@astrale-os/sdk 0.2.0 → 0.3.0

package/src/config/define-domain.ts

@@ -20,7 +20,7 @@ import type { Schema } from '@astrale-os/kernel-dsl'
 
 import { DomainOrigin } from '@astrale-os/kernel-core/domain'
 
-import type { RemoteFunctionDef, ViewDef } from '../define'
+import type { AnyRemoteFunctionDef, ViewDef } from '../define'
 import type { SchemaMethodsImpl } from '../method'
 
 // A registry holds views / functions of every deps + param/result shape. Their
@@ -28,10 +28,69 @@ import type { SchemaMethodsImpl } from '../method'
 // site; here they're held loosely and, crucially, kept OUT of `TDeps` inference
 // — so `TDeps` is fixed by `methods` alone (the authoritative deps source) and a
 // view authored with the default `unknown` deps can't fight `methods`'s `Env`.
-// oxlint-disable no-explicit-any
+// oxlint-disable-next-line no-explicit-any
 type AnyViewDef = ViewDef<any>
-type AnyFunctionDef = RemoteFunctionDef<any, any, any>
-// oxlint-enable no-explicit-any
+// The function bag is the canonical, variance-correct one from `../define` (it
+// must accept functions of any auth policy — see the note there). Aliased to
+// keep the local usages below terse.
+type AnyFunctionDef = AnyRemoteFunctionDef
+
+/**
+ * Optional presentation metadata for the domain, served verbatim on the
+ * worker's `/meta` endpoint (see `../deploy/meta`) so a host UI can brand a
+ * freshly-installed domain. Both the block and every field are optional.
+ */
+export interface DomainManifest {
+  /** Domain logo — an inline SVG string or a `data:` URL (no extra validation). */
+  logo?: string
+  /**
+   * Slug of one of THIS domain's own views to open first — the domain's entry
+   * surface. This is the SERVED form: a plain slug, stamped verbatim onto
+   * `/meta`. Authors don't write the slug directly — they pass the view OBJECT
+   * to `defineDomain` (see {@link DomainManifestConfig.entrypoint}), which
+   * resolves it to this slug. Pinned at app install to the `View` node at
+   * `/<origin>/views/<slug>` via the app's `entrypoint` edge.
+   */
+  entrypoint?: string
+  /**
+   * The ROLES this domain declares — named capability identities a workspace
+   * registers when an app for this domain is installed, then assigns to users
+   * (`default: true` roles are auto-assigned to the installing user). The
+   * domain itself grants each role its resource permissions (typically in its
+   * `postInstall`); declaring a role here only names it. Slugs are validated
+   * (lowercase slug charset, unique) at `defineDomain`.
+   */
+  roles?: readonly DomainRoleDecl[]
+}
+
+/** One declared role of the domain (see {@link DomainManifest.roles}). */
+export interface DomainRoleDecl {
+  /** Stable role slug, unique within the domain (e.g. `"editor"`). */
+  slug: string
+  /** Display name; defaults to the slug. */
+  name?: string
+  /** What holding this role means — shown in permission UIs. */
+  description?: string
+  /** Auto-assign this role to the user installing an app for this domain. */
+  default?: boolean
+}
+
+/**
+ * The author-facing manifest accepted by {@link defineDomain} — identical to the
+ * served {@link DomainManifest} except `entrypoint` is the view OBJECT (a value
+ * of the `views` map) rather than its slug. `defineDomain` resolves it to the
+ * slug by identity, so a renamed or dropped view is a compile error at the
+ * reference site, never a stale string (the same guarantee `postInstall` gives
+ * for functions).
+ */
+export interface DomainManifestConfig extends Omit<DomainManifest, 'entrypoint'> {
+  /**
+   * The view to open first — the domain's entry surface. Pass the view OBJECT
+   * from this domain's own `views` map (e.g. `entrypoint: views.welcome`).
+   * Resolved to its slug here and served as {@link DomainManifest.entrypoint}.
+   */
+  entrypoint?: AnyViewDef
+}
 
 export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
   /** The domain schema (from `schema/`). Its `.domain` seeds the default origin. */
@@ -67,6 +126,15 @@ export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
    * by slug. Omit when the domain has none.
    */
   functions?: Record<string, AnyFunctionDef>
+  /**
+   * Optional presentation metadata stamped onto `/meta`. When `manifest.entrypoint`
+   * is set it MUST be a view from this domain's own `views` map — passed as the
+   * OBJECT (`entrypoint: views.welcome`), resolved to its slug here. A view that
+   * isn't in `views` is a compile error at the reference site, and the
+   * resolution throws loudly if it's somehow absent — so a typo can never dangle
+   * to a NOT_FOUND view path at install.
+   */
+  manifest?: DomainManifestConfig
   /**
    * The domain's **addressing name** (the graph slug it mounts under, e.g.
    * `'crm.acme.dev'`). Defaults to `schema.domain`. Must be a name, never a
@@ -78,6 +146,16 @@ export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
   origin?: string
   /** Cross-domain deps, by origin. Verified present on the instance at install. */
   requires?: readonly string[]
+  /**
+   * Where the Domain node physically lives in the graph TREE — an absolute tree
+   * path whose LAST segment is the origin (e.g. `'/domains/crm.acme.dev'`).
+   * Optional; defaults to `/domains/<origin>`. This moves ONLY the physical
+   * `has_parent` position: the domain's `installed_in` edge and EVERY typed
+   * address (`/:<origin>`, `/:<origin>:Class`, …) stay ROOT-mounted, so
+   * addressing is unchanged. A platform domain that must stay top-level sets its
+   * own origin path (e.g. `'/workspace.astrale.ai'`).
+   */
+  path?: string
   /**
    * The function the kernel runs once after install, as __SYSTEM__ — where the
    * domain seeds itself / posts its own grants. Reference it from the `functions`
@@ -103,9 +181,13 @@ export interface DomainDefinition {
   deps?: (env: any, url: string) => any
   views?: Record<string, ViewDef>
   functions?: Record<string, AnyFunctionDef>
+  /** Presentation metadata for `/meta`, validated at definition time. */
+  manifest?: DomainManifest
   origin: string
   requires: readonly string[]
   postInstall?: string
+  /** Physical tree path for the Domain node; default `/domains/<origin>`. */
+  path?: string
 }
 
 export function defineDomain<S extends Schema, TDeps, TEnv = unknown>(
@@ -146,25 +228,96 @@ export function defineDomain<S extends Schema, TDeps, TEnv = unknown>(
     } catch {
       throw new Error(
         `defineDomain: invalid \`requires\` entry "${dep}". Use the dependency's origin slug ` +
-          '(lowercase FQDN-like, e.g. "dist.astrale.ai"), not a URL.',
+          '(lowercase FQDN-like, e.g. "example.astrale.ai"), not a URL.',
       )
     }
   })
 
+  // `path`, when set, is the Domain's physical tree path. Validate the
+  // two invariants the serializer/kernel rely on, string-only (no AbsolutePath
+  // import — this module must stay worker-safe): it is absolute with at least one
+  // segment, and its LAST segment equals the origin (the kernel derives origin
+  // from the mount basename in a few places, e.g. has_parent slug + get-access-
+  // token origin recovery). Full structural parse happens at build time.
+  if (config.path !== undefined) {
+    const loc = config.path
+    if (!loc.startsWith('/') || loc === '/') {
+      throw new Error(
+        `defineDomain: \`path\` must be an absolute graph path with at least ` +
+          `one segment (e.g. "/domains/${origin}"), not "${loc}".`,
+      )
+    }
+    if (loc.split('/').pop() !== origin) {
+      throw new Error(
+        `defineDomain: \`path\` last segment must equal the origin "${origin}" ` +
+          `(e.g. "/domains/${origin}" or "/${origin}"), got "${loc}".`,
+      )
+    }
+  }
+
+  // A `manifest.entrypoint` view is resolved to its slug below (in the return),
+  // where a view absent from `views` throws — see `resolveManifest`.
+
+  // Declared roles must carry valid, unique slugs — a role slug becomes a graph
+  // path segment and an identity subject, so the kernel's reserved separators
+  // (`/`, `:`, `@`) can never appear in one. Fail at authoring time.
+  if (config.manifest?.roles !== undefined) {
+    const seen = new Set<string>()
+    for (const role of config.manifest.roles) {
+      if (!/^[a-z0-9][a-z0-9_-]*$/.test(role.slug)) {
+        throw new Error(
+          `defineDomain: invalid \`manifest.roles\` slug "${role.slug}". ` +
+            'Use a lowercase slug (letters, digits, "_", "-"), e.g. "editor".',
+        )
+      }
+      if (seen.has(role.slug)) {
+        throw new Error(`defineDomain: duplicate \`manifest.roles\` slug "${role.slug}".`)
+      }
+      seen.add(role.slug)
+    }
+  }
+
   return {
     schema: config.schema,
     methods: config.methods as DomainDefinition['methods'],
     ...(config.deps ? { deps: config.deps as DomainDefinition['deps'] } : {}),
     ...(config.views ? { views: config.views as Record<string, ViewDef> } : {}),
     ...(config.functions ? { functions: config.functions } : {}),
+    ...(config.manifest ? { manifest: resolveManifest(config.manifest, config.views) } : {}),
     origin,
     requires,
+    ...(config.path ? { path: config.path } : {}),
     ...(config.postInstall !== undefined
       ? { postInstall: normalizePostInstall(config.postInstall, origin, config.functions) }
       : {}),
   }
 }
 
+/**
+ * Lower the author-facing manifest (view OBJECT for `entrypoint`) to the served
+ * {@link DomainManifest} (slug for `entrypoint`). The entrypoint view is matched
+ * to its `views`-map key by IDENTITY — the same mechanism `normalizePostInstall`
+ * uses for functions — so a view absent from `views` (one from another domain,
+ * or dropped) throws here instead of dangling to a NOT_FOUND view path at install.
+ */
+function resolveManifest(
+  manifest: DomainManifestConfig,
+  views: Record<string, AnyViewDef> | undefined,
+): DomainManifest {
+  const { entrypoint, ...rest } = manifest
+  if (entrypoint === undefined) return rest
+  const slug = views ? Object.entries(views).find(([, def]) => def === entrypoint)?.[0] : undefined
+  if (slug === undefined) {
+    const viewKeys = Object.keys(views ?? {})
+    throw new Error(
+      "defineDomain: `manifest.entrypoint` must be one of this domain's own views " +
+        '(pass the view object, e.g. `entrypoint: views.welcome`). ' +
+        `Available views: ${viewKeys.length > 0 ? viewKeys.map((k) => `"${k}"`).join(', ') : '(none)'}.`,
+    )
+  }
+  return { ...rest, entrypoint: slug }
+}
+
 /**
  * Resolve a `postInstall` function reference to the colon-path the bundle carries.
  * The slug is the `functions` map key the reference is registered under (found by

package/src/config/index.ts

@@ -14,7 +14,7 @@
  */
 
 export { defineDomain } from './define-domain'
-export type { DefineDomainConfig, DomainDefinition } from './define-domain'
+export type { DefineDomainConfig, DomainDefinition, DomainManifest } from './define-domain'
 
 export { deploy } from './deploy'
 export type { DeployConfig } from './deploy'

package/src/define/remote-function.ts

@@ -1,7 +1,7 @@
 /**
  * Authoring a standalone remote function — a callable not bound to a class.
  * (The verb keeps the `defineRemoteFunction` name; the node it materializes is
- * the canonical kernel `Function` class, the former distribution `RemoteFunction`.)
+ * the canonical kernel `Function` class, replacing the former remote-function wrapper.)
  *
  * Each entry in `defineRemoteDomain({ remoteFunctions: { ... } })` becomes:
  *   - a graph node at `/${origin}/functions/<slug>` — a first-class domain MEMBER,
@@ -23,6 +23,7 @@ import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
 import type { Context } from 'hono'
 import type { z } from 'zod'
 
+import type { DomainIssuer } from '../auth/issuer-mint'
 import type { CallRemoteFn } from '../dispatch/call-remote'
 import type { AuthForPolicy, KernelForAuth } from '../method/context'
 
@@ -47,12 +48,20 @@ export type RemoteFunctionContext<
   /**
    * `BoundClientSessionView` to the parent kernel, bound to the composed
    * credential `union(delegation, self)` — same shape as `RemoteContext.kernel`
-   * for `remoteMethod`. Nullability follows {@link KernelForAuth} of the
+   * for `remoteMethod`, including the typed graph read/write sugar flattened onto
+   * it (`kernel.get` / `kernel.children` / `kernel.query`,
+   * `kernel.createNode` / `kernel.mutate(patch)`, …) over the `function.get` /
+   * `function.mutate` syscalls. Nullability follows {@link KernelForAuth} of the
    * function's `auth`: non-null for the default `'required'`, `… | null` for
    * `'optional'`, `null` for `'public'` (use {@link RemoteFunctionContext.selfKernel}
    * there, after verifying the upstream).
    */
   kernel: TKernel
+  /**
+   * Mint seam for identities THIS DOMAIN issues — same contract as
+   * {@link RemoteContext.issuer}.
+   */
+  issuer: DomainIssuer
   /**
    * Call another worker's remote method, re-minting the credential for the
    * target's audience. Same contract as {@link RemoteContext.callRemote}: throws
@@ -113,11 +122,42 @@ export type RemoteFunctionDef<
   description?: string
 }
 
-// `TAuth = AuthPolicy` (the full union, not the `'required'` default) keeps this
-// permissive across any declared policy; `ctx.kernel` widens to
-// `BoundClientSessionView<FnMap> | null`. Used where the concrete policy is erased.
-// oxlint-disable-next-line no-explicit-any
-export type AnyRemoteFunctionDef = RemoteFunctionDef<any, any, any, AuthPolicy>
+// Loosely-typed "bag" for the per-domain function maps. The PRECISE typing is
+// enforced at each `defineRemoteFunction` call site; this only has to HOLD defs
+// of ANY auth policy. We deliberately do NOT pin a single concrete `TAuth`:
+// `RemoteFunctionContext` carries `kernel: KernelForAuth<TAuth>` (an
+// auth-dependent type that resolves to a concrete union), so any single concrete
+// policy — `'required'` OR the full `AuthPolicy` union — rejects the others when
+// a handler is assigned into the bag under parameter contravariance (a public
+// handler wants `kernel: null`, a required one `kernel: Kernel`; neither fits a
+// fixed bag). Relaxing the `authorize`/`execute` PARAMS to `any` is what makes
+// the bag accept every policy; soundness is unchanged — the bag was already
+// `any, any, any`, and the real contract is checked at the call site.
+// oxlint-disable no-explicit-any
+export type AnyRemoteFunctionDef = Omit<
+  RemoteFunctionDef<any, any, any, AuthPolicy>,
+  'authorize' | 'execute'
+> & {
+  authorize?: (ctx: any) => void | Promise<void>
+  execute: (ctx: any) => any
+}
+// oxlint-enable no-explicit-any
+
+// Compile-time regression guards (pure `type` aliases — zero runtime emit, but
+// checked by `pnpm typecheck` since this file is under `src/`). Each asserts a
+// function of the given auth policy still FITS the bag. If `AnyRemoteFunctionDef`
+// ever narrows back and rejects a policy, the matching `_Assert<false>` errors.
+type _AssertTrue<T extends true> = T
+type _FnFitsBag<D> = D extends AnyRemoteFunctionDef ? true : false
+// Exported only so `noUnusedLocals` treats the assertions as used — it is NOT
+// re-exported by `../define`, so it never reaches the package's public surface.
+// A regression that makes the bag reject a policy turns the matching
+// `_AssertTrue<false>` into a compile error here.
+export type _AuthPolicyBagGuards = [
+  _AssertTrue<_FnFitsBag<RemoteFunctionDef<unknown, unknown, unknown, 'public'>>>,
+  _AssertTrue<_FnFitsBag<RemoteFunctionDef<unknown, unknown, unknown, 'optional'>>>,
+  _AssertTrue<_FnFitsBag<RemoteFunctionDef<unknown, unknown, unknown, 'required'>>>,
+]
 
 /**
  * Identity helper for authoring a RemoteFunction. Returns its argument

package/src/deploy/check.ts

@@ -6,14 +6,14 @@ import type { Meta } from './meta'
 import { MetaSchema } from './meta'
 
 export type DeployCheckOptions = {
-  /** Deployed worker URL (e.g. `https://dist.astrale.ai`). */
+  /** Deployed worker URL (e.g. `https://example.astrale.ai`). */
   url: string
   /**
-   * Expected `meta.schemaHash` — the hash of the locally-built `spec.json`
-   * (via `hashSpecFile`). REQUIRED to verify schema drift: when the worker
-   * advertises a `schemaHash` but this is absent, the check fails loudly rather
-   * than silently "passing" an unverified deploy. Per-domain deploy scripts
-   * compute it (`hashSpecFile('./spec.json')`) and pass it.
+   * Expected `meta.schemaHash` — the hash of the domain's install graph (via
+   * `buildInstallGraphHash(domain, url)`). REQUIRED to verify schema drift: when
+   * the worker advertises a `schemaHash` but this is absent, the check fails
+   * loudly rather than silently "passing" an unverified deploy. Per-domain
+   * deploy scripts compute it (`buildInstallGraphHash(...)`) and pass it.
    */
   expectedSchemaHash?: string
   /**
@@ -96,7 +96,7 @@ async function checkSchemaHash(
   if (!opts.expectedSchemaHash) {
     throw new Error(
       `worker advertises schemaHash=${meta.schemaHash} but no expectedSchemaHash was provided — ` +
-        `cannot verify schema drift (pass expectedSchemaHash, e.g. hashSpecFile('./spec.json'))`,
+        `cannot verify schema drift (pass expectedSchemaHash, e.g. buildInstallGraphHash(domain, url))`,
     )
   }
   if (meta.schemaHash !== opts.expectedSchemaHash) {

package/src/deploy/index.ts

@@ -1,3 +1,2 @@
 export { MetaSchema, type Meta } from './meta'
-export { hashSpecFile } from './hash-spec'
 export { deployCheck, type DeployCheckOptions } from './check'

package/src/deploy/meta.ts

@@ -11,6 +11,8 @@
 import { z } from 'zod'
 
 export const MetaSchema = z.object({
+  // The version of the meta payload. Incremented on any change to the payload
+  version: z.number().int().min(1).default(1),
   /** Base URL where JWKS is published. Always stamped by `createRemoteServer`
    *  and required by `deployCheck` to verify JWKS reachability. */
   iss: z.string().min(1),
@@ -20,6 +22,29 @@ export const MetaSchema = z.object({
   schemaHash: z.string().optional(),
   /** Local directory name under `kernel/domains/<...>/` — used to auto-resolve the local spec. */
   domainName: z.string().optional(),
+  /**
+   * Optional presentation metadata declared on the domain (`defineDomain`):
+   * `logo` (inline SVG / `data:` URL), `entrypoint` (a view slug — the domain's
+   * entry surface), and the domain's declared `roles` (registered by a workspace
+   * at app install). Served verbatim so a host UI can brand a freshly-installed
+   * domain.
+   */
+  manifest: z
+    .object({
+      logo: z.string().optional(),
+      entrypoint: z.string().optional(),
+      roles: z
+        .array(
+          z.object({
+            slug: z.string().min(1),
+            name: z.string().optional(),
+            description: z.string().optional(),
+            default: z.boolean().optional(),
+          }),
+        )
+        .optional(),
+    })
+    .optional(),
 })
 
 export type Meta = z.infer<typeof MetaSchema>

package/src/dispatch/dispatcher.ts

@@ -11,13 +11,18 @@
 
 import type { AuthedKernelAPI, DispatchResult, KernelAPI } from '@astrale-os/kernel-api'
 import type { AuthPolicy } from '@astrale-os/kernel-api/routed'
-import type { CredentialInput, Path } from '@astrale-os/kernel-core'
+import type { NodeBinder } from '@astrale-os/kernel-client/schema'
+import type { CredentialInput } from '@astrale-os/kernel-core'
 import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain'
+import type { Schema } from '@astrale-os/kernel-dsl'
+
+import { createNodeBinder } from '@astrale-os/kernel-client/schema'
 
 import type { RemoteIdentityConfig } from '../auth/identity'
 import type { AnyRemoteHandler } from '../method/single'
 import type { MethodIndex } from './resolve'
 
+import { makeIssuerMint } from '../auth/issuer-mint'
 import { resolveInboundAuth } from '../auth/resolve'
 import { runAuthorize } from './authorize'
 import { makeCallRemote } from './call-remote'
@@ -25,9 +30,11 @@ import { MethodNotFoundError, SdkResultValidationError, SdkValidationError } fro
 import { executeHandler } from './execute'
 import { buildIdentityMap } from './identity'
 import { resolveMethod } from './resolve'
-import { resolveSelf, withNode, type ParsedSelf } from './self'
+import { resolveSelf, withBoundNode, withNode, type ParsedSelf } from './self'
 import { validateParams, validateResult } from './validate'
 
+type PathInput = string | { raw: string }
+
 export type SdkDispatcherConfig<TDeps> = {
   /** The compiled domain — source of the method layout and origin-addressed subs. */
   compiled: CompiledDomain
@@ -46,6 +53,12 @@ export type SdkDispatcherConfig<TDeps> = {
   issuer: string
   /** The worker's serving URL (`config.url`) — exposed to handlers as `ctx.url`. */
   url: string
+  /**
+   * The domain schema. When present, non-static handlers receive the rich,
+   * schema-typed `self` ({@link withBoundNode}: `self.node()` → `BoundNode<D>`,
+   * typed `self.call`); absent, they fall back to the untyped {@link withNode}.
+   */
+  schema?: Schema
 }
 
 export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
@@ -55,6 +68,8 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
   private readonly issuer: string
   private readonly url: string
   private readonly privateKey: JsonWebKey
+  /** Built once when a schema is supplied — drives the rich typed `self`. */
+  private readonly binder: NodeBinder<Schema> | null
 
   constructor(config: SdkDispatcherConfig<TDeps>) {
     this.methods = config.methods
@@ -62,6 +77,7 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
     this.issuer = config.issuer
     this.url = config.url
     this.privateKey = config.privateKey
+    this.binder = config.schema ? createNodeBinder(config.schema) : null
     const methodList = Array.from(new Set(config.methods.values()))
     const identityMethods = methodList.filter((bound) => methodAuthPolicy(bound) !== 'public')
     this.identities =
@@ -71,7 +87,7 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
   }
 
   async call(
-    path: Path | string,
+    path: PathInput,
     credential: CredentialInput,
     params: unknown,
     opts?: { self?: string },
@@ -80,7 +96,7 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
   }
 
   async stream(
-    path: Path | string,
+    path: PathInput,
     credential: CredentialInput,
     params: unknown,
     opts?: { self?: string },
@@ -98,7 +114,7 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
    * and hand it back to the kernel-api orchestrator.
    */
   async dispatch(
-    path: Path | string,
+    path: PathInput,
     credential: CredentialInput,
     params: unknown,
     opts?: { self?: string },
@@ -117,12 +133,12 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
   }
 
   private async run(
-    path: Path | string,
+    path: PathInput,
     credential: CredentialInput,
     params: unknown,
     selfRef?: string,
   ): Promise<unknown> {
-    const bound = resolveMethod(this.methods, path)
+    const bound = resolveMethod(this.methods, pathToString(path))
     if (!bound) throw new MethodNotFoundError(pathToString(path))
 
     const authPolicy: AuthPolicy = (bound.handler as { auth?: AuthPolicy }).auth ?? 'required'
@@ -177,7 +193,13 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
     // Enrich the parsed self with the lazy `node()` accessor, bound to this
     // request's kernel (null when the auth policy yields none — `node()` then
     // rejects). Done here, not in `resolveSelf`, so the parse stays kernel-free.
-    const self = parsedSelf ? withNode(parsedSelf, kernel) : undefined
+    // With a schema the handler gets the rich typed `self` keyed by its owner
+    // (class/interface); without one, the untyped fallback.
+    const self = parsedSelf
+      ? this.binder
+        ? withBoundNode(parsedSelf, kernel, this.binder, bound.owner)
+        : withNode(parsedSelf, kernel)
+      : undefined
     const ctx = {
       params: handlerParams,
       auth,
@@ -185,6 +207,7 @@ export class SdkDispatcher<TDeps = unknown> implements KernelAPI {
       deps: this.deps,
       url: this.url,
       kernel,
+      issuer: makeIssuerMint(fnIdentity),
       callRemote,
     }
 
@@ -213,7 +236,7 @@ function methodAuthPolicy(bound: BoundMethod<AnyRemoteHandler>): AuthPolicy {
   return (bound.handler as { auth?: AuthPolicy }).auth ?? 'required'
 }
 
-function pathToString(path: Path | string): string {
+function pathToString(path: PathInput): string {
   return typeof path === 'string' ? path : path.raw
 }
 

package/src/dispatch/execute.ts

@@ -11,8 +11,9 @@ import type { FnMap } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
 import type { AuthContext } from '@astrale-os/kernel-core'
 
+import type { DomainIssuer } from '../auth/issuer-mint'
 import type { CallRemoteFn } from './call-remote'
-import type { SelfResult } from './self'
+import type { SelfResult, TypedSelf } from './self'
 
 // oxlint-disable-next-line no-explicit-any
 type HandlerFn = (...args: any[]) => any
@@ -25,10 +26,13 @@ export type ExecuteParams = {
   ref?: string
   params: Record<string, unknown>
   auth: AuthContext | null
-  self: SelfResult | undefined
+  /** Untyped fallback ({@link withNode}) or the rich typed self ({@link withBoundNode}). */
+  self: SelfResult | TypedSelf<unknown> | undefined
   deps: unknown
   url: string
   kernel: BoundClientSessionView<FnMap> | null
+  /** Mint seam for identities this domain issues (`ctx.issuer`). */
+  issuer: DomainIssuer
   callRemote: CallRemoteFn
 }
 
@@ -46,6 +50,7 @@ export async function executeHandler(ctx: ExecuteParams): Promise<unknown> {
     deps: ctx.deps,
     url: ctx.url,
     kernel: ctx.kernel,
+    issuer: ctx.issuer,
     callRemote: ctx.callRemote,
   })
 }

package/src/dispatch/identity.ts

@@ -2,9 +2,10 @@
  * Per-callable identity — dispatcher runtime + install-time wiring.
  *
  * Three flavors of callable get an identity per the install-time identity
- * binding: Methods on classes/interfaces (sub = MethodPath), standalone-function
- * MEMBERS (sub = AbsolutePath at `/<origin>/functions/<slug>`), and view MEMBERS
- * (sub = AbsolutePath at `/<origin>/views/<slug>`).
+ * binding, each keyed by its mount-stable semantic sub: Methods on
+ * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
+ * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
+ * (sub = ViewPath `/:<origin>:view.<slug>`).
  *
  * At server startup the method dispatcher and the View / RemoteFunction
  * route mounter pre-compute, for every materialized callable, the
@@ -54,12 +55,12 @@ export type AuxBuckets<T> = {
 }
 
 /**
- * slug → `AbsolutePath.raw` for each aux callable MEMBER node:
- *   - standalone-function members (`kind: 'function'`) at `/<origin>/functions/<slug>`;
- *   - view members (`kind: 'view'`) at `/<origin>/views/<slug>` (plus any
- *     hand-authored/legacy core `View` nodes, `kind: 'core'` className `View`).
- * Neither has a class+method decomposition that would justify a MethodPath —
- * their identity is their graph position.
+ * slug → mount-stable semantic `sub` for each aux callable MEMBER node:
+ *   - standalone-function members (`kind: 'function'`) → FunctionPath;
+ *   - view members (`kind: 'view'`) → ViewPath (plus any hand-authored/legacy
+ *     core `View` nodes, `kind: 'core'` className `View`, keyed by their AbsolutePath).
+ * The value is `resolveCallables(...).sub` — the exact subject the kernel stamped on
+ * the node at install, so an outbound-signing worker matches its own function identity.
  */
 export type AuxIdentityPaths = AuxBuckets<string>
 
@@ -82,7 +83,7 @@ export function collectAuxIdentityPaths(compiled: CompiledDomain): AuxIdentityPa
  * slug → `RemoteIdentityConfig` for each auto-materialized View /
  * RemoteFunction. Built once at server startup; consumed by
  * `mountAuxiliaryRoutes` so each handler signs outbound `kernel.call(...)`
- * with its own `sub` (the node's AbsolutePath). Mirrors `buildIdentityMap`.
+ * with its own `sub` (its FunctionPath/ViewPath). Mirrors `buildIdentityMap`.
  */
 export type AuxIdentityMap = AuxBuckets<RemoteIdentityConfig>
 

package/src/dispatch/index.ts

@@ -6,7 +6,7 @@ export {
   type ValidationResult,
   type ResultValidationResult,
 } from './validate'
-export { resolveSelf, type SelfResult } from './self'
+export { resolveSelf, withBoundNode, type SelfResult, type TypedSelf } from './self'
 export { executeHandler, type ExecuteParams } from './execute'
 export { makeCallRemote, type CallRemoteFn, type KernelCaller } from './call-remote'
 export {