@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/dist/dispatch/dispatcher.js

@@ -1,237 +0,0 @@
-/**
- * `SdkDispatcher` — implements direct KernelAPI calls and hosted invocations
- * through the same SDK execution pipeline.
- *
- * Built once at server startup from the domain's `CompiledDomain` plus a typed
- * deps container and a private JWK. Per-method identity configs are
- * pre-resolved into a Map so dispatch is O(1) per call.
- *
- * Pipeline per call:
- *   resolve method → authenticate → validate → resolve self → execute
- */
-import { createNodeBinder } from '@astrale-os/kernel-client/schema';
-import { executeInvocation } from '@astrale-os/kernel-server';
-import { makeFunctionContext } from '../auth/function-context.js';
-import { makeDomainAuthority } from '../auth/issuer-mint.js';
-import { resolveInboundAuth } from '../auth/resolve.js';
-import { createInlineStep } from '../step/index.js';
-import { runAuthorize } from './authorize.js';
-import { MethodNotFoundError, SdkResultValidationError, SdkValidationError } from './errors.js';
-import { executeHandler } from './execute.js';
-import { buildIdentityMap } from './identity.js';
-import { resolveMethod } from './resolve.js';
-import { resolveSelf, withBoundNode } from './self.js';
-import { validateParams, validateResult } from './validate.js';
-export class SdkDispatcher {
-    methods;
-    deps;
-    identities;
-    issuer;
-    url;
-    privateKey;
-    /** Built once from the compiled domain — drives typed self and handler kernel binding. */
-    binder;
-    constructor(config) {
-        this.methods = config.methods;
-        this.deps = config.deps;
-        this.issuer = config.issuer;
-        this.url = config.url;
-        this.privateKey = config.privateKey;
-        this.binder = createNodeBinder(config.compiled.$.schema);
-        const methodList = Array.from(new Set(config.methods.values()));
-        const identityMethods = methodList.filter((bound) => methodAuthPolicy(bound) !== 'public');
-        this.identities =
-            identityMethods.length > 0
-                ? buildIdentityMap(config.compiled, identityMethods, config.privateKey, config.issuer)
-                : new Map();
-    }
-    async call(path, credential, params, self) {
-        const result = await this.dispatch(path, credential, params, self);
-        switch (result.kind) {
-            case 'value':
-                return result.value;
-            case 'stream':
-                return result.generator;
-            case 'redirect':
-                throw new Error(`SdkDispatcher cannot redirect "${pathToString(path)}"`);
-        }
-    }
-    async stream(path, credential, params, self) {
-        const result = await this.dispatch(path, credential, params, self);
-        if (result.kind !== 'stream') {
-            throw new Error(`Method "${pathToString(path)}" did not return an async generator`);
-        }
-        return result.generator;
-    }
-    /**
-     * SDK dispatch never redirects — the SDK server IS the remote destination.
-     * Every call resolves locally; we just classify the return as value or stream
-     * and hand it back to the invocation host.
-     */
-    async dispatch(path, credential, params, self) {
-        return executeInvocation(this, {
-            path,
-            credential,
-            params,
-            ...(self === undefined ? {} : { self }),
-        });
-    }
-    async invoke(invocation, caps) {
-        const result = await this.run(invocation, caps);
-        return isAsyncGenerator(result)
-            ? { kind: 'stream', generator: result }
-            : { kind: 'value', value: result };
-    }
-    as(credential) {
-        return {
-            call: (path, params) => this.call(path, credential, params),
-            stream: (path, params) => this.stream(path, credential, params),
-        };
-    }
-    async run(invocation, caps) {
-        const { path, credential, params, self: selfRef } = invocation;
-        const method = pathToString(path);
-        const bound = resolveMethod(this.methods, method);
-        if (!bound)
-            throw new MethodNotFoundError(method);
-        const authPolicy = bound.handler.auth ?? 'required';
-        const fnIdentity = this.identityFor(bound);
-        const { auth, kernel: rawKernel } = await resolveInboundAuth(credential, authPolicy, fnIdentity);
-        const kernel = rawKernel?.withSchema(this.binder.schema) ?? null;
-        if (typeof params !== 'object' || params === null || Array.isArray(params)) {
-            throw new SdkValidationError([{ path: [], message: 'Params must be a plain object' }]);
-        }
-        const validation = validateParams(bound.inputSchema, params);
-        if (!validation.ok) {
-            throw new SdkValidationError(validation.issues);
-        }
-        // `undefined` (not `null`) for static methods — matches the `self` type on
-        // `RemoteContext` / `MethodImpl`, which is `undefined` for static methods.
-        let parsedSelf;
-        if (!bound.isStatic) {
-            if (selfRef === undefined || selfRef === null || selfRef === '') {
-                throw new SdkValidationError([{ path: ['self'], message: 'Required for non-static method' }], `"${bound.owner}.${bound.method}" is an instance method — it needs a target node. ` +
-                    `Either call it via instance dispatch (e.g. "@<nodeId>::${bound.method}" ` +
-                    `or "/path/to/node::${bound.method}"), or pass "self" as the fourth ` +
-                    `dispatch argument (e.g. "@<nodeId>").`);
-            }
-            try {
-                parsedSelf = resolveSelf(String(selfRef));
-            }
-            catch (err) {
-                // A malformed caller-supplied `self` is bad client input, not a server
-                // fault — surface it as VALIDATION_ERROR (422), matching the sibling
-                // missing-self branch above, instead of INTERNAL_ERROR (500).
-                throw new SdkValidationError([
-                    {
-                        path: ['self'],
-                        message: err instanceof Error ? err.message : 'Failed to resolve self',
-                    },
-                ], `Invalid "self" target "${selfRef}": ${err instanceof Error ? err.message : 'unparseable path'}`);
-            }
-        }
-        const handler = bound.handler;
-        const handlerParams = validation.data;
-        // Enrich the parsed self with the lazy `node()` accessor, bound to this
-        // request's kernel (null when the auth policy yields none — `node()` then
-        // rejects). Done here, not in `resolveSelf`, so the parse stays kernel-free.
-        const self = parsedSelf
-            ? withBoundNode(parsedSelf, kernel, this.binder, bound.owner)
-            : undefined;
-        const inboundIss = auth?.credential?.verified?.iss;
-        const kernelUrl = kernel?.default ?? inboundIss;
-        const caller = auth && inboundIss
-            ? {
-                iss: inboundIss,
-                url: kernelUrl ?? inboundIss,
-            }
-            : undefined;
-        const ctx = {
-            params: handlerParams,
-            auth,
-            self,
-            deps: this.deps,
-            env: { url: this.url },
-            kernel,
-            ...(caller !== undefined ? { caller } : {}),
-            domain: makeDomainAuthority(fnIdentity),
-            fn: makeFunctionContext(fnIdentity, this.deps, {
-                ref: bound.ref,
-                ...(kernelUrl !== undefined ? { defaultKernelUrl: kernelUrl } : {}),
-            }),
-        };
-        if (handler.authorize)
-            await runAuthorize(handler.authorize, ctx);
-        const result = await executeHandler({
-            handler,
-            ref: bound.ref,
-            ...ctx,
-            step: createInlineStep({
-                scope: {
-                    kind: 'method',
-                    ref: bound.ref,
-                    owner: bound.owner,
-                    method: bound.method,
-                },
-            }),
-            defer: caps.defer,
-            sleep: caps.sleep,
-        });
-        if (isAsyncGenerator(result)) {
-            return validateOutputStream(bound, result);
-        }
-        return validateOutput(bound, result);
-    }
-    identityFor(bound) {
-        const identity = this.identities.get(bound);
-        if (!identity) {
-            if (methodAuthPolicy(bound) === 'public') {
-                return { issuer: this.issuer, subject: bound.ref, privateKey: this.privateKey };
-            }
-            throw new Error(`SdkDispatcher: no identity config for "${bound.owner}.${bound.method}" — ` +
-                `method is registered in the index but missing from the identity map.`);
-        }
-        return identity;
-    }
-}
-function methodAuthPolicy(bound) {
-    return bound.handler.auth ?? 'required';
-}
-function pathToString(path) {
-    return typeof path === 'string' ? path : path.raw;
-}
-/**
- * Validate a handler's output against `bound.outputSchema`, mirroring the
- * kernel's dispatcher (`runtime/.../dispatcher.ts` + `events.ts`):
- *   - `binary` outputs skip validation (no schema applies).
- *   - async-generator outputs (`output: 'stream'`) are wrapped so each chunk
- *     is validated as it is yielded.
- *   - all other (`value`) outputs are validated once and returned parsed.
- * Returns the synchronous shape (value or generator) so the caller's
- * `dispatch()` can classify it without awaiting a stream to completion.
- */
-function validateOutput(bound, result) {
-    if (bound.output === 'binary')
-        return result;
-    return validateChunk(bound, result);
-}
-async function* validateOutputStream(bound, gen) {
-    for await (const chunk of gen) {
-        yield validateChunk(bound, chunk);
-    }
-}
-/** Parse one output value against `bound.outputSchema` or throw a 500-class error. */
-function validateChunk(bound, value) {
-    const out = validateResult(bound.outputSchema, value);
-    if (!out.ok) {
-        throw new SdkResultValidationError(out.issues, bound.ref);
-    }
-    return out.data;
-}
-function isAsyncGenerator(value) {
-    return (value !== null &&
-        value !== undefined &&
-        typeof value === 'object' &&
-        Symbol.asyncIterator in value);
-}
-//# sourceMappingURL=dispatcher.js.map

package/dist/dispatch/dispatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/dispatch/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAM7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAmB,MAAM,WAAW,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAsB9D,MAAM,OAAO,aAAa;IACP,OAAO,CAAa;IACpB,IAAI,CAAO;IACX,UAAU,CAA0D;IACpE,MAAM,CAAQ;IACd,GAAG,CAAQ;IACX,UAAU,CAAY;IACvC,0FAA0F;IACzE,MAAM,CAA2C;IAElE,YAAY,MAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU;YACb,eAAe,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtF,CAAC,CAAC,IAAI,GAAG,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAClE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,SAAS,CAAA;YACzB,KAAK,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAClE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAC,SAAS,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,OAAO,iBAAiB,CAAC,IAAI,EAAE;YAC7B,IAAI;YACJ,UAAU;YACV,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAsB,EAAE,IAAkB;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO,gBAAgB,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAED,EAAE,CAAC,UAA2B;QAC5B,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;YAC3D,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;SAChE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,UAAsB,EAAE,IAAkB;QAC1D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;QAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,UAAU,GAAgB,KAAK,CAAC,OAAiC,CAAC,IAAI,IAAI,UAAU,CAAA;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAChG,MAAM,MAAM,GAAG,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;QAEhE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;QACjF,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,UAAkC,CAAA;QACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAC/D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,oDAAoD;oBACjF,0DAA0D,KAAK,CAAC,MAAM,IAAI;oBAC1E,sBAAsB,KAAK,CAAC,MAAM,mCAAmC;oBACrE,uCAAuC,CAC1C,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,qEAAqE;gBACrE,8DAA8D;gBAC9D,MAAM,IAAI,kBAAkB,CAC1B;oBACE;wBACE,IAAI,EAAE,CAAC,MAAM,CAAC;wBACd,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;qBACvE;iBACF,EACD,0BAA0B,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,EAAE,CACjG,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAGrB,CAAA;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAA;QACrC,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAyB,CAAA;QACxE,MAAM,SAAS,GAAG,MAAM,EAAE,OAAO,IAAI,UAAU,CAAA;QAC/C,MAAM,MAAM,GACV,IAAI,IAAI,UAAU;YAChB,CAAC,CAAC;gBACE,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,SAAS,IAAI,UAAU;aAC7B;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,GAAG,GAAG;YACV,MAAM,EAAE,aAAa;YACrB,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,MAAM;YACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACvC,EAAE,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC;SACH,CAAA;QAED,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,GAAG;YACN,IAAI,EAAE,gBAAgB,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB;aACF,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAA;QAEF,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAEO,WAAW,CAAC,KAAoC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjF,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,MAAM;gBACzE,sEAAsE,CACzE,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,OAAQ,KAAK,CAAC,OAAiC,CAAC,IAAI,IAAI,UAAU,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAuC;IAC3D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,KAAoC,EAAE,MAAe;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC5C,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AACrC,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,oBAAoB,CAClC,KAAoC,EACpC,GAA4B;IAE5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAoC,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAA4C,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,aAAa,IAAI,KAAK,CAC9B,CAAA;AACH,CAAC"}

package/dist/dispatch/errors.d.ts

@@ -1,47 +0,0 @@
-/**
- * Errors thrown by the dispatch pipeline.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api';
-/** A single Zod issue, normalized to the path/message the payload carries. */
-type ValidationIssue = {
-    path: (string | number)[];
-    message: string;
-};
-export declare class MethodNotFoundError extends Error implements KernelErrorClassifiable {
-    constructor(method: string);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export declare class SdkValidationError extends Error implements KernelErrorClassifiable {
-    readonly issues: ValidationIssue[];
-    constructor(issues: ValidationIssue[], message?: string);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-/**
- * Thrown when a handler's return value (or a stream chunk) fails validation
- * against its `outputSchema`. This is a server/handler fault — the author's
- * code produced data that violates its own declared contract — so it maps to
- * `INTERNAL_ERROR` (→ HTTP 500), NOT the `VALIDATION_ERROR` (422) used for
- * bad caller input. Mirrors the kernel's `ResultValidationError`.
- */
-export declare class SdkResultValidationError extends Error implements KernelErrorClassifiable {
-    readonly issues: ValidationIssue[];
-    readonly ref?: string | undefined;
-    constructor(issues: ValidationIssue[], ref?: string | undefined);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-/**
- * Thrown by a `RemoteHandler.authorize` hook to deny a call.
- *
- * Wraps any error the hook throws — handlers can throw a plain `Error` and
- * the dispatcher converts it. Already-typed `AuthorizationDeniedError`
- * instances are passed through unchanged so callers can attach hints.
- */
-export declare class AuthorizationDeniedError extends Error implements KernelErrorClassifiable {
-    constructor(message: string, cause?: unknown);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export {};
-//# sourceMappingURL=errors.d.ts.map

package/dist/dispatch/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/dispatch/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAIzF,8EAA8E;AAC9E,KAAK,eAAe,GAAG;IAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAWrE,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,uBAAuB;IAC/E,YAAY,MAAM,EAAE,MAAM,EAGzB;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF;AAED,qBAAa,kBAAmB,SAAQ,KAAM,YAAW,uBAAuB;IAE5E,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;IADpC,YACW,MAAM,EAAE,eAAe,EAAE,EAClC,OAAO,CAAC,EAAE,MAAM,EAIjB;IAED,oBAAoB,IAAI,kBAAkB,CAMzC;CACF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAM,YAAW,uBAAuB;IAElF,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAFvB,YACW,MAAM,EAAE,eAAe,EAAE,EACzB,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;IAED,oBAAoB,IAAI,kBAAkB,CAMzC;CACF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAM,YAAW,uBAAuB;IACpF,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAG3C;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF"}

package/dist/dispatch/errors.js

@@ -1,76 +0,0 @@
-/**
- * Errors thrown by the dispatch pipeline.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import { KERNEL_ERROR_CODES } from '@astrale-os/kernel-api';
-/** Shape Zod issues into the `data.errors` array of a `KernelErrorPayload`. */
-function toPayloadErrors(issues) {
-    return issues.map((i) => ({ path: i.path, code: 'INVALID', message: i.message }));
-}
-export class MethodNotFoundError extends Error {
-    constructor(method) {
-        super(`Method not found: ${method}`);
-        this.name = 'MethodNotFoundError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.METHOD_NOT_FOUND, message: this.message };
-    }
-}
-export class SdkValidationError extends Error {
-    issues;
-    constructor(issues, message) {
-        super(message ?? 'Invalid params');
-        this.issues = issues;
-        this.name = 'SdkValidationError';
-    }
-    toKernelErrorPayload() {
-        return {
-            code: KERNEL_ERROR_CODES.VALIDATION_ERROR,
-            message: this.message,
-            data: { errors: toPayloadErrors(this.issues) },
-        };
-    }
-}
-/**
- * Thrown when a handler's return value (or a stream chunk) fails validation
- * against its `outputSchema`. This is a server/handler fault — the author's
- * code produced data that violates its own declared contract — so it maps to
- * `INTERNAL_ERROR` (→ HTTP 500), NOT the `VALIDATION_ERROR` (422) used for
- * bad caller input. Mirrors the kernel's `ResultValidationError`.
- */
-export class SdkResultValidationError extends Error {
-    issues;
-    ref;
-    constructor(issues, ref) {
-        super(`Function${ref ? ` "${ref}"` : ''} returned an invalid result`);
-        this.issues = issues;
-        this.ref = ref;
-        this.name = 'SdkResultValidationError';
-    }
-    toKernelErrorPayload() {
-        return {
-            code: KERNEL_ERROR_CODES.INTERNAL_ERROR,
-            message: this.message,
-            data: { errors: toPayloadErrors(this.issues) },
-        };
-    }
-}
-/**
- * Thrown by a `RemoteHandler.authorize` hook to deny a call.
- *
- * Wraps any error the hook throws — handlers can throw a plain `Error` and
- * the dispatcher converts it. Already-typed `AuthorizationDeniedError`
- * instances are passed through unchanged so callers can attach hints.
- */
-export class AuthorizationDeniedError extends Error {
-    constructor(message, cause) {
-        super(message, { cause });
-        this.name = 'AuthorizationDeniedError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.PERMISSION_DENIED, message: this.message };
-    }
-}
-//# sourceMappingURL=errors.js.map

package/dist/dispatch/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/dispatch/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAK3D,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAyB;IAKhD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,MAAc;QACxB,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7E,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC,MAAM;IADjB,YACW,MAAyB,EAClC,OAAgB;QAEhB,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAA;sBAHzB,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC/C,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC,MAAM;IACN,GAAG;IAFd,YACW,MAAyB,EACzB,GAAY;QAErB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAA;sBAH5D,MAAM;mBACN,GAAG;QAGZ,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC/C,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC9E,CAAC;CACF"}

package/dist/dispatch/execute.d.ts

@@ -1,44 +0,0 @@
-/**
- * Handler execution — pipeline step 4.
- *
- * Calls the resolved handler's `execute` with a fully assembled
- * `RemoteContext`: validated params, auth context, optional bound self,
- * typed deps, and a kernel `BoundClientSessionView`. The handler may return a
- * value, a Promise, or an async generator (for `output: 'stream'`).
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { AuthContext } from '@astrale-os/kernel-core';
-import type { Defer, Sleep } from '@astrale-os/kernel-server';
-import type { FunctionContextApi } from '../auth/function-context.js';
-import type { DomainAuthority } from '../auth/issuer-mint.js';
-import type { CallerContext, RemoteEnv } from '../method/context.js';
-import type { Step } from '../step/index.js';
-import type { SelfResult, TypedSelf } from './self.js';
-type HandlerFn = (...args: any[]) => any;
-export type ExecuteParams = {
-    /** Handler may omit `execute` when authored as a stub (spec-only binding). */
-    handler: {
-        execute?: HandlerFn;
-    };
-    /** Namespaced ref of the dispatched method — names the offending method in the
-     *  stub-leak diagnostic below (the dispatcher passes `bound.ref`). */
-    ref?: string;
-    params: Record<string, unknown>;
-    auth: AuthContext | null;
-    /** Untyped fallback ({@link withNode}) or the rich typed self ({@link withBoundNode}). */
-    self: SelfResult | TypedSelf<unknown> | undefined;
-    deps: unknown;
-    env: RemoteEnv;
-    kernel: BoundClientSessionView<FnMap> | null;
-    caller?: CallerContext;
-    /** Mint seam for identities this domain issues. */
-    domain: DomainAuthority;
-    fn: FunctionContextApi;
-    step: Step;
-    defer: Defer;
-    sleep: Sleep;
-};
-export declare function executeHandler(ctx: ExecuteParams): Promise<unknown>;
-export {};
-//# sourceMappingURL=execute.d.ts.map

package/dist/dispatch/execute.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/dispatch/execute.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGtD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAExC,MAAM,MAAM,aAAa,GAAG;IAC1B,8EAA8E;IAC9E,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;IAChC;0EACsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,0FAA0F;IAC1F,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;IACjD,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IAC5C,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,mDAAmD;IACnD,MAAM,EAAE,eAAe,CAAA;IACvB,EAAE,EAAE,kBAAkB,CAAA;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,KAAK,EAAE,KAAK,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBzE"}

package/dist/dispatch/execute.js

@@ -1,29 +0,0 @@
-/**
- * Handler execution — pipeline step 4.
- *
- * Calls the resolved handler's `execute` with a fully assembled
- * `RemoteContext`: validated params, auth context, optional bound self,
- * typed deps, and a kernel `BoundClientSessionView`. The handler may return a
- * value, a Promise, or an async generator (for `output: 'stream'`).
- */
-export async function executeHandler(ctx) {
-    if (typeof ctx.handler.execute !== 'function') {
-        throw new Error(`executeHandler: handler${ctx.ref ? ` for "${ctx.ref}"` : ''} has no \`execute\` body — ` +
-            `this is a binding stub that should have been resolved to a remote redirect upstream.`);
-    }
-    return ctx.handler.execute({
-        params: ctx.params,
-        auth: ctx.auth,
-        self: ctx.self,
-        deps: ctx.deps,
-        env: ctx.env,
-        kernel: ctx.kernel,
-        ...(ctx.caller !== undefined ? { caller: ctx.caller } : {}),
-        domain: ctx.domain,
-        fn: ctx.fn,
-        step: ctx.step,
-        defer: ctx.defer,
-        sleep: ctx.sleep,
-    });
-}
-//# sourceMappingURL=execute.js.map

package/dist/dispatch/execute.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/dispatch/execute.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsCH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAkB;IACrD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;YACvF,sFAAsF,CACzF,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC,CAAA;AACJ,CAAC"}

package/dist/dispatch/identity.d.ts

@@ -1,75 +0,0 @@
-/**
- * Per-callable identity — dispatcher runtime + install-time wiring.
- *
- * Three flavors of callable get an identity per the install-time identity
- * binding, each keyed by its mount-stable semantic sub: Methods on
- * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
- * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
- * (sub = ViewPath `/:<origin>:view.<slug>`).
- *
- * At server startup the method dispatcher and the View / RemoteFunction
- * route mounter pre-compute, for every materialized callable, the
- * `RemoteIdentityConfig` they sign outbound kernel calls with. The kernel
- * then matches an existing function identity instead of provisioning a
- * generic one.
- *
- * **Single source of truth:** every helper here is a thin lens over the
- * canonical `resolveCallables` from `@astrale-os/kernel-core/domain`. The
- * kernel validates install subs against the SAME function — drift = 0
- * by construction. This closes the previous SDK-side gap where
- * `collectMethodPaths` filtered to `own|override` and silently dropped
- * `sealed`/`default` interface methods (which DO materialize as nodes).
- */
-import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-import type { AnyRemoteHandler } from '../method/single.js';
-/**
- * For each materialized method node, emit its `MethodPath` (semantic,
- * layout-independent) keyed by the method's namespaced ref. Used to
- * build the install `subs` claim and to look up runtime per-method
- * subjects in `buildIdentityMap`.
- *
- * Includes every method node the kernel materializes — class own/override
- * AND interface own (sealed/default/override). Inherited (non-overriding)
- * class methods reuse the interface's node via a `method_of` edge and
- * are correctly absent here.
- */
-export declare function collectMethodPaths(compiled: CompiledDomain): Record<string, string>;
-/** `{ views, remoteFunctions }` buckets keyed by slug — the shared shape
- *  for every per-aux-callable map (paths, identity configs). */
-export type AuxBuckets<T> = {
-    views: Record<string, T>;
-    remoteFunctions: Record<string, T>;
-};
-/**
- * slug → mount-stable semantic `sub` for each aux callable MEMBER node:
- *   - standalone-function members (`kind: 'function'`) → FunctionPath;
- *   - view members (`kind: 'view'`) → ViewPath (plus any hand-authored/legacy
- *     core `View` nodes, `kind: 'core'` className `View`, keyed by their AbsolutePath).
- * The value is `resolveCallables(...).sub` — the exact subject the kernel stamped on
- * the node at install, so an outbound-signing worker matches its own function identity.
- */
-export type AuxIdentityPaths = AuxBuckets<string>;
-export declare function collectAuxIdentityPaths(compiled: CompiledDomain): AuxIdentityPaths;
-/**
- * slug → `RemoteIdentityConfig` for each auto-materialized View /
- * RemoteFunction. Built once at server startup; consumed by
- * `mountAuxiliaryRoutes` so each handler signs outbound `kernel.call(...)`
- * with its own `sub` (its FunctionPath/ViewPath). Mirrors `buildIdentityMap`.
- */
-export type AuxIdentityMap = AuxBuckets<RemoteIdentityConfig>;
-export declare function buildAuxIdentityMap(compiled: CompiledDomain, privateKey: JsonWebKey, issuer: string): AuxIdentityMap;
-/**
- * Pre-resolve per-method identity configs. Lookup is by BoundMethod instance,
- * so the dispatcher pays O(1) per call instead of re-constructing the config.
- *
- * `iss` = the worker's own **serving URL** (`issuer` arg, e.g.
- * `https://crm.test.com`) — its cryptographic identity, DECOUPLED from the
- * domain's addressing `origin` (a graph slug). The kernel stamps the same
- * value on each function node at install (it pins `iss` to the URL it fetched
- * the domain at) and verifies inbound credentials against that issuer's JWKS
- * (OIDC discovery). The function `sub` stays the origin-addressed MethodPath —
- * `sub` = which function, `iss` = who signs.
- */
-export declare function buildIdentityMap(compiled: CompiledDomain, methods: BoundMethod<AnyRemoteHandler>[], privateKey: JsonWebKey, issuer: string): Map<BoundMethod<AnyRemoteHandler>, RemoteIdentityConfig>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/dispatch/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/dispatch/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAIjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnF;AAED;gEACgE;AAChE,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACxB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;CACnC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;AAEjD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,GAAG,gBAAgB,CAalF;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAA;AAE7D,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,cAAc,CAWhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,EACxC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,CAmB1D"}

package/dist/dispatch/identity.js

@@ -1,101 +0,0 @@
-/**
- * Per-callable identity — dispatcher runtime + install-time wiring.
- *
- * Three flavors of callable get an identity per the install-time identity
- * binding, each keyed by its mount-stable semantic sub: Methods on
- * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
- * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
- * (sub = ViewPath `/:<origin>:view.<slug>`).
- *
- * At server startup the method dispatcher and the View / RemoteFunction
- * route mounter pre-compute, for every materialized callable, the
- * `RemoteIdentityConfig` they sign outbound kernel calls with. The kernel
- * then matches an existing function identity instead of provisioning a
- * generic one.
- *
- * **Single source of truth:** every helper here is a thin lens over the
- * canonical `resolveCallables` from `@astrale-os/kernel-core/domain`. The
- * kernel validates install subs against the SAME function — drift = 0
- * by construction. This closes the previous SDK-side gap where
- * `collectMethodPaths` filtered to `own|override` and silently dropped
- * `sealed`/`default` interface methods (which DO materialize as nodes).
- */
-import { resolveCallables } from '@astrale-os/kernel-core/domain';
-/**
- * For each materialized method node, emit its `MethodPath` (semantic,
- * layout-independent) keyed by the method's namespaced ref. Used to
- * build the install `subs` claim and to look up runtime per-method
- * subjects in `buildIdentityMap`.
- *
- * Includes every method node the kernel materializes — class own/override
- * AND interface own (sealed/default/override). Inherited (non-overriding)
- * class methods reuse the interface's node via a `method_of` edge and
- * are correctly absent here.
- */
-export function collectMethodPaths(compiled) {
-    const out = {};
-    for (const c of resolveCallables(compiled)) {
-        if (c.kind === 'method')
-            out[c.ref] = c.sub;
-    }
-    return out;
-}
-export function collectAuxIdentityPaths(compiled) {
-    const views = {};
-    const remoteFunctions = {};
-    for (const c of resolveCallables(compiled)) {
-        if (!c.slug)
-            continue;
-        if (c.kind === 'function') {
-            remoteFunctions[c.slug] = c.sub;
-        }
-        else if (c.kind === 'view' || (c.kind === 'core' && c.className === 'View')) {
-            views[c.slug] = c.sub;
-        }
-        // Methods (`kind: 'method'`) get their identity via `collectMethodPaths`.
-    }
-    return { views, remoteFunctions };
-}
-export function buildAuxIdentityMap(compiled, privateKey, issuer) {
-    const paths = collectAuxIdentityPaths(compiled);
-    const views = {};
-    for (const [slug, subject] of Object.entries(paths.views)) {
-        views[slug] = { issuer, subject, privateKey };
-    }
-    const remoteFunctions = {};
-    for (const [slug, subject] of Object.entries(paths.remoteFunctions)) {
-        remoteFunctions[slug] = { issuer, subject, privateKey };
-    }
-    return { views, remoteFunctions };
-}
-/**
- * Pre-resolve per-method identity configs. Lookup is by BoundMethod instance,
- * so the dispatcher pays O(1) per call instead of re-constructing the config.
- *
- * `iss` = the worker's own **serving URL** (`issuer` arg, e.g.
- * `https://crm.test.com`) — its cryptographic identity, DECOUPLED from the
- * domain's addressing `origin` (a graph slug). The kernel stamps the same
- * value on each function node at install (it pins `iss` to the URL it fetched
- * the domain at) and verifies inbound credentials against that issuer's JWKS
- * (OIDC discovery). The function `sub` stays the origin-addressed MethodPath —
- * `sub` = which function, `iss` = who signs.
- */
-export function buildIdentityMap(compiled, methods, privateKey, issuer) {
-    const paths = collectMethodPaths(compiled);
-    const out = new Map();
-    for (const bound of methods) {
-        const subject = paths[bound.ref];
-        if (!subject) {
-            // Under the "drift = 0" invariant every dispatched method's ref is a key
-            // in `paths`. A miss means an install/index drift — fail loudly at boot
-            // rather than signing with `bound.ref` (a namespaced ref, NOT a
-            // MethodPath sub), which would silently fail kernel identity matching at
-            // call time. Mirrors `identityFor` / `requireAuxIdentity`.
-            throw new Error(`buildIdentityMap: method "${bound.ref}" is in the dispatch index but absent ` +
-                `from resolveCallables(compiled) — no identity subject to sign with.`);
-        }
-        out.set(bound, { issuer, subject, privateKey });
-    }
-    return out;
-}
-//# sourceMappingURL=identity.js.map