@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.40

package/dist/execution/workflows/steps.d.ts

@@ -0,0 +1,42 @@
+import type { IntegrationClientFactory, Integrations } from '../../application/integration/index.js';
+import type { DurableExecution, DurableStepAuthority } from '../../application/workflow/index.js';
+import type { BoundClientSession } from '../../platform/client/session/index.js';
+import type { Domain } from '../../platform/schema/index.js';
+import type { Identity } from '../identity/index.js';
+import type { Lifetime } from '../invocation/lifecycle/index.js';
+type Executor = NonNullable<Identity['executor']>;
+/** One attempt of one Step: its journal name, its Execution, its key sequence and its bounds. */
+export interface StepAttempt {
+    readonly name: string;
+    readonly execution: DurableExecution;
+    /** The next key of the Step's sequence; the sequence restarts with every attempt. */
+    readonly next: () => string;
+    readonly lifetime: Lifetime;
+}
+/** What one Step attempt holds, released once the attempt ends. */
+export interface StepAuthorityBinding {
+    readonly authority: DurableStepAuthority;
+    close(): void;
+}
+/** Bind the capabilities one Step attempt holds. */
+export type StepAuthorities = (attempt: StepAttempt) => StepAuthorityBinding;
+/**
+ * Steps acting as the Domain through a Session of the Execution they belong to: the capabilities of
+ * an Action over the keyed Session, and the Runtime's Integration clients over the same keys.
+ */
+export declare function sessionSteps(input: {
+    readonly executor: Executor;
+    readonly domain: Domain;
+    readonly integrations: IntegrationClientFactory<Integrations>;
+}): StepAuthorities;
+/**
+ * Every Mutation and every `invoke` of a durable callable of one Step without its own key carries
+ * the next key of the Step's sequence. The sequence restarts with every attempt, so a retried Step
+ * replays the same keys: the Kernel answers a Mutation with its receipt and a durable call with the
+ * Execution it started, or refuses a request that changed under its key. Any other `invoke` carries
+ * no key, because the Kernel accepts one only for a durable Function, and runs again with the Step.
+ */
+export declare function keyed<Session extends Pick<BoundClientSession, 'invoke' | 'mutate'>>(session: Session, domain: Domain, next: () => string): Session;
+/** The key sequence of one Step of one Execution: `<execution>.<digest of the name>.<position>`. */
+export declare function keySequence(execution: DurableExecution['id'], name: string): Promise<() => string>;
+export {};

package/dist/execution/workflows/steps.js

@@ -0,0 +1,67 @@
+import { bindSession } from '../../platform/client/session/index.js';
+import { bindCapabilities } from '../invocation/capabilities/index.js';
+import { bindIntegrationAuthentication } from '../invocation/integration/index.js';
+import { stepCalls } from './integrations.js';
+/**
+ * Steps acting as the Domain through a Session of the Execution they belong to: the capabilities of
+ * an Action over the keyed Session, and the Runtime's Integration clients over the same keys.
+ */
+export function sessionSteps(input) {
+    const { executor, domain, integrations } = input;
+    return ({ execution, next, lifetime }) => {
+        const session = executor(execution.kernel, execution.id, lifetime);
+        try {
+            const bound = bindSession(session, lifetime);
+            const self = keyed(bound, domain, next);
+            const auth = bindIntegrationAuthentication(lifetime, bound);
+            const authority = Object.freeze({
+                ...bindCapabilities(domain, { self }),
+                integrations: integrations(stepCalls({ next, lifetime, auth })),
+            });
+            return Object.freeze({ authority, close: () => session.close() });
+        }
+        catch (cause) {
+            session.close();
+            throw cause;
+        }
+    };
+}
+/**
+ * Every Mutation and every `invoke` of a durable callable of one Step without its own key carries
+ * the next key of the Step's sequence. The sequence restarts with every attempt, so a retried Step
+ * replays the same keys: the Kernel answers a Mutation with its receipt and a durable call with the
+ * Execution it started, or refuses a request that changed under its key. Any other `invoke` carries
+ * no key, because the Kernel accepts one only for a durable Function, and runs again with the Step.
+ */
+export function keyed(session, domain, next) {
+    const invokeSource = session.invoke;
+    const mutateSource = session.mutate;
+    const invoke = ((reference, value, options) => invokeSource(reference, value, declaredDurable(domain, reference) ? withKey(options, next) : options));
+    const mutate = ((author, options) => mutateSource(author, withKey(options, next)));
+    return Object.freeze({ ...session, invoke, mutate });
+}
+/**
+ * Whether the Domain's Schema closure declares the referenced callable durable. An untyped Path
+ * names no declaration and a callable outside the closure has none here: both need their own key.
+ */
+function declaredDurable(domain, reference) {
+    if (reference === null || typeof reference !== 'object')
+        return false;
+    const key = reference.callable;
+    return (typeof key === 'string' && domain.callable(key)?.execution?.durable === true);
+}
+function withKey(options, next) {
+    if (options?.idempotencyKey !== undefined || options?.body !== undefined)
+        return options;
+    return { ...options, idempotencyKey: next() };
+}
+/** The key sequence of one Step of one Execution: `<execution>.<digest of the name>.<position>`. */
+export async function keySequence(execution, name) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(name)));
+    const prefix = `${execution}.${Array.from(digest.subarray(0, 12), hex).join('')}`;
+    let position = 0;
+    return () => `${prefix}.${++position}`;
+}
+function hex(byte) {
+    return byte.toString(16).padStart(2, '0');
+}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 /** Curated SDK authoring journey. Semantic values remain available from focused subpaths. */
 export { defineAction } from './application/action/index.js';
 export type { Action, ActionContext, ActionOutputOf, Caller, DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from './application/action/index.js';
-export { defineApplication, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
-export type { Application, Frontend, Requirements, Route, Routes } from './application/index.js';
+export { defineDomain, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
+export type { DomainDefinition, Frontend, Requirements, Route, Routes, } from './application/index.js';
 export { defineIntegration, defineProvider } from './application/integration/index.js';
 export type { IntegrationClient, IntegrationDefinition, Provider, } from './application/integration/index.js';
 export { defineMutation, executeMutation } from './application/mutation/index.js';
@@ -13,9 +13,9 @@ export { defineRuntime } from './application/runtime/index.js';
 export type { Runtime } from './application/runtime/index.js';
 export { defineWorkflow } from './application/workflow/index.js';
 export type { Workflow, WorkflowContext } from './application/workflow/index.js';
-export { compile, deploy, runtime } from './deployment/index.js';
+export { compile, runtime } from './deployment/index.js';
 export type { Build, Deployment, Release } from './deployment/index.js';
 export { defineProject } from './project/index.js';
 export type { Project } from './project/index.js';
 export { serve } from './execution/index.js';
-export type { ServedApplication } from './execution/index.js';
+export type { ServedDomain } from './execution/index.js';

package/dist/index.js

@@ -1,11 +1,11 @@
 /** Curated SDK authoring journey. Semantic values remain available from focused subpaths. */
 export { defineAction } from './application/action/index.js';
-export { defineApplication, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
+export { defineDomain, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
 export { defineIntegration, defineProvider } from './application/integration/index.js';
 export { defineMutation, executeMutation } from './application/mutation/index.js';
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, executeQuery, } from './application/query/index.js';
 export { defineRuntime } from './application/runtime/index.js';
 export { defineWorkflow } from './application/workflow/index.js';
-export { compile, deploy, runtime } from './deployment/index.js';
+export { compile, runtime } from './deployment/index.js';
 export { defineProject } from './project/index.js';
 export { serve } from './execution/index.js';

package/dist/platform/graph/alias.d.ts

@@ -1,6 +1,2 @@
 /** Graph-local names retain the canonical Kernel type and constructor identity. */
-export { LocalBinding as LocalAlias, isLocalBinding as isLocalAlias, } from '@astrale-os/kernel-core/graph/graph';
-/** @deprecated Use LocalAlias. */
-export { LocalBinding } from '@astrale-os/kernel-core/graph/graph';
-/** @deprecated Use isLocalAlias. */
-export { isLocalBinding } from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias } from '@astrale-os/kernel-core/graph/graph';

package/dist/platform/graph/alias.js

@@ -1,6 +1,2 @@
 /** Graph-local names retain the canonical Kernel type and constructor identity. */
-export { LocalBinding as LocalAlias, isLocalBinding as isLocalAlias, } from '@astrale-os/kernel-core/graph/graph';
-/** @deprecated Use LocalAlias. */
-export { LocalBinding } from '@astrale-os/kernel-core/graph/graph';
-/** @deprecated Use isLocalAlias. */
-export { isLocalBinding } from '@astrale-os/kernel-core/graph/graph';
+export { LocalAlias, isLocalAlias } from '@astrale-os/kernel-core/graph/graph';

package/dist/platform/graph/document/index.d.ts

@@ -1,3 +1,3 @@
 /** Canonical graph documents and local aliases. */
 export * from '@astrale-os/kernel-core/graph/graph';
-export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from '../alias.js';
+export { LocalAlias, isLocalAlias } from '../alias.js';

package/dist/platform/graph/document/index.js

@@ -1,3 +1,3 @@
 /** Canonical graph documents and local aliases. */
 export * from '@astrale-os/kernel-core/graph/graph';
-export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from '../alias.js';
+export { LocalAlias, isLocalAlias } from '../alias.js';

package/dist/platform/graph/index.d.ts

@@ -1,6 +1,6 @@
 /** Curated aggregate over canonical graph values. */
 export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, } from '@astrale-os/kernel-core/graph/graph';
-export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from './alias.js';
+export { LocalAlias, isLocalAlias } from './alias.js';
 export type { AnonymousNodeSpec, GraphDataJson, GraphSpecEdge, GraphSpecEndpoint, GraphSpecJson, GraphSpecNode, } from '@astrale-os/kernel-core/graph/graph';
 export * from './edge/index.js';
 export * from './node/index.js';

package/dist/platform/graph/index.js

@@ -1,6 +1,6 @@
 /** Curated aggregate over canonical graph values. */
 export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError, } from '@astrale-os/kernel-core/graph/graph';
-export { LocalAlias, isLocalAlias, LocalBinding, isLocalBinding } from './alias.js';
+export { LocalAlias, isLocalAlias } from './alias.js';
 export * from './edge/index.js';
 export * from './node/index.js';
 export * from './path/index.js';

package/dist/platform/release/index.d.ts

@@ -0,0 +1,2 @@
+/** Canonical DomainRelease v4 and Delivery v2 wire contracts. */
+export * from '@astrale-os/kernel-protocol/release';

package/dist/platform/release/index.js

@@ -0,0 +1,2 @@
+/** Canonical DomainRelease v4 and Delivery v2 wire contracts. */
+export * from '@astrale-os/kernel-protocol/release';

package/dist/platform/schema/callable-authoring.d.ts

@@ -0,0 +1,21 @@
+import { func as kernelFunc, method as kernelMethod, type CallablePolicyBuilder, type FunctionInput, type Method, type MethodInput } from '@astrale-os/kernel-dsl/v1/builder';
+/** Who may call an authorized callable: Policy checks, or the constant `true` or `false`. */
+export type CallerRule = CallablePolicyBuilder | boolean;
+/**
+ * An executable `authorized` callable declares its caller rule. An abstract Method is a contract
+ * on an abstract Class and executable on a concrete one, so its rule is settled by the Class that
+ * declares it.
+ */
+export type DeclaredCallerRule<Config> = Config extends {
+    readonly auth: 'authorized';
+} ? Config extends {
+    readonly abstract: true;
+} ? unknown : {
+    readonly policy: CallerRule;
+} : unknown;
+/** Author a Function. An `authorized` Function declares its caller rule. */
+export declare function func<const Config extends FunctionInput>(config: Config & DeclaredCallerRule<Config>): ReturnType<typeof kernelFunc<Config>>;
+/** Author a Method. An executable `authorized` Method declares its caller rule. */
+export declare function method<const Config extends MethodInput>(config: Config & DeclaredCallerRule<Config>): ReturnType<typeof kernelMethod<Config>>;
+/** A concrete Class executes every Method it declares, abstract contracts included. */
+export declare function assertNoUndeclaredCallerRule(methods: Readonly<Record<string, Method>> | undefined): void;

package/dist/platform/schema/callable-authoring.js

@@ -0,0 +1,27 @@
+import { func as kernelFunc, method as kernelMethod, } from '@astrale-os/kernel-dsl/v1/builder';
+/** Authorized abstract Methods authored without a caller rule, until a Class declares them. */
+const undeclared = new WeakSet();
+export function func(config) {
+    if (config.auth === 'authorized' && config.policy === undefined)
+        undeclaredCallerRule('Function');
+    return kernelFunc(config);
+}
+export function method(config) {
+    const value = kernelMethod(config);
+    if (config.auth === 'authorized' && config.policy === undefined) {
+        if (config.abstract !== true)
+            undeclaredCallerRule('Method');
+        undeclared.add(value);
+    }
+    return value;
+}
+/** A concrete Class executes every Method it declares, abstract contracts included. */
+export function assertNoUndeclaredCallerRule(methods) {
+    for (const [name, value] of Object.entries(methods ?? {})) {
+        if (undeclared.has(value))
+            undeclaredCallerRule(`Method ${name}`);
+    }
+}
+function undeclaredCallerRule(subject) {
+    throw new TypeError(`${subject} is authorized and executable: declare its policy with Policy checks, true or false.`);
+}

package/dist/platform/schema/class-authoring.d.ts

@@ -1,36 +1,86 @@
-import { nodeClass as kernelNodeClass, type DirectedEdgeClass, type DirectedEdgeInput, type NodeClass, type NodeClassInput as KernelNodeClassInput, type UndirectedEdgeClass, type UndirectedEdgeInput } from '@astrale-os/kernel-dsl/v1/builder';
+import { edgeClass as kernelEdgeClass, nodeClass as kernelNodeClass, type DirectedEdgeClass, type DirectedEdgeInput, type Lazy, type NodeClass, type NodeClassInput as KernelNodeClassInput, type NodeClassPolicyInput, type Policy, type UndirectedEdgeClass, type UndirectedEdgeInput } from '@astrale-os/kernel-dsl/v1/builder';
 import { type ClassIcon } from './class-icon.js';
-/** SDK Node Class input: every author must make an explicit, admitted icon choice. */
+/**
+ * SDK Node Class input: every author must make an explicit, admitted icon choice, and every
+ * concrete Class must declare its read rule.
+ */
 export type NodeClassInput = Omit<KernelNodeClassInput, 'icon'> & {
     readonly icon: ClassIcon;
 };
+/** Who may read or traverse an Edge Class: a named Policy, or the constant `true` or `false`. */
+export type ClassReadRule = Lazy<Policy> | boolean;
+/**
+ * Who may read or traverse a Node Class: a named Policy, the constant `true` or `false`, or Policy
+ * checks over the observed Node (`self`) and fixed members (`ref(...)`), composed as the checks of
+ * an authorized callable.
+ */
+export type NodeClassReadRule = NodeClassPolicyInput;
+/**
+ * The observation rules of a concrete Class. A Node stays traversable through either rule, so a
+ * read rule other than `true` leaves every caller able to reach it, and to select its reference,
+ * until the traverse rule is declared too.
+ */
+export type DeclaredObservation<Rule = ClassReadRule> = {
+    readonly read: true;
+    readonly traverse?: Rule;
+} | {
+    readonly read: Exclude<Rule, true>;
+    readonly traverse: Rule;
+};
+/**
+ * A concrete Class declares its read rule, and its traverse rule whenever the read rule is not
+ * `true`. An abstract Class is never observed directly, so it declares neither.
+ */
+export type DeclaredReadRule<Config, Rule = ClassReadRule> = Config extends {
+    readonly abstract: true;
+} ? unknown : {
+    readonly policies: DeclaredObservation<Rule>;
+};
 /** Preserve authored input instead of serializing expanded inheritance projections in consumers. */
 export interface AuthoredNodeClass<Config extends NodeClassInput> extends ReturnType<typeof kernelNodeClass<Config>> {
 }
+type DirectedOptions = Omit<DirectedEdgeInput, 'orientation'>;
+type UndirectedOptions = Omit<UndirectedEdgeInput, 'orientation'>;
+/** The two states `defineClass` admits: abstract, or concrete with declared observation rules. */
+type Declared<Input, Rule = ClassReadRule> = (Input & {
+    readonly abstract: true;
+}) | (Input & {
+    readonly abstract: false;
+} & {
+    readonly policies: DeclaredObservation<Rule>;
+});
 type NodeInput = {
     readonly kind: 'node';
-    readonly abstract: boolean;
-} & NodeClassInput;
+} & Declared<NodeClassInput, NodeClassReadRule>;
 type DirectedInput = {
     readonly kind: 'edge';
     readonly orientation: 'directed';
-    readonly abstract: boolean;
-} & Omit<DirectedEdgeInput, 'orientation'>;
+} & Declared<DirectedOptions>;
 type UndirectedInput = {
     readonly kind: 'edge';
     readonly orientation: 'undirected';
-    readonly abstract: boolean;
-} & Omit<UndirectedEdgeInput, 'orientation'>;
+} & Declared<UndirectedOptions>;
 /**
  * Author a Node Class whose materialized configuration always carries an explicitly selected,
- * admitted SVG icon. The mapped input retains inference while expanding package-private
- * Config interface names into portable structure for downstream declaration emit.
+ * admitted SVG icon and, when concrete, a declared read rule. The mapped input retains inference
+ * while expanding package-private Config interface names into portable structure for downstream
+ * declaration emit.
  */
-export declare function nodeClass<const Config extends NodeClassInput>(config: Config & Record<Exclude<keyof Config, keyof NodeClassInput>, never>): AuthoredNodeClass<{
+export declare function nodeClass<const Config extends NodeClassInput>(config: Config & Record<Exclude<keyof Config, keyof NodeClassInput>, never> & DeclaredReadRule<Config, NodeClassReadRule>): AuthoredNodeClass<{
     [Key in keyof Config]: Key extends 'properties' | 'methods' | 'policies' ? {
         [Member in keyof NonNullable<Config[Key]>]: NonNullable<Config[Key]>[Member];
     } | Extract<Config[Key], undefined> : Key extends 'extends' ? Config[Key] extends infer Parents extends NodeClassInput['extends'] ? Parents extends readonly unknown[] ? readonly [...Parents] : Parents : never : Config[Key];
 }>;
+declare function directed<const Input extends DirectedOptions>(input: Input & Parameters<typeof kernelEdgeClass.directed<Input>>[0] & DeclaredReadRule<Input>): ReturnType<typeof kernelEdgeClass.directed<Input>>;
+declare function undirected<const Input extends UndirectedOptions>(input: Input & Parameters<typeof kernelEdgeClass.undirected<Input>>[0] & DeclaredReadRule<Input>): ReturnType<typeof kernelEdgeClass.undirected<Input>>;
+/**
+ * Author an Edge Class. A concrete Edge Class declares its read rule exactly as a Node Class
+ * does; the handle is the canonical DSL handle.
+ */
+export declare const edgeClass: Readonly<{
+    directed: typeof directed;
+    undirected: typeof undirected;
+}>;
 export declare function defineClass(config: NodeInput): NodeClass;
 export declare function defineClass(config: DirectedInput): DirectedEdgeClass;
 export declare function defineClass(config: UndirectedInput): UndirectedEdgeClass;

package/dist/platform/schema/class-authoring.js

@@ -1,20 +1,53 @@
-import { defineClass as defineKernelClass, nodeClass as kernelNodeClass, } from '@astrale-os/kernel-dsl/v1/builder';
+import { edgeClass as kernelEdgeClass, nodeClass as kernelNodeClass, } from '@astrale-os/kernel-dsl/v1/builder';
+import { assertNoUndeclaredCallerRule } from './callable-authoring.js';
 import { classIcon } from './class-icon.js';
 export function nodeClass(config) {
     if (config === undefined || config.icon === undefined) {
         throw new TypeError('Node Class icon is required; use classIcon.neutral to make an explicit neutral choice.');
     }
+    assertDeclaredReadRule('Node', config);
+    if (config.abstract !== true)
+        assertNoUndeclaredCallerRule(config.methods);
     return kernelNodeClass({
         ...config,
         icon: classIcon.svg(config.icon),
     });
 }
+function directed(input) {
+    assertDeclaredReadRule('Edge', input);
+    return kernelEdgeClass.directed(input);
+}
+function undirected(input) {
+    assertDeclaredReadRule('Edge', input);
+    return kernelEdgeClass.undirected(input);
+}
+/**
+ * Author an Edge Class. A concrete Edge Class declares its read rule exactly as a Node Class
+ * does; the handle is the canonical DSL handle.
+ */
+export const edgeClass = Object.freeze({ directed, undirected });
 export function defineClass(config) {
     if (config.kind === 'node') {
         const { kind: _, ...input } = config;
         return nodeClass(input);
     }
-    if (config.orientation === 'directed')
-        return defineKernelClass(config);
-    return defineKernelClass(config);
+    if (config.orientation === 'directed') {
+        const { kind: _, orientation: __, ...input } = config;
+        return edgeClass.directed(input);
+    }
+    const { kind: _, orientation: __, ...input } = config;
+    return edgeClass.undirected(input);
+}
+/** The authoring boundary restates the type contract for untyped and widened configurations. */
+function assertDeclaredReadRule(kind, config) {
+    if (config.abstract === true)
+        return;
+    const rule = kind === 'Node' ? 'a Policy, Policy checks, true or false' : 'a Policy, true or false';
+    const read = config.policies?.read;
+    if (read === undefined) {
+        throw new TypeError(`${kind} Class read rule is required; declare policies.read with ${rule}.`);
+    }
+    if (read !== true && config.policies?.traverse === undefined) {
+        throw new TypeError(`${kind} Class traverse rule is required when its read rule is not true; declare policies.traverse with ${rule}.`);
+    }
 }

package/dist/platform/schema/class-icon-svg.d.ts

@@ -0,0 +1,9 @@
+declare const CLASS_ICON: unique symbol;
+/** An admitted, self-contained SVG suitable for a Node Class presentation icon. */
+export type ClassIcon = string & {
+    readonly [CLASS_ICON]: true;
+};
+/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
+export declare const NEUTRAL_CLASS_ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\"></svg>";
+export declare function admitClassIconSvg(source: string): ClassIcon;
+export {};

package/dist/platform/schema/class-icon-svg.js

@@ -0,0 +1,29 @@
+const MAX_CLASS_ICON_LENGTH = 8_000;
+const SVG_ROOT = /^<svg(?:\s[^>]*)?>[\s\S]*<\/svg>$/u;
+const SVG_ROOT_OPEN = /<svg(?:\s|>)/gu;
+const SVG_ROOT_CLOSE = /<\/svg\s*>/gu;
+const SVG_GRAPHIC = /<(?:circle|ellipse|line|path|polygon|polyline|rect)\b/iu;
+const UNSAFE_SVG = /<\s*(?:animate|discard|embed|foreignObject|iframe|image|object|script|set|style|use)\b|<!DOCTYPE\b|<!ENTITY\b|\son[a-z][\w:.-]*\s*=|(?:href|xlink:href)\s*=|javascript\s*:|url\s*\(/iu;
+/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
+export const NEUTRAL_CLASS_ICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>';
+export function admitClassIconSvg(source) {
+    if (typeof source !== 'string') {
+        throw new TypeError('Class icon must be an inline SVG string.');
+    }
+    const value = source.trim();
+    if (Array.from(value).length > MAX_CLASS_ICON_LENGTH) {
+        throw new TypeError(`Class icon must contain at most ${MAX_CLASS_ICON_LENGTH} characters.`);
+    }
+    if (!SVG_ROOT.test(value) ||
+        (value.match(SVG_ROOT_OPEN)?.length ?? 0) !== 1 ||
+        (value.match(SVG_ROOT_CLOSE)?.length ?? 0) !== 1) {
+        throw new TypeError('Class icon must be one complete inline <svg> element.');
+    }
+    if (UNSAFE_SVG.test(value)) {
+        throw new TypeError('Class icon SVG must be self-contained and contain no executable content.');
+    }
+    if (value !== NEUTRAL_CLASS_ICON_SVG && !SVG_GRAPHIC.test(value)) {
+        throw new TypeError('Class icon SVG must contain a visible vector element.');
+    }
+    return value;
+}

package/dist/platform/schema/class-icon.d.ts

@@ -1,15 +1,10 @@
 import type { LucideIconData } from '@lucide/icons';
-declare const CLASS_ICON: unique symbol;
-/** An admitted, self-contained SVG suitable for a Node Class presentation icon. */
-export type ClassIcon = string & {
-    readonly [CLASS_ICON]: true;
-};
-/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
-export declare const NEUTRAL_CLASS_ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\"></svg>";
+import type { ClassIcon } from './class-icon-svg.js';
+export type { ClassIcon } from './class-icon-svg.js';
+export { NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
 /** Framework-neutral constructors for canonical Node Class icons. */
 export declare const classIcon: Readonly<{
     readonly neutral: ClassIcon;
     svg(source: string): ClassIcon;
     lucide(icon: LucideIconData): ClassIcon;
 }>;
-export {};

package/dist/platform/schema/class-icon.js

@@ -1,33 +1,6 @@
 import { buildLucideSvg } from '@lucide/icons/build';
-const MAX_CLASS_ICON_LENGTH = 8_000;
-const SVG_ROOT = /^<svg(?:\s[^>]*)?>[\s\S]*<\/svg>$/u;
-const SVG_ROOT_OPEN = /<svg(?:\s|>)/gu;
-const SVG_ROOT_CLOSE = /<\/svg\s*>/gu;
-const SVG_GRAPHIC = /<(?:circle|ellipse|line|path|polygon|polyline|rect)\b/iu;
-const UNSAFE_SVG = /<\s*(?:animate|discard|embed|foreignObject|iframe|image|object|script|set|style|use)\b|<!DOCTYPE\b|<!ENTITY\b|\son[a-z][\w:.-]*\s*=|(?:href|xlink:href)\s*=|javascript\s*:|url\s*\(/iu;
-/** Stable empty SVG used when an author explicitly chooses to render no icon glyph. */
-export const NEUTRAL_CLASS_ICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"></svg>';
-function svg(source) {
-    if (typeof source !== 'string') {
-        throw new TypeError('Class icon must be an inline SVG string.');
-    }
-    const value = source.trim();
-    if (Array.from(value).length > MAX_CLASS_ICON_LENGTH) {
-        throw new TypeError(`Class icon must contain at most ${MAX_CLASS_ICON_LENGTH} characters.`);
-    }
-    if (!SVG_ROOT.test(value) ||
-        (value.match(SVG_ROOT_OPEN)?.length ?? 0) !== 1 ||
-        (value.match(SVG_ROOT_CLOSE)?.length ?? 0) !== 1) {
-        throw new TypeError('Class icon must be one complete inline <svg> element.');
-    }
-    if (UNSAFE_SVG.test(value)) {
-        throw new TypeError('Class icon SVG must be self-contained and contain no executable content.');
-    }
-    if (value !== NEUTRAL_CLASS_ICON_SVG && !SVG_GRAPHIC.test(value)) {
-        throw new TypeError('Class icon SVG must contain a visible vector element.');
-    }
-    return value;
-}
+import { admitClassIconSvg as svg, NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
+export { NEUTRAL_CLASS_ICON_SVG } from './class-icon-svg.js';
 function lucide(icon) {
     let source;
     try {

package/dist/platform/schema/index.d.ts

@@ -7,16 +7,18 @@ export type { StateProperty } from './state-property.js';
 export { property } from './property.js';
 export type { AuthoredProperty, PropertyOptions } from './property.js';
 export { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
-export { defineClass, nodeClass } from './class-authoring.js';
-export type { AuthoredNodeClass, NodeClassInput } from './class-authoring.js';
+export { defineClass, edgeClass, nodeClass } from './class-authoring.js';
+export type { AuthoredNodeClass, ClassReadRule, DeclaredObservation, DeclaredReadRule, NodeClassReadRule, NodeClassInput, } from './class-authoring.js';
+export { func, method } from './callable-authoring.js';
+export type { CallerRule, DeclaredCallerRule } from './callable-authoring.js';
 export { error } from './error.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFamily } from './error.js';
 export { classIcon } from './class-icon.js';
 export type { ClassIcon } from './class-icon.js';
 export type { StoredPropertyInputOf } from './property-input.js';
-export type { CallablePolicyBuilder, CallablePolicyContext, CallableProjection, AuthoredMethodProjection, AuthoredPropertyProjection, ClassIdentityProjection, ClassOwnerProjection, CoreEdge, CoreEndpoint, CoreNode, DefinedSchema, DirectedEdgeClass, ClassReferenceProjection, ClassProjection, FunctionProjection, EdgeClass, Function, Method, MethodProjection, Lazy, NodeClass, Policy, PolicyExistsContext, PolicyNodeBinder, PolicyPatternContext, Property, PropertyProjection, ResolvedDomainOfInput, View, } from '@astrale-os/kernel-dsl/v1/builder';
+export type { CallablePolicyBuilder, CallablePolicyContext, ClassRuleBuilder, ClassRuleContext, PolicyCheckContext, CallableProjection, AuthoredMethodProjection, AuthoredPropertyProjection, ClassIdentityProjection, ClassOwnerProjection, CoreEdge, CoreEndpoint, CoreNode, DefinedSchema, DirectedEdgeClass, ClassReferenceProjection, ClassProjection, FunctionProjection, EdgeClass, Function, Method, MethodProjection, Lazy, NodeClass, Policy, PolicyExistsContext, PolicyNodeBinder, PolicyPatternContext, Property, PropertyProjection, ResolvedDomainOfInput, View, } from '@astrale-os/kernel-dsl/v1/builder';
 export type { Array, Object, Value } from '@astrale-os/kernel-dsl/value';
-export type { ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
+export type { CallableAdmission, CallableExecution, ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, PropertyImmutability, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
 export type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
 /** Kernel-owned Schema values used by authored product Schemas and graph operations. */
 export { AuthorityOperationOrder, AuthorityOperations, AuthorityRelations, KernelRootFunctions, OperationCore, operationOf, } from '@astrale-os/kernel-core/schema';

package/dist/platform/schema/index.js

@@ -4,7 +4,8 @@ export { defineSchema } from './schema-authoring.js';
 export { stateProperty } from './state-property.js';
 export { property } from './property.js';
 export { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
-export { defineClass, nodeClass } from './class-authoring.js';
+export { defineClass, edgeClass, nodeClass } from './class-authoring.js';
+export { func, method } from './callable-authoring.js';
 export { error } from './error.js';
 export { classIcon } from './class-icon.js';
 /** Kernel-owned Schema values used by authored product Schemas and graph operations. */

package/dist/platform/schema/property.d.ts

@@ -3,6 +3,11 @@ import { type Property as CanonicalProperty, type ValueSchemaInput } from '@astr
 export interface PropertyOptions {
     readonly required?: boolean;
     readonly description?: string;
+    /**
+     * `create` freezes the value when its node or edge is created. `once` admits one write while the
+     * value is absent; neither can be changed or unset afterwards, only removed with the element.
+     */
+    readonly immutable?: 'create' | 'once';
 }
 /** Keep canonical generic inference: ordinary properties carry no state machine. */
 export type AuthoredProperty<Schema extends ValueSchemaInput, Options extends PropertyOptions = Record<never, never>> = CanonicalProperty<Schema, Options, never>;

package/dist/platform/schema/schema-authoring.d.ts

@@ -1,9 +1,8 @@
-import type { DefinedSchema, ResolvedDomainOfInput } from '@astrale-os/kernel-dsl/v1/builder';
+import type { DefinedSchema, EntrypointOf, ResolvedDomainOfInput, SchemaInput } from '@astrale-os/kernel-dsl/v1/builder';
 import type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
-import { defineSchema as kernelDefineSchema } from '@astrale-os/kernel-dsl/v1';
-type DomainSchemaInput = Parameters<typeof kernelDefineSchema>[1];
+type DomainSchemaInput = SchemaInput;
 declare const authoredGraph: unique symbol;
-/** Opaque legacy Schemas retain their witness; SDK Schemas retain authored input and edges. */
+/** Resolved Schemas retain their witness; authored Schemas retain input and dependency edges. */
 type Entry = readonly [origin: string, schema: DomainSchema] | readonly [
     origin: string,
     input: DomainSchemaInput,
@@ -34,7 +33,7 @@ type InputOf<Origin extends string, Graph extends Entry> = Extract<Graph, readon
         readonly [Alias in keyof Dependencies]: SchemaOf<Dependencies[Alias], Graph>;
     };
 } : never;
-type SchemaOf<Origin extends string, Graph extends Entry> = Extract<Graph, readonly [Origin, DomainSchema]> extends infer Legacy ? [Legacy] extends [never] ? AuthoredSchema<Origin, Graph> : Legacy extends readonly [string, infer Schema extends DomainSchema] ? Schema : never : never;
+type SchemaOf<Origin extends string, Graph extends Entry> = Extract<Graph, readonly [Origin, DomainSchema]> extends infer Resolved ? [Resolved] extends [never] ? AuthoredSchema<Origin, Graph> : Resolved extends readonly [string, infer Schema extends DomainSchema] ? Schema : never : never;
 /** Resolve a dependency graph without expanding a shared Schema at each dependency edge. */
 export interface AuthoredDomain<Origin extends string, Graph extends Entry> extends ResolvedDomainOfInput<Origin, InputOf<Origin, Graph>> {
 }
@@ -42,7 +41,15 @@ export interface AuthoredDomain<Origin extends string, Graph extends Entry> exte
 export interface AuthoredSchema<Origin extends string, Graph extends Entry> extends DefinedSchema<Origin, AuthoredDomain<Origin, Graph>> {
     readonly [authoredGraph]?: Graph;
 }
-type DefineSchema = <const Origin extends string, const Input extends DomainSchemaInput>(origin: Origin, input: Input) => string extends Origin | Extract<Dependencies<Input>[keyof Dependencies<Input>], DomainSchema>['origin'] ? DefinedSchema<Origin, ResolvedDomainOfInput<Origin, Input>> : AuthoredSchema<Origin, Extract<UniqueEntries<GraphOfInput<Origin, Input>>, Entry>>;
-/** The canonical implementation with a portable, automatically inferred declaration. */
+type DefineSchema = <const Origin extends string, const Input extends DomainSchemaInput & {
+    readonly name: string;
+}>(origin: Origin, input: Input & {
+    readonly entrypoint?: EntrypointOf<Input>;
+}) => string extends Origin | Extract<Dependencies<Input>[keyof Dependencies<Input>], DomainSchema>['origin'] ? DefinedSchema<Origin, ResolvedDomainOfInput<Origin, Input>> : AuthoredSchema<Origin, Extract<UniqueEntries<GraphOfInput<Origin, Input>>, Entry>>;
+/**
+ * The canonical implementation with a portable, automatically inferred declaration. Its type
+ * requires the Domain `name`, which the Kernel requires to install a new revision; `defineDomain`
+ * refuses an unnamed root Schema at runtime. `entrypoint` names one of the declared Views.
+ */
 export declare const defineSchema: DefineSchema;
 export {};

package/dist/platform/schema/schema-authoring.js

@@ -1,3 +1,7 @@
 import { defineSchema as kernelDefineSchema } from '@astrale-os/kernel-dsl/v1';
-/** The canonical implementation with a portable, automatically inferred declaration. */
+/**
+ * The canonical implementation with a portable, automatically inferred declaration. Its type
+ * requires the Domain `name`, which the Kernel requires to install a new revision; `defineDomain`
+ * refuses an unnamed root Schema at runtime. `entrypoint` names one of the declared Views.
+ */
 export const defineSchema = kernelDefineSchema;