@astrale-os/sdk 0.6.0-beta.24 → 0.6.0-beta.26

package/README.md

@@ -5,10 +5,8 @@ single-step Actions, explicit multi-step Workflows, provider-neutral Integration
 authoring, Domain composition, Deployment, and Execution without exposing DSL callable
 topology in implementation files.
 
-This draft moves the Domain name and entrypoint into its root Schema. The source is rebased on
-current SDK main, but the required canonical Kernel Schema contract is not yet published in the
-pinned dependency cohort. See [the migration and qualification boundary](docs/domain-schema-migration.md)
-before using or releasing this branch.
+The Domain name and optional View entrypoint belong to its root Schema. See
+[the Schema authoring contract](docs/domain-schema-migration.md).
 
 [![CI](https://github.com/astrale-os/sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/astrale-os/sdk/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
@@ -60,11 +58,13 @@ Install the URL printed by `astrale-domain deploy` on each intended instance.
 
 ## Handler authority and dependencies
 
-Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
+Handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
 `dependencies.directory.caller.invoke(d => d.functions.lookup, input)` calls a direct declared
 dependency on behalf of the incoming caller Identity; `.self` calls it as the executing Domain.
 Explicit `caller` or `self` authority is also available on `kernel` and `graph`; the former
-handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
+handler `client` is removed. A call to an `auth: 'anonymous'` callable that carries no credential
+has no caller: its handler acts as the Domain alone, without the `caller` selections. See
+[the API and migration guide](docs/handler-dependencies.md).
 
 ## Durable Workflows
 

package/dist/application/action/context.d.ts

@@ -47,37 +47,41 @@ export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
 }
-export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self', DomainGraphExecutor<DomainValue>>>;
+/** Whose authority one Kernel call exercises: the incoming caller's or the installed Domain's. */
+export type AuthorityMode = 'caller' | 'self';
+/**
+ * One value per selectable authority. `self` exists in every invocation; `caller` exists only when
+ * the call carried a credential, so it is absent from a call that carried none.
+ */
+export type AuthoritySelection<Value, Selectable extends AuthorityMode = AuthorityMode> = Readonly<Record<Selectable, Value> & {
+    readonly [Absent in Exclude<AuthorityMode, Selectable>]?: never;
+}>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<DomainGraphExecutor<DomainValue> & AuthoritySelection<DomainGraphExecutor<DomainValue>, Selectable>>;
 /** Self-default Kernel session with one level of explicit authority selection. */
-export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self', BoundClientSession>>;
-type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
-    readonly auth: 'anonymous';
-} ? {
-    readonly caller: AnonymousCaller;
-    readonly dependencies: null;
-    readonly kernel: null;
-    readonly graph: null;
-    readonly query?: never;
-    readonly mutate?: never;
-} | {
-    readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
+export type DomainKernelSessions<Selectable extends AuthorityMode = AuthorityMode> = Readonly<BoundClientSession & AuthoritySelection<BoundClientSession, Selectable>>;
+/** What a handler holds toward the Kernel: the installed Domain authority by default. */
+interface DomainCapabilities<DomainValue extends Domain, Selectable extends AuthorityMode> {
+    readonly dependencies: HandlerDependencies<DomainValue, Selectable>;
+    readonly kernel: DomainKernelSessions<Selectable>;
+    readonly graph: DomainGraphExecutors<DomainValue, Selectable>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly query: QueryExecutor<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly mutate: MutationExecutor<DomainValue>;
-} : {
+}
+/**
+ * A call to an `anonymous` callable that carries no credential has no caller, and its handler acts
+ * as the installed Domain alone. Every other call also selects its authenticated caller.
+ */
+type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
+    readonly auth: 'anonymous';
+} ? ({
+    readonly caller: AnonymousCaller;
+} & DomainCapabilities<DomainValue, 'self'>) | ({
     readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly query: QueryExecutor<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly mutate: MutationExecutor<DomainValue>;
-};
+} & DomainCapabilities<DomainValue, AuthorityMode>) : {
+    readonly caller: AuthenticatedCaller;
+} & DomainCapabilities<DomainValue, AuthorityMode>;
 type SelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown, false> ? {
     readonly self: NodeId;
 } : {

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, AuthorityMode, AuthoritySelection, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/dependency/invoker.d.ts

@@ -2,7 +2,7 @@ import type { Binary, Input } from '../../platform/client/index.js';
 import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
-import type { LocalCallable } from '../action/index.js';
+import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
 export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
@@ -22,10 +22,10 @@ export interface DependencyInvoker<D extends Domain> {
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming caller Identity.
- * The canonical Kernel is exposed through context.kernel.
+ * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
+ * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+export type HandlerDependencies<D extends Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Selectable>;
 }>;
 export {};

package/dist/application/integration/operation.d.ts

@@ -19,9 +19,9 @@ export interface IntegrationExecution {
     readonly signal: AbortSignal;
     readonly deadline: number;
     readonly idempotencyKey?: string;
-    /** Exact caller-bound invocation capability; absent for an anonymous invocation. */
+    /** Exact caller-bound invocation capability; absent when the call carried no credential. */
     readonly invoke?: BoundClientSession['invoke'];
-    /** Domain-self transport authentication; absent for an anonymous invocation. */
+    /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
 export interface IntegrationOperation<Input = unknown, Output = unknown> {

package/dist/application/runtime/workflows.d.ts

@@ -9,5 +9,5 @@ export interface RuntimeWorkflow {
     /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
     readonly durable: boolean;
 }
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -1,6 +1,6 @@
 import { isWorkflow } from '../workflow/index.js';
 import { runtimeCallableAt } from './callables.js';
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export function admitWorkflows(callables, input) {
     if (!Array.isArray(input))
         throw new TypeError('Runtime workflows must be an array.');
@@ -16,9 +16,6 @@ export function admitWorkflows(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Workflow ${definition.address} is not root-local and executable.`);
         }
-        if (callable.auth === 'anonymous') {
-            throw new TypeError(`Runtime Workflow ${definition.address} must be authenticated.`);
-        }
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }

package/dist/application/workflow/context.d.ts

@@ -4,7 +4,7 @@ import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { DurableCallable, DurableWorkflowContext } from './durable.js';
 import type { WorkflowStep } from './step/index.js';
-/** Multi-step context of one authenticated value-output callable run inside its invocation. */
+/** Multi-step context of one value-output callable run inside its invocation. */
 export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
     readonly step: WorkflowStep;
 };

package/dist/application/workflow/define.d.ts

@@ -3,7 +3,7 @@ import type { ResolvedDomainOf } from '../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export declare function defineWorkflow<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
     <const Address extends WorkflowAddress<Schema>>(address: Address, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): WorkflowDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
     <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors = NoDeclaredErrors>(address: Address, options: WorkflowOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;

package/dist/application/workflow/define.js

@@ -2,7 +2,7 @@ import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { rememberDeclaredErrors } from '../error/index.js';
 const admittedWorkflows = new WeakSet();
 const COMPAT_TOKEN = /^[A-Za-z0-9._~-]{1,64}$/u;
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export function defineWorkflow() {
     return function define(address, optionsOrRun, possibleRun) {
         acceptWorkflowAddress(address);

package/dist/application/workflow/workflow.d.ts

@@ -3,9 +3,7 @@ import type { ActionAddressOf, ActionOutputOf, CallableAtAddress, LocalCallable,
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { WorkflowContext } from './context.js';
-export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? Callable extends {
-    readonly auth: 'anonymous';
-} ? never : CallableOutputOf<Callable> extends {
+export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? CallableOutputOf<Callable> extends {
     readonly mode: 'value';
 } ? Callable : never : never;
 export type WorkflowAddress<Schema extends schema.DomainSchema> = ActionAddressOf<WorkflowCallable<LocalCallable<ResolvedDomainOf<Schema>>>>;

package/dist/execution/identity/authentication.d.ts

@@ -1,6 +1,6 @@
 import type { Fetch } from '@astrale-os/kernel-client';
 import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
-import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { AuthenticatedInvocation, SelfInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
@@ -26,6 +26,15 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export declare function selfInvocation(kernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): SelfInvocation;
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/authentication.js

@@ -78,6 +78,27 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         },
     });
 }
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export function selfInvocation(kernel, execution, configuration) {
+    requireLive(execution);
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    const session = callbackSession(admitted, selfIdentity, undefined, execution, configuration);
+    let closed = false;
+    return Object.freeze({
+        graph: Object.freeze({ self: bindSession(session, execution) }),
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            session.close();
+        },
+    });
+}
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/identity.js

@@ -1,4 +1,4 @@
-import { admit, authenticate, executorSession } from './authentication.js';
+import { admit, authenticate, executorSession, selfInvocation } from './authentication.js';
 import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
@@ -53,6 +53,7 @@ export function createIdentity(input) {
         admit: (request) => admit(request, configuration),
         executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+        self: async (request) => selfInvocation(request.via.issuer, request.context.execution, configuration),
     });
 }
 export function identity(input) {
@@ -68,6 +69,7 @@ export function identity(input) {
         'delivery',
         'admit',
         'authenticate',
+        'self',
         'executor',
     ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
@@ -77,6 +79,7 @@ export function identity(input) {
         typeof input.delivery !== 'function' ||
         typeof input.admit !== 'function' ||
         typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function' ||
         (input.executor !== undefined && typeof input.executor !== 'function')) {
         invalid();
     }
@@ -95,6 +98,7 @@ export function identity(input) {
         delivery: receiver.delivery.bind(receiver),
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
         ...(receiver.executor === undefined ? {} : { executor: receiver.executor.bind(receiver) }),
     });
 }

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,12 +1,15 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
 import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
-import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
-export interface AnonymousInvocation {
+import type { AuthenticatedInvocation, InvocationAuthority, SelfInvocation } from './authority.js';
+/** A call without a credential: no caller, and the installed Domain's own capabilities. */
+export interface AnonymousInvocation extends SelfInvocation {
     readonly caller: AnonymousCaller;
-    readonly kernel: null;
-    readonly graph: null;
-    close(): void;
 }
 export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+/**
+ * The sessions one invocation holds toward its source Kernel: the Domain's own always, its
+ * caller's only when the call carried a credential.
+ */
+export type InvocationSessions = InvocationAuthentication['graph'];
 export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -3,16 +3,12 @@ import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
-const ANONYMOUS = Object.freeze({
-    caller: Object.freeze({ kind: 'anonymous' }),
-    kernel: null,
-    graph: null,
-    close() { },
-});
+const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
 export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined)
-        return ANONYMOUS;
+    if (callable.auth === 'anonymous' && credential === undefined) {
+        return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
+    }
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }
@@ -35,7 +31,7 @@ export async function authentication(callable, request, domain, authority) {
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
-        const graphInput = admitGraph(authenticated.graph);
+        const graphInput = admitGraph(authenticated.graph, ['caller', 'self']);
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
@@ -43,24 +39,46 @@ export async function authentication(callable, request, domain, authority) {
         return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
-        if (close === undefined)
-            invalid(cause);
-        try {
-            close();
-        }
-        catch (cleanup) {
-            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        rejectClosing(close, cause);
+    }
+}
+/** Admit the Domain's own capabilities for a call that carries no credential. */
+function anonymous(own) {
+    let close;
+    try {
+        close = captureClose(own);
+        if (own === null ||
+            typeof own !== 'object' ||
+            Array.isArray(own) ||
+            Reflect.ownKeys(own).some((key) => key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
         }
+        const graph = Object.freeze({ self: bindSession(admitGraph(own.graph, ['self']).self) });
+        return Object.freeze({ caller: ANONYMOUS, graph, close });
+    }
+    catch (cause) {
+        rejectClosing(close, cause);
+    }
+}
+/** Release whatever the authority opened before refusing its invalid capabilities. */
+function rejectClosing(close, cause) {
+    if (close === undefined)
         invalid(cause);
+    try {
+        close();
+    }
+    catch (cleanup) {
+        throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid capabilities and cleanup failed.');
     }
+    invalid(cause);
 }
-function admitGraph(input) {
+function admitGraph(input, modes) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        !Object.hasOwn(input, 'caller') ||
-        !Object.hasOwn(input, 'self') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self')) {
+        modes.some((mode) => !Object.hasOwn(input, mode)) ||
+        Reflect.ownKeys(input).some((key) => !modes.includes(key))) {
         invalid();
     }
     return input;
@@ -134,6 +152,6 @@ function optionalTime(input) {
     return input === undefined || (typeof input === 'number' && Number.isFinite(input));
 }
 function invalid(cause) {
-    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    const message = 'Invocation authority returned invalid capabilities.';
     throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
 }

package/dist/execution/invocation/admission/authority.d.ts

@@ -16,12 +16,22 @@ export interface InvocationAuthenticationInput {
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
+export interface InvocationSelfInput {
+    readonly via: invocation.Via;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
     readonly caller: AuthenticatedCaller;
     readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
     close(): void;
 }
+/** The Domain's own capabilities, before the SDK admits them for a call without a credential. */
+export interface SelfInvocation {
+    readonly graph: Readonly<Record<'self', BoundClientSession>>;
+    close(): void;
+}
 export interface InvocationAuthority {
     /**
      * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
@@ -30,8 +40,14 @@ export interface InvocationAuthority {
      */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+    /**
+     * The Domain's own authority toward the source Kernel, for an admitted call to an `anonymous`
+     * callable that carries no credential: its handler acts as the installed Domain, never as a
+     * caller.
+     */
+    self(input: InvocationSelfInput): Promise<SelfInvocation>;
 }
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served

package/dist/execution/invocation/admission/authority.js

@@ -1,15 +1,18 @@
 import { protocolError } from '../result/index.js';
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export function authority(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+    if (typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function') {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
     return Object.freeze({
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
     });
 }
 /**

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,5 @@
 export { authority, requireVia } from './authority.js';
-export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
-export { authentication, type InvocationAuthentication } from './authentication.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
+export { authentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
 export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,4 @@
 export { authority, requireVia } from './authority.js';
-export { authentication } from './authentication.js';
+export { authentication, } from './authentication.js';
 export { input } from './input.js';
 export { target } from './target.js';

package/dist/execution/invocation/dependency/bind.d.ts

@@ -1,5 +1,7 @@
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
+import type { InvocationSessions } from '../admission/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
 export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: InvocationSessions): HandlerDependencies<D> | HandlerDependencies<D, 'self'>;

package/dist/execution/invocation/dependency/bind.js

@@ -3,14 +3,13 @@ import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
 import { reference } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { Path } from '../../../platform/graph/path/index.js';
-/** Bind each explicit authority to its admitted session; metadata remains inert. */
 export function bindDependencies(domain, sessions) {
     const dependencies = Object.create(null);
     for (const [alias, dependency] of Object.entries(domain.dependencies)) {
         if (dependency.origin === 'kernel.astrale.ai')
             continue;
         dependencies[alias] = Object.freeze({
-            caller: bindDependency(dependency, sessions.caller),
+            ...('caller' in sessions ? { caller: bindDependency(dependency, sessions.caller) } : {}),
             self: bindDependency(dependency, sessions.self),
         });
     }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -12,11 +12,11 @@ export interface DispatchContext {
     readonly input: unknown;
     readonly body?: ActionBinaryInput;
     readonly caller: Caller;
-    readonly dependencies: HandlerDependencies<Domain> | null;
-    readonly kernel: DomainKernelSessions | null;
-    readonly graph: DomainGraphExecutors | null;
-    readonly query?: QueryExecutor;
-    readonly mutate?: MutationExecutor;
+    readonly dependencies: HandlerDependencies<Domain> | HandlerDependencies<Domain, 'self'>;
+    readonly kernel: DomainKernelSessions | DomainKernelSessions<'self'>;
+    readonly graph: DomainGraphExecutors | DomainGraphExecutors<Domain, 'self'>;
+    readonly query: QueryExecutor;
+    readonly mutate: MutationExecutor;
     readonly integrations: Readonly<Record<string, unknown>>;
     readonly execution: ActionExecution;
     readonly self?: NodeId;

package/dist/execution/invocation/dispatch/context.js

@@ -3,7 +3,8 @@ import { bindQuery } from '../../../application/query/execution/executor.js';
 import { bindDependencies } from '../dependency/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
-    const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
+    const sessions = authentication.graph;
+    const graph = bindGraph(sessions, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
         deadline: request.context.execution.deadline,
@@ -19,46 +20,31 @@ export function context(request, runtime, authentication, self) {
         input: request.call.input,
         ...(request.context.binary === undefined ? {} : { body: request.context.binary }),
         caller: authentication.caller,
-        kernel: authentication.graph === null
-            ? null
-            : Object.freeze({
-                ...authentication.graph.self,
-                ...authentication.graph,
-            }),
-        dependencies: authentication.graph === null
-            ? null
-            : bindDependencies(runtime.loaded.domain, authentication.graph),
+        kernel: Object.freeze({ ...sessions.self, ...sessions }),
+        dependencies: bindDependencies(runtime.loaded.domain, sessions),
         graph,
-        ...(graph === null
-            ? {}
-            : {
-                query: graph.self.query,
-                mutate: graph.self.mutate,
-            }),
-        integrations: clients(runtime, request.context, authentication.graph === null
-            ? null
-            : {
-                caller: authentication.graph.caller,
-                self: authentication.graph.self,
-                ...(authentication.caller.authentication.expiresAt === undefined
-                    ? {}
-                    : {
-                        expiresAt: authentication.caller.authentication.expiresAt,
-                    }),
-            }),
+        query: graph.self.query,
+        mutate: graph.self.mutate,
+        integrations: clients(runtime, request.context, {
+            ...sessions,
+            ...(authentication.caller.kind !== 'authenticated' ||
+                authentication.caller.authentication.expiresAt === undefined
+                ? {}
+                : { expiresAt: authentication.caller.authentication.expiresAt }),
+        }),
         execution,
         ...(self === undefined ? {} : { self }),
     });
 }
-function bindGraph(clients, domain) {
+function bindGraph(sessions, domain) {
     const bind = (client) => Object.freeze({
         query: bindQuery(client, domain),
         mutate: bindMutation(client, domain),
     });
-    const self = bind(clients.self);
+    const self = bind(sessions.self);
     return Object.freeze({
         ...self,
-        caller: bind(clients.caller),
+        ...('caller' in sessions ? { caller: bind(sessions.caller) } : {}),
         self,
     });
 }

package/dist/execution/invocation/dispatch/workflow.js

@@ -1,12 +1,8 @@
 import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
 import { protocolError } from '../result/index.js';
 export async function workflow(selected, context, runner) {
-    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
-        throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
-    }
     const complete = Object.freeze({
         ...context,
-        caller: context.caller,
         error: declaredErrorFactory(selected.definition),
     });
     try {

package/dist/execution/invocation/integration/call.d.ts

@@ -2,7 +2,8 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationInvocationOwner } from '../../../application/integration/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 export interface IntegrationInvocationSessions {
-    readonly caller: BoundClientSession;
+    /** Absent when the call carried no credential: there is no caller to invoke for. */
+    readonly caller?: BoundClientSession;
     readonly self: BoundClientSession;
     /** Verified incoming carrier expiry, in Unix seconds. */
     readonly expiresAt?: number;

package/dist/execution/invocation/integration/call.js

@@ -3,7 +3,7 @@ import { bindIntegrationAuthentication } from './authentication.js';
 /** One invocation-owned logical Integration call sequence. */
 export function calls(context, sessions = null) {
     const prefix = context.idempotencyKey ?? JSON.stringify([context.invocation.source, context.invocation.id]);
-    const invoke = sessions?.caller.invoke.bind(sessions.caller);
+    const invoke = sessions?.caller?.invoke.bind(sessions.caller);
     const auth = sessions === null
         ? undefined
         : bindIntegrationAuthentication(context, sessions.self, sessions.expiresAt);

package/dist/execution/invocation/integration/clients.d.ts

@@ -2,4 +2,4 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationClients, Integrations } from '../../../application/integration/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
 import type { IntegrationInvocationSessions } from './call.js';
-export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions | null): IntegrationClients<Integrations>;
+export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions): IntegrationClients<Integrations>;

package/dist/tooling/cli/publish/index.d.ts

@@ -16,13 +16,18 @@ export interface PublishCommandInput {
     readonly json: boolean;
     readonly signal: AbortSignal;
 }
-/** What `publish` uses of the Domain registry: the index, a baseline's bundle, the Publication. */
-type PublishRegistry = Pick<DomainRegistry, 'index' | 'bundle' | 'publish'>;
+/**
+ * What `publish` uses of the Domain registry: the index, the claim of an origin no one has, a
+ * baseline's bundle, the Publication.
+ */
+type PublishRegistry = Pick<DomainRegistry, 'index' | 'claim' | 'bundle' | 'publish'>;
 export interface PublishCommandDependencies {
     readonly open: (input: {
         readonly projectDir: string;
         readonly identity?: string;
         readonly signal: AbortSignal;
+        /** The first Astrale CLI release that serves every registry command publish may run. */
+        readonly minimum?: string;
     }) => Promise<PublishRegistry>;
     /** Step 5: the deployment serves exactly this sealed release at its URL. */
     readonly verify: (release: Release, signal: AbortSignal) => Promise<void>;
@@ -55,7 +60,9 @@ export declare const VERIFY_TIMEOUT_MS = 60000;
  *    configure, placement, label, URL and the sealed release digest.
  * 1. Read the version from `package.json`.
  * 2. Read the registry. The version exists: the same release succeeds without effect, another is
- *    refused. A Domain absent or unreadable, or a registry that does not answer, is refused.
+ *    refused. An origin the registry does not hold for this identity is claimed: Admin gives an
+ *    origin no one has to its first claimer, who administers its Domain, and refuses one another
+ *    account holds. A registry that does not answer is refused.
  * 3. Judge the version against the highest stable version below it (AM-23); refuse a version
  *    that is too low.
  * 4. Deploy the release, or reuse its deployment.
@@ -68,6 +75,7 @@ export declare const VERIFY_TIMEOUT_MS = 60000;
  *    keeps the published deployment. No first-party adapter declares it: Admin's Services and a
  *    Cloudflare dispatch namespace keep every deployment until its owner retires it.
  *
- * Steps 0 to 3 make no deploy call. Never installs.
+ * Steps 0 to 3 make no deploy call; step 2's claim is the only registry change before step 6.
+ * Never installs.
  */
 export declare function runPublish(input: PublishCommandInput, dependencies?: PublishCommandDependencies): Promise<number>;

package/dist/tooling/cli/publish/index.js

@@ -7,7 +7,7 @@ import { renderDiff } from '../diff/render.js';
 import { diffReport, publishedSchema } from '../diff/report.js';
 import { deployPlannedRelease, planImmutableDeployment, runtimeCommit, } from '../immutable-deployment.js';
 import { DIM, RED, RESET, YELLOW } from '../log.js';
-import { RegistryCliError, openDomainRegistry } from '../registry/index.js';
+import { MINIMUM_CLAIM_CLI_VERSION, RegistryCliError, openDomainRegistry, } from '../registry/index.js';
 import { publishReport } from './report.js';
 /**
  * Step 5 reads the deployment's `release.json` (at most 1 MiB) and its Bundle (at most 16 MiB)
@@ -36,7 +36,9 @@ const DEFAULT_DEPENDENCIES = Object.freeze({
  *    configure, placement, label, URL and the sealed release digest.
  * 1. Read the version from `package.json`.
  * 2. Read the registry. The version exists: the same release succeeds without effect, another is
- *    refused. A Domain absent or unreadable, or a registry that does not answer, is refused.
+ *    refused. An origin the registry does not hold for this identity is claimed: Admin gives an
+ *    origin no one has to its first claimer, who administers its Domain, and refuses one another
+ *    account holds. A registry that does not answer is refused.
  * 3. Judge the version against the highest stable version below it (AM-23); refuse a version
  *    that is too low.
  * 4. Deploy the release, or reuse its deployment.
@@ -49,7 +51,8 @@ const DEFAULT_DEPENDENCIES = Object.freeze({
  *    keeps the published deployment. No first-party adapter declares it: Admin's Services and a
  *    Cloudflare dispatch namespace keep every deployment until its owner retires it.
  *
- * Steps 0 to 3 make no deploy call. Never installs.
+ * Steps 0 to 3 make no deploy call; step 2's claim is the only registry change before step 6.
+ * Never installs.
  */
 export async function runPublish(input, dependencies = DEFAULT_DEPENDENCIES) {
     const { build, environment, signal } = input;
@@ -104,7 +107,12 @@ export async function runPublish(input, dependencies = DEFAULT_DEPENDENCIES) {
     let registry;
     let index;
     try {
-        registry = await dependencies.open({ projectDir: input.projectDir, ...identity, signal });
+        registry = await dependencies.open({
+            projectDir: input.projectDir,
+            ...identity,
+            signal,
+            minimum: MINIMUM_CLAIM_CLI_VERSION,
+        });
         index = await registry.index(origin);
     }
     catch (cause) {
@@ -113,7 +121,18 @@ export async function runPublish(input, dependencies = DEFAULT_DEPENDENCIES) {
         return refuse(`Domain registry: ${cause.code}: ${cause.message}`, 'Nothing was deployed or published.');
     }
     if (index === undefined) {
-        return refuse(`${origin} is not in the Domain registry, or you may not read it: nothing was deployed.`, 'An administrator of the Admin instance registers the Domain and names who may publish it.');
+        // First claim: the registry holds no Domain of this origin for this identity. Admin gives an
+        // origin no one has to its first claimer, before anything is deployed.
+        try {
+            await registry.claim(origin);
+        }
+        catch (cause) {
+            if (!(cause instanceof RegistryCliError))
+                throw cause;
+            return refuse(...notClaimed(origin, cause));
+        }
+        progress(`Claimed ${origin} in the Domain registry: this identity administers it.`);
+        index = { origin, publications: [] };
     }
     const existing = index.publications.find(({ version }) => version === declared);
     if (existing !== undefined) {
@@ -261,6 +280,25 @@ function notPublished(name, origin, url, cause) {
             `refusal until ${remedy(cause, origin)}.`,
     ];
 }
+/** Why the origin could not be claimed for this identity; nothing was deployed in any case. */
+function notClaimed(origin, cause) {
+    switch (cause.code) {
+        case 'REGISTRY_ORIGIN_CLAIMED':
+            return [
+                `${origin} is already claimed in the Domain registry, and you may not read it: nothing was deployed.`,
+                'An administrator of the Domain grants you domain_admin to publish it.',
+            ];
+        case 'REGISTRY_ORIGIN_RESERVED':
+            return [
+                `${origin} is under astrale.ai, which Astrale operators register: nothing was deployed.`,
+            ];
+        default:
+            return [
+                `${origin} is not in the Domain registry and could not be claimed: ${cause.code}: ${cause.message}`,
+                'Nothing was deployed or published. Rerun publish: a claim is safe to repeat.',
+            ];
+    }
+}
 /** CT29: a change may have applied, or the answer could not be read. */
 function unconfirmed(error) {
     const reason = error.details?.reason;

package/dist/tooling/cli/registry/client.d.ts

@@ -70,6 +70,13 @@ export interface RegistryYank {
 export interface DomainRegistry {
     /** The Domain's index, or `undefined` when it is absent or not readable by the caller. */
     index(origin: string): Promise<RegistryIndex | undefined>;
+    /**
+     * Claim one origin: Admin gives an origin no one has to its first claimer, who administers its
+     * Domain. Idempotent for a caller who administers the Domain, so a rerun is safe. An origin
+     * another account holds is refused (`REGISTRY_ORIGIN_CLAIMED`), as is one under `astrale.ai`
+     * for anyone but an Astrale operator (`REGISTRY_ORIGIN_RESERVED`).
+     */
+    claim(origin: string): Promise<void>;
     /** The bundle bytes of one Publication of the index, digest and Schema identity verified. */
     bundle(origin: string, publication: RegistryPublication): Promise<Uint8Array>;
     /**

package/dist/tooling/cli/registry/client.js

@@ -80,6 +80,14 @@ export async function openDomainRegistry(input, dependencies = {
                 throw cause;
             }
         },
+        async claim(origin) {
+            const document = await command({ executable, ...machine(['__domain-registry', 'claim', origin]) }, { stdout: DOCUMENT_LIMIT, timeoutMs: CHANGE_TIMEOUT_MS, change: true });
+            if (document.format !== 'astrale.registry-claim-result' ||
+                document.version !== 1 ||
+                document.origin !== origin) {
+                throw protocolError(`Astrale CLI answered no claim result of ${origin}.`);
+            }
+        },
         async bundle(origin, publication) {
             const directory = await mkdtemp(join(tmpdir(), 'astrale-registry-'));
             try {

package/dist/tooling/cli/registry/executable.d.ts

@@ -12,6 +12,12 @@ export declare const MINIMUM_REGISTRY_CLI_VERSION = "1.0.0-beta.128";
  * 1.0.0-beta.128 and older were released without it.
  */
 export declare const MINIMUM_INSTALLATIONS_CLI_VERSION = "1.0.0-beta.129";
+/**
+ * The first Astrale CLI release that claims an origin (`astrale __domain-registry claim`), which
+ * `astrale-domain publish` does before the first version of a Domain no one has registered.
+ * 1.0.0-beta.136 and older were released without it.
+ */
+export declare const MINIMUM_CLAIM_CLI_VERSION = "1.0.0-beta.137";
 export interface RegistryExecutableDependencies {
     readonly candidates: () => Promise<readonly string[]>;
     readonly run: (input: RegistryProcessInput) => Promise<RegistryProcessResult>;

package/dist/tooling/cli/registry/executable.js

@@ -17,6 +17,12 @@ export const MINIMUM_REGISTRY_CLI_VERSION = '1.0.0-beta.128';
  * 1.0.0-beta.128 and older were released without it.
  */
 export const MINIMUM_INSTALLATIONS_CLI_VERSION = '1.0.0-beta.129';
+/**
+ * The first Astrale CLI release that claims an origin (`astrale __domain-registry claim`), which
+ * `astrale-domain publish` does before the first version of a Domain no one has registered.
+ * 1.0.0-beta.136 and older were released without it.
+ */
+export const MINIMUM_CLAIM_CLI_VERSION = '1.0.0-beta.137';
 /**
  * Resolve one Astrale CLI for a whole command, the official installation before PATH, and admit
  * it only when it serves the registry plumbing, so an older CLI is refused by name instead of

package/dist/tooling/cli/registry/index.d.ts

@@ -3,7 +3,7 @@
  * registry plumbing (CT29), with the caller's own credential and the CLI's configured Admin target.
  */
 export { RegistryCliError, openDomainRegistry, type DomainRegistry, type DomainRegistryDependencies, type RegistryBundle, type RegistryDigest, type RegistryIndex, type RegistryPublication, type RegistryPublishRequest, type RegistryPublishResult, type RegistryYank, } from './client.js';
-export { MINIMUM_INSTALLATIONS_CLI_VERSION, MINIMUM_REGISTRY_CLI_VERSION, resolveRegistryExecutable, } from './executable.js';
+export { MINIMUM_CLAIM_CLI_VERSION, MINIMUM_INSTALLATIONS_CLI_VERSION, MINIMUM_REGISTRY_CLI_VERSION, resolveRegistryExecutable, } from './executable.js';
 export { isAdminFailure } from './installations.js';
 export type { InstallationUnknownReason, InstanceInstallation, InstanceListing, } from './installations.js';
 export { RegistryProcessTimeoutError } from './process.js';

package/dist/tooling/cli/registry/index.js

@@ -3,6 +3,6 @@
  * registry plumbing (CT29), with the caller's own credential and the CLI's configured Admin target.
  */
 export { RegistryCliError, openDomainRegistry, } from './client.js';
-export { MINIMUM_INSTALLATIONS_CLI_VERSION, MINIMUM_REGISTRY_CLI_VERSION, resolveRegistryExecutable, } from './executable.js';
+export { MINIMUM_CLAIM_CLI_VERSION, MINIMUM_INSTALLATIONS_CLI_VERSION, MINIMUM_REGISTRY_CLI_VERSION, resolveRegistryExecutable, } from './executable.js';
 export { isAdminFailure } from './installations.js';
 export { RegistryProcessTimeoutError } from './process.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.24",
+  "version": "0.6.0-beta.26",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -257,11 +257,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.87",
-    "@astrale-os/kernel-core": "0.9.0-beta.66",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.48",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.72",
-    "@astrale-os/kernel-server": "0.5.0-beta.74",
+    "@astrale-os/kernel-client": "0.6.0-beta.88",
+    "@astrale-os/kernel-core": "0.9.0-beta.67",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.49",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.73",
+    "@astrale-os/kernel-server": "0.5.0-beta.75",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -287,6 +287,7 @@
     "husky": "~9.1.7",
     "lint-staged": "~17.3.0",
     "mermaid": "^11.16.1",
+    "miniflare": "5.20260811.1-alpha",
     "oxfmt": "0.63.0",
     "oxlint": "1.78.0",
     "preact": "^10.29.8",
@@ -316,10 +317,10 @@
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
       "oxlint --disable-nested-config --fix",
-      "oxfmt --write"
+      "oxfmt --no-error-on-unmatched-pattern --write"
     ],
     "*.{json,yml,yaml}": [
-      "oxfmt --write"
+      "oxfmt --no-error-on-unmatched-pattern --write"
     ]
   },
   "devEngines": {