@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/deploy/check.js

@@ -1,82 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { join } from 'node:path';
-import { MetaSchema } from './meta.js';
-/**
- * Validate a deployed worker against local state by fetching `/meta` and
- * verifying sdkCommit / schemaHash / JWKS reachability.
- *
- * Throws on any mismatch. Returns `Meta` on success.
- */
-export async function deployCheck(opts) {
-    // oxlint-disable-next-line no-console
-    const log = opts.log ?? ((line) => console.log(line));
-    const base = opts.url.replace(/\/+$/, '');
-    log(`# deploy:check ${base}`);
-    const meta = await fetchMeta(base);
-    log(`  meta: ${JSON.stringify(meta)}`);
-    // `meta.iss` is required + non-empty by `MetaSchema`, enforced in `fetchMeta`.
-    await Promise.all([
-        checkSdkCommit(meta, opts, log),
-        checkSchemaHash(meta, opts, log),
-        checkJwks(meta.iss, log),
-    ]);
-    return meta;
-}
-async function fetchMeta(base) {
-    const res = await fetch(`${base}/meta`);
-    if (!res.ok)
-        throw new Error(`GET ${base}/meta → ${res.status}`);
-    return MetaSchema.parse(await res.json());
-}
-async function checkSdkCommit(meta, opts, log) {
-    if (!meta.sdkCommit) {
-        log('  ! meta.sdkCommit absent — skipping sdkCommit check');
-        return;
-    }
-    const sdkRepo = opts.sdkRepoPath ?? (opts.workspaceRoot ? join(opts.workspaceRoot, 'sdk') : undefined);
-    if (!sdkRepo) {
-        log(`  ! no sdkRepoPath / workspaceRoot — skipping sdkCommit check`);
-        return;
-    }
-    const localSha = gitHead(sdkRepo);
-    if (!localSha) {
-        log(`  ! could not read git HEAD from ${sdkRepo} — skipping sdkCommit check`);
-        return;
-    }
-    if (!localSha.startsWith(meta.sdkCommit) && !meta.sdkCommit.startsWith(localSha)) {
-        throw new Error(`sdkCommit mismatch: deployed=${meta.sdkCommit} local=${localSha} (${sdkRepo})`);
-    }
-    log(`  ✓ sdkCommit ${meta.sdkCommit} matches local HEAD`);
-}
-async function checkSchemaHash(meta, opts, log) {
-    if (!meta.schemaHash)
-        return;
-    // Fail loud: the worker advertises a schemaHash, so a missing expected value
-    // means we CANNOT verify drift — never silently "pass" an unverified deploy.
-    if (!opts.expectedSchemaHash) {
-        throw new Error(`worker advertises schemaHash=${meta.schemaHash} but no expectedSchemaHash was provided — ` +
-            `cannot verify schema drift (pass expectedSchemaHash, e.g. buildInstallGraphHash(domain, url))`);
-    }
-    if (meta.schemaHash !== opts.expectedSchemaHash) {
-        throw new Error(`schemaHash mismatch: deployed=${meta.schemaHash} local=${opts.expectedSchemaHash}`);
-    }
-    log(`  ✓ schemaHash ${meta.schemaHash} matches local`);
-}
-async function checkJwks(iss, log) {
-    const jwksUrl = `${iss.replace(/\/+$/, '')}/.well-known/jwks.json`;
-    const res = await fetch(jwksUrl);
-    if (!res.ok)
-        throw new Error(`GET ${jwksUrl} → ${res.status}`);
-    const body = (await res.json());
-    const keys = body.keys ?? [];
-    if (keys.length === 0)
-        throw new Error(`${jwksUrl} returned no keys`);
-    log(`  ✓ JWKS resolves (${keys.length} key${keys.length === 1 ? '' : 's'})`);
-}
-function gitHead(repoPath) {
-    const r = spawnSync('git', ['-C', repoPath, 'rev-parse', 'HEAD'], { encoding: 'utf-8' });
-    if (r.status !== 0)
-        return null;
-    return r.stdout.trim();
-}
-//# sourceMappingURL=check.js.map

package/dist/deploy/check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/deploy/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAwBtC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,sCAAsC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAA;IAE7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtC,+EAA+E;IAE/E,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAC/B,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;KACzB,CAAC,CAAA;IAEF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAU,EACV,IAAwB,EACxB,GAA2B;IAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC3D,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,+DAA+D,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,oCAAoC,OAAO,6BAA6B,CAAC,CAAA;QAC7E,OAAM;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,UAAU,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAA;IAClG,CAAC;IACD,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,qBAAqB,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAU,EACV,IAAwB,EACxB,GAA2B;IAE3B,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAM;IAC5B,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,UAAU,4CAA4C;YACzF,+FAA+F,CAClG,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,UAAU,UAAU,IAAI,CAAC,kBAAkB,EAAE,CACpF,CAAA;IACH,CAAC;IACD,GAAG,CAAC,kBAAkB,IAAI,CAAC,UAAU,gBAAgB,CAAC,CAAA;AACxD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,GAA2B;IAC/D,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAA;IAClE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAA;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mBAAmB,CAAC,CAAA;IACrE,GAAG,CAAC,sBAAsB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/B,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/deploy/index.d.ts

@@ -1,3 +0,0 @@
-export { MetaSchema, type Meta } from './meta.js';
-export { deployCheck, type DeployCheckOptions } from './check.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/deploy/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/deploy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/deploy/index.js

@@ -1,3 +0,0 @@
-export { MetaSchema } from './meta.js';
-export { deployCheck } from './check.js';
-//# sourceMappingURL=index.js.map

package/dist/deploy/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/deploy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,WAAW,EAA2B,MAAM,YAAY,CAAA"}

package/dist/deploy/meta.d.ts

@@ -1,29 +0,0 @@
-/**
- * `/meta` payload — the contract between `createRemoteServer` (producer)
- * and `deployCheck` (verifier). Both sides parse through `MetaSchema`, so
- * a new field added here flows to both paths and drift is caught at the
- * boundary rather than silently skipped.
- *
- * Scope: **domain workers only**. Kernels rely on OIDC discovery
- * (`/.well-known/openid-configuration`) + JWKS — they have no `/meta`.
- */
-import { z } from 'zod';
-export declare const MetaSchema: z.ZodObject<{
-    version: z.ZodDefault<z.ZodNumber>;
-    iss: z.ZodString;
-    sdkCommit: z.ZodOptional<z.ZodString>;
-    schemaHash: z.ZodOptional<z.ZodString>;
-    domainName: z.ZodOptional<z.ZodString>;
-    manifest: z.ZodOptional<z.ZodObject<{
-        logo: z.ZodOptional<z.ZodString>;
-        entrypoint: z.ZodOptional<z.ZodString>;
-        roles: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            slug: z.ZodString;
-            name: z.ZodOptional<z.ZodString>;
-            description: z.ZodOptional<z.ZodString>;
-            default: z.ZodOptional<z.ZodBoolean>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type Meta = z.infer<typeof MetaSchema>;
-//# sourceMappingURL=meta.d.ts.map

package/dist/deploy/meta.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../src/deploy/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;iBAmCrB,CAAA;AAEF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA"}

package/dist/deploy/meta.js

@@ -1,45 +0,0 @@
-/**
- * `/meta` payload — the contract between `createRemoteServer` (producer)
- * and `deployCheck` (verifier). Both sides parse through `MetaSchema`, so
- * a new field added here flows to both paths and drift is caught at the
- * boundary rather than silently skipped.
- *
- * Scope: **domain workers only**. Kernels rely on OIDC discovery
- * (`/.well-known/openid-configuration`) + JWKS — they have no `/meta`.
- */
-import { z } from 'zod';
-export const MetaSchema = z.object({
-    // The version of the meta payload. Incremented on any change to the payload
-    version: z.number().int().min(1).default(1),
-    /** Base URL where JWKS is published. Always stamped by `createRemoteServer`
-     *  and required by `deployCheck` to verify JWKS reachability. */
-    iss: z.string().min(1),
-    /** Short git SHA of the SDK used to build the worker. */
-    sdkCommit: z.string().optional(),
-    /** Deterministic hash of the compiled spec (`sha256:<hex>`). */
-    schemaHash: z.string().optional(),
-    /** Local directory name under `kernel/domains/<...>/` — used to auto-resolve the local spec. */
-    domainName: z.string().optional(),
-    /**
-     * Optional presentation metadata declared on the domain (`defineDomain`):
-     * `logo` (inline SVG / `data:` URL), `entrypoint` (a view slug — the domain's
-     * entry surface), and the domain's declared `roles` (registered by a workspace
-     * at app install). Served verbatim so a host UI can brand a freshly-installed
-     * domain.
-     */
-    manifest: z
-        .object({
-        logo: z.string().optional(),
-        entrypoint: z.string().optional(),
-        roles: z
-            .array(z.object({
-            slug: z.string().min(1),
-            name: z.string().optional(),
-            description: z.string().optional(),
-            default: z.boolean().optional(),
-        }))
-            .optional(),
-    })
-        .optional(),
-});
-//# sourceMappingURL=meta.js.map

package/dist/deploy/meta.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../src/deploy/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C;qEACiE;IACjE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gGAAgG;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAChC,CAAC,CACH;aACA,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAA"}

package/dist/dispatch/authorize.d.ts

@@ -1,14 +0,0 @@
-/**
- * Shared `authorize`-hook runner.
- *
- * Both the method dispatcher (`dispatcher.ts`) and the worker-side aux routes
- * (`server/auxiliary-routes.ts`) let an author deny a call by throwing from an
- * `authorize` hook. They MUST agree on the wire semantics: an already-typed
- * `AuthorizationDeniedError` passes through unchanged (so callers can attach
- * hints), and any other thrown error is wrapped into `AuthorizationDeniedError`
- * (→ `PERMISSION_DENIED` / HTTP 403). Centralised here so the two call sites
- * cannot drift — previously the aux routes awaited `authorize` directly, so a
- * plain `Error` thrown to deny leaked out as a 500 instead of a 403.
- */
-export declare function runAuthorize<C>(hook: (ctx: C) => void | Promise<void>, ctx: C): Promise<void>;
-//# sourceMappingURL=authorize.d.ts.map

package/dist/dispatch/authorize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/dispatch/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACtC,GAAG,EAAE,CAAC,GACL,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/dispatch/authorize.js

@@ -1,24 +0,0 @@
-/**
- * Shared `authorize`-hook runner.
- *
- * Both the method dispatcher (`dispatcher.ts`) and the worker-side aux routes
- * (`server/auxiliary-routes.ts`) let an author deny a call by throwing from an
- * `authorize` hook. They MUST agree on the wire semantics: an already-typed
- * `AuthorizationDeniedError` passes through unchanged (so callers can attach
- * hints), and any other thrown error is wrapped into `AuthorizationDeniedError`
- * (→ `PERMISSION_DENIED` / HTTP 403). Centralised here so the two call sites
- * cannot drift — previously the aux routes awaited `authorize` directly, so a
- * plain `Error` thrown to deny leaked out as a 500 instead of a 403.
- */
-import { AuthorizationDeniedError } from './errors.js';
-export async function runAuthorize(hook, ctx) {
-    try {
-        await hook(ctx);
-    }
-    catch (err) {
-        if (err instanceof AuthorizationDeniedError)
-            throw err;
-        throw new AuthorizationDeniedError(err instanceof Error ? err.message : 'Authorization denied', err);
-    }
-}
-//# sourceMappingURL=authorize.js.map

package/dist/dispatch/authorize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/dispatch/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAEtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsC,EACtC,GAAM;IAEN,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB;YAAE,MAAM,GAAG,CAAA;QACtD,MAAM,IAAI,wBAAwB,CAChC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,EAC3D,GAAG,CACJ,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/dispatch/dispatcher.d.ts

@@ -1,59 +0,0 @@
-/**
- * `SdkDispatcher` — implements direct KernelAPI calls and hosted invocations
- * through the same SDK execution pipeline.
- *
- * Built once at server startup from the domain's `CompiledDomain` plus a typed
- * deps container and a private JWK. Per-method identity configs are
- * pre-resolved into a Map so dispatch is O(1) per call.
- *
- * Pipeline per call:
- *   resolve method → authenticate → validate → resolve self → execute
- */
-import type { AuthedKernelAPI, DispatchResult, KernelAPI } from '@astrale-os/kernel-api';
-import type { CredentialInput, Path } from '@astrale-os/kernel-core';
-import type { CompiledDomain } from '@astrale-os/kernel-core/domain';
-import type { Invocation, Capabilities, Dispatcher } from '@astrale-os/kernel-server';
-import type { MethodIndex } from './resolve.js';
-export type SdkDispatcherConfig<TDeps> = {
-    /** The compiled domain — source of the method layout and origin-addressed subs. */
-    compiled: CompiledDomain;
-    /** Pre-built method map: ref → BoundMethod. */
-    methods: MethodIndex;
-    /** Dependency container injected into every handler. */
-    deps: TDeps;
-    /** Private key for signing outbound per-function credentials. */
-    privateKey: JsonWebKey;
-    /**
-     * The worker's identity (`iss`) for outbound per-function credentials — its
-     * serving URL (e.g. `https://crm.test.com`), DECOUPLED from the domain's
-     * addressing `origin`. Matches the `iss` the kernel pins on each node at
-     * install (the URL it fetched the domain at).
-     */
-    issuer: string;
-    /** The worker's serving URL (`config.url`) — exposed to handlers as `ctx.env.url`. */
-    url: string;
-};
-export declare class SdkDispatcher<TDeps = unknown> implements KernelAPI, Dispatcher {
-    private readonly methods;
-    private readonly deps;
-    private readonly identities;
-    private readonly issuer;
-    private readonly url;
-    private readonly privateKey;
-    /** Built once from the compiled domain — drives typed self and handler kernel binding. */
-    private readonly binder;
-    constructor(config: SdkDispatcherConfig<TDeps>);
-    call(path: Path | string, credential: CredentialInput, params: unknown, self?: string): Promise<unknown>;
-    stream(path: Path | string, credential: CredentialInput, params: unknown, self?: string): Promise<AsyncGenerator<unknown>>;
-    /**
-     * SDK dispatch never redirects — the SDK server IS the remote destination.
-     * Every call resolves locally; we just classify the return as value or stream
-     * and hand it back to the invocation host.
-     */
-    dispatch(path: Path | string, credential: CredentialInput, params: unknown, self?: string): Promise<DispatchResult>;
-    invoke(invocation: Invocation, caps: Capabilities): Promise<DispatchResult>;
-    as(credential: CredentialInput): AuthedKernelAPI;
-    private run;
-    private identityFor;
-}
-//# sourceMappingURL=dispatcher.d.ts.map

package/dist/dispatch/dispatcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/dispatch/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGxF,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,gCAAgC,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAOrF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAc/C,MAAM,MAAM,mBAAmB,CAAC,KAAK,IAAI;IACvC,mFAAmF;IACnF,QAAQ,EAAE,cAAc,CAAA;IACxB,+CAA+C;IAC/C,OAAO,EAAE,WAAW,CAAA;IACpB,wDAAwD;IACxD,IAAI,EAAE,KAAK,CAAA;IACX,iEAAiE;IACjE,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,qBAAa,aAAa,CAAC,KAAK,GAAG,OAAO,CAAE,YAAW,SAAS,EAAE,UAAU;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0D;IACrF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAElE,YAAY,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAa7C;IAEK,IAAI,CACR,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;IAEK,MAAM,CACV,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAMlC;IAED;;;;OAIG;IACG,QAAQ,CACZ,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,CAAC,CAOzB;IAEK,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAKhF;IAED,EAAE,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAK/C;YAEa,GAAG;IA+GjB,OAAO,CAAC,WAAW;CAapB"}

package/dist/dispatch/dispatcher.js

@@ -1,237 +0,0 @@
-/**
- * `SdkDispatcher` — implements direct KernelAPI calls and hosted invocations
- * through the same SDK execution pipeline.
- *
- * Built once at server startup from the domain's `CompiledDomain` plus a typed
- * deps container and a private JWK. Per-method identity configs are
- * pre-resolved into a Map so dispatch is O(1) per call.
- *
- * Pipeline per call:
- *   resolve method → authenticate → validate → resolve self → execute
- */
-import { createNodeBinder } from '@astrale-os/kernel-client/schema';
-import { executeInvocation } from '@astrale-os/kernel-server';
-import { makeFunctionContext } from '../auth/function-context.js';
-import { makeDomainAuthority } from '../auth/issuer-mint.js';
-import { resolveInboundAuth } from '../auth/resolve.js';
-import { createInlineStep } from '../step/index.js';
-import { runAuthorize } from './authorize.js';
-import { MethodNotFoundError, SdkResultValidationError, SdkValidationError } from './errors.js';
-import { executeHandler } from './execute.js';
-import { buildIdentityMap } from './identity.js';
-import { resolveMethod } from './resolve.js';
-import { resolveSelf, withBoundNode } from './self.js';
-import { validateParams, validateResult } from './validate.js';
-export class SdkDispatcher {
-    methods;
-    deps;
-    identities;
-    issuer;
-    url;
-    privateKey;
-    /** Built once from the compiled domain — drives typed self and handler kernel binding. */
-    binder;
-    constructor(config) {
-        this.methods = config.methods;
-        this.deps = config.deps;
-        this.issuer = config.issuer;
-        this.url = config.url;
-        this.privateKey = config.privateKey;
-        this.binder = createNodeBinder(config.compiled.$.schema);
-        const methodList = Array.from(new Set(config.methods.values()));
-        const identityMethods = methodList.filter((bound) => methodAuthPolicy(bound) !== 'public');
-        this.identities =
-            identityMethods.length > 0
-                ? buildIdentityMap(config.compiled, identityMethods, config.privateKey, config.issuer)
-                : new Map();
-    }
-    async call(path, credential, params, self) {
-        const result = await this.dispatch(path, credential, params, self);
-        switch (result.kind) {
-            case 'value':
-                return result.value;
-            case 'stream':
-                return result.generator;
-            case 'redirect':
-                throw new Error(`SdkDispatcher cannot redirect "${pathToString(path)}"`);
-        }
-    }
-    async stream(path, credential, params, self) {
-        const result = await this.dispatch(path, credential, params, self);
-        if (result.kind !== 'stream') {
-            throw new Error(`Method "${pathToString(path)}" did not return an async generator`);
-        }
-        return result.generator;
-    }
-    /**
-     * SDK dispatch never redirects — the SDK server IS the remote destination.
-     * Every call resolves locally; we just classify the return as value or stream
-     * and hand it back to the invocation host.
-     */
-    async dispatch(path, credential, params, self) {
-        return executeInvocation(this, {
-            path,
-            credential,
-            params,
-            ...(self === undefined ? {} : { self }),
-        });
-    }
-    async invoke(invocation, caps) {
-        const result = await this.run(invocation, caps);
-        return isAsyncGenerator(result)
-            ? { kind: 'stream', generator: result }
-            : { kind: 'value', value: result };
-    }
-    as(credential) {
-        return {
-            call: (path, params) => this.call(path, credential, params),
-            stream: (path, params) => this.stream(path, credential, params),
-        };
-    }
-    async run(invocation, caps) {
-        const { path, credential, params, self: selfRef } = invocation;
-        const method = pathToString(path);
-        const bound = resolveMethod(this.methods, method);
-        if (!bound)
-            throw new MethodNotFoundError(method);
-        const authPolicy = bound.handler.auth ?? 'required';
-        const fnIdentity = this.identityFor(bound);
-        const { auth, kernel: rawKernel } = await resolveInboundAuth(credential, authPolicy, fnIdentity);
-        const kernel = rawKernel?.withSchema(this.binder.schema) ?? null;
-        if (typeof params !== 'object' || params === null || Array.isArray(params)) {
-            throw new SdkValidationError([{ path: [], message: 'Params must be a plain object' }]);
-        }
-        const validation = validateParams(bound.inputSchema, params);
-        if (!validation.ok) {
-            throw new SdkValidationError(validation.issues);
-        }
-        // `undefined` (not `null`) for static methods — matches the `self` type on
-        // `RemoteContext` / `MethodImpl`, which is `undefined` for static methods.
-        let parsedSelf;
-        if (!bound.isStatic) {
-            if (selfRef === undefined || selfRef === null || selfRef === '') {
-                throw new SdkValidationError([{ path: ['self'], message: 'Required for non-static method' }], `"${bound.owner}.${bound.method}" is an instance method — it needs a target node. ` +
-                    `Either call it via instance dispatch (e.g. "@<nodeId>::${bound.method}" ` +
-                    `or "/path/to/node::${bound.method}"), or pass "self" as the fourth ` +
-                    `dispatch argument (e.g. "@<nodeId>").`);
-            }
-            try {
-                parsedSelf = resolveSelf(String(selfRef));
-            }
-            catch (err) {
-                // A malformed caller-supplied `self` is bad client input, not a server
-                // fault — surface it as VALIDATION_ERROR (422), matching the sibling
-                // missing-self branch above, instead of INTERNAL_ERROR (500).
-                throw new SdkValidationError([
-                    {
-                        path: ['self'],
-                        message: err instanceof Error ? err.message : 'Failed to resolve self',
-                    },
-                ], `Invalid "self" target "${selfRef}": ${err instanceof Error ? err.message : 'unparseable path'}`);
-            }
-        }
-        const handler = bound.handler;
-        const handlerParams = validation.data;
-        // Enrich the parsed self with the lazy `node()` accessor, bound to this
-        // request's kernel (null when the auth policy yields none — `node()` then
-        // rejects). Done here, not in `resolveSelf`, so the parse stays kernel-free.
-        const self = parsedSelf
-            ? withBoundNode(parsedSelf, kernel, this.binder, bound.owner)
-            : undefined;
-        const inboundIss = auth?.credential?.verified?.iss;
-        const kernelUrl = kernel?.default ?? inboundIss;
-        const caller = auth && inboundIss
-            ? {
-                iss: inboundIss,
-                url: kernelUrl ?? inboundIss,
-            }
-            : undefined;
-        const ctx = {
-            params: handlerParams,
-            auth,
-            self,
-            deps: this.deps,
-            env: { url: this.url },
-            kernel,
-            ...(caller !== undefined ? { caller } : {}),
-            domain: makeDomainAuthority(fnIdentity),
-            fn: makeFunctionContext(fnIdentity, this.deps, {
-                ref: bound.ref,
-                ...(kernelUrl !== undefined ? { defaultKernelUrl: kernelUrl } : {}),
-            }),
-        };
-        if (handler.authorize)
-            await runAuthorize(handler.authorize, ctx);
-        const result = await executeHandler({
-            handler,
-            ref: bound.ref,
-            ...ctx,
-            step: createInlineStep({
-                scope: {
-                    kind: 'method',
-                    ref: bound.ref,
-                    owner: bound.owner,
-                    method: bound.method,
-                },
-            }),
-            defer: caps.defer,
-            sleep: caps.sleep,
-        });
-        if (isAsyncGenerator(result)) {
-            return validateOutputStream(bound, result);
-        }
-        return validateOutput(bound, result);
-    }
-    identityFor(bound) {
-        const identity = this.identities.get(bound);
-        if (!identity) {
-            if (methodAuthPolicy(bound) === 'public') {
-                return { issuer: this.issuer, subject: bound.ref, privateKey: this.privateKey };
-            }
-            throw new Error(`SdkDispatcher: no identity config for "${bound.owner}.${bound.method}" — ` +
-                `method is registered in the index but missing from the identity map.`);
-        }
-        return identity;
-    }
-}
-function methodAuthPolicy(bound) {
-    return bound.handler.auth ?? 'required';
-}
-function pathToString(path) {
-    return typeof path === 'string' ? path : path.raw;
-}
-/**
- * Validate a handler's output against `bound.outputSchema`, mirroring the
- * kernel's dispatcher (`runtime/.../dispatcher.ts` + `events.ts`):
- *   - `binary` outputs skip validation (no schema applies).
- *   - async-generator outputs (`output: 'stream'`) are wrapped so each chunk
- *     is validated as it is yielded.
- *   - all other (`value`) outputs are validated once and returned parsed.
- * Returns the synchronous shape (value or generator) so the caller's
- * `dispatch()` can classify it without awaiting a stream to completion.
- */
-function validateOutput(bound, result) {
-    if (bound.output === 'binary')
-        return result;
-    return validateChunk(bound, result);
-}
-async function* validateOutputStream(bound, gen) {
-    for await (const chunk of gen) {
-        yield validateChunk(bound, chunk);
-    }
-}
-/** Parse one output value against `bound.outputSchema` or throw a 500-class error. */
-function validateChunk(bound, value) {
-    const out = validateResult(bound.outputSchema, value);
-    if (!out.ok) {
-        throw new SdkResultValidationError(out.issues, bound.ref);
-    }
-    return out.data;
-}
-function isAsyncGenerator(value) {
-    return (value !== null &&
-        value !== undefined &&
-        typeof value === 'object' &&
-        Symbol.asyncIterator in value);
-}
-//# sourceMappingURL=dispatcher.js.map

package/dist/dispatch/dispatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/dispatch/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAM7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAmB,MAAM,WAAW,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAsB9D,MAAM,OAAO,aAAa;IACP,OAAO,CAAa;IACpB,IAAI,CAAO;IACX,UAAU,CAA0D;IACpE,MAAM,CAAQ;IACd,GAAG,CAAQ;IACX,UAAU,CAAY;IACvC,0FAA0F;IACzE,MAAM,CAA2C;IAElE,YAAY,MAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU;YACb,eAAe,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtF,CAAC,CAAC,IAAI,GAAG,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAClE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,SAAS,CAAA;YACzB,KAAK,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAClE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAC,SAAS,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,IAAmB,EACnB,UAA2B,EAC3B,MAAe,EACf,IAAa;QAEb,OAAO,iBAAiB,CAAC,IAAI,EAAE;YAC7B,IAAI;YACJ,UAAU;YACV,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAsB,EAAE,IAAkB;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO,gBAAgB,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAED,EAAE,CAAC,UAA2B;QAC5B,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;YAC3D,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;SAChE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,UAAsB,EAAE,IAAkB;QAC1D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;QAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,UAAU,GAAgB,KAAK,CAAC,OAAiC,CAAC,IAAI,IAAI,UAAU,CAAA;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAChG,MAAM,MAAM,GAAG,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;QAEhE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAsC,CAAC,CAAA;QACjF,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,UAAkC,CAAA;QACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAC/D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,oDAAoD;oBACjF,0DAA0D,KAAK,CAAC,MAAM,IAAI;oBAC1E,sBAAsB,KAAK,CAAC,MAAM,mCAAmC;oBACrE,uCAAuC,CAC1C,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,qEAAqE;gBACrE,8DAA8D;gBAC9D,MAAM,IAAI,kBAAkB,CAC1B;oBACE;wBACE,IAAI,EAAE,CAAC,MAAM,CAAC;wBACd,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;qBACvE;iBACF,EACD,0BAA0B,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,EAAE,CACjG,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAGrB,CAAA;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAA;QACrC,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAyB,CAAA;QACxE,MAAM,SAAS,GAAG,MAAM,EAAE,OAAO,IAAI,UAAU,CAAA;QAC/C,MAAM,MAAM,GACV,IAAI,IAAI,UAAU;YAChB,CAAC,CAAC;gBACE,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,SAAS,IAAI,UAAU;aAC7B;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,GAAG,GAAG;YACV,MAAM,EAAE,aAAa;YACrB,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,MAAM;YACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACvC,EAAE,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC;SACH,CAAA;QAED,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,GAAG;YACN,IAAI,EAAE,gBAAgB,CAAC;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB;aACF,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAA;QAEF,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAEO,WAAW,CAAC,KAAoC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjF,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,MAAM;gBACzE,sEAAsE,CACzE,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,OAAQ,KAAK,CAAC,OAAiC,CAAC,IAAI,IAAI,UAAU,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAuC;IAC3D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,KAAoC,EAAE,MAAe;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC5C,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AACrC,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,oBAAoB,CAClC,KAAoC,EACpC,GAA4B;IAE5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,KAAoC,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAA4C,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,aAAa,IAAI,KAAK,CAC9B,CAAA;AACH,CAAC"}

package/dist/dispatch/errors.d.ts

@@ -1,47 +0,0 @@
-/**
- * Errors thrown by the dispatch pipeline.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api';
-/** A single Zod issue, normalized to the path/message the payload carries. */
-type ValidationIssue = {
-    path: (string | number)[];
-    message: string;
-};
-export declare class MethodNotFoundError extends Error implements KernelErrorClassifiable {
-    constructor(method: string);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export declare class SdkValidationError extends Error implements KernelErrorClassifiable {
-    readonly issues: ValidationIssue[];
-    constructor(issues: ValidationIssue[], message?: string);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-/**
- * Thrown when a handler's return value (or a stream chunk) fails validation
- * against its `outputSchema`. This is a server/handler fault — the author's
- * code produced data that violates its own declared contract — so it maps to
- * `INTERNAL_ERROR` (→ HTTP 500), NOT the `VALIDATION_ERROR` (422) used for
- * bad caller input. Mirrors the kernel's `ResultValidationError`.
- */
-export declare class SdkResultValidationError extends Error implements KernelErrorClassifiable {
-    readonly issues: ValidationIssue[];
-    readonly ref?: string | undefined;
-    constructor(issues: ValidationIssue[], ref?: string | undefined);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-/**
- * Thrown by a `RemoteHandler.authorize` hook to deny a call.
- *
- * Wraps any error the hook throws — handlers can throw a plain `Error` and
- * the dispatcher converts it. Already-typed `AuthorizationDeniedError`
- * instances are passed through unchanged so callers can attach hints.
- */
-export declare class AuthorizationDeniedError extends Error implements KernelErrorClassifiable {
-    constructor(message: string, cause?: unknown);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export {};
-//# sourceMappingURL=errors.d.ts.map

package/dist/dispatch/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/dispatch/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAIzF,8EAA8E;AAC9E,KAAK,eAAe,GAAG;IAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAWrE,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,uBAAuB;IAC/E,YAAY,MAAM,EAAE,MAAM,EAGzB;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF;AAED,qBAAa,kBAAmB,SAAQ,KAAM,YAAW,uBAAuB;IAE5E,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;IADpC,YACW,MAAM,EAAE,eAAe,EAAE,EAClC,OAAO,CAAC,EAAE,MAAM,EAIjB;IAED,oBAAoB,IAAI,kBAAkB,CAMzC;CACF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAM,YAAW,uBAAuB;IAElF,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAFvB,YACW,MAAM,EAAE,eAAe,EAAE,EACzB,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;IAED,oBAAoB,IAAI,kBAAkB,CAMzC;CACF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAM,YAAW,uBAAuB;IACpF,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAG3C;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF"}