@astrale-os/sdk 0.1.10 → 0.3.0

package/dist/server/auxiliary-routes.js

@@ -14,6 +14,7 @@
 import { isKernelErrorClassifiable, KERNEL_ERROR_CODES, kernelErrorHttpStatus, } from '@astrale-os/kernel-api';
 import { isSubdomainOf, matchHost, compileHostMatcher, parseUrlTemplate, } from '@astrale-os/kernel-api/routed';
 import { buildCorsHeaders } from '@astrale-os/kernel-server';
+import { makeIssuerMint } from '../auth/issuer-mint';
 import { makeSelfKernel } from '../auth/kernel-client';
 import { resolveInboundAuth } from '../auth/resolve';
 import { runAuthorize } from '../dispatch/authorize';
@@ -76,13 +77,23 @@ export function mountAuxiliaryRoutes(config) {
                     if (!validation.ok) {
                         throw new SdkValidationError(validation.issues);
                     }
-                    const ctx = { params: validation.data, c, auth, deps, kernel, callRemote, selfKernel };
+                    const issuer = makeIssuerMint(identity);
+                    const ctx = {
+                        params: validation.data,
+                        c,
+                        auth,
+                        deps,
+                        kernel,
+                        issuer,
+                        callRemote,
+                        selfKernel,
+                    };
                     if (def.authorize)
                         await runAuthorize(def.authorize, ctx);
                     const result = await def.execute(ctx);
                     const outValidation = validateResult(def.outputSchema, result);
                     if (!outValidation.ok) {
-                        throw new SdkResultValidationError(outValidation.issues, def.ref);
+                        throw new SdkResultValidationError(outValidation.issues, `function.${slug}`);
                     }
                     return c.json({ result: outValidation.data });
                 },
@@ -123,7 +134,7 @@ function mountEntry(args) {
             `Aux routes (views / remote functions) support only GET and POST.`);
     }
     // Local-dev requests target literal `localhost`, but bindings reference a
-    // logical host (`dist.localhost`) — so only enforce a Host-header match
+    // logical host (`example.localhost`) — so only enforce a Host-header match
     // when the binding has actual placeholders to extract.
     const hostMatcher = parsed.hostPlaceholders.length > 0 ? compileHostMatcher(parsed.hostPattern) : null;
     const pathParamNames = collectPlaceholderNames(fullPath);

package/dist/server/auxiliary-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auxiliary-routes.js","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,2BAA2B,CAAA;AAQ7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA0BrE,MAAM,UAAU,oBAAoB,CAAQ,MAAoC;IAC9E,MAAM,EACJ,GAAG,EACH,GAAG,EACH,KAAK,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,IAAI,GACL,GAAG,MAAM,CAAA;IAEV,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE1C,IAAI,KAAK,IAAI,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,SAAQ;YACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;oBACjD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,OAAO,GAAG,CAAC,MAAO,CAAC,GAAG,CAAC,CAAA;gBACzB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,IAAI,sBAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;oBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,OAAO,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;oBAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;wBACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;oBACjF,CAAC;oBACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;oBACtF,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;oBAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,IAAI,wBAAwB,CAChC,aAAa,CAAC,MAA4C,EAC1D,GAAG,CAAC,GAAG,CACR,CAAA;oBACH,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAgC,EAChC,IAAY,EACZ,QAA0C;IAE1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,KAAK,IAAI,KAAK;QACpE,6CAA6C,IAAI,4BAA4B,CAChF,CAAA;AACH,CAAC;AAqBD,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C,SAAS,UAAU,CAAC,IAAoB;IACtC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,CAAC,SAAS;QAAE,OAAM;IAEtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC;QAAE,OAAM;IAEhF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAA;IACzD,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,gBAAgB,QAAQ,KAAK;YACvF,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yDAAyD;QACzD,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,UAAU,GAA2B,EAAE,CAAA;YAC3C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC/B,UAAU,GAAG,KAAK,CAAA;YACpB,CAAC;YAED,MAAM,UAAU,GAA2B,EAAE,CAAA;YAC7C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAC7D,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EACtD,IAAI,EACJ,QAAQ,CACT,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;gBACzB,CAAC;gBACD,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE;gBACxC,IAAI,EAAE,YAAY;gBAClB,MAAM;gBACN,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,IAAI,UAAU,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;SAC/C,IAAI,UAAU,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE3D,8DAA8D;IAC9D,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,OAA+B;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAA+B;IAC9E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5E,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAuB,yBAAyB,CAAC,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;SAC/D,CAAA;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;IAC7C,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAA;AACjC,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC"}
+{"version":3,"file":"auxiliary-routes.js","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,2BAA2B,CAAA;AAQ7E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA0BrE,MAAM,UAAU,oBAAoB,CAAQ,MAAoC;IAC9E,MAAM,EACJ,GAAG,EACH,GAAG,EACH,KAAK,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,IAAI,GACL,GAAG,MAAM,CAAA;IAEV,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE1C,IAAI,KAAK,IAAI,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,SAAQ;YACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;oBACjD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,OAAO,GAAG,CAAC,MAAO,CAAC,GAAG,CAAC,CAAA;gBACzB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,IAAI,sBAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;oBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,OAAO,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;oBAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;wBACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;oBACjF,CAAC;oBACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;oBACvC,MAAM,GAAG,GAAG;wBACV,MAAM,EAAE,UAAU,CAAC,IAAI;wBACvB,CAAC;wBACD,IAAI;wBACJ,IAAI;wBACJ,MAAM;wBACN,MAAM;wBACN,UAAU;wBACV,UAAU;qBACX,CAAA;oBACD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;oBAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,IAAI,wBAAwB,CAChC,aAAa,CAAC,MAA4C,EAC1D,YAAY,IAAI,EAAE,CACnB,CAAA;oBACH,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAgC,EAChC,IAAY,EACZ,QAA0C;IAE1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,KAAK,IAAI,KAAK;QACpE,6CAA6C,IAAI,4BAA4B,CAChF,CAAA;AACH,CAAC;AAqBD,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C,SAAS,UAAU,CAAC,IAAoB;IACtC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,CAAC,SAAS;QAAE,OAAM;IAEtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC;QAAE,OAAM;IAEhF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAA;IACzD,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,gBAAgB,QAAQ,KAAK;YACvF,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yDAAyD;QACzD,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,UAAU,GAA2B,EAAE,CAAA;YAC3C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC/B,UAAU,GAAG,KAAK,CAAA;YACpB,CAAC;YAED,MAAM,UAAU,GAA2B,EAAE,CAAA;YAC7C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAC7D,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EACtD,IAAI,EACJ,QAAQ,CACT,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;gBACzB,CAAC;gBACD,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE;gBACxC,IAAI,EAAE,YAAY;gBAClB,MAAM;gBACN,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,IAAI,UAAU,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;SAC/C,IAAI,UAAU,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE3D,8DAA8D;IAC9D,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,OAA+B;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAA+B;IAC9E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5E,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAuB,yBAAyB,CAAC,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;SAC/D,CAAA;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;IAC7C,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAA;AACjC,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/dist/server/create.d.ts

@@ -1,19 +1,6 @@
 /**
- * `createRemoteServer` — the SDK's entry point for running a remote domain.
- *
- * Identity is per-function: the dispatcher signs `iss` = the worker's serving
- * URL (`effectiveIssuer`, decoupled from the addressing `origin`) and `sub` =
- * the origin-addressed function path on each dispatch.
- *
- * Composes:
- *   methods             ← Map keyed by BoundMethod.ref (built by dispatch/resolve)
- *   effectiveIssuer     ← config.issuer ?? config.url
- *   dispatcher          ← SdkDispatcher(compiled, methods, deps, privateKey)
- *   jwks                ← derivePublicJwk(privateKey), keyed by effectiveIssuer
- *   /meta               ← provenance endpoint (sdkCommit, schemaHash, domainName)
- *   auxiliary routes    ← view / remote-function handlers from defineRemoteDomain
- *   app                 ← createKernelApp(dispatcher, contracts, host, jwks, transports, ...)
- *   start               ← startNodeServer(app, port)
+ * Remote-domain server entry point. The worker serving URL is the issuer; each
+ * method/view/function signs with its own semantic subject.
  */
 import type { RemoteServerConfig } from './config';
 import type { RemoteServer } from './handle';

package/dist/server/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,UAAU,CAAA;AAahE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,YAAY,CA+JzF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,UAAU,CAAA;AAahE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,YAAY,CAyIzF"}

package/dist/server/create.js

@@ -1,19 +1,6 @@
 /**
- * `createRemoteServer` — the SDK's entry point for running a remote domain.
- *
- * Identity is per-function: the dispatcher signs `iss` = the worker's serving
- * URL (`effectiveIssuer`, decoupled from the addressing `origin`) and `sub` =
- * the origin-addressed function path on each dispatch.
- *
- * Composes:
- *   methods             ← Map keyed by BoundMethod.ref (built by dispatch/resolve)
- *   effectiveIssuer     ← config.issuer ?? config.url
- *   dispatcher          ← SdkDispatcher(compiled, methods, deps, privateKey)
- *   jwks                ← derivePublicJwk(privateKey), keyed by effectiveIssuer
- *   /meta               ← provenance endpoint (sdkCommit, schemaHash, domainName)
- *   auxiliary routes    ← view / remote-function handlers from defineRemoteDomain
- *   app                 ← createKernelApp(dispatcher, contracts, host, jwks, transports, ...)
- *   start               ← startNodeServer(app, port)
+ * Remote-domain server entry point. The worker serving URL is the issuer; each
+ * method/view/function signs with its own semantic subject.
  */
 import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
 import { collectFunctionSubs, domainInstallRequestSchema, hashInstallGraph, } from '@astrale-os/kernel-core/domain';
@@ -32,19 +19,16 @@ import { derivePublicJwk } from './jwks';
 import { canonicalizeServingUrl } from './serving-url';
 export function createRemoteServer(config) {
     const methods = buildMethodIndex(config.domain.methods);
-    // The worker's identity (`iss`) is its full serving URL (base path included,
-    // trailing slash stripped) — decoupled from the addressing `origin` slug. One
-    // canonical value drives outbound signing, the JWKS issuer, `/meta`, and the
-    // install credential. Must equal the URL the kernel fetched the domain at.
+    // Canonical serving URL drives signing, JWKS, /meta, and install credentials.
     const iss = canonicalizeServingUrl(config.url);
-    // Re-materialize the domain with the real serving url (`iss`) so the aux
-    // View/Function `binding.remoteUrl` resolve to this host — the define-time
-    // placeholder is discarded. `compiled`/`auxiliary` drive everything below;
-    // `iss` is the single source for both bindings and identity.
+    // Stamp aux bindings against the same URL used as issuer.
     const { compiled, auxiliary } = materializeRemoteDomain(config.domain, iss);
     const dispatcher = new SdkDispatcher({
         compiled,
         methods,
+        // The source schema drives the rich typed `self` handed to non-static
+        // handlers (`self.node()` → BoundNode<D>, typed `self.call`).
+        schema: compiled.$.schema,
         deps: config.deps,
         privateKey: config.privateKey,
         issuer: iss,
@@ -57,12 +41,7 @@ export function createRemoteServer(config) {
         issuer: iss,
         loadOwnKeys: async () => [publicJwk],
     };
-    // `/meta`'s `schemaHash` is computed from the LIVE domain graph (lazy +
-    // cached). `hashInstallGraph` is id-independent/deterministic, so an
-    // independent build (a deploy script) produces the SAME hash — `deployCheck`
-    // can compare its expected value against this and detect genuine schema drift.
-    // An explicit `config.meta.schemaHash` still wins as an override for
-    // offline/pinned spec producers, but normal deploys omit it.
+    // Normal /meta schemaHash is the deterministic install-graph hash; explicit overrides win.
     let cachedSchemaHash = null;
     const resolveSchemaHash = () => config.meta?.schemaHash !== undefined
         ? Promise.resolve(config.meta.schemaHash)
@@ -74,6 +53,7 @@ export function createRemoteServer(config) {
         iss,
         sdkCommit: config.meta?.sdkCommit,
         domainName: config.meta?.domainName ?? compiled.$.origin,
+        ...(config.domain.manifest ? { manifest: config.domain.manifest } : {}),
     };
     hostApp.get('/meta', async (c) => c.json(MetaSchema.parse({ ...metaBase, schemaHash: await resolveSchemaHash() })));
     hostApp.post('/_astrale/install-domain', async (c) => {
@@ -94,23 +74,16 @@ export function createRemoteServer(config) {
         catch (err) {
             return c.json({ error: 'Install denied', message: err.message }, 403);
         }
-        // Build the install graph. `buildInstallGraph` re-materializes the domain
-        // with the serving url (`iss`), so every `binding.remoteUrl` points at this
-        // host — the same single value as the credential's `iss` below. The kernel
-        // hashes exactly this graph; no install-time rewrite.
+        // The signed graph is built for this serving URL; the kernel verifies it as-is.
         const graph = buildInstallGraph(config.domain, iss);
         const graphHash = await hashInstallGraph(graph);
         const origin = compiled.$.origin;
-        // `postInstall` + `requires` ride in BOTH the signed credential claims and
-        // the bundle body, and the kernel rejects any bundle field that disagrees
-        // with its signed claim — so derive them once and reuse for both.
+        // Signed claims and bundle fields must agree exactly.
         const bundleExtras = {
             ...(config.postInstall ? { postInstall: config.postInstall } : {}),
             ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
         };
-        // The credential's `iss` is the worker's serving URL (`iss`, computed above)
-        // — the kernel pins it to the URL it fetched the domain at and verifies this
-        // credential against that issuer's JWKS.
+        // Install credential issuer is the serving URL the kernel fetched.
         const credential = await signInstallCredential({
             privateKey: config.privateKey,
             issuer: iss,
@@ -130,12 +103,7 @@ export function createRemoteServer(config) {
     // Resolved once and shared between the kernel envelope (createKernelApp) and
     // the aux routes (mountAuxiliaryRoutes) so both honor the same policy.
     const cors = config.cors ?? { origin: '*' };
-    // Worker-side wires for defineView / defineRemoteFunction. Mounted before
-    // the kernel catch-all. Each aux route gets its own per-slug identity
-    // (issuer + key + the aux node's AbsolutePath as subject) so outbound
-    // `kernel.call(...)` from a handler signs with that path — matching the
-    // identity the install-time `subs` claim registered for the node, the
-    // same way Methods work.
+    // Aux routes mount before the kernel catch-all and sign with their member subjects.
     if (auxiliary) {
         const auxIdentities = buildAuxIdentityMap(compiled, config.privateKey, iss);
         mountAuxiliaryRoutes({
@@ -164,10 +132,7 @@ export function createRemoteServer(config) {
     });
     return {
         app,
-        // The canonical serving URL = the worker's `iss` identity. Exposed so a
-        // worker that also seeds `Identity.iss` on graph nodes (e.g. recruitment's
-        // self-seed) stamps the SAME canonical value the dispatcher signs with —
-        // never the raw env.WORKER_URL — so the kernel's exact-match lookup resolves.
+        // Expose the canonical issuer, not the raw env URL, for graph identity stamping.
         iss,
         async start(port) {
             const nodeStartModule = './start';
@@ -190,8 +155,7 @@ async function signInstallCredential(args) {
     const kid = args.privateKey.kid;
     const header = typeof kid === 'string' ? { alg, kid } : { alg };
     const key = await importJWK(args.privateKey, alg);
-    // `postInstall` + `requires` are signed (not just carried in the bundle) so a
-    // MITM can't retarget the system-authority hook or forge dependencies
+    // postInstall/requires are signed, not just copied into the bundle.
     return new SignJWT({
         subs: args.subs,
         nonce: args.nonce,

package/dist/server/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,UAAU,kBAAkB,CAAQ,MAAiC;IACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE9C,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE3E,MAAM,UAAU,GAAG,IAAI,aAAa,CAAQ;QAC1C,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,GAAG;QACX,sEAAsE;QACtE,2EAA2E;QAC3E,GAAG,EAAE,GAAG;KACT,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAa;QACrB,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;KACrC,CAAA;IAED,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,gBAAgB,GAA2B,IAAI,CAAA;IACnD,MAAM,iBAAiB,GAAG,GAAoB,EAAE,CAC9C,MAAM,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAEtE,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,MAAM,QAAQ,GAAG;QACf,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS;QACjC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM;KACzD,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC,CAAC,CACjF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QAChC,2EAA2E;QAC3E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAA;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,yCAAyC;QACzC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;YAClC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,SAAS;YACT,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACnC,GAAG,YAAY;SAChB,CAAC,CAAA;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,KAAK;YACL,QAAQ,EAAE,EAAE,UAAU,EAAE;YACxB,GAAG,YAAY;SAChB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAE3C,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,yBAAyB;IACzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC3E,oBAAoB,CAAQ;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,2CAA2C;YAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAmD;YACxE,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe;YAC9C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,aAAa;YACzB,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC;QAC9B,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAChD,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QACzB,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,OAAO;QACZ,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,GAAG;QACH,KAAK,CAAC,KAAK,CAAC,IAAa;YACvB,MAAM,eAAe,GAAG,SAAS,CAAA;YACjC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;YACzD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IASpC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CACrG,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAI,IAAI,CAAC,UAAiD,CAAC,GAAG,CAAA;IACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,8EAA8E;IAC9E,sEAAsE;IACtE,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;SACC,kBAAkB,CAAC,MAAM,CAAC;SAC1B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC1B,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,UAAU,kBAAkB,CAAQ,MAAiC;IACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE9C,0DAA0D;IAC1D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE3E,MAAM,UAAU,GAAG,IAAI,aAAa,CAAQ;QAC1C,QAAQ;QACR,OAAO;QACP,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,GAAG;QACX,sEAAsE;QACtE,2EAA2E;QAC3E,GAAG,EAAE,GAAG;KACT,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAa;QACrB,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;KACrC,CAAA;IAED,2FAA2F;IAC3F,IAAI,gBAAgB,GAA2B,IAAI,CAAA;IACnD,MAAM,iBAAiB,GAAG,GAAoB,EAAE,CAC9C,MAAM,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAEtE,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,MAAM,QAAQ,GAAG;QACf,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS;QACjC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM;QACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC,CAAC,CACjF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,gFAAgF;QAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QAChC,sDAAsD;QACtD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAA;QACD,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;YAClC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,SAAS;YACT,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACnC,GAAG,YAAY;SAChB,CAAC,CAAA;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,KAAK;YACL,QAAQ,EAAE,EAAE,UAAU,EAAE;YACxB,GAAG,YAAY;SAChB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAE3C,oFAAoF;IACpF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC3E,oBAAoB,CAAQ;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,2CAA2C;YAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAmD;YACxE,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe;YAC9C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,aAAa;YACzB,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC;QAC9B,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAChD,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QACzB,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,OAAO;QACZ,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,iFAAiF;QACjF,GAAG;QACH,KAAK,CAAC,KAAK,CAAC,IAAa;YACvB,MAAM,eAAe,GAAG,SAAS,CAAA;YACjC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;YACzD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IASpC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CACrG,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAI,IAAI,CAAC,UAAiD,CAAC,GAAG,CAAA;IACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,oEAAoE;IACpE,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;SACC,kBAAkB,CAAC,MAAM,CAAC;SAC1B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC1B,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/server/domain-entry.d.ts

@@ -16,6 +16,7 @@
  */
 import type { Core, Schema } from '@astrale-os/kernel-dsl';
 import type { Hono } from 'hono';
+import type { DomainManifest } from '../config/define-domain';
 import type { AnyRemoteFunctionDef, ViewDef } from '../define';
 import type { SchemaMethodsImpl } from '../method';
 import type { RemoteServerConfig } from './config';
@@ -40,8 +41,17 @@ export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
     requires?: readonly string[];
     /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
     postInstall?: string;
+    /**
+     * Physical tree path for the Domain node (absolute, e.g. `/domains/acme`);
+     * default `/domains/<origin>`. Rides in on the `...domain` spread from
+     * `defineDomain`; declared here so it is captured (not silently dropped like a
+     * spread prop absent from this type) and forwarded to `defineRemoteDomain`.
+     */
+    path?: string;
     /** Provenance stamped on `/meta`. */
     meta?: RemoteServerConfig<TDeps>['meta'];
+    /** Presentation metadata (logo / initial view) stamped on `/meta`. */
+    manifest?: DomainManifest;
     /**
      * Map the worker `env` to the handler dependency container. Defaults to
      * passing `env` straight through (the common case where handlers read

package/dist/server/domain-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAKpE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAExC;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAiCrB"}
+{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAKpE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IACxC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAmCrB"}

package/dist/server/domain-entry.js

@@ -31,6 +31,8 @@ export function domainWorkerEntry() {
             ...(config.core ? { core: config.core } : {}),
             ...(config.views ? { views: config.views } : {}),
             ...(config.functions ? { remoteFunctions: config.functions } : {}),
+            ...(config.manifest ? { manifest: config.manifest } : {}),
+            ...(config.path ? { path: config.path } : {}),
         });
         return createWorkerEntry({
             ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),

package/dist/server/domain-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AA2ClD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAoDlD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -8,6 +8,5 @@ export { assets, createWorkerEntry } from './worker-entry';
 export type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
 export { domainWorkerEntry } from './domain-entry';
 export type { DomainWorkerEntryConfig } from './domain-entry';
-export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/index.js

@@ -4,6 +4,5 @@ export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
 export { assets, createWorkerEntry } from './worker-entry';
 export { domainWorkerEntry } from './domain-entry';
-export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/worker-entry.d.ts

@@ -127,9 +127,9 @@ export interface WorkerEntry<TDeps> {
 export declare function clientOrigin(url: URL, request: Request): string;
 /**
  * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
- * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
- * domain's `client` binding. Returns `undefined` for non-matching paths (and
- * when no binding is present) so the request falls through to domain dispatch.
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of an
+ * adapter env's client-asset config. Returns `undefined` for non-matching paths
+ * (and when no binding is present) so the request falls through to domain dispatch.
  *
  * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
  * this hook strips that prefix before delegating to the binding, so

package/dist/server/worker-entry.js

@@ -82,9 +82,9 @@ export function clientOrigin(url, request) {
 }
 /**
  * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
- * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
- * domain's `client` binding. Returns `undefined` for non-matching paths (and
- * when no binding is present) so the request falls through to domain dispatch.
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of an
+ * adapter env's client-asset config. Returns `undefined` for non-matching paths
+ * (and when no binding is present) so the request falls through to domain dispatch.
  *
  * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
  * this hook strips that prefix before delegating to the binding, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.1.10",
+  "version": "0.3.0",
   "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
   "keywords": [
     "astrale",
@@ -9,7 +9,7 @@
     "remote",
     "sdk"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "Astrale",
   "repository": {
     "type": "git",
@@ -47,13 +47,10 @@
       "import": "./dist/deploy/index.js"
     }
   },
-  "publishConfig": {
-    "registry": "https://npm.pkg.github.com"
-  },
   "dependencies": {
-    "@astrale-os/kernel-api": ">=0.4.5 <1.0.0",
-    "@astrale-os/kernel-client": ">=0.2.2 <1.0.0",
-    "@astrale-os/kernel-core": ">=0.4.3 <1.0.0",
+    "@astrale-os/kernel-api": ">=0.4.7 <1.0.0",
+    "@astrale-os/kernel-client": ">=0.3.0 <1.0.0",
+    "@astrale-os/kernel-core": ">=0.6.2 <1.0.0",
     "@astrale-os/kernel-dsl": ">=0.1.2 <1.0.0",
     "@astrale-os/kernel-server": ">=0.4.0 <1.0.0",
     "hono": "^4.6.20",
@@ -61,8 +58,9 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@astrale-os/kernel-test": ">=0.1.0 <1.0.0",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.0",
+    "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@commitlint/cli": "~20.3.1",
     "@commitlint/config-conventional": "~20.3.1",
@@ -71,7 +69,7 @@
     "@typescript/native-preview": "latest",
     "husky": "~9.1.7",
     "lint-staged": "~16.2.7",
-    "oxfmt": "latest",
+    "oxfmt": "0.52.0",
     "oxlint": "latest",
     "typescript": "~6.0.1-rc",
     "vitest": "^3.0.0"
@@ -99,7 +97,8 @@
   "scripts": {
     "preinstall": "node -e \"try{require('./.check-workspace.cjs')}catch{}\"",
     "build": "tsgo",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsgo --noEmit && pnpm run typecheck:types",
+    "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "test": "vitest run --config __tests__/vitest.config.ts",
     "test:watch": "vitest --config __tests__/vitest.config.ts",
     "lint": "oxlint .",

package/src/auth/check.ts

@@ -36,8 +36,7 @@ export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core'
  * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
  * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
  *
- * Implementation: calls `@<principal>::checkPerm` on the kernel (the
- * `checkPerm` syscall lives on the Identity, not the target). Cheap; adds
+ * Implementation: delegates to the bound session's AuthApi. Cheap; adds
  * one round-trip to the dispatch path.
  */
 export async function assertPerm(
@@ -52,10 +51,7 @@ export async function assertPerm(
   if (!principal) {
     throw new AuthorizationDeniedError('No authenticated principal')
   }
-  const ok = (await kernel.call(`@${principal}::checkPerm`, {
-    node: target,
-    perms: requiredBits,
-  })) as boolean
+  const ok = await kernel.auth.check({ who: principal, on: target, perms: requiredBits })
   if (!ok) {
     throw new AuthorizationDeniedError(
       `Permission denied on "${target}" — required bits=${requiredBits} for principal "${principal}"`,

package/src/auth/index.ts

@@ -6,6 +6,8 @@ export { resolveInboundAuth, buildAuthContext, type ResolvedAuth } from './resol
 export { verifyInboundCredential } from './verify'
 export { buildComposedGrant } from './compose'
 export { signCredential } from './sign'
-export { bindKernel } from './kernel-client'
+export { makeIssuerMint } from './issuer-mint'
+export type { DomainIssuer, MintIssuedParams } from './issuer-mint'
+export { bindKernel, bindSelfKernel, makeSelfKernel } from './kernel-client'
 export { AuthMissingError, AuthInvalidError } from './errors'
 export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './check'

package/src/auth/issuer-mint.ts

@@ -0,0 +1,75 @@
+/**
+ * `DomainIssuer` — the worker-side mint seam for identities THIS DOMAIN issues.
+ *
+ * A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
+ * credential signed with the worker's key back to the graph node carrying that
+ * identity. That makes the worker the natural authority for the principals it
+ * materializes — an App identity a workspace installs, a per-domain role
+ * umbrella, a managed user. `mint` signs such a credential (optionally carrying
+ * a `grant` claim with an unresolved identity expression); `sessionFor` opens a
+ * kernel session presenting it, so the worker can ACT AS an identity it issues
+ * (e.g. call `@<role>::mintDelegationCredential` as the role to obtain a
+ * kernel-issued delegation inner).
+ *
+ * Scope guard: this signs under the WORKER'S OWN issuer only — it cannot forge
+ * another issuer's identities. The kernel still enforces everything downstream
+ * (trust of the issuer, `frozen`, grant resolution, nested-credential rules).
+ */
+
+import type { FnMap } from '@astrale-os/kernel-client'
+import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
+import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core'
+
+import { createUnresolvedGrant } from '@astrale-os/kernel-core'
+
+import type { RemoteIdentityConfig } from './identity'
+
+import { bindCredentialSession } from './kernel-client'
+import { signCredential } from './sign'
+
+export type MintIssuedParams = {
+  /** The issued identity's `sub` — must match the graph node's stored subject. */
+  subject: string
+  /** The credential's audience — the kernel (or worker) it will be presented to. */
+  audience: string
+  /**
+   * Optional `grant` claim: the identity expression the credential's holder may
+   * act as (wrapped `{v:1, expr}`). Omit for a plain self-authenticating
+   * credential — the kernel falls back to a self-grant for externally-issued
+   * credentials. Nested `credential` leaves MUST be kernel-issued delegation
+   * inners (the kernel refuses non-kernel nested credentials).
+   */
+  grant?: UnresolvedIdentityExpr
+  /** JWT lifetime, jose-style (`'60s'`, `'5m'`, `'1h'`). Default `'1h'`. */
+  ttl?: string
+}
+
+export type DomainIssuer = {
+  /** The issuer (`iss`) this worker signs under — what issued identities store. */
+  readonly iss: string
+  /** Sign a credential AS an identity this domain issues. */
+  mint(params: MintIssuedParams): Promise<string>
+  /**
+   * A kernel session presenting a pre-signed credential (typically from
+   * {@link DomainIssuer.mint} with `audience = kernelUrl`). Direct calls only —
+   * no delegation mint is wired, so redirect-following to other workers is not
+   * available on this session.
+   */
+  sessionFor(kernelUrl: string, credential: string): BoundClientSessionView<FnMap>
+}
+
+/** Build the `DomainIssuer` for one worker identity config. */
+export function makeIssuerMint(identity: RemoteIdentityConfig): DomainIssuer {
+  return {
+    iss: identity.issuer,
+    mint: ({ subject, audience, grant, ttl }) =>
+      signCredential(grant !== undefined ? { grant: createUnresolvedGrant(grant) } : {}, {
+        issuer: identity.issuer,
+        subject,
+        audience,
+        privateKey: identity.privateKey,
+        ttl: ttl ?? '1h',
+      }),
+    sessionFor: (kernelUrl, credential) => bindCredentialSession(kernelUrl, credential),
+  }
+}