@astrale-os/sdk 0.5.0-beta.66 → 0.5.0-beta.68

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.5.0-beta.68](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.67...sdk-v0.5.0-beta.68) (2026-08-28)
+
+
+### Performance Improvements
+
+* **execution:** cache issuer verification basis ([#307](https://github.com/astrale-os/sdk/issues/307)) ([a88f227](https://github.com/astrale-os/sdk/commit/a88f22700e61f5c5926621f95fc66638b462fbf5))
+
+## [0.5.0-beta.67](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.66...sdk-v0.5.0-beta.67) (2026-08-28)
+
+
+### Features
+
+* make StateProperty transitions intrinsic ([#306](https://github.com/astrale-os/sdk/issues/306)) ([a2b2575](https://github.com/astrale-os/sdk/commit/a2b2575cf19c585c26539839c4777c0c2d413275))
+
+
+### Documentation
+
+* **state:** ratify intrinsic property transitions ([#303](https://github.com/astrale-os/sdk/issues/303)) ([d484e58](https://github.com/astrale-os/sdk/commit/d484e58bc47f80c2571886b5c85d91d91da52b25))
+
 ## [0.5.0-beta.66](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.65...sdk-v0.5.0-beta.66) (2026-08-27)
 
 

package/dist/application/mutation/authoring/builder.d.ts

@@ -1,11 +1,12 @@
 import type { EdgeSlug } from '@astrale-os/kernel-core/graph/edge';
 import type { MutationBuilder } from '@astrale-os/kernel-core/graph/mutate';
 import type { QueryEdgeAST, QueryNodeAST } from '@astrale-os/kernel-core/graph/query';
-import type { ResolvedClass } from '../../../platform/schema/index.js';
-import type { StateMachine, StateOf, TransitionOf } from '../../state/machine.js';
+import type { Domain, ResolvedClass } from '../../../platform/schema/index.js';
+import type { EventOf, StateOf } from '../../state/machine.js';
 import type { CreatedNode, ExistingEndpoint, MutationEndpoint } from './endpoint.js';
 import type { QueryPrecondition } from './precondition.js';
-import type { RichPropertyConditions, RichPropertyDelta, RichPropertyInput, RichPropertyName } from './properties.js';
+import type { RichPropertyConditions, RichPropertyDelta, RichPropertyInput } from './properties.js';
+import { type StateMachineOf, type StatePropertyName, type StateTransitionInput } from './transition.js';
 export interface RichMutationBuilder {
     readonly expect: {
         node<Class extends ResolvedClass<'node'>>(input: {
@@ -29,14 +30,7 @@ export interface RichMutationBuilder {
         readonly class: Class;
         readonly props: RichPropertyDelta<Class>;
     }): this;
-    transition<Machine extends StateMachine, Class extends ResolvedClass<'node'>, Property extends StateMachinePropertyName<Class, Machine>>(input: {
-        readonly machine: Machine;
-        readonly node: ExistingEndpoint;
-        readonly class: Class;
-        readonly property: Property;
-        readonly decision: AllowedTransitionDecision<Machine>;
-        readonly props?: RichPropertyConditions<Class>;
-    }): this;
+    transition<Class extends ResolvedClass<'node'>, Property extends StatePropertyName<Class>, Machine extends StateMachineOf<Class, Property>, From extends StateOf<Machine>, Event extends EventOf<Machine, From>>(input: StateTransitionInput<Class, Property, Machine, From, Event>): this;
     deleteNode<Class extends ResolvedClass<'node'>>(input: {
         readonly node: ExistingEndpoint;
         readonly class: Class;
@@ -59,13 +53,4 @@ export interface EdgeSelector<Class extends ResolvedClass<'edge'>> {
     readonly target: ExistingEndpoint;
     readonly class: Class;
 }
-export declare function richMutationBuilder(core: MutationBuilder): RichMutationBuilder;
-type StateMachinePropertyName<Class extends ResolvedClass<'node'>, Machine extends StateMachine> = {
-    [Name in RichPropertyName<Class>]: string extends StateOf<Machine> ? never : IsExact<Exclude<RichPropertyInput<Class>[Name], undefined>, StateOf<Machine>> extends true ? Name : never;
-}[RichPropertyName<Class>];
-type AllowedTransitionDecision<Machine extends StateMachine> = Readonly<{
-    kind: 'allowed';
-    transition: TransitionOf<Machine>;
-}>;
-type IsExact<Left, Right> = [Left] extends [Right] ? ([Right] extends [Left] ? true : false) : false;
-export {};
+export declare function richMutationBuilder(core: MutationBuilder, domain: Domain): RichMutationBuilder;

package/dist/application/mutation/authoring/builder.js

@@ -2,8 +2,9 @@ import { LocalBinding } from '@astrale-os/kernel-core/graph/graph';
 import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import { endpoint, existingEndpoint } from './endpoint.js';
 import { precondition } from './precondition.js';
-import { conditions, delta, properties, resolvedProperty } from './properties.js';
-export function richMutationBuilder(core) {
+import { conditions, delta, properties } from './properties.js';
+import { authorStateTransition, } from './transition.js';
+export function richMutationBuilder(core, domain) {
     const expectation = Object.freeze({
         node(input) {
             core.expect.node({
@@ -47,66 +48,7 @@ export function richMutationBuilder(core) {
             return rich;
         },
         transition(input) {
-            const submitted = input.decision;
-            const kind = submitted.kind;
-            const rawTransition = submitted.transition;
-            if (kind !== 'allowed' ||
-                rawTransition === undefined ||
-                rawTransition === null ||
-                typeof rawTransition !== 'object') {
-                throw new TypeError('StateMachine transition decision must be allowed.');
-            }
-            const fromState = rawTransition.from;
-            const event = rawTransition.event;
-            const toState = rawTransition.to;
-            if (typeof fromState !== 'string' ||
-                typeof event !== 'string' ||
-                typeof toState !== 'string') {
-                throw new TypeError('StateMachine transition decision must be allowed.');
-            }
-            const transition = Object.freeze({
-                from: fromState,
-                event: event,
-                to: toState,
-            });
-            let decision;
-            try {
-                decision = input.machine.decide(transition.from, transition.event);
-            }
-            catch {
-                invalidTransition(transition);
-            }
-            if (decision.kind !== 'allowed' || decision.transition.to !== transition.to) {
-                invalidTransition(transition);
-            }
-            const selected = resolvedProperty(input.class, input.property);
-            for (const state of [transition.from, transition.to]) {
-                if (selected.validate(state).length > 0) {
-                    throw new TypeError(`StateMachine-backed property ${String(input.property)} does not admit state ${state}.`);
-                }
-            }
-            const from = { [input.property]: transition.from };
-            const to = { [input.property]: transition.to };
-            const suppliedEquals = input.props?.equals;
-            if ((suppliedEquals !== undefined &&
-                Object.hasOwn(suppliedEquals, input.property) &&
-                suppliedEquals[input.property] !== transition.from) ||
-                input.props?.absent?.includes(input.property) === true) {
-                throw new TypeError(`StateMachine transition conditions conflict with property ${String(input.property)}.`);
-            }
-            core.expect.node({
-                node: existingEndpoint(input.node),
-                class: classKey(input.class),
-                props: conditions(input.class, {
-                    ...input.props,
-                    equals: { ...suppliedEquals, ...from },
-                }),
-            });
-            core.updateNode({
-                node: existingEndpoint(input.node),
-                class: classKey(input.class),
-                props: delta(input.class, { set: to }),
-            });
+            authorStateTransition(core, domain, input);
             return rich;
         },
         deleteNode(input) {
@@ -158,6 +100,3 @@ export function richMutationBuilder(core) {
 function classKey(selected) {
     return ClassKey(selected.key);
 }
-function invalidTransition(transition) {
-    throw new TypeError(`StateMachine transition decision is not legal: ${transition.from} + ${transition.event} -> ${transition.to}.`);
-}

package/dist/application/mutation/authoring/transition.d.ts

@@ -0,0 +1,17 @@
+import type { MutationBuilder } from '@astrale-os/kernel-core/graph/mutate';
+import type { Domain, ResolvedClass } from '../../../platform/schema/index.js';
+import type { StatePropertiesOfClass } from '../../../platform/schema/state-property/index.js';
+import type { EventOf, StateMachine, StateOf } from '../../state/machine.js';
+import type { ExistingEndpoint } from './endpoint.js';
+import type { RichPropertyConditions, RichPropertyName } from './properties.js';
+export type StatePropertyName<Class extends ResolvedClass<'node'>> = Extract<keyof StatePropertiesOfClass<Class>, RichPropertyName<Class>>;
+export type StateMachineOf<Class extends ResolvedClass<'node'>, Property extends StatePropertyName<Class>> = Extract<StatePropertiesOfClass<Class>[Property], StateMachine>;
+export interface StateTransitionInput<Class extends ResolvedClass<'node'>, Property extends StatePropertyName<Class>, Machine extends StateMachineOf<Class, Property>, From extends StateOf<Machine>, Event extends EventOf<Machine, From>> {
+    readonly node: ExistingEndpoint;
+    readonly class: Class;
+    readonly property: Property;
+    readonly from: From;
+    readonly event: Event;
+    readonly props?: RichPropertyConditions<Class>;
+}
+export declare function authorStateTransition<Class extends ResolvedClass<'node'>, Property extends StatePropertyName<Class>, Machine extends StateMachineOf<Class, Property>, From extends StateOf<Machine>, Event extends EventOf<Machine, From>>(core: MutationBuilder, domain: Domain, input: StateTransitionInput<Class, Property, Machine, From, Event>): void;

package/dist/application/mutation/authoring/transition.js

@@ -0,0 +1,47 @@
+import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { stateMachineFor } from '../../../platform/schema/state-property/registry.js';
+import { stateTransitionFailure } from '../failure.js';
+import { existingEndpoint } from './endpoint.js';
+import { conditions, delta, resolvedProperty } from './properties.js';
+export function authorStateTransition(core, domain, input) {
+    const node = existingEndpoint(input.node);
+    const selectedClass = input.class;
+    const property = input.property;
+    const fromState = input.from;
+    const event = input.event;
+    const suppliedProps = input.props;
+    const equals = suppliedProps?.equals;
+    const absent = suppliedProps?.absent;
+    const suppliedEquals = equals === undefined ? undefined : { ...equals };
+    const suppliedAbsent = absent === undefined ? undefined : [...absent];
+    const selected = resolvedProperty(selectedClass, property);
+    const selectedClassKey = ClassKey(selectedClass.key);
+    const machine = stateMachineFor(domain, selected);
+    if (machine === undefined) {
+        throw new TypeError(`State transition requires StateProperty ${selectedClassKey}.${String(property)} in the selected Domain.`);
+    }
+    const decision = machine.decide(fromState, event);
+    if (decision.kind === 'rejected')
+        throw stateTransitionFailure(decision.from, decision.event);
+    const from = { [property]: fromState };
+    const to = { [property]: decision.transition.to };
+    if ((suppliedEquals !== undefined &&
+        Object.hasOwn(suppliedEquals, property) &&
+        suppliedEquals[property] !== fromState) ||
+        suppliedAbsent?.includes(property) === true) {
+        throw new TypeError(`StateMachine transition conditions conflict with property ${String(property)}.`);
+    }
+    core.expect.node({
+        node,
+        class: selectedClassKey,
+        props: conditions(selectedClass, {
+            ...(suppliedAbsent === undefined ? {} : { absent: suppliedAbsent }),
+            equals: { ...suppliedEquals, ...from },
+        }),
+    });
+    core.updateNode({
+        node,
+        class: selectedClassKey,
+        props: delta(selectedClass, { set: to }),
+    });
+}

package/dist/application/mutation/define.d.ts

@@ -1,9 +1,11 @@
 import type { MutationResult } from '@astrale-os/kernel-core/graph/mutate';
 import type { Domain, schema } from '../../platform/schema/index.js';
+import type { StatefulDomainOf } from '../../platform/schema/state-property/index.js';
 import type { Mutation, MutationDefinition } from './mutation.js';
 type ResolvedDomainOf<Schema extends schema.DomainSchema> = Extract<schema.DomainOf<Schema>, Domain>;
+type AuthoringDomainOf<Schema extends schema.DomainSchema> = StatefulDomainOf<Schema>;
 interface MutationProjector<Schema extends schema.DomainSchema> {
-    <Input, Output = MutationResult>(project: (domain: ResolvedDomainOf<Schema>) => MutationDefinition<Input, Output>): Mutation<ResolvedDomainOf<Schema>, Input, Output>;
+    <Input, Output = MutationResult>(project: (domain: AuthoringDomainOf<Schema>) => MutationDefinition<Input, Output>): Mutation<ResolvedDomainOf<Schema>, Input, Output>;
 }
 /** Define one inert Mutation recipe projected from its exact loaded Domain. */
 export declare function defineMutation<Schema extends schema.DomainSchema>(): MutationProjector<Schema>;

package/dist/application/mutation/execution/execute.js

@@ -9,7 +9,7 @@ export async function executeMutation(client, domain, definition, input) {
     }
     const operation = realizeMutation(definition, domain);
     try {
-        const ast = MutationAST.build((builder) => operation.build(input, richMutationBuilder(builder)));
+        const ast = MutationAST.build((builder) => operation.build(input, richMutationBuilder(builder, domain)));
         return projectMutation(operation, await client.mutate(ast, { expected: domain.closure }), input);
     }
     catch (cause) {

package/dist/application/mutation/failure.d.ts

@@ -1,5 +1,13 @@
-export interface MutationFailure extends Error {
-    readonly code: string;
+export interface KernelMutationFailure extends Error {
+    readonly code: `MUTATION_${string}`;
     readonly outcomeKnown: boolean;
 }
+export interface StateTransitionFailure extends Error {
+    readonly code: 'STATE_TRANSITION_ILLEGAL';
+    readonly outcomeKnown: true;
+    readonly from: string;
+    readonly event: string;
+}
+export type MutationFailure = KernelMutationFailure | StateTransitionFailure;
+export declare function stateTransitionFailure(from: string, event: string): StateTransitionFailure;
 export declare function mutationFailure(input: unknown): MutationFailure | undefined;

package/dist/application/mutation/failure.js

@@ -1,4 +1,15 @@
 const UNKNOWN_OUTCOME_CODES = new Set(['MUTATION_OUTCOME_UNKNOWN']);
+const localStateTransitionFailures = new WeakSet();
+export function stateTransitionFailure(from, event) {
+    const failure = Object.assign(new Error(`State transition is illegal: ${from} + ${event}.`), {
+        code: 'STATE_TRANSITION_ILLEGAL',
+        outcomeKnown: true,
+        from,
+        event,
+    });
+    localStateTransitionFailures.add(failure);
+    return failure;
+}
 export function mutationFailure(input) {
     if (!(input instanceof Error))
         return undefined;
@@ -8,6 +19,15 @@ export function mutationFailure(input) {
     const explicit = input.outcomeKnown;
     if (explicit !== undefined && typeof explicit !== 'boolean')
         return undefined;
+    if (code === 'STATE_TRANSITION_ILLEGAL') {
+        if (!localStateTransitionFailures.has(input))
+            return undefined;
+        const from = Reflect.get(input, 'from');
+        const event = Reflect.get(input, 'event');
+        if (typeof from !== 'string' || typeof event !== 'string' || explicit === false)
+            return undefined;
+        return Object.assign(input, { code, outcomeKnown: true, from, event });
+    }
     return Object.assign(input, {
         code,
         outcomeKnown: explicit !== false && !UNKNOWN_OUTCOME_CODES.has(code),
@@ -15,9 +35,12 @@ export function mutationFailure(input) {
 }
 function mutationCode(input) {
     const value = input;
+    if (value.code === 'STATE_TRANSITION_ILLEGAL')
+        return value.code;
     for (const candidate of [value.code, nestedCode(value.reason), nestedCode(value.data)]) {
-        if (typeof candidate === 'string' && candidate.startsWith('MUTATION_'))
+        if (typeof candidate === 'string' && candidate.startsWith('MUTATION_')) {
             return candidate;
+        }
     }
     return undefined;
 }

package/dist/application/state/authority.d.ts

@@ -0,0 +1,3 @@
+import type { StateMachine } from './machine.js';
+export declare function rememberStateMachine(machine: StateMachine): void;
+export declare function isStateMachine(input: unknown): input is StateMachine;

package/dist/application/state/authority.js

@@ -0,0 +1,7 @@
+const machines = new WeakSet();
+export function rememberStateMachine(machine) {
+    machines.add(machine);
+}
+export function isStateMachine(input) {
+    return typeof input === 'object' && input !== null && machines.has(input);
+}

package/dist/application/state/define.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { rememberStateMachine } from './authority.js';
 import { relation } from './relation.js';
 export function stateMachine(input) {
     const admitted = relation(input);
@@ -10,7 +11,7 @@ export function stateMachine(input) {
     const eventSchema = z.enum(events);
     const stateSet = new Set(states);
     const eventSet = new Set(events);
-    return Object.freeze({
+    const machine = Object.freeze({
         initial: admitted.initial,
         stateSchema,
         eventSchema,
@@ -40,6 +41,8 @@ export function stateMachine(input) {
             });
         },
     });
+    rememberStateMachine(machine);
+    return machine;
 }
 function admitState(state, states) {
     if (!states.has(state))

package/dist/execution/identity/authentication.d.ts

@@ -2,7 +2,7 @@ import type { Fetch } from '@astrale-os/kernel-client';
 import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
 import type { AuthenticatedInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
-import type { IdentityNetworkPolicy, VerificationBasis } from './jwks.js';
+import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
@@ -11,6 +11,7 @@ export interface AuthenticationConfiguration {
     readonly signing: SigningMaterial;
     readonly fetch: Fetch;
     readonly policy: IdentityNetworkPolicy;
+    readonly verification: VerificationBasisResolver;
 }
 export declare function authenticate(credentialInput: CredentialInput, expectedKernel: IssuerId, execution: {
     readonly deadline: number;

package/dist/execution/identity/authentication.js

@@ -48,7 +48,7 @@ export async function admit(request, configuration) {
     }
 }
 export async function authenticate(credentialInput, expectedKernel, execution, configuration) {
-    const established = await establishCaller(credentialInput, configuration.issuer, configuration.fetch, execution, configuration.policy);
+    const established = await establishCaller(credentialInput, configuration.issuer, configuration.verification, execution, configuration.policy);
     if (established.verified.iss !== expectedKernel) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
@@ -104,10 +104,10 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         });
     }
 }
-async function establishCaller(input, audience, fetch, execution, policy) {
+async function establishCaller(input, audience, verification, execution, policy) {
     requireLive(execution);
     try {
-        const context = await verifyCredential(input, audience, fetch, execution.signal, policy);
+        const context = await verifyCredential(input, audience, verification, execution.signal, policy);
         const carried = delegation.accept(context.verified.claims.delegation);
         if (typeof carried.credential !== 'string') {
             throw new CredentialRejected('Destination carrier has no Kernel authority proof.');

package/dist/execution/identity/exchange.d.ts

@@ -1,10 +1,9 @@
-import type { Fetch } from '@astrale-os/kernel-client';
 import type { exchange } from '@astrale-os/kernel-server';
 import type { IssuerId } from '../../platform/auth/index.js';
-import type { IdentityNetworkPolicy } from './jwks.js';
+import type { IdentityNetworkPolicy, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 export interface ExchangeOptions {
     readonly maximumTtlSeconds?: number;
 }
 export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;
-export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, fetch: Fetch, policy: IdentityNetworkPolicy, maximumTtlSeconds: number): exchange.Provider;
+export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, policy: IdentityNetworkPolicy, verification: VerificationBasisResolver, maximumTtlSeconds: number): exchange.Provider;

package/dist/execution/identity/exchange.js

@@ -22,19 +22,22 @@ export function maximumExchangeTtl(input) {
     }
     return value;
 }
-export function tokenExchange(issuer, subject, signing, fetch, policy, maximumTtlSeconds) {
+export function tokenExchange(issuer, subject, signing, policy, verification, maximumTtlSeconds) {
     return Object.freeze({
         async exchange(request, context) {
             try {
-                const outer = await verifyCredential(request.token, issuer, fetch, context.signal, policy);
+                context.signal.throwIfAborted();
+                const outer = await verifyCredential(request.token, issuer, verification, context.signal, policy);
                 requireProfile(outer.verified, 'outer');
                 const carried = delegation.accept(outer.verified.claims.delegation);
                 if (typeof carried.credential !== 'string')
                     invalid();
+                context.signal.throwIfAborted();
                 const inner = await verifyCredentialAgainst(carried.credential, outer.verified.iss, outer.basis);
                 requireProfile(inner.verified, 'inner');
                 requireCoherence(outer.verified, inner.verified);
                 acceptResolvedDelegation(inner.verified.claims.delegation);
+                context.signal.throwIfAborted();
                 const now = Math.floor(Date.now() / 1_000);
                 const expiresAt = Math.min(outer.verified.exp, inner.verified.exp, now + maximumTtlSeconds);
                 if (expiresAt <= now)
@@ -55,6 +58,7 @@ export function tokenExchange(issuer, subject, signing, fetch, policy, maximumTt
                     .setIssuedAt(now)
                     .setExpirationTime(expiresAt)
                     .sign(await signing.privateKey);
+                context.signal.throwIfAborted();
                 return issuerExchange.response(token, expiresAt);
             }
             catch (cause) {

package/dist/execution/identity/identity.js

@@ -2,6 +2,7 @@ import { admit, authenticate } from './authentication.js';
 import { publicationDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
+import { createVerificationBasisResolver } from './jwks.js';
 import { signing } from './signing.js';
 /** Create one stateless execution identity backed by an asymmetric private JWK. */
 export function createIdentity(input) {
@@ -25,16 +26,18 @@ export function createIdentity(input) {
         ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
         ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
     });
+    const verification = createVerificationBasisResolver(fetch, policy);
     const configuration = Object.freeze({
         issuer,
         subject: input.subject,
         signing: material,
         fetch,
         policy,
+        verification,
     });
     const exchangeProvider = input.tokenExchange === false
         ? undefined
-        : tokenExchange(issuer, input.subject, material, fetch, policy, maximumExchangeTtl(input.tokenExchange));
+        : tokenExchange(issuer, input.subject, material, policy, verification, maximumExchangeTtl(input.tokenExchange));
     return identity({
         issuer,
         subject: input.subject,

package/dist/execution/identity/jwks.d.ts

@@ -10,7 +10,15 @@ export interface VerificationBasis {
     readonly algorithms: readonly [string, ...string[]];
     readonly keys: readonly JsonWebKey[];
 }
-export declare function verifyCredential(input: CredentialInput, audience: IssuerId, fetch: Fetch, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
+export interface VerificationBasisResolver {
+    resolve(issuer: IssuerId, keyId: string | undefined, signal: AbortSignal): Promise<VerificationBasis>;
+}
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export declare function createVerificationBasisResolver(fetch: Fetch, policy: IdentityNetworkPolicy, now?: () => number): VerificationBasisResolver;
+export declare function verifyCredential(input: CredentialInput, audience: IssuerId, bases: VerificationBasisResolver, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
     readonly raw: CredentialInput;
     readonly verified: VerifiedCredential;
     readonly basis: VerificationBasis;

package/dist/execution/identity/jwks.js

@@ -5,7 +5,94 @@ import { errors as joseErrors, importJWK, jwtVerify } from 'jose';
 import { credential } from '../../platform/auth/index.js';
 import { CredentialRejected, IssuerUnavailable, admitEndpoint, httpIssuer } from './errors.js';
 const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
-export async function verifyCredential(input, audience, fetch, signal, policy) {
+const MAXIMUM_VERIFICATION_BASES = 64;
+const VERIFICATION_BASIS_TTL_MS = 60_000;
+const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export function createVerificationBasisResolver(fetch, policy, now = Date.now) {
+    const bases = new Map();
+    const pending = new Map();
+    return Object.freeze({
+        async resolve(issuer, keyId, signal) {
+            signal.throwIfAborted();
+            const cached = bases.get(issuer);
+            const observedAt = now();
+            const age = cached === undefined ? Number.POSITIVE_INFINITY : observedAt - cached.refreshedAt;
+            const fresh = cached !== undefined && age >= 0 && age < VERIFICATION_BASIS_TTL_MS;
+            const knownKey = keyId === undefined ||
+                cached?.basis.keys.some((candidate) => candidate.kid === keyId) === true;
+            const unknownKeyCooldown = cached?.unknownKeyRefreshedAt !== undefined &&
+                observedAt - cached.unknownKeyRefreshedAt >= 0 &&
+                observedAt - cached.unknownKeyRefreshedAt < UNKNOWN_KEY_REFRESH_COOLDOWN_MS;
+            if (fresh && knownKey) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            const unknownKeyRefresh = cached !== undefined && !knownKey;
+            let refresh = pending.get(issuer);
+            if (refresh === undefined && fresh && unknownKeyCooldown) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            if (refresh === undefined && unknownKeyRefresh && cached !== undefined) {
+                bases.set(issuer, Object.freeze({ ...cached, unknownKeyRefreshedAt: observedAt }));
+            }
+            if (refresh === undefined) {
+                const controller = new AbortController();
+                refresh = {
+                    controller,
+                    operation: undefined,
+                    subscribers: 0,
+                    settled: false,
+                    unknownKeyRefresh,
+                    requestedKeyIds: new Set(keyId === undefined ? [] : [keyId]),
+                };
+                const owned = refresh;
+                owned.operation = discover(issuer, fetch, controller.signal, policy)
+                    .then((basis) => {
+                    controller.signal.throwIfAborted();
+                    const refreshedAt = now();
+                    if (bases.size >= MAXIMUM_VERIFICATION_BASES && !bases.has(issuer)) {
+                        const oldest = bases.keys().next().value;
+                        if (oldest !== undefined)
+                            bases.delete(oldest);
+                    }
+                    bases.delete(issuer);
+                    bases.set(issuer, Object.freeze({
+                        basis,
+                        refreshedAt,
+                        ...(owned.unknownKeyRefresh ||
+                            [...owned.requestedKeyIds].some((requested) => !basis.keys.some((candidate) => candidate.kid === requested))
+                            ? { unknownKeyRefreshedAt: refreshedAt }
+                            : {}),
+                    }));
+                    return basis;
+                })
+                    .finally(() => {
+                    owned.settled = true;
+                    if (pending.get(issuer) === owned)
+                        pending.delete(issuer);
+                });
+                pending.set(issuer, owned);
+            }
+            else if (unknownKeyRefresh) {
+                refresh.unknownKeyRefresh = true;
+            }
+            if (keyId !== undefined)
+                refresh.requestedKeyIds.add(keyId);
+            const basis = await subscribe(refresh, issuer, pending, signal);
+            signal.throwIfAborted();
+            return basis;
+        },
+    });
+}
+export async function verifyCredential(input, audience, bases, signal, policy) {
+    signal.throwIfAborted();
     let inspected;
     try {
         inspected = credential.inspect(input);
@@ -22,11 +109,48 @@ export async function verifyCredential(input, audience, fetch, signal, policy) {
     catch (cause) {
         throw new CredentialRejected('Credential issuer is invalid.', cause);
     }
-    const basis = await discover(admittedIssuer, fetch, signal, policy);
+    const basis = await bases.resolve(admittedIssuer, inspected.kid, signal);
+    signal.throwIfAborted();
     const verified = await verifyCredentialAgainst(input, audience, basis, inspected);
+    signal.throwIfAborted();
     admitEndpoint(`${admittedIssuer.replace(/\/+$/u, '')}/invoke`, policy);
     return Object.freeze({ raw: input, verified: verified.verified, basis });
 }
+function subscribe(refresh, issuer, pending, signal) {
+    signal.throwIfAborted();
+    refresh.subscribers += 1;
+    return new Promise((resolve, reject) => {
+        let complete = false;
+        const finish = () => {
+            if (complete)
+                return false;
+            complete = true;
+            signal.removeEventListener('abort', cancel);
+            refresh.subscribers -= 1;
+            if (!refresh.settled && refresh.subscribers === 0) {
+                if (pending.get(issuer) === refresh)
+                    pending.delete(issuer);
+                refresh.controller.abort(new DOMException('Issuer discovery was cancelled.', 'AbortError'));
+            }
+            return true;
+        };
+        const cancel = () => {
+            if (!finish())
+                return;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', cancel, { once: true });
+        refresh.operation.then((basis) => {
+            if (!finish())
+                return;
+            resolve(basis);
+        }, (cause) => {
+            if (!finish())
+                return;
+            reject(cause);
+        });
+    });
+}
 export async function verifyCredentialAgainst(input, audience, basis, preinspected) {
     let inspected;
     try {

package/dist/platform/schema/index.d.ts

@@ -1,4 +1,6 @@
 import { KernelSchema as CoreKernelSchema } from '@astrale-os/kernel-core/schema';
+export { defineSchema, edgeClass, nodeClass, stateProperty } from './state-property/index.js';
+export type { StateClass, StateProperty, StateSchema } from './state-property/index.js';
 export * from '@astrale-os/kernel-dsl/v1';
 export { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 export type { CallablePolicyBuilder, CallablePolicyContext, CallableProjection, AuthoredMethodProjection, AuthoredPropertyProjection, ClassIdentityProjection, ClassOwnerProjection, CoreEdge, CoreEndpoint, CoreNode, DefinedSchema, DirectedEdgeClass, ClassReferenceProjection, ClassProjection, FunctionProjection, EdgeClass, Function, Method, MethodProjection, Lazy, NodeClass, Policy, Property, PropertyProjection, ResolvedDomainOfInput, View, } from '@astrale-os/kernel-dsl/v1/builder';

package/dist/platform/schema/index.js

@@ -1,6 +1,7 @@
 import { KernelSchema as CoreKernelSchema } from '@astrale-os/kernel-core/schema';
 /** Canonical Schema authoring, compilation, loading, and resolved Domain surface. */
 import { schema as language } from '@astrale-os/kernel-dsl/v1';
+export { defineSchema, edgeClass, nodeClass, stateProperty } from './state-property/index.js';
 export * from '@astrale-os/kernel-dsl/v1';
 export { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 /** Kernel-owned Schema values used by authored product Schemas and graph operations. */

package/dist/platform/schema/state-property/authoring.d.ts

@@ -0,0 +1,15 @@
+import type { DefinedSchema, NodeClassInput, PropertyOptions, ResolvedDomainOfInput, SchemaInput as DomainSchemaInput } from '@astrale-os/kernel-dsl/v1/builder';
+import { nodeClass as languageNodeClass } from '@astrale-os/kernel-dsl/v1';
+import type { StateMachine } from '../../../application/state/machine.js';
+import type { StateClass, StateClassesOfInput, StateDependenciesOfInput, StatePropertiesOfConfig, StateProperty, StateSchema } from './model.js';
+interface StatePropertyOptions {
+    readonly visibility?: PropertyOptions['visibility'];
+    readonly description?: string;
+}
+type RequiredStatePropertyOptions<Options extends StatePropertyOptions> = Readonly<Options & {
+    readonly required: true;
+}>;
+export declare function stateProperty<const Machine extends StateMachine, const Options extends StatePropertyOptions = Record<never, never>>(machine: Machine, options?: Options & Record<Exclude<keyof Options, keyof StatePropertyOptions>, never>): StateProperty<Machine, RequiredStatePropertyOptions<Options>>;
+export declare function nodeClass<const Config extends NodeClassInput = Record<never, never>>(config?: Config & Record<Exclude<keyof Config, keyof NodeClassInput>, never>): ReturnType<typeof languageNodeClass<Config>> & StateClass<StatePropertiesOfConfig<Config>>;
+export declare function defineSchema<const Origin extends string, const Input extends DomainSchemaInput>(origin: Origin, input: Input): DefinedSchema<Origin, ResolvedDomainOfInput<Origin, Input>> & StateSchema<StateClassesOfInput<Input>, StateDependenciesOfInput<Input>>;
+export {};

package/dist/platform/schema/state-property/authoring.js

@@ -0,0 +1,49 @@
+import { defineSchema as defineLanguageSchema, nodeClass as languageNodeClass, property, schema, } from '@astrale-os/kernel-dsl/v1';
+import { isStateMachine } from '../../../application/state/authority.js';
+import { rememberStateClass, rememberStateProperty, rememberStateSchema } from './registry.js';
+export function stateProperty(machine, options) {
+    if (!isStateMachine(machine))
+        throw new TypeError('stateProperty requires an SDK StateMachine.');
+    if (options !== undefined &&
+        (typeof options !== 'object' ||
+            options === null ||
+            Array.isArray(options) ||
+            Reflect.ownKeys(options).some((key) => key !== 'visibility' && key !== 'description'))) {
+        throw new TypeError('stateProperty options are visibility and description only.');
+    }
+    const value = property(machine.stateSchema, {
+        ...options,
+        required: true,
+    });
+    rememberStateProperty(value, machine);
+    return value;
+}
+export function nodeClass(config) {
+    const captured = captureNodeClassInput(config);
+    const value = languageNodeClass(captured);
+    rememberStateClass(value, captured?.properties);
+    return value;
+}
+export function defineSchema(origin, input) {
+    const captured = captureSchemaInput(input);
+    const source = defineLanguageSchema(origin, captured);
+    rememberStateSchema(source, captured, schema.resolve(source));
+    return source;
+}
+function captureNodeClassInput(config) {
+    if (config === undefined)
+        return undefined;
+    const captured = { ...config };
+    return {
+        ...captured,
+        ...(captured.properties === undefined ? {} : { properties: { ...captured.properties } }),
+    };
+}
+function captureSchemaInput(input) {
+    const captured = { ...input };
+    return {
+        ...captured,
+        ...(captured.dependencies === undefined ? {} : { dependencies: { ...captured.dependencies } }),
+        ...(captured.classes === undefined ? {} : { classes: { ...captured.classes } }),
+    };
+}

package/dist/platform/schema/state-property/edge.d.ts

@@ -0,0 +1,16 @@
+import type { DirectedEdgeInput, UndirectedEdgeInput } from '@astrale-os/kernel-dsl/v1/builder';
+import { edgeClass as languageEdgeClass } from '@astrale-os/kernel-dsl/v1';
+import type { StateProperty } from './model.js';
+interface EdgeClassAuthoring {
+    directed<const Input extends Omit<DirectedEdgeInput, 'orientation'>>(input: Parameters<typeof languageEdgeClass.directed<Input>>[0] & WithoutStateProperties<Input>): ReturnType<typeof languageEdgeClass.directed<Input>>;
+    undirected<const Input extends Omit<UndirectedEdgeInput, 'orientation'>>(input: Parameters<typeof languageEdgeClass.undirected<Input>>[0] & WithoutStateProperties<Input>): ReturnType<typeof languageEdgeClass.undirected<Input>>;
+}
+type WithoutStateProperties<Input> = Input extends {
+    readonly properties?: infer Properties extends Readonly<Record<string, unknown>>;
+} ? {
+    readonly properties?: {
+        readonly [Name in keyof Properties]: Properties[Name] extends StateProperty ? never : Properties[Name];
+    };
+} : unknown;
+export declare const edgeClass: Readonly<EdgeClassAuthoring>;
+export {};

package/dist/platform/schema/state-property/edge.js

@@ -0,0 +1,21 @@
+import { edgeClass as languageEdgeClass } from '@astrale-os/kernel-dsl/v1';
+import { isStateProperty } from './registry.js';
+export const edgeClass = Object.freeze({
+    directed(input) {
+        return languageEdgeClass.directed(captureEdgeInput(input));
+    },
+    undirected(input) {
+        return languageEdgeClass.undirected(captureEdgeInput(input));
+    },
+});
+function captureEdgeInput(input) {
+    const captured = { ...input };
+    const properties = captured.properties === undefined ? undefined : { ...captured.properties };
+    if (Object.values(properties ?? {}).some(isStateProperty)) {
+        throw new TypeError('StateProperty is supported only on Node Classes.');
+    }
+    return {
+        ...captured,
+        ...(properties === undefined ? {} : { properties }),
+    };
+}

package/dist/platform/schema/state-property/index.d.ts

@@ -0,0 +1,4 @@
+export { defineSchema, nodeClass, stateProperty } from './authoring.js';
+export { edgeClass } from './edge.js';
+export type { StateClass, StatePropertiesOfClass, StateProperty, StateSchema, StatefulDomainOf, } from './model.js';
+export { stateMachineFor } from './registry.js';

package/dist/platform/schema/state-property/index.js

@@ -0,0 +1,3 @@
+export { defineSchema, nodeClass, stateProperty } from './authoring.js';
+export { edgeClass } from './edge.js';
+export { stateMachineFor } from './registry.js';

package/dist/platform/schema/state-property/model.d.ts

@@ -0,0 +1,49 @@
+import type { Domain, ResolvedClass } from '@astrale-os/kernel-dsl/v1';
+import type { NodeClassInput, Property, PropertyOptions, SchemaInput as DomainSchemaInput } from '@astrale-os/kernel-dsl/v1/builder';
+import type * as languageSchema from '@astrale-os/kernel-dsl/v1/schema';
+import type { StateMachine } from '../../../application/state/machine.js';
+declare const STATE_PROPERTY_MACHINE: unique symbol;
+declare const STATE_CLASS_PROPERTIES: unique symbol;
+declare const STATE_SCHEMA_CLASSES: unique symbol;
+export interface StateProperty<Machine extends StateMachine = StateMachine, Options extends PropertyOptions = PropertyOptions> extends Property<Machine['stateSchema'], Options> {
+    readonly [STATE_PROPERTY_MACHINE]: Machine;
+}
+export interface StateClass<Properties extends Readonly<Record<string, StateMachine>>> {
+    readonly [STATE_CLASS_PROPERTIES]: Properties;
+}
+export interface StateSchema<Classes extends Readonly<Record<string, Readonly<Record<string, StateMachine>>>>, Dependencies extends Readonly<Record<string, languageSchema.DomainSchema>> = Readonly<Record<never, never>>> {
+    readonly [STATE_SCHEMA_CLASSES]: {
+        readonly classes: Classes;
+        readonly dependencies: Dependencies;
+    };
+}
+export type StatePropertiesOfConfig<Config extends NodeClassInput> = Merge<ParentStateProperties<Config>, OwnStateProperties<Config>>;
+export type StateClassesOfInput<Input extends DomainSchemaInput> = Input extends {
+    readonly classes?: infer Classes extends Readonly<Record<string, unknown>>;
+} ? {
+    readonly [Name in keyof Classes]: Classes[Name] extends StateClass<infer Properties> ? Properties : Readonly<Record<never, never>>;
+} : Readonly<Record<never, never>>;
+export type StateDependenciesOfInput<Input extends DomainSchemaInput> = Input extends {
+    readonly dependencies?: infer Dependencies extends Readonly<Record<string, languageSchema.DomainSchema>>;
+} ? Dependencies : Readonly<Record<never, never>>;
+export type StatefulDomainOf<Schema extends languageSchema.DomainSchema> = Schema extends StateSchema<infer Classes, infer Dependencies> ? Extract<languageSchema.DomainOf<Schema>, Domain> extends infer DomainValue extends Domain ? DomainValue & {
+    readonly classes: {
+        readonly [Name in keyof DomainValue['classes']]: DomainValue['classes'][Name] & StateClass<Name extends keyof Classes ? Extract<Classes[Name], Readonly<Record<string, StateMachine>>> : Readonly<Record<never, never>>>;
+    };
+    readonly dependencies: {
+        readonly [Name in keyof DomainValue['dependencies']]: Name extends keyof Dependencies ? Dependencies[Name] extends languageSchema.DomainSchema ? StatefulDomainOf<Dependencies[Name]> : DomainValue['dependencies'][Name] : DomainValue['dependencies'][Name];
+    };
+} : never : Extract<languageSchema.DomainOf<Schema>, Domain>;
+export type StatePropertiesOfClass<Class extends ResolvedClass<'node'>> = Class extends StateClass<infer Properties> ? Properties : Readonly<Record<never, never>>;
+type OwnStateProperties<Config extends NodeClassInput> = Config extends {
+    readonly properties?: infer Properties extends Readonly<Record<string, unknown>>;
+} ? {
+    readonly [Name in keyof Properties as Properties[Name] extends StateProperty ? Name : never]: Properties[Name] extends StateProperty<infer Machine> ? Machine : never;
+} : Readonly<Record<never, never>>;
+type ParentStateProperties<Config extends NodeClassInput> = Config extends {
+    readonly extends?: readonly (infer Parent)[];
+} ? UnionToIntersection<StatePropertiesOfReference<Parent>> : Readonly<Record<never, never>>;
+type StatePropertiesOfReference<Value, Depth extends readonly unknown[] = []> = Depth['length'] extends 32 ? Readonly<Record<never, never>> : Value extends () => infer Resolved ? StatePropertiesOfReference<Resolved, readonly [...Depth, unknown]> : Value extends StateClass<infer Properties> ? Properties : Readonly<Record<never, never>>;
+type UnionToIntersection<Value> = (Value extends unknown ? (input: Value) => void : never) extends (input: infer Intersection) => void ? Intersection : never;
+type Merge<Parent, Own> = Readonly<Omit<Parent, keyof Own> & Own>;
+export {};

package/dist/platform/schema/state-property/model.js

@@ -0,0 +1 @@
+export {};

package/dist/platform/schema/state-property/registry.d.ts

@@ -0,0 +1,9 @@
+import type { Domain, ResolvedProperty } from '@astrale-os/kernel-dsl/v1';
+import type { Property, SchemaInput as DomainSchemaInput } from '@astrale-os/kernel-dsl/v1/builder';
+import type * as languageSchema from '@astrale-os/kernel-dsl/v1/schema';
+import type { StateMachine } from '../../../application/state/machine.js';
+export declare function rememberStateProperty(property: Property, machine: StateMachine): void;
+export declare function isStateProperty(value: unknown): boolean;
+export declare function rememberStateClass(selected: object, properties?: Readonly<Record<string, unknown>>): void;
+export declare function rememberStateSchema(source: languageSchema.DomainSchema, input: DomainSchemaInput, domain: Domain): void;
+export declare function stateMachineFor(domain: Domain, selected: ResolvedProperty<unknown>): StateMachine | undefined;

package/dist/platform/schema/state-property/registry.js

@@ -0,0 +1,74 @@
+const propertyMachines = new WeakMap();
+const classProperties = new WeakMap();
+const schemaProperties = new WeakMap();
+export function rememberStateProperty(property, machine) {
+    propertyMachines.set(property, machine);
+}
+export function isStateProperty(value) {
+    return typeof value === 'object' && value !== null && propertyMachines.has(value);
+}
+export function rememberStateClass(selected, properties) {
+    const machines = new Map();
+    for (const [name, property] of Object.entries(properties ?? {})) {
+        if (typeof property !== 'object' || property === null)
+            continue;
+        const machine = propertyMachines.get(property);
+        if (machine !== undefined)
+            machines.set(name, machine);
+    }
+    classProperties.set(selected, machines);
+}
+export function rememberStateSchema(source, input, domain) {
+    const byKey = new Map();
+    for (const dependency of Object.values(input.dependencies ?? {})) {
+        const associated = schemaProperties.get(dependency);
+        if (associated === undefined)
+            continue;
+        for (const [key, machine] of associated.byKey)
+            bindKey(byKey, key, machine);
+    }
+    for (const [className, authored] of Object.entries(input.classes ?? {})) {
+        const machines = classProperties.get(authored);
+        if (machines === undefined || machines.size === 0)
+            continue;
+        const resolved = Reflect.get(domain.classes, className);
+        if (resolved === undefined)
+            continue;
+        for (const [propertyName, machine] of machines) {
+            const property = Reflect.get(resolved.self.properties, propertyName);
+            if (property !== undefined)
+                bindKey(byKey, property.key, machine);
+        }
+    }
+    const byProperty = new WeakMap();
+    bindDomainProperties(domain, byKey, byProperty, new Set());
+    schemaProperties.set(source, { byKey, byProperty });
+}
+export function stateMachineFor(domain, selected) {
+    const source = Reflect.get(domain, 'source');
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    return schemaProperties.get(source)?.byProperty.get(selected);
+}
+function bindKey(byKey, key, machine) {
+    const existing = byKey.get(key);
+    if (existing !== undefined && existing !== machine) {
+        throw new TypeError(`StateProperty ${key} has more than one StateMachine authority.`);
+    }
+    byKey.set(key, machine);
+}
+function bindDomainProperties(domain, byKey, byProperty, seen) {
+    if (seen.has(domain))
+        return;
+    seen.add(domain);
+    for (const definition of domain.definitions('class')) {
+        for (const property of definition.self.properties) {
+            const machine = byKey.get(property.key);
+            if (machine !== undefined)
+                byProperty.set(property, machine);
+        }
+    }
+    for (const dependency of Object.values(domain.dependencies)) {
+        bindDomainProperties(dependency, byKey, byProperty, seen);
+    }
+}

package/dist/tooling/linter/implementations/source/mutations.js

@@ -1,7 +1,7 @@
 import ts from 'typescript';
 import { importedSymbol, propertyChain, staticText, unwrap, visit, } from '../../adapters/typescript/index.js';
 import { ambiguity, callback, DSL_MODULES, definitionOriginAmbiguity, definitionObjects, domainProjectorEvidence, forbiddenIoImport, hasForbiddenGlobalCall, production, violation, } from './shared.js';
-import { stateMachineIdentity, stateSchemaIdentity } from './state-machine.js';
+import { stateMachineIdentity, statePropertyIdentity } from './state-machine.js';
 const FORBIDDEN_LAYERS = new Set(['integrations', 'actions', 'providers', 'queries', 'workflows']);
 const FORBIDDEN_CALLS = new Set(['invoke', 'query', 'retry', 'run', 'submit']);
 export const mutationRules = [
@@ -150,19 +150,27 @@ export const mutationRules = [
                         evidence.push(ambiguity(file, node, 'StateMachine transition input is not one static object.'));
                         return;
                     }
-                    if (assignedValue(input, 'to') !== undefined ||
-                        assignedValue(input, 'event') !== undefined ||
-                        assignedValue(input, 'transition') !== undefined ||
-                        assignedValue(input, 'witness') !== undefined) {
-                        evidence.push(violation(file, input, 'StateMachine transition accepts one allowed decision, not a target, event, transition, or witness field.'));
+                    const removed = [
+                        'machine',
+                        'lifecycle',
+                        'decision',
+                        'to',
+                        'transition',
+                        'witness',
+                        'step',
+                    ].filter((name) => assignedValue(input, name) !== undefined);
+                    if (removed.length > 0) {
+                        evidence.push(violation(file, input, `StateMachine transition derives authority and target from StateProperty; remove ${removed.join(', ')}.`));
                     }
                     const spread = hasSpread(input);
                     if (spread) {
                         evidence.push(ambiguity(file, input, 'StateMachine transition input contains a spread that may override or add governed fields.'));
                     }
-                    if (assignedValue(input, 'decision') === undefined) {
-                        if (!spread) {
-                            evidence.push(violation(file, input, 'StateMachine transition has no allowed decision.'));
+                    if (!spread) {
+                        for (const required of ['from', 'event']) {
+                            if (assignedValue(input, required) !== undefined)
+                                continue;
+                            evidence.push(violation(file, input, `StateMachine transition has no ${required} intent.`));
                         }
                     }
                     const selectedClass = propertiesForClass(input, machineProperties);
@@ -177,25 +185,6 @@ export const mutationRules = [
                         (selectedClass.kind === 'resolved' && !selectedClass.properties.has(property))) {
                         evidence.push(violation(file, assignedValue(input, 'property') ?? input, `StateMachine transition property ${property} is not a machine-backed Property of the selected Class.`));
                     }
-                    const legacyLifecycle = assignedValue(input, 'lifecycle');
-                    if (legacyLifecycle !== undefined) {
-                        evidence.push(violation(file, legacyLifecycle, 'StateMachine transition uses removed lifecycle field; use machine.'));
-                    }
-                    const machineInput = assignedValue(input, 'machine');
-                    const machine = machineInput === undefined
-                        ? { kind: 'absent' }
-                        : stateMachineIdentity(project, file, machineInput);
-                    if (machine.kind !== 'resolved') {
-                        if (legacyLifecycle === undefined) {
-                            evidence.push(ambiguity(file, machineInput ?? input, 'StateMachine transition machine has no resolvable canonical States source.'));
-                        }
-                    }
-                    else if (property !== undefined &&
-                        selectedClass.kind === 'resolved' &&
-                        selectedClass.properties.get(property) !== undefined &&
-                        selectedClass.properties.get(property) !== machine.identity) {
-                        evidence.push(violation(file, machineInput ?? input, `StateMachine transition uses a different authority than property ${property}.`));
-                    }
                 });
             }
             return evidence;
@@ -587,7 +576,7 @@ function machinePropertiesByClass(project) {
     const ambiguousByClass = new Map();
     const ownerSources = new Map();
     const record = (file, owner, name, value) => {
-        const machine = stateSchemaIdentity(project, file, value);
+        const machine = statePropertyIdentity(project, file, value);
         if (machine.kind === 'resolved') {
             const identities = all.get(name) ?? new Set();
             identities.add(machine.identity);
@@ -635,7 +624,7 @@ function machinePropertiesByClass(project) {
                     }
                 }
                 else if (owner !== undefined) {
-                    const machine = stateSchemaIdentity(project, file, node.expression);
+                    const machine = statePropertyIdentity(project, file, node.expression);
                     if (machine.kind !== 'absent') {
                         const names = ambiguousByClass.get(owner) ?? new Set();
                         names.add('<spread>');

package/dist/tooling/linter/implementations/source/schema.js

@@ -1,7 +1,7 @@
 import ts from 'typescript';
 import { importedSymbol, propertyChain, staticText, unwrap, visit, } from '../../adapters/typescript/index.js';
-import { ambiguity, forbiddenIoImport, production, violation } from './shared.js';
-import { stateMachineConstructorOrigin, stateMachineOrigin, stateSchemaIdentity, } from './state-machine.js';
+import { ambiguity, DSL_MODULES, forbiddenIoImport, production, violation } from './shared.js';
+import { stateMachineConstructorOrigin, stateMachineOrigin, statePropertyIdentity, statePropertyOrigin, stateSchemaIdentity, } from './state-machine.js';
 const FORBIDDEN_LAYERS = new Set([
     'integrations',
     'actions',
@@ -32,10 +32,23 @@ export const schemaRules = [
                 const ownedVocabularies = file.submodule === undefined ? undefined : machineVocabularies.get(file.submodule);
                 const reportedEnums = new Set();
                 visit(file.source, (node) => {
-                    if (ts.isPropertyAssignment(node) && isPropertiesMember(node)) {
-                        const codec = stateSchemaIdentity(project, file, node.initializer);
-                        if (codec.kind === 'ambiguous') {
-                            evidence.push(ambiguity(file, node.initializer, 'Schema machine-backed Property codec has no exact stateSchema source.'));
+                    if ((ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node)) &&
+                        isPropertiesMember(node)) {
+                        const value = ts.isPropertyAssignment(node) ? node.initializer : node.name;
+                        const result = persistedStatePropertyEvidence(project, file, value, node);
+                        if (result !== undefined)
+                            evidence.push(result);
+                    }
+                    if (ts.isSpreadAssignment(node) && isPropertiesObject(node.parent)) {
+                        const spread = staticSchemaObject(file, node.expression);
+                        for (const entry of spread?.properties ?? []) {
+                            if (!ts.isPropertyAssignment(entry) && !ts.isShorthandPropertyAssignment(entry)) {
+                                continue;
+                            }
+                            const value = ts.isPropertyAssignment(entry) ? entry.initializer : entry.name;
+                            const result = persistedStatePropertyEvidence(project, file, value, node);
+                            if (result !== undefined)
+                                evidence.push(result);
                         }
                     }
                     if (ts.isCallExpression(node)) {
@@ -277,9 +290,79 @@ function propertyName(name) {
         ? (staticText(name.expression) ?? '<dynamic>')
         : '<dynamic>';
 }
+function persistedStatePropertyEvidence(project, file, value, placement) {
+    const associationOrigin = statePropertyOrigin(file, value);
+    const association = statePropertyIdentity(project, file, value);
+    if (associationOrigin === 'resolved' && isEdgePropertyPlacement(file, placement)) {
+        return violation(file, value, 'Schema StateProperty is supported only on Node Classes.');
+    }
+    if (associationOrigin === 'resolved' && association.kind === 'absent') {
+        return violation(file, value, 'Schema stateProperty does not reference an exported StateMachine authority.');
+    }
+    if (associationOrigin === 'ambiguous' || association.kind === 'ambiguous') {
+        return ambiguity(file, value, 'Schema StateProperty has no exact StateMachine source.');
+    }
+    if (associationOrigin !== 'absent')
+        return undefined;
+    const codec = stateSchemaIdentity(project, file, value);
+    if (codec.kind === 'resolved') {
+        return violation(file, value, 'Schema persists a StateMachine codec without retaining its authority; use stateProperty(machine).');
+    }
+    return codec.kind === 'ambiguous'
+        ? ambiguity(file, value, 'Schema machine-backed Property has no exact stateProperty source.')
+        : undefined;
+}
+function isEdgePropertyPlacement(file, placement) {
+    let current = placement;
+    while (current !== undefined && !ts.isSourceFile(current)) {
+        if (ts.isCallExpression(current)) {
+            const expression = unwrap(current.expression);
+            if (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) {
+                const member = ts.isPropertyAccessExpression(expression)
+                    ? expression.name.text
+                    : staticText(expression.argumentExpression);
+                const owner = importedSymbol(file, expression.expression);
+                if ((member === 'directed' || member === 'undirected') &&
+                    owner?.name === 'edgeClass' &&
+                    DSL_MODULES.has(owner.module)) {
+                    return true;
+                }
+            }
+        }
+        current = current.parent;
+    }
+    return false;
+}
+function staticSchemaObject(file, expression, seen = new Set()) {
+    const value = unwrap(expression);
+    if (ts.isObjectLiteralExpression(value))
+        return value;
+    if (!ts.isIdentifier(value) || seen.has(value.text))
+        return undefined;
+    for (const statement of file.source.statements) {
+        if (!ts.isVariableStatement(statement))
+            continue;
+        if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0)
+            continue;
+        for (const declaration of statement.declarationList.declarations) {
+            if (ts.isIdentifier(declaration.name) &&
+                declaration.name.text === value.text &&
+                declaration.initializer !== undefined) {
+                return staticSchemaObject(file, declaration.initializer, new Set([...seen, value.text]));
+            }
+        }
+    }
+    return undefined;
+}
 function isPropertiesMember(node) {
     const owner = node.parent.parent;
     return (ts.isPropertyAssignment(owner) &&
         owner.name !== undefined &&
         propertyName(owner.name) === 'properties');
 }
+function isPropertiesObject(node) {
+    const owner = node.parent;
+    return (ts.isPropertyAssignment(owner) &&
+        owner.name !== undefined &&
+        propertyName(owner.name) === 'properties');
+}

package/dist/tooling/linter/implementations/source/state-machine.d.ts

@@ -16,5 +16,9 @@ export declare function stateMachineOrigin(project: SourceProject, file: SourceF
 export declare function stateMachineIdentity(project: SourceProject, file: SourceFile, expression: ts.Expression, seen?: ReadonlySet<string>): StateMachineResolution;
 /** Resolve a Schema codec expression to the exact machine whose stateSchema it aliases. */
 export declare function stateSchemaIdentity(project: SourceProject, file: SourceFile, expression: ts.Expression, seen?: ReadonlySet<string>): StateMachineResolution;
+/** Resolve a persisted Schema stateProperty to its exact StateMachine authority. */
+export declare function statePropertyIdentity(project: SourceProject, file: SourceFile, expression: ts.Expression, seen?: ReadonlySet<string>): StateMachineResolution;
+/** Classify whether an expression is produced by the canonical SDK stateProperty helper. */
+export declare function statePropertyOrigin(file: SourceFile, expression: ts.Expression, seen?: ReadonlySet<string>): StateMachineOrigin;
 /** Classify whether a stateMachine call is the value of an exported top-level binding. */
 export declare function machineExportStatus(file: SourceFile, call: ts.CallExpression): MachineExportStatus;

package/dist/tooling/linter/implementations/source/state-machine.js

@@ -7,6 +7,7 @@ const SCHEMA_MODULES = new Set([
     '@astrale-os/kernel-dsl',
     '@astrale-os/kernel-dsl/v1',
 ]);
+const STATE_PROPERTY_MODULES = new Set(['@astrale-os/sdk/schema']);
 /** Resolve a direct or static local alias of the SDK stateMachine constructor. */
 export function stateMachineConstructorOrigin(file, expression, seen = new Set()) {
     const value = unwrap(expression);
@@ -107,6 +108,67 @@ export function stateSchemaIdentity(project, file, expression, seen = new Set())
     });
     return candidate ? { kind: 'ambiguous' } : { kind: 'absent' };
 }
+/** Resolve a persisted Schema stateProperty to its exact StateMachine authority. */
+export function statePropertyIdentity(project, file, expression, seen = new Set()) {
+    const value = unwrap(expression);
+    if (ts.isCallExpression(value)) {
+        const symbol = resolveImportedSymbol(file, value.expression);
+        if (symbol.kind === 'resolved' &&
+            symbol.name === 'stateProperty' &&
+            STATE_PROPERTY_MODULES.has(symbol.module)) {
+            const machine = value.arguments[0];
+            return machine === undefined
+                ? { kind: 'absent' }
+                : stateMachineIdentity(project, file, machine);
+        }
+    }
+    if (ts.isIdentifier(value)) {
+        const declaration = localVariable(file, value.text);
+        if (declaration === undefined)
+            return { kind: 'absent' };
+        if (seen.has(value.text))
+            return { kind: 'ambiguous' };
+        const next = new Set(seen);
+        next.add(value.text);
+        const resolution = statePropertyIdentity(project, file, declaration.initializer, next);
+        return declaration.constant || resolution.kind === 'absent' ? resolution : { kind: 'ambiguous' };
+    }
+    let candidate = false;
+    visit(value, (node) => {
+        if (!ts.isCallExpression(node))
+            return;
+        const symbol = resolveImportedSymbol(file, node.expression);
+        if (symbol.kind !== 'local' &&
+            symbol.name === 'stateProperty' &&
+            (symbol.kind === 'ambiguous' || STATE_PROPERTY_MODULES.has(symbol.module))) {
+            candidate = true;
+        }
+    });
+    return candidate ? { kind: 'ambiguous' } : { kind: 'absent' };
+}
+/** Classify whether an expression is produced by the canonical SDK stateProperty helper. */
+export function statePropertyOrigin(file, expression, seen = new Set()) {
+    const value = unwrap(expression);
+    if (ts.isCallExpression(value)) {
+        const symbol = resolveImportedSymbol(file, value.expression);
+        if (symbol.kind === 'resolved') {
+            return symbol.name === 'stateProperty' && STATE_PROPERTY_MODULES.has(symbol.module)
+                ? 'resolved'
+                : 'absent';
+        }
+        if (symbol.kind === 'ambiguous' && symbol.name === 'stateProperty')
+            return 'ambiguous';
+    }
+    if (!ts.isIdentifier(value) || seen.has(value.text))
+        return 'absent';
+    const declaration = localVariable(file, value.text);
+    if (declaration === undefined)
+        return 'absent';
+    const next = new Set(seen);
+    next.add(value.text);
+    const origin = statePropertyOrigin(file, declaration.initializer, next);
+    return declaration.constant || origin === 'absent' ? origin : 'ambiguous';
+}
 function staticMemberReceiver(expression, member) {
     const value = unwrap(expression);
     if (ts.isPropertyAccessExpression(value) && value.name.text === member) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.66",
+  "version": "0.5.0-beta.68",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -287,7 +287,7 @@
     "build": "node scripts/clean-dist.mjs && tsgo && node scripts/verify-no-source-maps.mjs dist && pnpm run verify:package",
     "e2e": "node __e2e__/flagship/runner.mjs",
     "typecheck": "tsgo --noEmit && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
-    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json",
+    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "typecheck:tests": "tsgo --noEmit -p tsconfig.test.json",
     "typecheck:e2e": "tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.v1.json && tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.json",