ -0,0 +1 @@
+export type { DependencyCallOptions, DependencyInvoker, HandlerDependencies } from './invoker.js';

package/dist/application/dependency/index.js

@@ -0,0 +1 @@
+export {};

package/dist/application/dependency/invoker.d.ts

@@ -0,0 +1,22 @@
+import type { Binary, Input } from '../../platform/client/index.js';
+import type { SessionRequestOptions } from '../../platform/client/session/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
+import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
+import type { LocalCallable } from '../action/index.js';
+export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey'>;
+type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type FunctionOrStaticMethodOf<D extends Domain> = Exclude<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : Extract<CallableInputOf<C>, Input> : never;
+type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
+/** One declared dependency, bound to the incoming caller Grant for this invocation. */
+export interface DependencyInvoker<D extends Domain> {
+    readonly invoke: {
+        <const C extends FunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends InstanceMethodOf<D>>(select: (domain: D) => C, instance: NodeId, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+    };
+}
+/** Direct Schema aliases only; the canonical Kernel is exposed through context.kernel. */
+export type HandlerDependencies<D extends Domain> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>;
+}>;
+export {};

package/dist/application/dependency/invoker.js

@@ -0,0 +1 @@
+export {};

package/dist/execution/identity/authentication.js

@@ -66,7 +66,6 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
     let closed = false;
     return Object.freeze({
         caller: established.caller,
-        client: graph.caller,
         graph,
         close() {
             if (closed)

package/dist/execution/invocation/admission/authentication.d.ts

@@ -5,7 +5,6 @@ import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
     readonly caller: AnonymousCaller;
-    readonly client: null;
     readonly kernel: null;
     readonly graph: null;
     close(): void;

package/dist/execution/invocation/admission/authentication.js

@@ -5,7 +5,6 @@ import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
 const ANONYMOUS = Object.freeze({
     caller: Object.freeze({ kind: 'anonymous' }),
-    client: null,
     kernel: null,
     graph: null,
     close() { },
@@ -32,20 +31,18 @@ export async function authentication(callable, request, release, domain, authori
         if (authenticated === null ||
             typeof authenticated !== 'object' ||
             Array.isArray(authenticated) ||
-            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'client' && key !== 'graph' && key !== 'close') ||
+            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'graph' && key !== 'close') ||
             close === undefined) {
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
         const graphInput = admitGraph(authenticated.graph);
-        if (authenticated.client !== graphInput.caller)
-            invalid();
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
             union: bindSession(graphInput.union),
         });
-        return Object.freeze({ caller, client: graph.caller, graph, close });
+        return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
         if (close === undefined)

package/dist/execution/invocation/admission/authority.d.ts

@@ -22,7 +22,6 @@ export interface InvocationAuthenticationInput {
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
     readonly caller: Omit<AuthenticatedCaller, 'identity'>;
-    readonly client: BoundClientSession;
     readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
     close(): void;
 }

package/dist/execution/invocation/dependency/bind.d.ts

@@ -0,0 +1,5 @@
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+/** Capture only the admitted caller session; schema metadata never acquires capabilities. */
+export declare function bindDependencies<D extends Domain>(domain: D, caller: BoundClientSession): HandlerDependencies<D>;

package/dist/execution/invocation/dependency/bind.js

@@ -0,0 +1,62 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { reference } from '../../../platform/client/session/index.js';
+import { NodeId } from '../../../platform/graph/node/index.js';
+import { Path } from '../../../platform/graph/path/index.js';
+/** Capture only the admitted caller session; schema metadata never acquires capabilities. */
+export function bindDependencies(domain, caller) {
+    const invoke = caller.invoke.bind(caller);
+    const dependencies = Object.create(null);
+    for (const [alias, dependency] of Object.entries(domain.dependencies)) {
+        if (dependency.origin === 'kernel.astrale.ai')
+            continue;
+        dependencies[alias] = Object.freeze({
+            async invoke(select, ...args) {
+                if (typeof select !== 'function')
+                    invalid();
+                const selected = select(dependency);
+                if (selected === null ||
+                    typeof selected !== 'object' ||
+                    !('key' in selected) ||
+                    typeof selected.key !== 'string')
+                    invalid();
+                const callable = dependency.callable(selected.key);
+                if (callable !== selected || Key.origin(callable.key) !== dependency.origin)
+                    invalid();
+                if ('owner' in callable &&
+                    (callable.inheritance === 'abstract' || !ownMethod(dependency, callable)))
+                    invalid();
+                if ('owner' in callable && !callable.static) {
+                    if (args.length < 2 || args.length > 3 || typeof args[0] !== 'string')
+                        invalid();
+                    const instance = Path.id(NodeId(args[0]));
+                    return invoke(reference(dependency, callable)(instance), args[1], options(args[2]));
+                }
+                if (args.length < 1 || args.length > 2)
+                    invalid();
+                return invoke(reference(dependency, callable), args[0], options(args[1]));
+            },
+        });
+    }
+    return Object.freeze(dependencies);
+}
+function ownMethod(domain, callable) {
+    const owner = Object.values(domain.classes).find((value) => value === callable.owner);
+    if (owner === undefined)
+        return false;
+    const methods = callable.static ? owner.self.static.methods : owner.self.methods;
+    return methods.get(callable.key) === callable;
+}
+function options(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        Reflect.ownKeys(value).some((key) => key !== 'timeoutMs' && key !== 'idempotencyKey'))
+        invalid();
+    // Canonical ClientSession admits option values and clamps them to the parent lifetime.
+    return value;
+}
+function invalid() {
+    throw new TypeError('Dependency invocation requires one owned concrete callable, its input, and valid instance/options.');
+}

package/dist/execution/invocation/dependency/index.d.ts

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dependency/index.js

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dispatch/context.d.ts

@@ -1,8 +1,8 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { ActionExecution, Caller, DomainGraphExecutors } from '../../../application/action/index.js';
+import type { ActionExecution, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { MutationExecutor } from '../../../application/mutation/index.js';
 import type { QueryExecutor } from '../../../application/query/index.js';
-import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { NodeId } from '../../../platform/graph/node/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
@@ -11,8 +11,8 @@ export interface DispatchContext {
     readonly domain: Domain;
     readonly input: unknown;
     readonly caller: Caller;
-    readonly client: BoundClientSession | null;
-    readonly kernel: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>> | null;
+    readonly dependencies: HandlerDependencies<Domain> | null;
+    readonly kernel: DomainKernelSessions | null;
     readonly graph: DomainGraphExecutors | null;
     readonly query?: QueryExecutor;
     readonly mutate?: MutationExecutor;

package/dist/execution/invocation/dispatch/context.js

@@ -1,8 +1,8 @@
 import { bindMutation } from '../../../application/mutation/execution/executor.js';
 import { bindQuery } from '../../../application/query/execution/executor.js';
+import { bindDependencies } from '../dependency/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
-    const client = authentication.client;
     const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
@@ -18,8 +18,15 @@ export function context(request, runtime, authentication, self) {
         domain: runtime.loaded.domain,
         input: request.call.input,
         caller: authentication.caller,
-        client,
-        kernel: authentication.graph,
+        kernel: authentication.graph === null
+            ? null
+            : Object.freeze({
+                ...authentication.graph.self,
+                ...authentication.graph,
+            }),
+        dependencies: authentication.graph === null
+            ? null
+            : bindDependencies(runtime.loaded.domain, authentication.graph.caller),
         graph,
         ...(graph === null
             ? {}
@@ -47,9 +54,11 @@ function bindGraph(clients, domain) {
         query: bindQuery(client, domain),
         mutate: bindMutation(client, domain),
     });
+    const self = bind(clients.self);
     return Object.freeze({
+        ...self,
         caller: bind(clients.caller),
-        self: bind(clients.self),
+        self,
         union: bind(clients.union),
     });
 }

package/dist/execution/invocation/dispatch/workflow.js

@@ -1,13 +1,12 @@
 import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
 import { protocolError } from '../result/index.js';
 export async function workflow(selected, context, runner) {
-    if (context.caller.kind !== 'authenticated' || context.client === null) {
+    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
         throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
     }
     const complete = Object.freeze({
         ...context,
         caller: context.caller,
-        client: context.client,
         error: declaredErrorFactory(selected.definition),
     });
     try {

package/dist/execution/invocation/lifecycle/active.js

@@ -9,11 +9,17 @@ export function active(context) {
 }
 /** Close authenticated resources after finite results or stream settlement. */
 export function settle(result, close) {
-    if (result.kind !== 'stream') {
-        close();
-        return result;
+    if (result.kind === 'stream') {
+        return Object.freeze({ kind: 'stream', stream: settledStream(result.stream, close) });
+    }
+    if (result.kind === 'binary' && !(result.value.body instanceof Uint8Array)) {
+        return Object.freeze({
+            kind: 'binary',
+            value: Object.freeze({ ...result.value, body: settledIterable(result.value.body, close) }),
+        });
     }
-    return Object.freeze({ kind: 'stream', stream: settledStream(result.stream, close) });
+    close();
+    return result;
 }
 function settledStream(stream, close) {
     let settled = false;
@@ -24,6 +30,7 @@ function settledStream(stream, close) {
         close();
     };
     return Object.freeze({
+        ...settledIterable(stream, finish),
         async cancel(reason) {
             try {
                 await stream.cancel(reason);
@@ -32,8 +39,26 @@ function settledStream(stream, close) {
                 finish();
             }
         },
+    });
+}
+function settledIterable(stream, close) {
+    let settled = false;
+    const finish = () => {
+        if (settled)
+            return;
+        settled = true;
+        close();
+    };
+    return Object.freeze({
         [Symbol.asyncIterator]() {
-            const iterator = stream[Symbol.asyncIterator]();
+            let iterator;
+            try {
+                iterator = stream[Symbol.asyncIterator]();
+            }
+            catch (cause) {
+                finish();
+                throw cause;
+            }
             return Object.freeze({
                 async next() {
                     try {

package/dist/tooling/linter/implementations/source/callable-requirements.d.ts

@@ -0,0 +1,28 @@
+import ts from 'typescript';
+import { type SourceFile, type SourceProject } from '../../adapters/typescript/index.js';
+export interface RemoteCallable {
+    readonly file: SourceFile;
+    readonly node: ts.CallExpression;
+    readonly module: string;
+    readonly selector: readonly string[];
+}
+export interface FunctionRequirements {
+    readonly keys: ReadonlySet<string>;
+    readonly indeterminate: boolean;
+}
+export declare function applicationFunctionRequirements(project: SourceProject): FunctionRequirements;
+export declare function requiredCallable(project: SourceProject, file: SourceFile, input: ts.Expression): Pick<RemoteCallable, 'module' | 'selector'> | undefined;
+export declare function declaredDomainDependencies(project: SourceProject): {
+    readonly aliases: ReadonlyMap<string, string>;
+    readonly indeterminate: boolean;
+};
+export declare function callableSelector(selector: readonly string[]): boolean;
+export declare function externalFacade(module: string): boolean;
+export declare function remoteCallableKey(input: Pick<RemoteCallable, 'module' | 'selector'>): string;
+export declare function callableReference(expression: ts.Expression): {
+    readonly expression: ts.Expression;
+    readonly resolved: boolean;
+};
+/** Resolve only one immutable lexical alias; the linter does not emulate program execution. */
+export declare function lexicalConstInitializer(identifier: ts.Identifier): ts.Expression | undefined;
+export declare function bindingContains(binding: ts.BindingName, name: string): boolean;