@astrale-os/sdk 0.5.0-beta.99 → 0.6.0-beta.0

package/dist/execution/invocation/dependency/bind.js

@@ -0,0 +1,68 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { reference } from '../../../platform/client/session/index.js';
+import { NodeId } from '../../../platform/graph/node/index.js';
+import { Path } from '../../../platform/graph/path/index.js';
+/** Bind each explicit authority to its admitted session; metadata remains inert. */
+export function bindDependencies(domain, sessions) {
+    const dependencies = Object.create(null);
+    for (const [alias, dependency] of Object.entries(domain.dependencies)) {
+        if (dependency.origin === 'kernel.astrale.ai')
+            continue;
+        dependencies[alias] = Object.freeze({
+            caller: bindDependency(dependency, sessions.caller),
+            self: bindDependency(dependency, sessions.self),
+            union: bindDependency(dependency, sessions.union),
+        });
+    }
+    return Object.freeze(dependencies);
+}
+function bindDependency(dependency, session) {
+    const invoke = session.invoke.bind(session);
+    return Object.freeze({
+        async invoke(select, ...args) {
+            if (typeof select !== 'function')
+                invalid();
+            const selected = select(dependency);
+            if (selected === null ||
+                typeof selected !== 'object' ||
+                !('key' in selected) ||
+                typeof selected.key !== 'string')
+                invalid();
+            const callable = dependency.callable(selected.key);
+            if (callable !== selected || Key.origin(callable.key) !== dependency.origin)
+                invalid();
+            if ('owner' in callable && (!callable.executable || !ownMethod(dependency, callable)))
+                invalid();
+            if ('owner' in callable && !callable.static) {
+                if (args.length < 2 || args.length > 3 || typeof args[0] !== 'string')
+                    invalid();
+                const instance = Path.id(NodeId(args[0]));
+                return invoke(reference(dependency, callable)(instance), args[1], options(args[2]));
+            }
+            if (args.length < 1 || args.length > 2)
+                invalid();
+            return invoke(reference(dependency, callable), args[0], options(args[1]));
+        },
+    });
+}
+function ownMethod(domain, callable) {
+    const owner = Object.values(domain.classes).find((value) => value === callable.owner);
+    if (owner === undefined)
+        return false;
+    const methods = callable.static ? owner.self.static.methods : owner.self.methods;
+    return methods.get(callable.key) === callable;
+}
+function options(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        Reflect.ownKeys(value).some((key) => key !== 'timeoutMs' && key !== 'idempotencyKey'))
+        invalid();
+    // Canonical ClientSession admits option values and clamps them to the parent lifetime.
+    return value;
+}
+function invalid() {
+    throw new TypeError('Dependency invocation requires one owned executable callable, its input, and valid instance/options.');
+}

package/dist/execution/invocation/dependency/index.d.ts

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dependency/index.js

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dispatch/action.js

@@ -1,3 +1,20 @@
-export function action(selected, context) {
-    return selected.definition.run(context);
+import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
+import { protocolError } from '../result/index.js';
+export async function action(selected, context) {
+    const complete = Object.freeze({
+        ...context,
+        error: declaredErrorFactory(selected.definition),
+    });
+    try {
+        return await selected.definition.run(complete);
+    }
+    catch (cause) {
+        const declared = declaredErrorOf(cause, selected.definition);
+        if (declared === undefined)
+            throw cause;
+        throw protocolError(declared.family, declared.message, {
+            code: declared.code,
+            details: declared.details,
+        });
+    }
 }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -1,8 +1,8 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { ActionExecution, Caller, DomainGraphExecutors } from '../../../application/action/index.js';
+import type { ActionExecution, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { MutationExecutor } from '../../../application/mutation/index.js';
 import type { QueryExecutor } from '../../../application/query/index.js';
-import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { NodeId } from '../../../platform/graph/node/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
@@ -11,8 +11,8 @@ export interface DispatchContext {
     readonly domain: Domain;
     readonly input: unknown;
     readonly caller: Caller;
-    readonly client: BoundClientSession | null;
-    readonly kernel: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>> | null;
+    readonly dependencies: HandlerDependencies<Domain> | null;
+    readonly kernel: DomainKernelSessions | null;
     readonly graph: DomainGraphExecutors | null;
     readonly query?: QueryExecutor;
     readonly mutate?: MutationExecutor;

package/dist/execution/invocation/dispatch/context.js

@@ -1,8 +1,9 @@
 import { bindMutation } from '../../../application/mutation/execution/executor.js';
 import { bindQuery } from '../../../application/query/execution/executor.js';
+import { bindDependencies } from '../dependency/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
-    const client = authentication.client;
+    const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
         deadline: request.context.execution.deadline,
@@ -17,16 +18,33 @@ export function context(request, runtime, authentication, self) {
         domain: runtime.loaded.domain,
         input: request.call.input,
         caller: authentication.caller,
-        client,
-        kernel: authentication.graph,
-        graph: authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain),
-        ...(client === null
+        kernel: authentication.graph === null
+            ? null
+            : Object.freeze({
+                ...authentication.graph.self,
+                ...authentication.graph,
+            }),
+        dependencies: authentication.graph === null
+            ? null
+            : bindDependencies(runtime.loaded.domain, authentication.graph),
+        graph,
+        ...(graph === null
             ? {}
             : {
-                query: bindQuery(client, runtime.loaded.domain),
-                mutate: bindMutation(client, runtime.loaded.domain),
+                query: graph.self.query,
+                mutate: graph.self.mutate,
+            }),
+        integrations: clients(runtime, request.context, authentication.graph === null
+            ? null
+            : {
+                caller: authentication.graph.caller,
+                self: authentication.graph.self,
+                ...(authentication.caller.authentication.expiresAt === undefined
+                    ? {}
+                    : {
+                        expiresAt: authentication.caller.authentication.expiresAt,
+                    }),
             }),
-        integrations: clients(runtime, request.context, client),
         execution,
         ...(self === undefined ? {} : { self }),
     });
@@ -36,9 +54,11 @@ function bindGraph(clients, domain) {
         query: bindQuery(client, domain),
         mutate: bindMutation(client, domain),
     });
+    const self = bind(clients.self);
     return Object.freeze({
+        ...self,
         caller: bind(clients.caller),
-        self: bind(clients.self),
+        self,
         union: bind(clients.union),
     });
 }

package/dist/execution/invocation/dispatch/workflow.js

@@ -1,11 +1,24 @@
+import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
 import { protocolError } from '../result/index.js';
-export function workflow(selected, context, runner) {
-    if (context.caller.kind !== 'authenticated' || context.client === null) {
+export async function workflow(selected, context, runner) {
+    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
         throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
     }
-    return runner.run(selected.definition, {
+    const complete = Object.freeze({
         ...context,
         caller: context.caller,
-        client: context.client,
+        error: declaredErrorFactory(selected.definition),
     });
+    try {
+        return await runner.run(selected.definition, complete);
+    }
+    catch (cause) {
+        const declared = declaredErrorOf(cause, selected.definition);
+        if (declared === undefined)
+            throw cause;
+        throw protocolError(declared.family, declared.message, {
+            code: declared.code,
+            details: declared.details,
+        });
+    }
 }

package/dist/execution/invocation/integration/authentication.d.ts

@@ -0,0 +1,5 @@
+import type { InvocationContext } from '@astrale-os/kernel-server';
+import type { IntegrationAuthentication } from '../../../application/integration/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+/** Capture only self mint, bounded by this invocation's verified credential horizon. */
+export declare function bindIntegrationAuthentication(context: InvocationContext, self: BoundClientSession, expiresAt?: number): IntegrationAuthentication;

package/dist/execution/invocation/integration/authentication.js

@@ -0,0 +1,53 @@
+import { credential as credentials } from '../../../platform/auth/index.js';
+import { active } from '../lifecycle/index.js';
+import { protocolError } from '../result/index.js';
+// Match the callback resolver's reserve; a child credential cannot outlive its source.
+const TRANSPORT_RESERVE_SECONDS = 5;
+/** Capture only self mint, bounded by this invocation's verified credential horizon. */
+export function bindIntegrationAuthentication(context, self, expiresAt) {
+    if (expiresAt !== undefined && !Number.isFinite(expiresAt)) {
+        throw new TypeError('Invalid Integration authentication expiry.');
+    }
+    const mint = self.auth.mint.bind(self.auth);
+    return Object.freeze({
+        async mint(input) {
+            active(context);
+            if (input === null || typeof input !== 'object' || Array.isArray(input))
+                invalidInput();
+            const keys = Reflect.ownKeys(input);
+            const { audience, ttlSeconds } = input;
+            if (keys.length !== 2 ||
+                !keys.every((key) => key === 'audience' || key === 'ttlSeconds') ||
+                typeof audience !== 'string' ||
+                audience.length === 0 ||
+                audience.trim() !== audience ||
+                !Number.isInteger(ttlSeconds) ||
+                ttlSeconds < 1 ||
+                ttlSeconds > 60)
+                invalidInput();
+            const horizon = Math.min(context.execution.deadline / 1000, expiresAt ?? Infinity);
+            const remaining = Math.floor(horizon) - Math.floor(Date.now() / 1000) - TRANSPORT_RESERVE_SECONDS;
+            if (remaining < 1) {
+                throw protocolError('DEADLINE_EXCEEDED', 'Insufficient lifetime for Integration credential.');
+            }
+            const credential = await mint({ audience, ttlSeconds: Math.min(ttlSeconds, remaining) }, {
+                signal: context.execution.signal,
+                timeoutMs: Math.max(1, context.execution.deadline - Date.now()),
+            });
+            active(context);
+            // Inspect only the result of the trusted Kernel call, not a Provider-supplied token.
+            // The reserve is an optimization; this absolute check is the lifetime boundary.
+            const expiry = credentials.inspect(credential).claims.exp;
+            if (typeof expiry !== 'number' ||
+                !Number.isSafeInteger(expiry) ||
+                expiry <= Math.floor(Date.now() / 1000) ||
+                expiry > Math.floor(horizon)) {
+                throw protocolError('DEADLINE_EXCEEDED', 'Integration credential exceeds its lifetime.');
+            }
+            return credential;
+        },
+    });
+}
+function invalidInput() {
+    throw new TypeError('Invalid Integration mint input.');
+}

package/dist/execution/invocation/integration/call.d.ts

@@ -1,5 +1,11 @@
 import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationInvocationOwner } from '../../../application/integration/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
+export interface IntegrationInvocationSessions {
+    readonly caller: BoundClientSession;
+    readonly self: BoundClientSession;
+    /** Verified incoming carrier expiry, in Unix seconds. */
+    readonly expiresAt?: number;
+}
 /** One invocation-owned logical Integration call sequence. */
-export declare function calls(context: InvocationContext, client?: BoundClientSession | null): IntegrationInvocationOwner;
+export declare function calls(context: InvocationContext, sessions?: IntegrationInvocationSessions | null): IntegrationInvocationOwner;

package/dist/execution/invocation/integration/call.js

@@ -1,8 +1,12 @@
 import { active } from '../lifecycle/index.js';
+import { bindIntegrationAuthentication } from './authentication.js';
 /** One invocation-owned logical Integration call sequence. */
-export function calls(context, client = null) {
-    const prefix = context.idempotencyKey ?? context.invocation;
-    const invoke = client?.invoke.bind(client);
+export function calls(context, sessions = null) {
+    const prefix = context.idempotencyKey ?? JSON.stringify([context.invocation.source, context.invocation.id]);
+    const invoke = sessions?.caller.invoke.bind(sessions.caller);
+    const auth = sessions === null
+        ? undefined
+        : bindIntegrationAuthentication(context, sessions.self, sessions.expiresAt);
     let sequence = 0;
     return Object.freeze({
         invoke(call) {
@@ -13,6 +17,7 @@ export function calls(context, client = null) {
                 signal: context.execution.signal,
                 deadline: context.execution.deadline,
                 ...(invoke === undefined ? {} : { invoke }),
+                ...(auth === undefined ? {} : { auth }),
             });
         },
     });

package/dist/execution/invocation/integration/clients.d.ts

@@ -1,5 +1,5 @@
 import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationClients, Integrations } from '../../../application/integration/index.js';
-import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
-export declare function clients(runtime: InitializedRuntime, context: InvocationContext, client: BoundClientSession | null): IntegrationClients<Integrations>;
+import type { IntegrationInvocationSessions } from './call.js';
+export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions | null): IntegrationClients<Integrations>;

package/dist/execution/invocation/integration/clients.js

@@ -1,4 +1,4 @@
 import { calls } from './call.js';
-export function clients(runtime, context, client) {
-    return runtime.clients(calls(context, client));
+export function clients(runtime, context, sessions) {
+    return runtime.clients(calls(context, sessions));
 }

package/dist/execution/invocation/lifecycle/active.js

@@ -9,11 +9,17 @@ export function active(context) {
 }
 /** Close authenticated resources after finite results or stream settlement. */
 export function settle(result, close) {
-    if (result.kind !== 'stream') {
-        close();
-        return result;
+    if (result.kind === 'stream') {
+        return Object.freeze({ kind: 'stream', stream: settledStream(result.stream, close) });
+    }
+    if (result.kind === 'binary' && !(result.value.body instanceof Uint8Array)) {
+        return Object.freeze({
+            kind: 'binary',
+            value: Object.freeze({ ...result.value, body: settledIterable(result.value.body, close) }),
+        });
     }
-    return Object.freeze({ kind: 'stream', stream: settledStream(result.stream, close) });
+    close();
+    return result;
 }
 function settledStream(stream, close) {
     let settled = false;
@@ -24,6 +30,7 @@ function settledStream(stream, close) {
         close();
     };
     return Object.freeze({
+        ...settledIterable(stream, finish),
         async cancel(reason) {
             try {
                 await stream.cancel(reason);
@@ -32,8 +39,26 @@ function settledStream(stream, close) {
                 finish();
             }
         },
+    });
+}
+function settledIterable(stream, close) {
+    let settled = false;
+    const finish = () => {
+        if (settled)
+            return;
+        settled = true;
+        close();
+    };
+    return Object.freeze({
         [Symbol.asyncIterator]() {
-            const iterator = stream[Symbol.asyncIterator]();
+            let iterator;
+            try {
+                iterator = stream[Symbol.asyncIterator]();
+            }
+            catch (cause) {
+                finish();
+                throw cause;
+            }
             return Object.freeze({
                 async next() {
                     try {

package/dist/execution/invocation/result/errors.d.ts

@@ -3,6 +3,7 @@ import type { ResolvedCallable } from '../../../application/action/index.js';
 import type { Key } from '../../../platform/schema/index.js';
 import type { Value } from '../../../platform/value/index.js';
 export type InvocationErrorCode = Extract<keyof typeof errors.CODES, 'VALIDATION_ERROR' | 'ACCESS_DENIED' | 'NOT_FOUND' | 'CONFLICT' | 'UNSUPPORTED' | 'LIMIT_EXCEEDED' | 'BACKEND_UNAVAILABLE'>;
+/** @deprecated Declare expected failures on defineAction or defineWorkflow instead. */
 export declare class InvocationError extends Error {
     readonly code: InvocationErrorCode;
     readonly name = "InvocationError";

package/dist/execution/invocation/result/errors.js

@@ -2,7 +2,10 @@ import * as errors from '@astrale-os/kernel-protocol/errors';
 import { ClientError, MissError, ProtocolError as ClientProtocolError, ResponseError, SessionError, StaleRouteError, TransportError, } from '../../../platform/client/index.js';
 const PUBLIC_DIAGNOSTICS = new Set(['VALUE_SCHEMA_INSTANCE_INVALID', 'VS_NUMBER_DOMAIN']);
 const PUBLIC_ERROR_CODES = new Set(Object.values(errors.CODES));
+const PUBLIC_ERROR_NAMES = new Map(Object.entries(errors.CODES).map(([name, code]) => [code, name]));
 const MAXIMUM_DIAGNOSTICS = 32;
+const admittedProtocolErrors = new WeakSet();
+/** @deprecated Declare expected failures on defineAction or defineWorkflow instead. */
 export class InvocationError extends Error {
     code;
     name = 'InvocationError';
@@ -25,11 +28,13 @@ export class InvocationDefect extends Error {
     }
 }
 export function protocolError(code, message, data) {
-    return new errors.ProtocolError({
+    const error = new errors.ProtocolError({
         code: errors.CODES[code],
         message,
         ...(data === undefined ? {} : { data }),
     });
+    admittedProtocolErrors.add(error);
+    return error;
 }
 export function inputError(callable, diagnostics) {
     if (diagnostics.length === 0 ||
@@ -52,19 +57,19 @@ export function inputError(callable, diagnostics) {
     return protocolError('VALIDATION_ERROR', 'Callable input is invalid.', reason);
 }
 export function projectError(input) {
-    if (input instanceof errors.ProtocolError)
-        return input;
-    if (input instanceof InvocationError)
-        return protocolError(input.code, input.message, input.reason);
+    if (input instanceof errors.ProtocolError) {
+        return admittedProtocolErrors.has(input)
+            ? input
+            : protocolError('INTERNAL_ERROR', 'Internal application error.');
+    }
+    if (input instanceof InvocationError) {
+        return protocolError('INTERNAL_ERROR', 'Internal application error.');
+    }
     if (input instanceof ResponseError) {
         if (!PUBLIC_ERROR_CODES.has(input.code)) {
             return protocolError('BACKEND_UNAVAILABLE', 'Dependency Kernel returned invalid error evidence.');
         }
-        return new errors.ProtocolError({
-            code: input.code,
-            message: input.message,
-            ...(input.data === undefined ? {} : { data: input.data }),
-        });
+        return protocolError(PUBLIC_ERROR_NAMES.get(input.code), input.message, input.data);
     }
     if (input instanceof TransportError) {
         return protocolError(input.phase === 'timeout' ? 'DEADLINE_EXCEEDED' : 'BACKEND_UNAVAILABLE', input.phase === 'timeout'

package/dist/execution/service/create.js

@@ -33,9 +33,10 @@ export function createService(input) {
         const prepared = prepareServer({
             ...serverOptions(input.server),
             path: invocationPath(),
+            publicOrigin: release.addressing.publicUrl,
             invocation: {
                 source: selectedIdentity.issuer,
-                next: () => globalThis.crypto.randomUUID(),
+                next: () => crypto.randomUUID(),
             },
             issuer: selectedIdentity,
             ...(selectedIdentity.tokenExchange === undefined
@@ -92,6 +93,7 @@ function serverOptions(input) {
         'path',
         'invocation',
         'issuer',
+        'publicOrigin',
         'tokenExchange',
         'publication',
         'delivery',

package/dist/execution/service/service.d.ts

@@ -5,7 +5,7 @@ import type { WorkflowRunner } from '../../application/workflow/runner/index.js'
 import type { Release } from '../../deployment/release/index.js';
 import type { Identity } from '../identity/index.js';
 import type { ReleaseLoader } from './release.js';
-export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'tokenExchange' | 'publication' | 'delivery'>;
+export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'publication' | 'delivery'>;
 export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtime> {
     readonly runtime: RuntimeValue;
     readonly environment: Environment;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /** Curated SDK authoring journey. Semantic values remain available from focused subpaths. */
 export { defineAction } from './application/action/index.js';
-export type { Action, ActionContext, ActionOutputOf, Caller } from './application/action/index.js';
+export type { Action, ActionContext, ActionOutputOf, Caller, DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from './application/action/index.js';
 export { defineApplication, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
 export type { Application, Frontend, Requirements, Route, Routes } from './application/index.js';
 export { defineIntegration, defineProvider } from './application/integration/index.js';
@@ -15,5 +15,7 @@ export { defineWorkflow } from './application/workflow/index.js';
 export type { Workflow, WorkflowContext } from './application/workflow/index.js';
 export { compile, deploy, runtime } from './deployment/index.js';
 export type { Build, Deployment, Release } from './deployment/index.js';
+export { defineProject } from './project/index.js';
+export type { Project } from './project/index.js';
 export { serve } from './execution/index.js';
 export type { ServedApplication } from './execution/index.js';

package/dist/index.js

@@ -7,4 +7,5 @@ export { defineCollectionQuery, defineCompositeQuery, defineQuery, executeQuery,
 export { defineRuntime } from './application/runtime/index.js';
 export { defineWorkflow } from './application/workflow/index.js';
 export { compile, deploy, runtime } from './deployment/index.js';
+export { defineProject } from './project/index.js';
 export { serve } from './execution/index.js';

package/dist/platform/auth/index.d.ts

@@ -1,4 +1,4 @@
 /** Canonical authentication and authority values. */
 export * from '@astrale-os/kernel-core/auth';
-export { createAuth, type AuthApi, type PolicyDecisionInput } from '@astrale-os/kernel-client/auth';
+export type { AuthApi, AdmissionOptions, FunctionAdmission, PolicyDecisionInput, RegisterRequest, RegisterIdentity, } from '@astrale-os/kernel-client/auth';
 export * as exchange from './exchange/index.js';

package/dist/platform/auth/index.js

@@ -1,4 +1,3 @@
 /** Canonical authentication and authority values. */
 export * from '@astrale-os/kernel-core/auth';
-export { createAuth } from '@astrale-os/kernel-client/auth';
 export * as exchange from './exchange/index.js';

package/dist/platform/graph/alias.d.ts

@@ -0,0 +1,6 @@
+/** Graph-local names retain the canonical Kernel type and constructor identity. */
+export { LocalBinding as LocalAlias, isLocalBinding as isLocalAlias, } from '@astrale-os/kernel-core/graph/graph';
+/** @deprecated Use LocalAlias. */
+export { LocalBinding } from '@astrale-os/kernel-core/graph/graph';
+/** @deprecated Use isLocalAlias. */
+export { isLocalBinding } from '@astrale-os/kernel-core/graph/graph';

package/dist/platform/graph/alias.js

@@ -0,0 +1,6 @@
+/** Graph-local names retain the canonical Kernel type and constructor identity. */
+export { LocalBinding as LocalAlias, isLocalBinding as isLocalAlias, } from '@astrale-os/kernel-core/graph/graph';
+/** @deprecated Use LocalAlias. */
+export { LocalBinding } from '@astrale-os/kernel-core/graph/graph';
+/** @deprecated Use isLocalAlias. */
+export { isLocalBinding } from '@astrale-os/kernel-core/graph/graph';

package/dist/platform/graph/document/index.d.ts

@@ -1,2 +1,3 @@
-/** Canonical graph documents and local bindings. */
+/** Canonical graph documents and local aliases. */
 export * from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from '../alias.js';

package/dist/platform/graph/document/index.js

@@ -1,2 +1,3 @@
-/** Canonical graph documents and local bindings. */
+/** Canonical graph documents and local aliases. */
 export * from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from '../alias.js';

package/dist/platform/graph/index.d.ts

@@ -1,5 +1,6 @@
 /** Curated aggregate over canonical graph values. */
-export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, LocalBinding, } from '@astrale-os/kernel-core/graph/graph';
+export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, } from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from './alias.js';
 export type { AnonymousNodeSpec, GraphDataJson, GraphSpecEdge, GraphSpecEndpoint, GraphSpecJson, GraphSpecNode, } from '@astrale-os/kernel-core/graph/graph';
 export * from './edge/index.js';
 export * from './node/index.js';

package/dist/platform/graph/index.js

@@ -1,5 +1,6 @@
 /** Curated aggregate over canonical graph values. */
-export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, LocalBinding, } from '@astrale-os/kernel-core/graph/graph';
+export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, } from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from './alias.js';
 export * from './edge/index.js';
 export * from './node/index.js';
 export * from './path/index.js';

package/dist/platform/schema/class-authoring.d.ts

@@ -0,0 +1,37 @@
+import { nodeClass as kernelNodeClass, type DirectedEdgeClass, type DirectedEdgeInput, type NodeClass, type NodeClassInput as KernelNodeClassInput, type UndirectedEdgeClass, type UndirectedEdgeInput } from '@astrale-os/kernel-dsl/v1/builder';
+import { type ClassIcon } from './class-icon.js';
+/** SDK Node Class input: every author must make an explicit, admitted icon choice. */
+export type NodeClassInput = Omit<KernelNodeClassInput, 'icon'> & {
+    readonly icon: ClassIcon;
+};
+/** Preserve authored input instead of serializing expanded inheritance projections in consumers. */
+export interface AuthoredNodeClass<Config extends NodeClassInput> extends ReturnType<typeof kernelNodeClass<Config>> {
+}
+type NodeInput = {
+    readonly kind: 'node';
+    readonly abstract: boolean;
+} & NodeClassInput;
+type DirectedInput = {
+    readonly kind: 'edge';
+    readonly orientation: 'directed';
+    readonly abstract: boolean;
+} & Omit<DirectedEdgeInput, 'orientation'>;
+type UndirectedInput = {
+    readonly kind: 'edge';
+    readonly orientation: 'undirected';
+    readonly abstract: boolean;
+} & Omit<UndirectedEdgeInput, 'orientation'>;
+/**
+ * Author a Node Class whose materialized configuration always carries an explicitly selected,
+ * admitted SVG icon. The mapped input retains inference while expanding package-private
+ * Config interface names into portable structure for downstream declaration emit.
+ */
+export declare function nodeClass<const Config extends NodeClassInput>(config: Config & Record<Exclude<keyof Config, keyof NodeClassInput>, never>): AuthoredNodeClass<{
+    [Key in keyof Config]: Key extends 'properties' | 'methods' | 'policies' ? {
+        [Member in keyof NonNullable<Config[Key]>]: NonNullable<Config[Key]>[Member];
+    } | Extract<Config[Key], undefined> : Key extends 'extends' ? Config[Key] extends infer Parents extends NodeClassInput['extends'] ? Parents extends readonly unknown[] ? readonly [...Parents] : Parents : never : Config[Key];
+}>;
+export declare function defineClass(config: NodeInput): NodeClass;
+export declare function defineClass(config: DirectedInput): DirectedEdgeClass;
+export declare function defineClass(config: UndirectedInput): UndirectedEdgeClass;
+export {};

package/dist/platform/schema/class-authoring.js

@@ -0,0 +1,20 @@
+import { defineClass as defineKernelClass, nodeClass as kernelNodeClass, } from '@astrale-os/kernel-dsl/v1/builder';
+import { classIcon } from './class-icon.js';
+export function nodeClass(config) {
+    if (config === undefined || config.icon === undefined) {
+        throw new TypeError('Node Class icon is required; use classIcon.neutral to make an explicit neutral choice.');
+    }
+    return kernelNodeClass({
+        ...config,
+        icon: classIcon.svg(config.icon),
+    });
+}
+export function defineClass(config) {
+    if (config.kind === 'node') {
+        const { kind: _, ...input } = config;
+        return nodeClass(input);
+    }
+    if (config.orientation === 'directed')
+        return defineKernelClass(config);
+    return defineKernelClass(config);
+}