@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/src/dispatch/dispatcher.ts

@@ -1,321 +0,0 @@
-/**
- * `SdkDispatcher` — implements direct KernelAPI calls and hosted invocations
- * through the same SDK execution pipeline.
- *
- * Built once at server startup from the domain's `CompiledDomain` plus a typed
- * deps container and a private JWK. Per-method identity configs are
- * pre-resolved into a Map so dispatch is O(1) per call.
- *
- * Pipeline per call:
- *   resolve method → authenticate → validate → resolve self → execute
- */
-
-import type { AuthedKernelAPI, DispatchResult, KernelAPI } from '@astrale-os/kernel-api'
-import type { AuthPolicy } from '@astrale-os/kernel-api/routed'
-import type { NodeBinder } from '@astrale-os/kernel-client/schema'
-import type { CredentialInput, Path } from '@astrale-os/kernel-core'
-import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain'
-import type { Invocation, Capabilities, Dispatcher } from '@astrale-os/kernel-server'
-
-import { createNodeBinder } from '@astrale-os/kernel-client/schema'
-import { executeInvocation } from '@astrale-os/kernel-server'
-
-import type { RemoteIdentityConfig } from '../auth/identity.js'
-import type { AnyRemoteHandler } from '../method/single.js'
-import type { MethodIndex } from './resolve.js'
-
-import { makeFunctionContext } from '../auth/function-context.js'
-import { makeDomainAuthority } from '../auth/issuer-mint.js'
-import { resolveInboundAuth } from '../auth/resolve.js'
-import { createInlineStep } from '../step/index.js'
-import { runAuthorize } from './authorize.js'
-import { MethodNotFoundError, SdkResultValidationError, SdkValidationError } from './errors.js'
-import { executeHandler } from './execute.js'
-import { buildIdentityMap } from './identity.js'
-import { resolveMethod } from './resolve.js'
-import { resolveSelf, withBoundNode, type ParsedSelf } from './self.js'
-import { validateParams, validateResult } from './validate.js'
-
-export type SdkDispatcherConfig<TDeps> = {
-  /** The compiled domain — source of the method layout and origin-addressed subs. */
-  compiled: CompiledDomain
-  /** Pre-built method map: ref → BoundMethod. */
-  methods: MethodIndex
-  /** Dependency container injected into every handler. */
-  deps: TDeps
-  /** Private key for signing outbound per-function credentials. */
-  privateKey: JsonWebKey
-  /**
-   * The worker's identity (`iss`) for outbound per-function credentials — its
-   * serving URL (e.g. `https://crm.test.com`), DECOUPLED from the domain's
-   * addressing `origin`. Matches the `iss` the kernel pins on each node at
-   * install (the URL it fetched the domain at).
-   */
-  issuer: string
-  /** The worker's serving URL (`config.url`) — exposed to handlers as `ctx.env.url`. */
-  url: string
-}
-
-export class SdkDispatcher<TDeps = unknown> implements KernelAPI, Dispatcher {
-  private readonly methods: MethodIndex
-  private readonly deps: TDeps
-  private readonly identities: Map<BoundMethod<AnyRemoteHandler>, RemoteIdentityConfig>
-  private readonly issuer: string
-  private readonly url: string
-  private readonly privateKey: JsonWebKey
-  /** Built once from the compiled domain — drives typed self and handler kernel binding. */
-  private readonly binder: NodeBinder<CompiledDomain['$']['schema']>
-
-  constructor(config: SdkDispatcherConfig<TDeps>) {
-    this.methods = config.methods
-    this.deps = config.deps
-    this.issuer = config.issuer
-    this.url = config.url
-    this.privateKey = config.privateKey
-    this.binder = createNodeBinder(config.compiled.$.schema)
-    const methodList = Array.from(new Set(config.methods.values()))
-    const identityMethods = methodList.filter((bound) => methodAuthPolicy(bound) !== 'public')
-    this.identities =
-      identityMethods.length > 0
-        ? buildIdentityMap(config.compiled, identityMethods, config.privateKey, config.issuer)
-        : new Map()
-  }
-
-  async call(
-    path: Path | string,
-    credential: CredentialInput,
-    params: unknown,
-    self?: string,
-  ): Promise<unknown> {
-    const result = await this.dispatch(path, credential, params, self)
-    switch (result.kind) {
-      case 'value':
-        return result.value
-      case 'stream':
-        return result.generator
-      case 'redirect':
-        throw new Error(`SdkDispatcher cannot redirect "${pathToString(path)}"`)
-    }
-  }
-
-  async stream(
-    path: Path | string,
-    credential: CredentialInput,
-    params: unknown,
-    self?: string,
-  ): Promise<AsyncGenerator<unknown>> {
-    const result = await this.dispatch(path, credential, params, self)
-    if (result.kind !== 'stream') {
-      throw new Error(`Method "${pathToString(path)}" did not return an async generator`)
-    }
-    return result.generator
-  }
-
-  /**
-   * SDK dispatch never redirects — the SDK server IS the remote destination.
-   * Every call resolves locally; we just classify the return as value or stream
-   * and hand it back to the invocation host.
-   */
-  async dispatch(
-    path: Path | string,
-    credential: CredentialInput,
-    params: unknown,
-    self?: string,
-  ): Promise<DispatchResult> {
-    return executeInvocation(this, {
-      path,
-      credential,
-      params,
-      ...(self === undefined ? {} : { self }),
-    })
-  }
-
-  async invoke(invocation: Invocation, caps: Capabilities): Promise<DispatchResult> {
-    const result = await this.run(invocation, caps)
-    return isAsyncGenerator(result)
-      ? { kind: 'stream', generator: result }
-      : { kind: 'value', value: result }
-  }
-
-  as(credential: CredentialInput): AuthedKernelAPI {
-    return {
-      call: (path, params) => this.call(path, credential, params),
-      stream: (path, params) => this.stream(path, credential, params),
-    }
-  }
-
-  private async run(invocation: Invocation, caps: Capabilities): Promise<unknown> {
-    const { path, credential, params, self: selfRef } = invocation
-    const method = pathToString(path)
-    const bound = resolveMethod(this.methods, method)
-    if (!bound) throw new MethodNotFoundError(method)
-
-    const authPolicy: AuthPolicy = (bound.handler as { auth?: AuthPolicy }).auth ?? 'required'
-    const fnIdentity = this.identityFor(bound)
-    const { auth, kernel: rawKernel } = await resolveInboundAuth(credential, authPolicy, fnIdentity)
-    const kernel = rawKernel?.withSchema(this.binder.schema) ?? null
-
-    if (typeof params !== 'object' || params === null || Array.isArray(params)) {
-      throw new SdkValidationError([{ path: [], message: 'Params must be a plain object' }])
-    }
-    const validation = validateParams(bound.inputSchema, params)
-    if (!validation.ok) {
-      throw new SdkValidationError(validation.issues as SdkValidationError['issues'])
-    }
-
-    // `undefined` (not `null`) for static methods — matches the `self` type on
-    // `RemoteContext` / `MethodImpl`, which is `undefined` for static methods.
-    let parsedSelf: ParsedSelf | undefined
-    if (!bound.isStatic) {
-      if (selfRef === undefined || selfRef === null || selfRef === '') {
-        throw new SdkValidationError(
-          [{ path: ['self'], message: 'Required for non-static method' }],
-          `"${bound.owner}.${bound.method}" is an instance method — it needs a target node. ` +
-            `Either call it via instance dispatch (e.g. "@<nodeId>::${bound.method}" ` +
-            `or "/path/to/node::${bound.method}"), or pass "self" as the fourth ` +
-            `dispatch argument (e.g. "@<nodeId>").`,
-        )
-      }
-      try {
-        parsedSelf = resolveSelf(String(selfRef))
-      } catch (err) {
-        // A malformed caller-supplied `self` is bad client input, not a server
-        // fault — surface it as VALIDATION_ERROR (422), matching the sibling
-        // missing-self branch above, instead of INTERNAL_ERROR (500).
-        throw new SdkValidationError(
-          [
-            {
-              path: ['self'],
-              message: err instanceof Error ? err.message : 'Failed to resolve self',
-            },
-          ],
-          `Invalid "self" target "${selfRef}": ${err instanceof Error ? err.message : 'unparseable path'}`,
-        )
-      }
-    }
-
-    const handler = bound.handler as {
-      execute: (...args: unknown[]) => unknown
-      authorize?: (ctx: unknown) => void | Promise<void>
-    }
-    const handlerParams = validation.data
-    // Enrich the parsed self with the lazy `node()` accessor, bound to this
-    // request's kernel (null when the auth policy yields none — `node()` then
-    // rejects). Done here, not in `resolveSelf`, so the parse stays kernel-free.
-    const self = parsedSelf
-      ? withBoundNode(parsedSelf, kernel, this.binder, bound.owner)
-      : undefined
-    const inboundIss = auth?.credential?.verified?.iss as string | undefined
-    const kernelUrl = kernel?.default ?? inboundIss
-    const caller =
-      auth && inboundIss
-        ? {
-            iss: inboundIss,
-            url: kernelUrl ?? inboundIss,
-          }
-        : undefined
-
-    const ctx = {
-      params: handlerParams,
-      auth,
-      self,
-      deps: this.deps,
-      env: { url: this.url },
-      kernel,
-      ...(caller !== undefined ? { caller } : {}),
-      domain: makeDomainAuthority(fnIdentity),
-      fn: makeFunctionContext(fnIdentity, this.deps, {
-        ref: bound.ref,
-        ...(kernelUrl !== undefined ? { defaultKernelUrl: kernelUrl } : {}),
-      }),
-    }
-
-    if (handler.authorize) await runAuthorize(handler.authorize, ctx)
-
-    const result = await executeHandler({
-      handler,
-      ref: bound.ref,
-      ...ctx,
-      step: createInlineStep({
-        scope: {
-          kind: 'method',
-          ref: bound.ref,
-          owner: bound.owner,
-          method: bound.method,
-        },
-      }),
-      defer: caps.defer,
-      sleep: caps.sleep,
-    })
-
-    if (isAsyncGenerator(result)) {
-      return validateOutputStream(bound, result)
-    }
-
-    return validateOutput(bound, result)
-  }
-
-  private identityFor(bound: BoundMethod<AnyRemoteHandler>): RemoteIdentityConfig {
-    const identity = this.identities.get(bound)
-    if (!identity) {
-      if (methodAuthPolicy(bound) === 'public') {
-        return { issuer: this.issuer, subject: bound.ref, privateKey: this.privateKey }
-      }
-      throw new Error(
-        `SdkDispatcher: no identity config for "${bound.owner}.${bound.method}" — ` +
-          `method is registered in the index but missing from the identity map.`,
-      )
-    }
-    return identity
-  }
-}
-
-function methodAuthPolicy(bound: BoundMethod<AnyRemoteHandler>): AuthPolicy {
-  return (bound.handler as { auth?: AuthPolicy }).auth ?? 'required'
-}
-
-function pathToString(path: string | { readonly raw: string }): string {
-  return typeof path === 'string' ? path : path.raw
-}
-
-/**
- * Validate a handler's output against `bound.outputSchema`, mirroring the
- * kernel's dispatcher (`runtime/.../dispatcher.ts` + `events.ts`):
- *   - `binary` outputs skip validation (no schema applies).
- *   - async-generator outputs (`output: 'stream'`) are wrapped so each chunk
- *     is validated as it is yielded.
- *   - all other (`value`) outputs are validated once and returned parsed.
- * Returns the synchronous shape (value or generator) so the caller's
- * `dispatch()` can classify it without awaiting a stream to completion.
- */
-function validateOutput(bound: BoundMethod<AnyRemoteHandler>, result: unknown): unknown {
-  if (bound.output === 'binary') return result
-  return validateChunk(bound, result)
-}
-
-async function* validateOutputStream(
-  bound: BoundMethod<AnyRemoteHandler>,
-  gen: AsyncGenerator<unknown>,
-): AsyncGenerator<unknown> {
-  for await (const chunk of gen) {
-    yield validateChunk(bound, chunk)
-  }
-}
-
-/** Parse one output value against `bound.outputSchema` or throw a 500-class error. */
-function validateChunk(bound: BoundMethod<AnyRemoteHandler>, value: unknown): unknown {
-  const out = validateResult(bound.outputSchema, value)
-  if (!out.ok) {
-    throw new SdkResultValidationError(out.issues as SdkResultValidationError['issues'], bound.ref)
-  }
-  return out.data
-}
-
-function isAsyncGenerator(value: unknown): value is AsyncGenerator<unknown> {
-  return (
-    value !== null &&
-    value !== undefined &&
-    typeof value === 'object' &&
-    Symbol.asyncIterator in value
-  )
-}

package/src/dispatch/errors.ts

@@ -1,94 +0,0 @@
-/**
- * Errors thrown by the dispatch pipeline.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api'
-
-import { KERNEL_ERROR_CODES } from '@astrale-os/kernel-api'
-
-/** A single Zod issue, normalized to the path/message the payload carries. */
-type ValidationIssue = { path: (string | number)[]; message: string }
-
-/** Shape Zod issues into the `data.errors` array of a `KernelErrorPayload`. */
-function toPayloadErrors(issues: ValidationIssue[]): Array<{
-  path: (string | number)[]
-  code: 'INVALID'
-  message: string
-}> {
-  return issues.map((i) => ({ path: i.path, code: 'INVALID', message: i.message }))
-}
-
-export class MethodNotFoundError extends Error implements KernelErrorClassifiable {
-  constructor(method: string) {
-    super(`Method not found: ${method}`)
-    this.name = 'MethodNotFoundError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return { code: KERNEL_ERROR_CODES.METHOD_NOT_FOUND, message: this.message }
-  }
-}
-
-export class SdkValidationError extends Error implements KernelErrorClassifiable {
-  constructor(
-    readonly issues: ValidationIssue[],
-    message?: string,
-  ) {
-    super(message ?? 'Invalid params')
-    this.name = 'SdkValidationError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return {
-      code: KERNEL_ERROR_CODES.VALIDATION_ERROR,
-      message: this.message,
-      data: { errors: toPayloadErrors(this.issues) },
-    }
-  }
-}
-
-/**
- * Thrown when a handler's return value (or a stream chunk) fails validation
- * against its `outputSchema`. This is a server/handler fault — the author's
- * code produced data that violates its own declared contract — so it maps to
- * `INTERNAL_ERROR` (→ HTTP 500), NOT the `VALIDATION_ERROR` (422) used for
- * bad caller input. Mirrors the kernel's `ResultValidationError`.
- */
-export class SdkResultValidationError extends Error implements KernelErrorClassifiable {
-  constructor(
-    readonly issues: ValidationIssue[],
-    readonly ref?: string,
-  ) {
-    super(`Function${ref ? ` "${ref}"` : ''} returned an invalid result`)
-    this.name = 'SdkResultValidationError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return {
-      code: KERNEL_ERROR_CODES.INTERNAL_ERROR,
-      message: this.message,
-      data: { errors: toPayloadErrors(this.issues) },
-    }
-  }
-}
-
-/**
- * Thrown by a `RemoteHandler.authorize` hook to deny a call.
- *
- * Wraps any error the hook throws — handlers can throw a plain `Error` and
- * the dispatcher converts it. Already-typed `AuthorizationDeniedError`
- * instances are passed through unchanged so callers can attach hints.
- */
-export class AuthorizationDeniedError extends Error implements KernelErrorClassifiable {
-  constructor(message: string, cause?: unknown) {
-    super(message, { cause })
-    this.name = 'AuthorizationDeniedError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return { code: KERNEL_ERROR_CODES.PERMISSION_DENIED, message: this.message }
-  }
-}

package/src/dispatch/execute.ts

@@ -1,67 +0,0 @@
-/**
- * Handler execution — pipeline step 4.
- *
- * Calls the resolved handler's `execute` with a fully assembled
- * `RemoteContext`: validated params, auth context, optional bound self,
- * typed deps, and a kernel `BoundClientSessionView`. The handler may return a
- * value, a Promise, or an async generator (for `output: 'stream'`).
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { AuthContext } from '@astrale-os/kernel-core'
-import type { Defer, Sleep } from '@astrale-os/kernel-server'
-
-import type { FunctionContextApi } from '../auth/function-context.js'
-import type { DomainAuthority } from '../auth/issuer-mint.js'
-import type { CallerContext, RemoteEnv } from '../method/context.js'
-import type { Step } from '../step/index.js'
-import type { SelfResult, TypedSelf } from './self.js'
-
-// oxlint-disable-next-line no-explicit-any
-type HandlerFn = (...args: any[]) => any
-
-export type ExecuteParams = {
-  /** Handler may omit `execute` when authored as a stub (spec-only binding). */
-  handler: { execute?: HandlerFn }
-  /** Namespaced ref of the dispatched method — names the offending method in the
-   *  stub-leak diagnostic below (the dispatcher passes `bound.ref`). */
-  ref?: string
-  params: Record<string, unknown>
-  auth: AuthContext | null
-  /** Untyped fallback ({@link withNode}) or the rich typed self ({@link withBoundNode}). */
-  self: SelfResult | TypedSelf<unknown> | undefined
-  deps: unknown
-  env: RemoteEnv
-  kernel: BoundClientSessionView<FnMap> | null
-  caller?: CallerContext
-  /** Mint seam for identities this domain issues. */
-  domain: DomainAuthority
-  fn: FunctionContextApi
-  step: Step
-  defer: Defer
-  sleep: Sleep
-}
-
-export async function executeHandler(ctx: ExecuteParams): Promise<unknown> {
-  if (typeof ctx.handler.execute !== 'function') {
-    throw new Error(
-      `executeHandler: handler${ctx.ref ? ` for "${ctx.ref}"` : ''} has no \`execute\` body — ` +
-        `this is a binding stub that should have been resolved to a remote redirect upstream.`,
-    )
-  }
-  return ctx.handler.execute({
-    params: ctx.params,
-    auth: ctx.auth,
-    self: ctx.self,
-    deps: ctx.deps,
-    env: ctx.env,
-    kernel: ctx.kernel,
-    ...(ctx.caller !== undefined ? { caller: ctx.caller } : {}),
-    domain: ctx.domain,
-    fn: ctx.fn,
-    step: ctx.step,
-    defer: ctx.defer,
-    sleep: ctx.sleep,
-  })
-}

package/src/dispatch/identity.ts

@@ -1,143 +0,0 @@
-/**
- * Per-callable identity — dispatcher runtime + install-time wiring.
- *
- * Three flavors of callable get an identity per the install-time identity
- * binding, each keyed by its mount-stable semantic sub: Methods on
- * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
- * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
- * (sub = ViewPath `/:<origin>:view.<slug>`).
- *
- * At server startup the method dispatcher and the View / RemoteFunction
- * route mounter pre-compute, for every materialized callable, the
- * `RemoteIdentityConfig` they sign outbound kernel calls with. The kernel
- * then matches an existing function identity instead of provisioning a
- * generic one.
- *
- * **Single source of truth:** every helper here is a thin lens over the
- * canonical `resolveCallables` from `@astrale-os/kernel-core/domain`. The
- * kernel validates install subs against the SAME function — drift = 0
- * by construction. This closes the previous SDK-side gap where
- * `collectMethodPaths` filtered to `own|override` and silently dropped
- * `sealed`/`default` interface methods (which DO materialize as nodes).
- */
-
-import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain'
-
-import { resolveCallables } from '@astrale-os/kernel-core/domain'
-
-import type { RemoteIdentityConfig } from '../auth/identity.js'
-import type { AnyRemoteHandler } from '../method/single.js'
-
-/**
- * For each materialized method node, emit its `MethodPath` (semantic,
- * layout-independent) keyed by the method's namespaced ref. Used to
- * build the install `subs` claim and to look up runtime per-method
- * subjects in `buildIdentityMap`.
- *
- * Includes every method node the kernel materializes — class own/override
- * AND interface own (sealed/default/override). Inherited (non-overriding)
- * class methods reuse the interface's node via a `method_of` edge and
- * are correctly absent here.
- */
-export function collectMethodPaths(compiled: CompiledDomain): Record<string, string> {
-  const out: Record<string, string> = {}
-  for (const c of resolveCallables(compiled)) {
-    if (c.kind === 'method') out[c.ref] = c.sub
-  }
-  return out
-}
-
-/** `{ views, remoteFunctions }` buckets keyed by slug — the shared shape
- *  for every per-aux-callable map (paths, identity configs). */
-export type AuxBuckets<T> = {
-  views: Record<string, T>
-  remoteFunctions: Record<string, T>
-}
-
-/**
- * slug → mount-stable semantic `sub` for each aux callable MEMBER node:
- *   - standalone-function members (`kind: 'function'`) → FunctionPath;
- *   - view members (`kind: 'view'`) → ViewPath (plus any hand-authored/legacy
- *     core `View` nodes, `kind: 'core'` className `View`, keyed by their AbsolutePath).
- * The value is `resolveCallables(...).sub` — the exact subject the kernel stamped on
- * the node at install, so an outbound-signing worker matches its own function identity.
- */
-export type AuxIdentityPaths = AuxBuckets<string>
-
-export function collectAuxIdentityPaths(compiled: CompiledDomain): AuxIdentityPaths {
-  const views: Record<string, string> = {}
-  const remoteFunctions: Record<string, string> = {}
-  for (const c of resolveCallables(compiled)) {
-    if (!c.slug) continue
-    if (c.kind === 'function') {
-      remoteFunctions[c.slug] = c.sub
-    } else if (c.kind === 'view' || (c.kind === 'core' && c.className === 'View')) {
-      views[c.slug] = c.sub
-    }
-    // Methods (`kind: 'method'`) get their identity via `collectMethodPaths`.
-  }
-  return { views, remoteFunctions }
-}
-
-/**
- * slug → `RemoteIdentityConfig` for each auto-materialized View /
- * RemoteFunction. Built once at server startup; consumed by
- * `mountAuxiliaryRoutes` so each handler signs outbound `kernel.call(...)`
- * with its own `sub` (its FunctionPath/ViewPath). Mirrors `buildIdentityMap`.
- */
-export type AuxIdentityMap = AuxBuckets<RemoteIdentityConfig>
-
-export function buildAuxIdentityMap(
-  compiled: CompiledDomain,
-  privateKey: JsonWebKey,
-  issuer: string,
-): AuxIdentityMap {
-  const paths = collectAuxIdentityPaths(compiled)
-  const views: Record<string, RemoteIdentityConfig> = {}
-  for (const [slug, subject] of Object.entries(paths.views)) {
-    views[slug] = { issuer, subject, privateKey }
-  }
-  const remoteFunctions: Record<string, RemoteIdentityConfig> = {}
-  for (const [slug, subject] of Object.entries(paths.remoteFunctions)) {
-    remoteFunctions[slug] = { issuer, subject, privateKey }
-  }
-  return { views, remoteFunctions }
-}
-
-/**
- * Pre-resolve per-method identity configs. Lookup is by BoundMethod instance,
- * so the dispatcher pays O(1) per call instead of re-constructing the config.
- *
- * `iss` = the worker's own **serving URL** (`issuer` arg, e.g.
- * `https://crm.test.com`) — its cryptographic identity, DECOUPLED from the
- * domain's addressing `origin` (a graph slug). The kernel stamps the same
- * value on each function node at install (it pins `iss` to the URL it fetched
- * the domain at) and verifies inbound credentials against that issuer's JWKS
- * (OIDC discovery). The function `sub` stays the origin-addressed MethodPath —
- * `sub` = which function, `iss` = who signs.
- */
-export function buildIdentityMap(
-  compiled: CompiledDomain,
-  methods: BoundMethod<AnyRemoteHandler>[],
-  privateKey: JsonWebKey,
-  issuer: string,
-): Map<BoundMethod<AnyRemoteHandler>, RemoteIdentityConfig> {
-  const paths = collectMethodPaths(compiled)
-  const out = new Map<BoundMethod<AnyRemoteHandler>, RemoteIdentityConfig>()
-  for (const bound of methods) {
-    const subject = paths[bound.ref]
-    if (!subject) {
-      // Under the "drift = 0" invariant every dispatched method's ref is a key
-      // in `paths`. A miss means an install/index drift — fail loudly at boot
-      // rather than signing with `bound.ref` (a namespaced ref, NOT a
-      // MethodPath sub), which would silently fail kernel identity matching at
-      // call time. Mirrors `identityFor` / `requireAuxIdentity`.
-      throw new Error(
-        `buildIdentityMap: method "${bound.ref}" is in the dispatch index but absent ` +
-          `from resolveCallables(compiled) — no identity subject to sign with.`,
-      )
-    }
-    out.set(bound, { issuer, subject, privateKey })
-  }
-  return out
-}

package/src/dispatch/index.ts

@@ -1,16 +0,0 @@
-export { SdkDispatcher, type SdkDispatcherConfig } from './dispatcher.js'
-export { resolveMethod, buildMethodIndex, type MethodIndex } from './resolve.js'
-export {
-  validateParams,
-  validateResult,
-  type ValidationResult,
-  type ResultValidationResult,
-} from './validate.js'
-export { resolveSelf, withBoundNode, type SelfResult, type TypedSelf } from './self.js'
-export { executeHandler, type ExecuteParams } from './execute.js'
-export {
-  AuthorizationDeniedError,
-  MethodNotFoundError,
-  SdkValidationError,
-  SdkResultValidationError,
-} from './errors.js'