@astrale-os/sdk 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -1,14 +1,18 @@
-export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext, RemoteHandler, MethodImpl, ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl, } from './method';
+export type { MethodParams, MethodResult, AuthForPolicy, GraphApi, Kernel, KernelForAuth, RemoteContext, RemoteHandler, MethodImpl, ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl, } from './method';
 export { remoteMethod, remoteClassMethods, remoteInterfaceMethods } from './method';
 export { defineDomain, deploy, defineAdapter } from './config';
-export type { DefineDomainConfig, DomainDefinition, DeployConfig, AdapterSpec, DeployCtx, DeployResult, DomainAdapter, DomainInfo, WatchCtx, WatchHandle, } from './config';
+export type { DefineDomainConfig, DomainDefinition, DomainManifest, DeployConfig, AdapterSpec, DeployCtx, DeployResult, DomainAdapter, DomainInfo, WatchCtx, WatchHandle, } from './config';
 export { buildInstallGraph, buildInstallGraphHash } from './domain';
+export { AbsolutePath, Patch, Path } from '@astrale-os/kernel-core';
+export { ClassPath } from '@astrale-os/kernel-core/domain';
+export type { EdgeCreate, EdgeDelete, EdgeMatcher, EdgeUpdate, NodeCreate, NodeDelete, NodeUpdate, PatchData, } from '@astrale-os/kernel-core';
 export { defineView, defineRemoteFunction } from './define';
 export type { ViewDef, ViewRenderContext, RemoteFunctionDef, RemoteFunctionContext } from './define';
 export { MetaSchema } from './deploy/meta';
 export type { Meta } from './deploy/meta';
 export type { AuthPolicy, RouteBinding, FunctionBinding, CredentialSource, SingleCredentialSource, HttpMethod, RouteBody, OutputMode, } from '@astrale-os/kernel-api/routed';
 export type { RemoteIdentityConfig, AuthenticateResult } from './auth';
+export type { DomainIssuer, MintIssuedParams } from './auth';
 export { authenticateRequest, bindSelfKernel, buildComposedGrant, makeSelfKernel, signCredential, } from './auth';
 export { AuthMissingError, AuthInvalidError } from './auth';
 export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './auth';
@@ -16,5 +20,5 @@ export type { AuthContext, Attestation, Authenticated, Delegation, IdentityId, I
 export { selfGrant } from '@astrale-os/kernel-core';
 export { SdkDispatcher, type SdkDispatcherConfig } from './dispatch';
 export { AuthorizationDeniedError, MethodNotFoundError, SdkValidationError, SdkResultValidationError, } from './dispatch';
-export type { SelfResult, CallRemoteFn, KernelCaller } from './dispatch';
+export type { SelfResult, TypedSelf, CallRemoteFn, KernelCaller } from './dispatch';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,aAAa,EACb,MAAM,EACN,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAOnF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC9D,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAUnE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC3D,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAcpG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAGzC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,+BAA+B,CAAA;AAGtC,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAA;AACtE,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,QAAQ,CAAA;AACf,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAClF,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,MAAM,EACN,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAOnF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC9D,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAQnE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAC1D,YAAY,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,yBAAyB,CAAA;AAUhC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC3D,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAcpG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAGzC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,+BAA+B,CAAA;AAGtC,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAA;AACtE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC5D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,QAAQ,CAAA;AACf,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAClF,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -7,6 +7,14 @@ export { remoteMethod, remoteClassMethods, remoteInterfaceMethods } from './meth
 export { defineDomain, deploy, defineAdapter } from './config';
 // ─── Install graph (advanced) ────────────────────────────────────────────
 export { buildInstallGraph, buildInstallGraphHash } from './domain';
+// ─── Graph patching (advanced) ────────────────────────────────────────
+// Author-facing patch types, re-exported from kernel-core (the single source).
+// Build a `Patch` and feed it straight to `ctx.kernel.mutate(patch)` (it implements
+// `PatchData`); the graph sugar itself lives in `@astrale-os/kernel-client/graph`,
+// flattened onto `ctx.kernel`, and `function.mutate` validates every patch kernel-side
+// against kernel-core's `patchDataSchema` — no client-side re-validation needed.
+export { AbsolutePath, Patch, Path } from '@astrale-os/kernel-core';
+export { ClassPath } from '@astrale-os/kernel-core/domain';
 // ─── Declarative resource helpers ────────────────────────────────────────
 // Author Views (iframe-mountable) and RemoteFunctions (standalone callables)
 // at the domain definition site. Each `defineView` / `defineRemoteFunction`
@@ -23,10 +31,10 @@ export { defineView, defineRemoteFunction } from './define';
 // chunk — which fails on Node built-ins. Consumers that need the server
 // runtime import from '@astrale-os/sdk/server' directly.
 // ─── Deploy ──────────────────────────────────────────────────────────────
-// `deployCheck` and `hashSpecFile` use Node-only modules (`node:crypto`,
-// `node:fs`, `node:child_process`) at module load time. Exporting them from
-// the barrel poisons browser bundlers (Vite/esbuild) that transitively load
-// every re-export. Consumers that need them import from './deploy' directly.
+// `deployCheck` uses Node-only modules (`node:path`, `node:child_process`) at
+// module load time. Exporting it from the barrel poisons browser bundlers
+// (Vite/esbuild) that transitively load every re-export. Consumers that need it
+// import from './deploy' directly.
 export { MetaSchema } from './deploy/meta';
 export { authenticateRequest, bindSelfKernel, buildComposedGrant, makeSelfKernel, signCredential, } from './auth';
 export { AuthMissingError, AuthInvalidError } from './auth';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAEnF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAc9D,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEnE,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,wBAAwB;AACxB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAG3D,4EAA4E;AAC5E,qFAAqF;AACrF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,yDAAyD;AAEzD,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAiB1C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,QAAQ,CAAA;AACf,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AASlF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAEnF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAe9D,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEnE,yEAAyE;AACzE,+EAA+E;AAC/E,oFAAoF;AACpF,mFAAmF;AACnF,uFAAuF;AACvF,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAY1D,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,wBAAwB;AACxB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAG3D,4EAA4E;AAC5E,qFAAqF;AACrF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,yDAAyD;AAEzD,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,mCAAmC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAkB1C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,QAAQ,CAAA;AACf,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AASlF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA"}

package/dist/method/class.d.ts

@@ -13,7 +13,7 @@
  */
 import type { DefForInterface, InterfaceMethodDefs, InterfaceMethodKeys, MethodClassKeys, NonSealedMethodKeys, OwnMethodKeys, ResolveParams, ResolveReturn, SealedKeys } from '@astrale-os/kernel-core/domain';
 import type { ImplementableOwnKeys, Schema } from '@astrale-os/kernel-dsl';
-import type { SelfResult } from '../dispatch/self';
+import type { TypedSelf } from '../dispatch/self';
 import type { MethodImpl, RemoteHandler } from './single';
 /** Per-class method implementations for a remote domain. */
 export type ClassMethodsImpl<S extends Schema, K extends MethodClassKeys<S> & string, TDeps = unknown> = {
@@ -28,7 +28,7 @@ type InterfaceMethodHandler<S extends Schema, K extends string, M extends string
     readonly config: infer MC;
 } ? MC extends {
     readonly static: true;
-} ? RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, undefined, TDeps> : RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, SelfResult, TDeps> : never : never;
+} ? RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, undefined, TDeps> : RemoteHandler<ResolveParams<MC>, ResolveReturn<MC>, TypedSelf<DefForInterface<S, K>, S>, TDeps> : never : never;
 /** Per-interface method implementations. */
 export type InterfaceMethodsImpl<S extends Schema, K extends InterfaceMethodKeys<S> & string, TDeps = unknown> = {
     [M in ImplementableOwnKeys<DefForInterface<S, K>> & string]: InterfaceMethodHandler<S, K, M, TDeps>;

package/dist/method/class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"class.d.ts","sourceRoot":"","sources":["../../src/method/class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACX,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzD,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,KAAK,GAAG,OAAO,IACb;KACD,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;CACvD,GAAG;KACD,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;CAC7D,GAAG;KACD,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK;CAChC,CAAA;AAED,oFAAoF;AACpF,KAAK,sBAAsB,CACzB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,MAAM,EAChB,KAAK,IACH,CAAC,SAAS,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GACzC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAChE,EAAE,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GAClC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAMrE,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GACxE,KAAK,GACP,KAAK,CAAA;AAET,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,CAC9B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,KAAK,GAAG,OAAO,IACb;KACD,CAAC,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,sBAAsB,CACjF,CAAC,EACD,CAAC,EACD,CAAC,EACD,KAAK,CACN;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,GAAG,OAAO,IAAI;IACjE,KAAK,EAAE;SAAG,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;KAAE,CAAA;IAC5E,SAAS,CAAC,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;KAAE,CAAA;CAC1F,CAAA;AAED,KAAK,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,IAAI,MAAM,CAAC,GACpE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAC5B,CAAC,GACD,2DAA2D,CAAC,MAAM,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAAA;AAE3G,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,KAAK,CAC3C,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAEvC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,IAAI,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAChC,CAAC,CAAA;AACN,wBAAgB,kBAAkB,CAChC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAChC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;AASlE;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,KAAK,CAC/C,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,CAAC,SAAS,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAE3C,MAAM,EAAE,CAAC,EACT,aAAa,EAAE,CAAC,EAChB,IAAI,EAAE,CAAC,KACJ,CAAC,CAAA;AACN,wBAAgB,sBAAsB,CACpC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,CAAC,SAAS,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,EACpC,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA"}
+{"version":3,"file":"class.d.ts","sourceRoot":"","sources":["../../src/method/class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACX,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAE1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzD,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,KAAK,GAAG,OAAO,IACb;KACD,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;CACvD,GAAG;KACD,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;CAC7D,GAAG;KACD,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK;CAChC,CAAA;AAED,oFAAoF;AACpF,KAAK,sBAAsB,CACzB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,MAAM,EAChB,KAAK,IACH,CAAC,SAAS,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GACzC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAChE,EAAE,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GAClC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAKrE,aAAa,CACX,aAAa,CAAC,EAAE,CAAC,EACjB,aAAa,CAAC,EAAE,CAAC,EACjB,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EACnC,KAAK,CACN,GACH,KAAK,GACP,KAAK,CAAA;AAET,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,CAC9B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,KAAK,GAAG,OAAO,IACb;KACD,CAAC,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,sBAAsB,CACjF,CAAC,EACD,CAAC,EACD,CAAC,EACD,KAAK,CACN;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,GAAG,OAAO,IAAI;IACjE,KAAK,EAAE;SAAG,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;KAAE,CAAA;IAC5E,SAAS,CAAC,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;KAAE,CAAA;CAC1F,CAAA;AAED,KAAK,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,IAAI,MAAM,CAAC,GACpE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAC5B,CAAC,GACD,2DAA2D,CAAC,MAAM,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAAA;AAE3G,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,KAAK,CAC3C,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAEvC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,IAAI,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAChC,CAAC,CAAA;AACN,wBAAgB,kBAAkB,CAChC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EAChC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;AASlE;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,KAAK,CAC/C,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,CAAC,SAAS,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAE3C,MAAM,EAAE,CAAC,EACT,aAAa,EAAE,CAAC,EAChB,IAAI,EAAE,CAAC,KACJ,CAAC,CAAA;AACN,wBAAgB,sBAAsB,CACpC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,EACzC,CAAC,SAAS,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,EACpC,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA"}

package/dist/method/class.js.map

@@ -1 +1 @@
-{"version":3,"file":"class.js","sourceRoot":"","sources":["../../src/method/class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkGH,MAAM,UAAU,kBAAkB,CAAC,GAAG,IAAe;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC;AA0BD,MAAM,UAAU,sBAAsB,CAAC,GAAG,IAAe;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}
+{"version":3,"file":"class.js","sourceRoot":"","sources":["../../src/method/class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAsGH,MAAM,UAAU,kBAAkB,CAAC,GAAG,IAAe;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC;AA0BD,MAAM,UAAU,sBAAsB,CAAC,GAAG,IAAe;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}

package/dist/method/context.d.ts

@@ -10,7 +10,9 @@ import type { AuthPolicy } from '@astrale-os/kernel-api/routed';
 import type { FnMap } from '@astrale-os/kernel-client';
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
 import type { AuthContext } from '@astrale-os/kernel-core';
+import type { DomainIssuer } from '../auth/issuer-mint';
 import type { CallRemoteFn } from '../dispatch/call-remote';
+export type { GraphApi } from '@astrale-os/kernel-client/graph';
 /**
  * The kernel session a handler holds: a credential-bound view over the parent
  * kernel — the FULL dispatch surface (`call`/`stream`/`binary`/`signal`,
@@ -60,11 +62,24 @@ export type RemoteContext<TParams, TSelf, TDeps, TKernel = Kernel | null, TAuth
      * credential `union(delegation, self)`. Its nullability is `{@link
      * KernelForAuth}` of the method's `auth`: non-null for the default
      * `'required'`, `… | null` for `'optional'`, `null` for `'public'`. Use for
-     * kernel syscalls + same-domain methods. For ANOTHER worker's remote method
-     * use {@link RemoteContext.callRemote} — `kernel.call` to a remote method
-     * fails the audience check.
+     * kernel syscalls + same-domain methods, and for the typed graph read/write
+     * sugar flattened onto it (`kernel.get` / `kernel.children` / `kernel.query`,
+     * plus `kernel.createNode` / `kernel.updateNode` /
+     * `kernel.deleteNode` / `kernel.createEdge` / `kernel.updateEdge` /
+     * `kernel.deleteEdge` / `kernel.mutate(patch)`) over the `function.get` /
+     * `function.mutate` syscalls. For ANOTHER worker's remote method use
+     * {@link RemoteContext.callRemote} — `kernel.call` to a remote method fails the
+     * audience check.
      */
     kernel: TKernel;
+    /**
+     * Mint seam for identities THIS DOMAIN issues (`iss` = this worker): sign a
+     * credential for a domain-owned principal (an App identity, a role umbrella,
+     * a managed user) and optionally open a kernel session AS it. See
+     * {@link DomainIssuer}. The kernel enforces trust/frozen/grant rules — this
+     * only signs under the worker's own issuer.
+     */
+    issuer: DomainIssuer;
     /**
      * Call another worker's remote method (a Function with `binding.remoteUrl`),
      * re-minting the credential for the target's audience so it isn't rejected at

package/dist/method/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/method/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,MAAM,GAAG,IAAI,GACb,MAAM,CAAA;AAEZ;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,WAAW,GAAG,IAAI,GAClB,WAAW,CAAA;AAEjB,MAAM,MAAM,aAAa,CACvB,OAAO,EACP,KAAK,EACL,KAAK,EACL,OAAO,GAAG,MAAM,GAAG,IAAI,EACvB,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,KAAK,CAAA;IACX,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;;OAQG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;;;OAOG;IACH,UAAU,EAAE,YAAY,CAAA;CACzB,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/method/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D,YAAY,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,MAAM,GAAG,IAAI,GACb,MAAM,CAAA;AAEZ;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,WAAW,GAAG,IAAI,GAClB,WAAW,CAAA;AAEjB,MAAM,MAAM,aAAa,CACvB,OAAO,EACP,KAAK,EACL,KAAK,EACL,OAAO,GAAG,MAAM,GAAG,IAAI,EACvB,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,KAAK,CAAA;IACX,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;;OAMG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;;;;OAOG;IACH,UAAU,EAAE,YAAY,CAAA;CACzB,CAAA"}

package/dist/method/index.d.ts

@@ -1,5 +1,5 @@
-export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext } from './context';
-export type { RemoteHandler, AnyRemoteHandler, MethodImpl } from './single';
+export type { AuthForPolicy, GraphApi, Kernel, KernelForAuth, RemoteContext } from './context';
+export type { RemoteHandler, AnyRemoteHandler, MethodImpl, MethodParams, MethodResult, } from './single';
 export { remoteMethod } from './single';
 export type { ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl } from './class';
 export { remoteClassMethods, remoteInterfaceMethods } from './class';

package/dist/method/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACpF,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9F,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}

package/dist/method/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}

package/dist/method/single.d.ts

@@ -1,31 +1,12 @@
-/**
- * Authoring a single remote method.
- *
- * `RemoteHandler` is the typed shape an author writes for ONE method:
- * an `execute` body plus optional REST `route` (using the kernel's
- * canonical `RouteBinding`) and optional anchor `remoteUrl`.
- *
- * `MethodImpl` resolves params/result/self from a schema for a given
- * `(class, method)` pair. `remoteMethod` is the identity helper an author
- * calls per method to get full inference without writing generics by hand.
- */
+/** Authoring helpers for one schema-bound remote method. */
 import type { AuthPolicy, RouteBinding } from '@astrale-os/kernel-api/routed';
 import type { MethodClassKeys, ClassMethodConfig, NonSealedMethodKeys, OwnMethodKeys } from '@astrale-os/kernel-core/domain';
 import type { Schema } from '@astrale-os/kernel-dsl';
-import type { SelfResult } from '../dispatch/self';
+import type { TypedSelf } from '../dispatch/self';
 import type { KernelForAuth, RemoteContext } from './context';
 /**
- * Remote function handler — execute with full typed context.
- *
- * `execute` is **optional** at the type level: a handler may be a pure
- * binding stub (only `remoteUrl` / `route` set) when authored as a spec-side
- * declaration that never runs locally — the kernel resolver short-circuits
- * via `binding.remoteUrl` before reaching the handler body. The worker-side
- * declaration that actually serves the call MUST provide `execute`.
- *
- * Runtime guard: if dispatch routes to a handler that has no `execute`, the
- * dispatcher throws — that's a programmer error indicating a stub leaked into
- * a code path that was supposed to execute it.
+ * Remote method handler. `execute` is optional only for binding stubs; any
+ * handler that the dispatcher actually reaches must provide it.
  */
 export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPolicy = 'required'> = {
     /** The handler body. May be async or an async generator (for `output: 'stream'`). */
@@ -52,22 +33,22 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPoli
      */
     auth?: TAuth;
     /**
-     * Optional pre-execute authorization check. Runs after auth resolution and
-     * `_self` resolution, before `execute`. Throw any error to deny the call —
-     * the SDK wraps it as `AuthorizationDeniedError` (mapped to wire-level
-     * `PERMISSION_DENIED`).
-     *
-     * Use for fine-grained checks the kernel's bit-level perms can't express
-     * (e.g. "only the project lead can addMember"). For straight bit-level
-     * checks, prefer the helpers in `@astrale-os/sdk` (`assertPerm`,
-     * `requireOwnership`).
-     *
-     * The kernel still enforces `has_perm` independently — `authorize` is
-     * additive ergonomic gating on top, not a replacement.
+     * Optional business authorization after auth/_self resolution. Kernel
+     * has_perm checks remain authoritative; this is additive gating.
      */
     authorize?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>, TAuth>) => void | Promise<void>;
 };
-export type AnyRemoteHandler = RemoteHandler<any, any, any, any, AuthPolicy>;
+export type AnyRemoteHandler = Omit<RemoteHandler<any, any, any, any, AuthPolicy>, 'authorize' | 'execute'> & {
+    execute?: (ctx: any) => any;
+    authorize?: (ctx: any) => void | Promise<void>;
+};
+type _AssertTrueH<T extends true> = T;
+type _HandlerFitsBag<D> = D extends AnyRemoteHandler ? true : false;
+export type _MethodPolicyBagGuards = [
+    _AssertTrueH<_HandlerFitsBag<RemoteHandler<unknown, unknown, unknown, unknown, 'public'>>>,
+    _AssertTrueH<_HandlerFitsBag<RemoteHandler<unknown, unknown, unknown, unknown, 'optional'>>>,
+    _AssertTrueH<_HandlerFitsBag<RemoteHandler<unknown, unknown, unknown, unknown, 'required'>>>
+];
 /**
  * Fully typed method implementation — resolves params/result/self from the
  * schema, wraps in `RemoteHandler` with deps.
@@ -77,7 +58,14 @@ export type MethodImpl<S extends Schema, K extends MethodClassKeys<S> & string,
     result: infer R;
     self: unknown;
     isStatic: infer St;
-} ? RemoteHandler<P, R, St extends true ? undefined : SelfResult, TDeps, TAuth> : never;
+} ? RemoteHandler<P, R, St extends true ? undefined : TypedSelf<S['classes'][K], S>, TDeps, TAuth> : never;
+/**
+ * `MethodParams` / `MethodResult` — a handler types its `params` as
+ * `MethodParams<typeof schema, 'Def', 'method'>` and its return as
+ * `MethodResult<…>`, so it never re-declares (and can't drift from) the schema.
+ * Resolved from whichever def — CLASS or INTERFACE — declares the method.
+ */
+export type { MethodParams, MethodResult } from '@astrale-os/kernel-core/domain';
 type ImplementableMethodName<S extends Schema, K extends MethodClassKeys<S> & string> = (OwnMethodKeys<S, K> | NonSealedMethodKeys<S, K>) & string;
 /**
  * Identity helper for authoring one remote method with full schema-driven typing.
@@ -90,5 +78,4 @@ type ImplementableMethodName<S extends Schema, K extends MethodClassKeys<S> & st
  */
 export declare function remoteMethod<TDeps>(): <S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>, TAuth extends AuthPolicy = 'required'>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M, TDeps, TAuth>) => MethodImpl<S, K, M, TDeps, TAuth>;
 export declare function remoteMethod<S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>, TAuth extends AuthPolicy = 'required'>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M, unknown, TAuth>): MethodImpl<S, K, M, unknown, TAuth>;
-export {};
 //# sourceMappingURL=single.d.ts.map

package/dist/method/single.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACjG,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B,CAAA;AAOD,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IAErC,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAC3E,KAAK,CAAA;AAEX,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KACpC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACtC,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GACxC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA"}
+{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACjG,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;OAGG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B,CAAA;AAKD,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAC7C,WAAW,GAAG,SAAS,CACxB,GAAG;IACF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAA;IAC3B,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C,CAAA;AAID,KAAK,YAAY,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;AACrC,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAAG,IAAI,GAAG,KAAK,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5F,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;CAC7F,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IAErC,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAC9F,KAAK,CAAA;AAEX;;;;;GAKG;AACH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAEhF,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KACpC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACtC,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GACxC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA"}

package/dist/method/single.js

@@ -1,14 +1,4 @@
-/**
- * Authoring a single remote method.
- *
- * `RemoteHandler` is the typed shape an author writes for ONE method:
- * an `execute` body plus optional REST `route` (using the kernel's
- * canonical `RouteBinding`) and optional anchor `remoteUrl`.
- *
- * `MethodImpl` resolves params/result/self from a schema for a given
- * `(class, method)` pair. `remoteMethod` is the identity helper an author
- * calls per method to get full inference without writing generics by hand.
- */
+/** Authoring helpers for one schema-bound remote method. */
 export function remoteMethod(...args) {
     if (args.length === 0) {
         return (...innerArgs) => innerArgs[3];

package/dist/method/single.js.map

@@ -1 +1 @@
-{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwIH,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}
+{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA,4DAA4D;AA2I5D,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}

package/dist/server/auxiliary-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auxiliary-routes.d.ts","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAQzC,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAG7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAS1D,MAAM,MAAM,qBAAqB,CAAC,KAAK,IAAI;IACzC,GAAG,EAAE,IAAI,CAAA;IACT,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IACtD,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACxD,IAAI,EAAE,KAAK,CAAA;IACX;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAA;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,UAAU,CAAA;CACjB,CAAA;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,IAAI,CAiFtF"}
+{"version":3,"file":"auxiliary-routes.d.ts","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAQzC,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAG7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAU1D,MAAM,MAAM,qBAAqB,CAAC,KAAK,IAAI;IACzC,GAAG,EAAE,IAAI,CAAA;IACT,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IACtD,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACxD,IAAI,EAAE,KAAK,CAAA;IACX;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAA;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,UAAU,CAAA;CACjB,CAAA;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,IAAI,CA2FtF"}

package/dist/server/auxiliary-routes.js

@@ -14,6 +14,7 @@
 import { isKernelErrorClassifiable, KERNEL_ERROR_CODES, kernelErrorHttpStatus, } from '@astrale-os/kernel-api';
 import { isSubdomainOf, matchHost, compileHostMatcher, parseUrlTemplate, } from '@astrale-os/kernel-api/routed';
 import { buildCorsHeaders } from '@astrale-os/kernel-server';
+import { makeIssuerMint } from '../auth/issuer-mint';
 import { makeSelfKernel } from '../auth/kernel-client';
 import { resolveInboundAuth } from '../auth/resolve';
 import { runAuthorize } from '../dispatch/authorize';
@@ -76,7 +77,17 @@ export function mountAuxiliaryRoutes(config) {
                     if (!validation.ok) {
                         throw new SdkValidationError(validation.issues);
                     }
-                    const ctx = { params: validation.data, c, auth, deps, kernel, callRemote, selfKernel };
+                    const issuer = makeIssuerMint(identity);
+                    const ctx = {
+                        params: validation.data,
+                        c,
+                        auth,
+                        deps,
+                        kernel,
+                        issuer,
+                        callRemote,
+                        selfKernel,
+                    };
                     if (def.authorize)
                         await runAuthorize(def.authorize, ctx);
                     const result = await def.execute(ctx);
@@ -123,7 +134,7 @@ function mountEntry(args) {
             `Aux routes (views / remote functions) support only GET and POST.`);
     }
     // Local-dev requests target literal `localhost`, but bindings reference a
-    // logical host (`dist.localhost`) — so only enforce a Host-header match
+    // logical host (`example.localhost`) — so only enforce a Host-header match
     // when the binding has actual placeholders to extract.
     const hostMatcher = parsed.hostPlaceholders.length > 0 ? compileHostMatcher(parsed.hostPattern) : null;
     const pathParamNames = collectPlaceholderNames(fullPath);

package/dist/server/auxiliary-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auxiliary-routes.js","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,2BAA2B,CAAA;AAQ7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA0BrE,MAAM,UAAU,oBAAoB,CAAQ,MAAoC;IAC9E,MAAM,EACJ,GAAG,EACH,GAAG,EACH,KAAK,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,IAAI,GACL,GAAG,MAAM,CAAA;IAEV,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE1C,IAAI,KAAK,IAAI,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,SAAQ;YACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;oBACjD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,OAAO,GAAG,CAAC,MAAO,CAAC,GAAG,CAAC,CAAA;gBACzB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,IAAI,sBAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;oBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,OAAO,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;oBAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;wBACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;oBACjF,CAAC;oBACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;oBACtF,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;oBAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,IAAI,wBAAwB,CAChC,aAAa,CAAC,MAA4C,EAC1D,YAAY,IAAI,EAAE,CACnB,CAAA;oBACH,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAgC,EAChC,IAAY,EACZ,QAA0C;IAE1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,KAAK,IAAI,KAAK;QACpE,6CAA6C,IAAI,4BAA4B,CAChF,CAAA;AACH,CAAC;AAqBD,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C,SAAS,UAAU,CAAC,IAAoB;IACtC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,CAAC,SAAS;QAAE,OAAM;IAEtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC;QAAE,OAAM;IAEhF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAA;IACzD,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,gBAAgB,QAAQ,KAAK;YACvF,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yDAAyD;QACzD,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,UAAU,GAA2B,EAAE,CAAA;YAC3C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC/B,UAAU,GAAG,KAAK,CAAA;YACpB,CAAC;YAED,MAAM,UAAU,GAA2B,EAAE,CAAA;YAC7C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAC7D,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EACtD,IAAI,EACJ,QAAQ,CACT,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;gBACzB,CAAC;gBACD,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE;gBACxC,IAAI,EAAE,YAAY;gBAClB,MAAM;gBACN,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,IAAI,UAAU,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;SAC/C,IAAI,UAAU,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE3D,8DAA8D;IAC9D,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,OAA+B;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAA+B;IAC9E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5E,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAuB,yBAAyB,CAAC,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;SAC/D,CAAA;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;IAC7C,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAA;AACjC,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC"}
+{"version":3,"file":"auxiliary-routes.js","sourceRoot":"","sources":["../../src/server/auxiliary-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,2BAA2B,CAAA;AAQ7E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA0BrE,MAAM,UAAU,oBAAoB,CAAQ,MAAoC;IAC9E,MAAM,EACJ,GAAG,EACH,GAAG,EACH,KAAK,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,IAAI,GACL,GAAG,MAAM,CAAA;IAEV,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE1C,IAAI,KAAK,IAAI,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,SAAQ;YACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;oBACjD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,OAAO,GAAG,CAAC,MAAO,CAAC,GAAG,CAAC,CAAA;gBACzB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,IAAI,sBAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,UAAU,CAAC;gBACT,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,aAAa,EAAE,MAAM;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;oBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACjD,MAAM,OAAO,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;oBAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;wBACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;oBACjF,CAAC;oBACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;oBACvC,MAAM,GAAG,GAAG;wBACV,MAAM,EAAE,UAAU,CAAC,IAAI;wBACvB,CAAC;wBACD,IAAI;wBACJ,IAAI;wBACJ,MAAM;wBACN,MAAM;wBACN,UAAU;wBACV,UAAU;qBACX,CAAA;oBACD,IAAI,GAAG,CAAC,SAAS;wBAAE,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;oBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;oBAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,IAAI,wBAAwB,CAChC,aAAa,CAAC,MAA4C,EAC1D,YAAY,IAAI,EAAE,CACnB,CAAA;oBACH,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAgC,EAChC,IAAY,EACZ,QAA0C;IAE1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,KAAK,IAAI,KAAK;QACpE,6CAA6C,IAAI,4BAA4B,CAChF,CAAA;AACH,CAAC;AAqBD,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C,SAAS,UAAU,CAAC,IAAoB;IACtC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,CAAC,SAAS;QAAE,OAAM;IAEtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC;QAAE,OAAM;IAEhF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAA;IACzD,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,gBAAgB,QAAQ,KAAK;YACvF,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yDAAyD;QACzD,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,UAAU,GAA2B,EAAE,CAAA;YAC3C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC/B,UAAU,GAAG,KAAK,CAAA;YACpB,CAAC;YAED,MAAM,UAAU,GAA2B,EAAE,CAAA;YAC7C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAC7D,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EACtD,IAAI,EACJ,QAAQ,CACT,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;gBACzB,CAAC;gBACD,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE;gBACxC,IAAI,EAAE,YAAY;gBAClB,MAAM;gBACN,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,mBAAmB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,IAAI,UAAU,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;SAC/C,IAAI,UAAU,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAE3D,8DAA8D;IAC9D,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,OAA+B;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAA+B;IAC9E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5E,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAuB,yBAAyB,CAAC,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;SAC/D,CAAA;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;IAC7C,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAA;AACjC,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/dist/server/create.d.ts

@@ -1,19 +1,6 @@
 /**
- * `createRemoteServer` — the SDK's entry point for running a remote domain.
- *
- * Identity is per-function: the dispatcher signs `iss` = the worker's serving
- * URL (`effectiveIssuer`, decoupled from the addressing `origin`) and `sub` =
- * the origin-addressed function path on each dispatch.
- *
- * Composes:
- *   methods             ← Map keyed by BoundMethod.ref (built by dispatch/resolve)
- *   effectiveIssuer     ← config.issuer ?? config.url
- *   dispatcher          ← SdkDispatcher(compiled, methods, deps, privateKey)
- *   jwks                ← derivePublicJwk(privateKey), keyed by effectiveIssuer
- *   /meta               ← provenance endpoint (sdkCommit, schemaHash, domainName)
- *   auxiliary routes    ← view / remote-function handlers from defineRemoteDomain
- *   app                 ← createKernelApp(dispatcher, contracts, host, jwks, transports, ...)
- *   start               ← startNodeServer(app, port)
+ * Remote-domain server entry point. The worker serving URL is the issuer; each
+ * method/view/function signs with its own semantic subject.
  */
 import type { RemoteServerConfig } from './config';
 import type { RemoteServer } from './handle';

package/dist/server/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,UAAU,CAAA;AAahE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,YAAY,CA+JzF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,UAAU,CAAA;AAahE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,YAAY,CAyIzF"}

package/dist/server/create.js

@@ -1,19 +1,6 @@
 /**
- * `createRemoteServer` — the SDK's entry point for running a remote domain.
- *
- * Identity is per-function: the dispatcher signs `iss` = the worker's serving
- * URL (`effectiveIssuer`, decoupled from the addressing `origin`) and `sub` =
- * the origin-addressed function path on each dispatch.
- *
- * Composes:
- *   methods             ← Map keyed by BoundMethod.ref (built by dispatch/resolve)
- *   effectiveIssuer     ← config.issuer ?? config.url
- *   dispatcher          ← SdkDispatcher(compiled, methods, deps, privateKey)
- *   jwks                ← derivePublicJwk(privateKey), keyed by effectiveIssuer
- *   /meta               ← provenance endpoint (sdkCommit, schemaHash, domainName)
- *   auxiliary routes    ← view / remote-function handlers from defineRemoteDomain
- *   app                 ← createKernelApp(dispatcher, contracts, host, jwks, transports, ...)
- *   start               ← startNodeServer(app, port)
+ * Remote-domain server entry point. The worker serving URL is the issuer; each
+ * method/view/function signs with its own semantic subject.
  */
 import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
 import { collectFunctionSubs, domainInstallRequestSchema, hashInstallGraph, } from '@astrale-os/kernel-core/domain';
@@ -32,19 +19,16 @@ import { derivePublicJwk } from './jwks';
 import { canonicalizeServingUrl } from './serving-url';
 export function createRemoteServer(config) {
     const methods = buildMethodIndex(config.domain.methods);
-    // The worker's identity (`iss`) is its full serving URL (base path included,
-    // trailing slash stripped) — decoupled from the addressing `origin` slug. One
-    // canonical value drives outbound signing, the JWKS issuer, `/meta`, and the
-    // install credential. Must equal the URL the kernel fetched the domain at.
+    // Canonical serving URL drives signing, JWKS, /meta, and install credentials.
     const iss = canonicalizeServingUrl(config.url);
-    // Re-materialize the domain with the real serving url (`iss`) so the aux
-    // View/Function `binding.remoteUrl` resolve to this host — the define-time
-    // placeholder is discarded. `compiled`/`auxiliary` drive everything below;
-    // `iss` is the single source for both bindings and identity.
+    // Stamp aux bindings against the same URL used as issuer.
     const { compiled, auxiliary } = materializeRemoteDomain(config.domain, iss);
     const dispatcher = new SdkDispatcher({
         compiled,
         methods,
+        // The source schema drives the rich typed `self` handed to non-static
+        // handlers (`self.node()` → BoundNode<D>, typed `self.call`).
+        schema: compiled.$.schema,
         deps: config.deps,
         privateKey: config.privateKey,
         issuer: iss,
@@ -57,12 +41,7 @@ export function createRemoteServer(config) {
         issuer: iss,
         loadOwnKeys: async () => [publicJwk],
     };
-    // `/meta`'s `schemaHash` is computed from the LIVE domain graph (lazy +
-    // cached). `hashInstallGraph` is id-independent/deterministic, so an
-    // independent build (a deploy script) produces the SAME hash — `deployCheck`
-    // can compare its expected value against this and detect genuine schema drift.
-    // An explicit `config.meta.schemaHash` still wins as an override for
-    // offline/pinned spec producers, but normal deploys omit it.
+    // Normal /meta schemaHash is the deterministic install-graph hash; explicit overrides win.
     let cachedSchemaHash = null;
     const resolveSchemaHash = () => config.meta?.schemaHash !== undefined
         ? Promise.resolve(config.meta.schemaHash)
@@ -74,6 +53,7 @@ export function createRemoteServer(config) {
         iss,
         sdkCommit: config.meta?.sdkCommit,
         domainName: config.meta?.domainName ?? compiled.$.origin,
+        ...(config.domain.manifest ? { manifest: config.domain.manifest } : {}),
     };
     hostApp.get('/meta', async (c) => c.json(MetaSchema.parse({ ...metaBase, schemaHash: await resolveSchemaHash() })));
     hostApp.post('/_astrale/install-domain', async (c) => {
@@ -94,23 +74,16 @@ export function createRemoteServer(config) {
         catch (err) {
             return c.json({ error: 'Install denied', message: err.message }, 403);
         }
-        // Build the install graph. `buildInstallGraph` re-materializes the domain
-        // with the serving url (`iss`), so every `binding.remoteUrl` points at this
-        // host — the same single value as the credential's `iss` below. The kernel
-        // hashes exactly this graph; no install-time rewrite.
+        // The signed graph is built for this serving URL; the kernel verifies it as-is.
         const graph = buildInstallGraph(config.domain, iss);
         const graphHash = await hashInstallGraph(graph);
         const origin = compiled.$.origin;
-        // `postInstall` + `requires` ride in BOTH the signed credential claims and
-        // the bundle body, and the kernel rejects any bundle field that disagrees
-        // with its signed claim — so derive them once and reuse for both.
+        // Signed claims and bundle fields must agree exactly.
         const bundleExtras = {
             ...(config.postInstall ? { postInstall: config.postInstall } : {}),
             ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
         };
-        // The credential's `iss` is the worker's serving URL (`iss`, computed above)
-        // — the kernel pins it to the URL it fetched the domain at and verifies this
-        // credential against that issuer's JWKS.
+        // Install credential issuer is the serving URL the kernel fetched.
         const credential = await signInstallCredential({
             privateKey: config.privateKey,
             issuer: iss,
@@ -130,12 +103,7 @@ export function createRemoteServer(config) {
     // Resolved once and shared between the kernel envelope (createKernelApp) and
     // the aux routes (mountAuxiliaryRoutes) so both honor the same policy.
     const cors = config.cors ?? { origin: '*' };
-    // Worker-side wires for defineView / defineRemoteFunction. Mounted before
-    // the kernel catch-all. Each aux route gets its own per-slug identity
-    // (issuer + key + the aux node's AbsolutePath as subject) so outbound
-    // `kernel.call(...)` from a handler signs with that path — matching the
-    // identity the install-time `subs` claim registered for the node, the
-    // same way Methods work.
+    // Aux routes mount before the kernel catch-all and sign with their member subjects.
     if (auxiliary) {
         const auxIdentities = buildAuxIdentityMap(compiled, config.privateKey, iss);
         mountAuxiliaryRoutes({
@@ -164,10 +132,7 @@ export function createRemoteServer(config) {
     });
     return {
         app,
-        // The canonical serving URL = the worker's `iss` identity. Exposed so a
-        // worker that also seeds `Identity.iss` on graph nodes (e.g. recruitment's
-        // self-seed) stamps the SAME canonical value the dispatcher signs with —
-        // never the raw env.WORKER_URL — so the kernel's exact-match lookup resolves.
+        // Expose the canonical issuer, not the raw env URL, for graph identity stamping.
         iss,
         async start(port) {
             const nodeStartModule = './start';
@@ -190,8 +155,7 @@ async function signInstallCredential(args) {
     const kid = args.privateKey.kid;
     const header = typeof kid === 'string' ? { alg, kid } : { alg };
     const key = await importJWK(args.privateKey, alg);
-    // `postInstall` + `requires` are signed (not just carried in the bundle) so a
-    // MITM can't retarget the system-authority hook or forge dependencies
+    // postInstall/requires are signed, not just copied into the bundle.
     return new SignJWT({
         subs: args.subs,
         nonce: args.nonce,