@astrale-os/sdk 0.6.0-beta.23 → 0.6.0-beta.25

package/README.md

@@ -5,6 +5,9 @@ single-step Actions, explicit multi-step Workflows, provider-neutral Integration
 authoring, Domain composition, Deployment, and Execution without exposing DSL callable
 topology in implementation files.
 
+The Domain name and optional View entrypoint belong to its root Schema. See
+[the Schema authoring contract](docs/domain-schema-migration.md).
+
 [![CI](https://github.com/astrale-os/sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/astrale-os/sdk/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 
@@ -46,39 +49,22 @@ Run the project's checks and validate on development.
 Nothing is committed or deployed. A Shell update also requires checking the installed Shell revision.
 Rerunning an upgrade synchronizes installation even when the manifest versions are already current.
 
-## Move a runtime without changing its Domain identity
-
-A Domain issuer is retained across installation upgrades. To deploy a new Cloudflare runtime for
-selected instances, keep the existing signing identity and issuer while selecting a new public origin:
-
-```ts
-cloudflare({
-  route: 'services-v2.example.com',
-  workerName: 'services-v2',
-  identityIssuer: 'https://services.example.com',
-  signingIdentity: '.astrale/identity.json',
-})
-```
-
-The new Publication places its Bundle, Delivery, callables, Views and routes at the new origin.
-Install that public URL on each intended instance. The Kernel verifies its Delivery against the
-retained issuer's keys and preserves the Domain installation identity and owned data. Keep the
-original issuer discovery endpoints and keys available; unadopted instances continue to use their
-previous bindings. Deployment readiness checks the exact new Worker version separately from issuer
-discovery. No uninstall or identity rotation is involved.
+## Immutable deployments
 
-At the provider-neutral release boundary, this stable-target path uses
-`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })` with
-`legacy.assemble`. That split is deprecated with direct mode and goes with it: an immutable
-deployment's URL is its issuer, so `assemble(build, buildDigest, url)` takes the URL alone.
+A deployment serves one `DomainRelease` v4 at its immutable URL, which is also its issuer.
+`assemble(build, buildDigest, url)` seals the document from the exact Build and running bytes.
+Cloudflare deployments require a dispatch namespace; `astrale()` hosts them on Admin's Services.
+Install the URL printed by `astrale-domain deploy` on each intended instance.
 
 ## Handler authority and dependencies
 
-Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
+Handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
 `dependencies.directory.caller.invoke(d => d.functions.lookup, input)` calls a direct declared
 dependency on behalf of the incoming caller Identity; `.self` calls it as the executing Domain.
 Explicit `caller` or `self` authority is also available on `kernel` and `graph`; the former
-handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
+handler `client` is removed. A call to an `auth: 'anonymous'` callable that carries no credential
+has no caller: its handler acts as the Domain alone, without the `caller` selections. See
+[the API and migration guide](docs/handler-dependencies.md).
 
 ## Durable Workflows
 
@@ -141,11 +127,8 @@ for an Identity in the Domain's local Core. `subject` is the resolved Core Node;
 must request at least one capability. The top-level `functions`, `classes`, and `authority` members
 describe capabilities for the Domain principal.
 
-This replaces `requirements.profiles`. Rename that property to `core` and imported
-`CapabilityProfileRequirement` / `CapabilityProfileRequirementInput` types to `CoreRequirement` /
-`CoreRequirementInput`. Builds emit `requirements.capabilities.core`; new releases use Publication
-v3 and require a Kernel that supports it. That Kernel can restore historical v2 Publications and
-installation ledgers without changing their existing authority or integrity evidence.
+Builds emit `requirements.capabilities.core`; the release declares those requirements for the
+Domain principal and local Core identities. Installation verifies the Release and its exact Bundle.
 
 ### Prerequisites
 
@@ -262,13 +245,12 @@ NodePath and its Dataset Node ID through encoding and decoding. Matching propert
 not create that association. Studio uses it when simulating `sameNode` and reference endpoints;
 a missing association makes that simulation unavailable.
 
-## Kernel publication discovery
+## Kernel release discovery
 
-Use `session.publication()` when a consumer needs the intrinsic Kernel's published identity or
-endpoints without its schema bundle or Views. It revalidates through the Client's existing issuer,
-URL, size, and ETag checks. Concurrent publication and snapshot observations share acquisition;
-cancelling one observer does not cancel another. `session.snapshot()` remains the complete,
-coherent Publication, bundle, and View catalog observation.
+Use `session.release()` for the intrinsic Kernel's Release without its schema bundle or Views.
+It revalidates issuer, URL, size and ETag. Concurrent release and snapshot observations share
+acquisition; cancelling one observer does not cancel another. `session.snapshot()` returns one
+coherent Release, Bundle and View catalog observation.
 
 ## Headless scripts and Domain callables
 
@@ -366,6 +348,18 @@ recomputes an address tests against them.
 
 Apache License 2.0 — see [LICENSE](LICENSE) for details.
 
+## Domain icon
+
+```ts
+import { classIcon } from '@astrale-os/sdk/schema'
+import { Building2 } from '@astrale-os/sdk/schema/icons'
+
+export const domain = defineDomain({ schema, runtime, icon: classIcon.lucide(Building2) })
+```
+
+The release publishes the icon as `manifest.logo`. Use `classIcon.svg(...)` for a self-contained
+inline SVG, or omit `icon` and the release carries no manifest.
+
 ## View host requirements
 
 A frontend route can declare the exact external origins its View needs to open:
@@ -383,7 +377,7 @@ routes: {
 }
 ```
 
-These requirements are publication metadata, so changing them updates the publication ETag without
+These requirements belong to the Release, so changing them updates its digest without
 changing the Domain's business Schema. They require the `shell` handshake. Origins must use
 HTTPS without credentials, paths, queries, fragments, or wildcards; authoring normalizes and sorts
 them. Supporting hosts admit them per mount and execute the existing `browser.openExternal`

package/dist/application/action/context.d.ts

@@ -47,37 +47,41 @@ export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
 }
-export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self', DomainGraphExecutor<DomainValue>>>;
+/** Whose authority one Kernel call exercises: the incoming caller's or the installed Domain's. */
+export type AuthorityMode = 'caller' | 'self';
+/**
+ * One value per selectable authority. `self` exists in every invocation; `caller` exists only when
+ * the call carried a credential, so it is absent from a call that carried none.
+ */
+export type AuthoritySelection<Value, Selectable extends AuthorityMode = AuthorityMode> = Readonly<Record<Selectable, Value> & {
+    readonly [Absent in Exclude<AuthorityMode, Selectable>]?: never;
+}>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<DomainGraphExecutor<DomainValue> & AuthoritySelection<DomainGraphExecutor<DomainValue>, Selectable>>;
 /** Self-default Kernel session with one level of explicit authority selection. */
-export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self', BoundClientSession>>;
-type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
-    readonly auth: 'anonymous';
-} ? {
-    readonly caller: AnonymousCaller;
-    readonly dependencies: null;
-    readonly kernel: null;
-    readonly graph: null;
-    readonly query?: never;
-    readonly mutate?: never;
-} | {
-    readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
+export type DomainKernelSessions<Selectable extends AuthorityMode = AuthorityMode> = Readonly<BoundClientSession & AuthoritySelection<BoundClientSession, Selectable>>;
+/** What a handler holds toward the Kernel: the installed Domain authority by default. */
+interface DomainCapabilities<DomainValue extends Domain, Selectable extends AuthorityMode> {
+    readonly dependencies: HandlerDependencies<DomainValue, Selectable>;
+    readonly kernel: DomainKernelSessions<Selectable>;
+    readonly graph: DomainGraphExecutors<DomainValue, Selectable>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly query: QueryExecutor<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly mutate: MutationExecutor<DomainValue>;
-} : {
+}
+/**
+ * A call to an `anonymous` callable that carries no credential has no caller, and its handler acts
+ * as the installed Domain alone. Every other call also selects its authenticated caller.
+ */
+type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
+    readonly auth: 'anonymous';
+} ? ({
+    readonly caller: AnonymousCaller;
+} & DomainCapabilities<DomainValue, 'self'>) | ({
     readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly query: QueryExecutor<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly mutate: MutationExecutor<DomainValue>;
-};
+} & DomainCapabilities<DomainValue, AuthorityMode>) : {
+    readonly caller: AuthenticatedCaller;
+} & DomainCapabilities<DomainValue, AuthorityMode>;
 type SelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown, false> ? {
     readonly self: NodeId;
 } : {

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, AuthorityMode, AuthoritySelection, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/define.d.ts

@@ -1,4 +1,4 @@
-import type { schema } from '../platform/schema/index.js';
+import type { ClassIcon, schema } from '../platform/schema/index.js';
 import type { DomainDefinition } from './domain.js';
 import type { Requirements } from './requirements/index.js';
 import type { Routes } from './routes/index.js';
@@ -10,6 +10,8 @@ export interface DomainDefinitionInput<Schema extends schema.DomainSchema, Runti
     readonly frontend?: FrontendValue;
     readonly routes?: RoutesValue;
     readonly requirements?: RequirementsValue;
+    /** The application's icon, made with `classIcon.svg(...)` or `classIcon.lucide(...)`. */
+    readonly icon?: ClassIcon;
 }
 /** Capture one inert authored Domain without resolving, compiling, loading, or deploying it. */
 export declare function defineDomain<const Schema extends schema.DomainSchema, const RuntimeValue extends Runtime<Schema>, const FrontendValue extends Frontend<Schema> | undefined = undefined, const RoutesValue extends Routes | undefined = undefined, const RequirementsValue extends Requirements | undefined = undefined>(input: DomainDefinitionInput<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>): DomainDefinition<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>;

package/dist/application/define.js

@@ -1,3 +1,4 @@
+import { admitClassIconSvg } from '../platform/schema/class-icon-svg.js';
 import { isRequirements } from './requirements/index.js';
 import { isRoutes } from './routes/index.js';
 import { isRuntime } from './runtime/index.js';
@@ -7,9 +8,19 @@ const admittedDomainDefinitions = new WeakSet();
 export function defineDomain(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    const allowed = new Set(['schema', 'runtime', 'frontend', 'routes', 'requirements']);
+    const allowed = new Set([
+        'schema',
+        'runtime',
+        'frontend',
+        'routes',
+        'requirements',
+        'icon',
+    ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)))
         invalid();
+    if (typeof input.schema?.name !== 'string') {
+        throw new TypeError(`Domain Schema ${String(input.schema?.origin)} must declare its name: defineSchema(origin, { name, ... }).`);
+    }
     if (!isRuntime(input.runtime))
         throw new TypeError('Domain Runtime is not admitted.');
     if (input.frontend !== undefined &&
@@ -22,12 +33,15 @@ export function defineDomain(input) {
     if (input.requirements !== undefined && !isRequirements(input.requirements)) {
         throw new TypeError('Domain requirements are not admitted.');
     }
+    // The same admission as a Node Class icon: one self-contained inline SVG.
+    const icon = input.icon === undefined ? undefined : admitClassIconSvg(input.icon);
     const domain = Object.freeze({
         schema: input.schema,
         runtime: input.runtime,
         ...(input.frontend === undefined ? {} : { frontend: input.frontend }),
         ...(input.routes === undefined ? {} : { routes: input.routes }),
         ...(input.requirements === undefined ? {} : { requirements: input.requirements }),
+        ...(icon === undefined ? {} : { icon }),
     });
     admittedDomainDefinitions.add(domain);
     return domain;
@@ -36,5 +50,5 @@ export function isDomainDefinition(input) {
     return input !== null && typeof input === 'object' && admittedDomainDefinitions.has(input);
 }
 function invalid() {
-    throw new TypeError('Domain definition may contain only schema, runtime, frontend, routes, and requirements.');
+    throw new TypeError('Domain definition may contain only schema, runtime, frontend, routes, requirements, and icon.');
 }

package/dist/application/dependency/invoker.d.ts

@@ -2,7 +2,7 @@ import type { Binary, Input } from '../../platform/client/index.js';
 import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
-import type { LocalCallable } from '../action/index.js';
+import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
 export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
@@ -22,10 +22,10 @@ export interface DependencyInvoker<D extends Domain> {
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming caller Identity.
- * The canonical Kernel is exposed through context.kernel.
+ * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
+ * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+export type HandlerDependencies<D extends Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Selectable>;
 }>;
 export {};

package/dist/application/domain.d.ts

@@ -1,4 +1,4 @@
-import type { schema } from '../platform/schema/index.js';
+import type { ClassIcon, schema } from '../platform/schema/index.js';
 import type { Requirements } from './requirements/index.js';
 import type { Routes } from './routes/index.js';
 import type { Runtime, SchemaOfRuntime as RuntimeSchemaOf } from './runtime/index.js';
@@ -16,6 +16,8 @@ export interface DomainDefinition<Schema extends schema.DomainSchema = schema.Do
     readonly frontend?: FrontendValue;
     readonly routes?: RoutesValue;
     readonly requirements?: RequirementsValue;
+    /** The application's icon. */
+    readonly icon?: ClassIcon;
     readonly [DOMAIN_DEFINITION_SCHEMA]: (schema: Schema) => Schema;
 }
 export type SchemaOfDomainDefinition<Value> = Value extends {

package/dist/application/index.d.ts

@@ -5,5 +5,5 @@ export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation,
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
-export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
+export type { Frontend, FrontendInput, FrontendSource, ViewHostRequirements } from './view/index.js';
 export type { DomainDefinition, DomainDefinitionIdentity, RuntimeOfDomainDefinition, SchemaOfDomainDefinition, SchemaOfRuntime, } from './domain.js';

package/dist/application/integration/operation.d.ts

@@ -19,9 +19,9 @@ export interface IntegrationExecution {
     readonly signal: AbortSignal;
     readonly deadline: number;
     readonly idempotencyKey?: string;
-    /** Exact caller-bound invocation capability; absent for an anonymous invocation. */
+    /** Exact caller-bound invocation capability; absent when the call carried no credential. */
     readonly invoke?: BoundClientSession['invoke'];
-    /** Domain-self transport authentication; absent for an anonymous invocation. */
+    /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
 export interface IntegrationOperation<Input = unknown, Output = unknown> {

package/dist/application/mutation/index.d.ts

@@ -5,4 +5,4 @@ export type { Mutation, MutationDefinition, MutationInputOf, MutationOutputOf }
 export type { CreatedNode, EdgeSelector, ExistingEndpoint, MutationEndpoint, QueryPrecondition, RichMutationBuilder, RichPropertyConditions, RichPropertyDelta, RichPropertyInput, RichPropertyName, } from './authoring/index.js';
 /** Canonical low-level Mutation documents remain available as the explicit escape hatch. */
 export * from '@astrale-os/kernel-core/graph/mutate';
-export type { LocalAlias, LocalBinding } from '../../platform/graph/alias.js';
+export type { LocalAlias } from '../../platform/graph/alias.js';

package/dist/application/query/composite/plan.d.ts

@@ -7,10 +7,6 @@ export declare const QUERY_COMPOSITION_LIMITS: Readonly<{
     maximumDependencyDepth: 8;
 }>;
 export interface QueryPlanAnalysis {
-    /** @deprecated Use physicalQueries. */
-    readonly queries: number;
-    /** @deprecated Use dependencyDepth. */
-    readonly depth: number;
     readonly logicalQueries: number;
     readonly physicalQueries: number;
     readonly dependencyDepth: number;

package/dist/application/query/composite/plan.js

@@ -53,8 +53,6 @@ export function analyzeQueryPlan(plan) {
         throw new QueryCompositionError('QUERY_COMPOSITION_LIMIT', `Composite Query exceeds ${QUERY_COMPOSITION_LIMITS.maximumPhysicalQueries} physical Queries or dependency depth ${QUERY_COMPOSITION_LIMITS.maximumDependencyDepth}.`);
     }
     return Object.freeze({
-        queries: physicalKeys.size,
-        depth: maximumDepth,
         logicalQueries,
         physicalQueries: physicalKeys.size,
         dependencyDepth: maximumDepth,

package/dist/application/runtime/workflows.d.ts

@@ -9,5 +9,5 @@ export interface RuntimeWorkflow {
     /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
     readonly durable: boolean;
 }
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -1,6 +1,6 @@
 import { isWorkflow } from '../workflow/index.js';
 import { runtimeCallableAt } from './callables.js';
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export function admitWorkflows(callables, input) {
     if (!Array.isArray(input))
         throw new TypeError('Runtime workflows must be an array.');
@@ -16,9 +16,6 @@ export function admitWorkflows(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Workflow ${definition.address} is not root-local and executable.`);
         }
-        if (callable.auth === 'anonymous') {
-            throw new TypeError(`Runtime Workflow ${definition.address} must be authenticated.`);
-        }
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }

package/dist/application/view/define.js

@@ -5,7 +5,10 @@ import { isFrontendSource } from './source.js';
 export function defineFrontend(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes' && key !== 'entrypoint')) {
+    if (Object.hasOwn(input, 'entrypoint')) {
+        throw new TypeError('Frontend entrypoint is removed: declare it with defineSchema(origin, { entrypoint }).');
+    }
+    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes')) {
         invalid();
     }
     const names = Object.keys(input.schema.views).sort(compare);
@@ -18,10 +21,6 @@ export function defineFrontend(input) {
     const unknown = Reflect.ownKeys(authored).find((name) => typeof name !== 'string' || !names.includes(name));
     if (unknown !== undefined)
         throw new TypeError(`Frontend route ${String(unknown)} is unknown.`);
-    const entrypoint = input.entrypoint ?? (names.length === 1 ? names[0] : undefined);
-    if (entrypoint === undefined || !names.includes(entrypoint)) {
-        throw new TypeError('Frontend entrypoint must name one Schema View.');
-    }
     const paths = new Set();
     const routes = {};
     for (const name of names) {
@@ -36,7 +35,6 @@ export function defineFrontend(input) {
         schema: input.schema,
         source,
         routes: Object.freeze(routes),
-        entrypoint: entrypoint,
     }));
 }
 function admitSource(input) {

package/dist/application/view/frontend.d.ts

@@ -8,12 +8,12 @@ export interface FrontendInput<Schema extends schema.DomainSchema> {
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes?: FrontendRouteInputs<Schema>;
-    readonly entrypoint?: ViewName<Schema>;
+    /** Removed: the Schema declares its entrypoint with `defineSchema(origin, { entrypoint })`. */
+    readonly entrypoint?: never;
 }
 export interface Frontend<Schema extends schema.DomainSchema = schema.DomainSchema> {
     readonly kind: 'frontend';
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes: FrontendRoutes<Schema>;
-    readonly entrypoint: ViewName<Schema>;
 }

package/dist/application/view/index.d.ts

@@ -1,6 +1,6 @@
 export { isFrontend } from './admission.js';
 export { defineFrontend } from './define.js';
 export type { Frontend, FrontendInput, FrontendRouteInputs, FrontendRoutes, ViewName, } from './frontend.js';
-export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, IframeRequirements, ViewHostRequirements, } from './route.js';
+export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, ViewHostRequirements, } from './route.js';
 export { external, isFrontendSource, vite } from './source.js';
 export type { ExternalSource, FrontendSource, ViteSource } from './source.js';

package/dist/application/view/route.d.ts

@@ -1,30 +1,16 @@
 import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type { ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type FrontendHandshake = 'shell' | 'none';
-/**
- * @deprecated Every trusted View receives the Shell's shared browser profile: requirements within
- * it are redundant, and Astrale hosts refuse any beyond it. Declare none.
- */
-export interface IframeRequirements {
-    readonly sandbox?: readonly string[];
-    readonly allow?: readonly string[];
-}
 export type FrontendRouteInput = string | {
     readonly path?: string;
     readonly document?: string;
     readonly handshake?: FrontendHandshake;
-    /**
-     * @deprecated Every trusted View receives the Shell's shared browser profile: requirements
-     * within it are redundant, and Astrale hosts refuse any beyond it. Remove this field.
-     */
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 };
 export interface FrontendRoute {
     readonly path: string;
     readonly document: string;
     readonly handshake: FrontendHandshake;
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 }
 export declare function normalizeRoute(input: FrontendRouteInput | undefined, fallback: string): FrontendRoute;

package/dist/application/view/route.js

@@ -1,16 +1,10 @@
 import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
-const TOKEN = /^[a-z][a-z0-9-]*$/u;
-const BASELINES = Object.freeze({
-    none: iframeRequirements(['allow-scripts'], []),
-    shell: iframeRequirements(['allow-same-origin', 'allow-scripts'], ['clipboard-write']),
-});
 export function normalizeRoute(input, fallback) {
     if (typeof input === 'string') {
         return Object.freeze({ path: routePath(input), document: 'index.html', handshake: 'shell' });
     }
     const value = plainRecord(input ?? {});
-    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' ||
-        !['path', 'document', 'handshake', 'iframe', 'host'].includes(key))) {
+    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' || !['path', 'document', 'handshake', 'host'].includes(key))) {
         invalid();
     }
     const authoredHandshake = dataValue(value, 'handshake');
@@ -20,59 +14,14 @@ export function normalizeRoute(input, fallback) {
         invalid();
     }
     const handshake = authoredHandshake ?? 'shell';
-    const iframe = normalizeIframeRequirements(dataValue(value, 'iframe'), handshake);
     const host = acceptViewHostRequirements(dataValue(value, 'host'), handshake, true);
     return Object.freeze({
         path: routePath(dataValue(value, 'path') ?? fallback),
         document: filePath(dataValue(value, 'document') ?? 'index.html'),
         handshake,
-        ...(iframe === undefined ? {} : { iframe }),
         ...(host === undefined ? {} : { host }),
     });
 }
-function normalizeIframeRequirements(input, handshake) {
-    if (input === undefined)
-        return undefined;
-    const value = plainRecord(input);
-    if (Reflect.ownKeys(value).some((key) => key !== 'sandbox' && key !== 'allow'))
-        invalid();
-    const authored = iframeRequirements(tokenArray(dataValue(value, 'sandbox')), tokenArray(dataValue(value, 'allow')));
-    assertSandboxRelationships(authored.sandbox);
-    const baseline = BASELINES[handshake];
-    const sandbox = authored.sandbox.filter((token) => !baseline.sandbox.includes(token));
-    const allow = authored.allow.filter((feature) => !baseline.allow.includes(feature));
-    return sandbox.length === 0 && allow.length === 0 ? undefined : iframeRequirements(sandbox, allow);
-}
-function iframeRequirements(sandbox, allow) {
-    return Object.freeze({
-        sandbox: Object.freeze([...new Set(sandbox)].sort()),
-        allow: Object.freeze([...new Set(allow)].sort()),
-    });
-}
-function tokenArray(input) {
-    if (input === undefined)
-        return [];
-    if (!Array.isArray(input))
-        invalid();
-    const descriptors = Object.getOwnPropertyDescriptors(input);
-    const result = [];
-    for (let index = 0; index < input.length; index += 1) {
-        const descriptor = descriptors[String(index)];
-        if (descriptor === undefined || !('value' in descriptor))
-            invalid();
-        if (typeof descriptor.value !== 'string' || !TOKEN.test(descriptor.value))
-            invalid();
-        result.push(descriptor.value);
-    }
-    for (const key of Reflect.ownKeys(descriptors)) {
-        if (key === 'length')
-            continue;
-        if (typeof key !== 'string' || !/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= input.length) {
-            invalid();
-        }
-    }
-    return result;
-}
 function plainRecord(input) {
     if (typeof input !== 'object' || input === null || Array.isArray(input))
         invalid();
@@ -89,18 +38,6 @@ function dataValue(input, key) {
         invalid();
     return descriptor.value;
 }
-function assertSandboxRelationships(sandbox) {
-    const tokens = new Set(sandbox);
-    if (tokens.has('allow-popups-to-escape-sandbox') && !tokens.has('allow-popups'))
-        invalid();
-    if (tokens.has('allow-top-navigation') && tokens.has('allow-top-navigation-by-user-activation')) {
-        invalid();
-    }
-    if (tokens.has('allow-top-navigation-to-custom-protocols') &&
-        (tokens.has('allow-top-navigation') || tokens.has('allow-popups'))) {
-        invalid();
-    }
-}
 export function defaultRoute(name) {
     return routePath(`/${name
         .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')

package/dist/application/workflow/context.d.ts

@@ -4,7 +4,7 @@ import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { DurableCallable, DurableWorkflowContext } from './durable.js';
 import type { WorkflowStep } from './step/index.js';
-/** Multi-step context of one authenticated value-output callable run inside its invocation. */
+/** Multi-step context of one value-output callable run inside its invocation. */
 export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
     readonly step: WorkflowStep;
 };

package/dist/application/workflow/define.d.ts

@@ -3,7 +3,7 @@ import type { ResolvedDomainOf } from '../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export declare function defineWorkflow<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
     <const Address extends WorkflowAddress<Schema>>(address: Address, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): WorkflowDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
     <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors = NoDeclaredErrors>(address: Address, options: WorkflowOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;

package/dist/application/workflow/define.js

@@ -2,7 +2,7 @@ import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { rememberDeclaredErrors } from '../error/index.js';
 const admittedWorkflows = new WeakSet();
 const COMPAT_TOKEN = /^[A-Za-z0-9._~-]{1,64}$/u;
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export function defineWorkflow() {
     return function define(address, optionsOrRun, possibleRun) {
         acceptWorkflowAddress(address);

package/dist/application/workflow/workflow.d.ts

@@ -3,9 +3,7 @@ import type { ActionAddressOf, ActionOutputOf, CallableAtAddress, LocalCallable,
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { WorkflowContext } from './context.js';
-export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? Callable extends {
-    readonly auth: 'anonymous';
-} ? never : CallableOutputOf<Callable> extends {
+export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? CallableOutputOf<Callable> extends {
     readonly mode: 'value';
 } ? Callable : never : never;
 export type WorkflowAddress<Schema extends schema.DomainSchema> = ActionAddressOf<WorkflowCallable<LocalCallable<ResolvedDomainOf<Schema>>>>;