@astrale-os/adapter-cloudflare 0.4.10 → 0.5.0-beta.2

package/src/worker/index.ts

@@ -0,0 +1,276 @@
+import type { schema } from '@astrale-os/kernel-dsl/v1'
+import type { DomainDefinition, FrontendRoute } from '@astrale-os/sdk'
+import type {
+  Application,
+  RemoteDeploymentInput,
+  RemoteIdentityInput,
+} from '@astrale-os/sdk/server'
+import type { ExecutionContext, Hono } from 'hono'
+
+import { issuer } from '@astrale-os/kernel-core/auth'
+import { createRemoteApplication } from '@astrale-os/sdk/server'
+import { Hono as HonoApplication } from 'hono'
+
+const MAXIMUM_CACHED_APPLICATIONS = 4
+const APPLICATION_CLOSE_TIMEOUT_MS = 5_000
+
+/** SDK-owned Publication manifest passed through without adapter interpretation. */
+export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>
+
+export interface Fetcher {
+  fetch(request: Request): Response | Promise<Response>
+}
+
+/** Adapter-owned bindings generated into every Cloudflare deployment. */
+export interface CloudflareAdapterBindings {
+  /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
+  readonly ASTRALE_VERSION_METADATA?: {
+    readonly id: string
+    readonly tag: string
+    readonly timestamp: string
+  }
+  /** Content-derived generation supplied by providers without version metadata. */
+  readonly ASTRALE_DEPLOYMENT_VERSION?: string
+  readonly WORKER_URL?: string
+  readonly ASSETS?: Fetcher
+  readonly SELF?: Fetcher
+  readonly FRONTEND_DEV_URL?: string
+  readonly DISPATCHER?: { get(name: string): Fetcher }
+}
+
+export interface CloudflareWorkerConfig<
+  S extends schema.DomainSchema,
+  Bindings extends CloudflareAdapterBindings,
+  Environment,
+> {
+  readonly definition: DomainDefinition<S>
+  readonly privateKey:
+    | RemoteIdentityInput['privateKey']
+    | ((bindings: Bindings) => RemoteIdentityInput['privateKey'])
+  /** Compose provider bindings into the exact Domain environment once per deployment generation. */
+  readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>
+  readonly manifest?: CloudflareManifest
+  readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string
+  readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined
+  readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined
+}
+
+export interface CloudflareWorker<Environment> {
+  fetch(
+    request: Request,
+    environment: Environment,
+    executionContext?: ExecutionContext,
+  ): Response | Promise<Response>
+}
+
+interface CachedApplication<Environment> {
+  readonly origin: string
+  readonly application: Application<Hono>
+  readonly environment: Environment
+}
+
+/**
+ * Compose one Cloudflare module Worker without request-global mutation.
+ * Environment bindings are captured once per immutable serving URL/version generation.
+ */
+export function cloudflareWorkerEntry<
+  Bindings extends CloudflareAdapterBindings,
+  Environment = Bindings,
+>() {
+  return function <const S extends schema.DomainSchema>(
+    config: CloudflareWorkerConfig<S, Bindings, Environment>,
+  ): CloudflareWorker<Bindings> {
+    const applications = new Map<string, CachedApplication<Environment>>()
+
+    const applicationFor = async (
+      url: string,
+      bindings: Bindings,
+    ): Promise<CachedApplication<Environment>> => {
+      const version = deploymentVersion(bindings)
+      const key = `${url}\u0000${version}`
+      const cached = applications.get(key)
+      if (cached !== undefined) return cached
+      const environment =
+        config.resolveEnvironment === undefined
+          ? (bindings as unknown as Environment)
+          : await config.resolveEnvironment(bindings)
+
+      const routedFetch: typeof fetch = async (input, init) => {
+        const request = new Request(input, init)
+        const destination = new URL(request.url)
+        if (destination.origin === new URL(url).origin) {
+          const self = config.selfBinding?.(bindings)
+          if (self !== null && self !== undefined) return self.fetch(request)
+          return serving.app.fetch(request, environment)
+        }
+        const route = config.routeSubrequest?.(destination, bindings)
+        return route === null || route === undefined ? fetch(request) : route.fetch(request)
+      }
+
+      const deploymentQuery = `deployment=${encodeURIComponent(version)}`
+      const issuerId = issuer.accept(url)
+      const host = new HonoApplication()
+      host.get('/meta', (context) =>
+        context.json({
+          origin: config.definition.schema.origin,
+          issuer: issuerId,
+          schemaRevision: config.definition.domain.$.revision,
+          deploymentVersion: version,
+        }),
+      )
+      const serving: Application<Hono> = createRemoteApplication({
+        definition: config.definition,
+        environment,
+        identity: {
+          issuer: issuerId,
+          subject: config.definition.schema.origin,
+          privateKey:
+            typeof config.privateKey === 'function'
+              ? config.privateKey(bindings)
+              : config.privateKey,
+          fetch: routedFetch,
+          ...(new URL(url).protocol === 'http:' ? { allowInsecureHttp: true } : {}),
+        },
+        deployment: {
+          bundleHref: `${url}/.well-known/astrale/domain.bundle.json?${deploymentQuery}`,
+          endpoint: { http: `${url}/invoke` },
+          ...(config.definition.frontend === undefined
+            ? {}
+            : { frontendBaseHref: url, frontendCacheKey: version }),
+          ...(config.manifest === undefined ? {} : { manifest: config.manifest }),
+          installation: {
+            href: `${url}/install`,
+            method: 'POST',
+            authentication: { kind: 'public' },
+          },
+        },
+        app: host,
+        server: {
+          path: '/invoke',
+          health: { probe: { check: () => true } },
+          limits: {
+            maximumRequestBytes: 1024 * 1024,
+            maximumPublicationBytes: 1024 * 1024,
+            maximumBundleBytes: 8 * 1024 * 1024,
+            maximumInstallationBytes: 8 * 1024 * 1024,
+            invocationTimeoutMs: 30_000,
+          },
+        },
+      })
+      const created = Object.freeze({
+        origin: new URL(url).origin,
+        application: serving,
+        environment,
+      })
+      if (applications.size >= MAXIMUM_CACHED_APPLICATIONS) {
+        const oldest = applications.keys().next().value
+        if (oldest !== undefined) {
+          const evicted = applications.get(oldest)
+          applications.delete(oldest)
+          if (evicted !== undefined) {
+            try {
+              await closeEvictedApplication(evicted.application)
+            } catch (cause) {
+              await serving
+                .close({ deadline: Date.now() + APPLICATION_CLOSE_TIMEOUT_MS })
+                .catch(() => undefined)
+              throw cause
+            }
+          }
+        }
+      }
+      applications.set(key, created)
+      return created
+    }
+
+    return Object.freeze({
+      async fetch(request: Request, bindings: Bindings, executionContext?: ExecutionContext) {
+        const requestUrl = new URL(request.url)
+        if (config.definition.frontend !== undefined) {
+          const asset = await frontendAsset(config.definition, bindings, requestUrl, request)
+          if (asset !== undefined) return asset
+        }
+        const publicUrl = canonicalServingUrl(
+          config.resolveUrl?.(bindings, requestOrigin(requestUrl, request)) ??
+            bindings.WORKER_URL ??
+            requestOrigin(requestUrl, request),
+        )
+        const serving = await applicationFor(publicUrl, bindings)
+        return serving.application.app.fetch(request, serving.environment, executionContext)
+      },
+    })
+  }
+}
+
+/** Close an evicted Application before its environment bindings leave the cache. */
+export function closeEvictedApplication(
+  application: Pick<Application, 'close'>,
+  now: () => number = Date.now,
+): Promise<void> {
+  return application.close({ deadline: now() + APPLICATION_CLOSE_TIMEOUT_MS })
+}
+
+async function frontendAsset<S extends schema.DomainSchema>(
+  definition: DomainDefinition<S>,
+  environment: CloudflareAdapterBindings,
+  url: URL,
+  request: Request,
+): Promise<Response | undefined> {
+  const frontend = definition.frontend
+  if (frontend === undefined || frontend.source.kind === 'external') return undefined
+  const routes = frontend.routes as Readonly<Record<string, FrontendRoute>>
+  const route = Object.values(routes).find((candidate) => candidate.path === url.pathname)
+  const staticAsset = url.pathname.startsWith('/assets/')
+  if (route === undefined && !staticAsset) return undefined
+  if (request.method !== 'GET' && request.method !== 'HEAD') return undefined
+  const binding = environment.ASSETS
+  if (binding === undefined) return undefined
+  const dev = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '')
+  if (dev !== undefined && dev.length > 0) {
+    return fetch(new Request(`${dev}${url.pathname}${url.search}`, request))
+  }
+  const path =
+    route === undefined ? `${url.pathname}${url.search}` : `/${route.document}${url.search}`
+  return binding.fetch(new Request(new URL(path, url.origin), request))
+}
+
+function requestOrigin(url: URL, request: Request): string {
+  if (url.protocol !== 'http:') return url.origin
+  const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase()
+  return forwarded === 'https' ? `https://${url.host}` : url.origin
+}
+
+function canonicalServingUrl(input: string): string {
+  let url: URL
+  try {
+    url = new URL(input)
+  } catch (cause) {
+    throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause })
+  }
+  if (
+    (url.protocol !== 'https:' && url.protocol !== 'http:') ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.pathname !== '/' ||
+    url.search !== '' ||
+    url.hash !== ''
+  ) {
+    throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.')
+  }
+  return url.origin
+}
+
+function deploymentVersion(environment: CloudflareAdapterBindings): string {
+  const input = environment.ASTRALE_VERSION_METADATA
+  if (
+    input !== null &&
+    typeof input === 'object' &&
+    typeof input.id === 'string' &&
+    input.id.length > 0
+  ) {
+    return input.id
+  }
+  const fallback = environment.ASTRALE_DEPLOYMENT_VERSION
+  if (typeof fallback === 'string' && fallback.length > 0) return fallback
+  throw new TypeError('Cloudflare Worker deployment version is unavailable.')
+}

package/src/worker/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": [],
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "skipLibCheck": true
+  },
+  "include": ["index.ts"]
+}

package/template/astrale.config.ts

@@ -1,8 +1,8 @@
 /**
- * astrale.config.ts — binds the worker-safe domain (`domain.ts`) to its deploy
+ * astrale.config.ts — binds the worker-safe composition (`implementation.ts`) to its deploy
  * adapter for the `astrale-domain` CLI. This is a NODE-only module: it imports
  * the adapter (wrangler + filesystem). The generated worker never imports this
- * file — it imports `domain.ts` directly — so the adapter stays out of the bundle.
+ * file — it imports `implementation.ts` directly — so the adapter stays out of the bundle.
  *
  * This variant deploys to YOUR OWN Cloudflare account (the `cloudflare` adapter).
  *
@@ -18,19 +18,19 @@ import { deploy } from '@astrale-os/sdk'
 //
 //   import { astrale } from '@astrale-os/adapter-astrale'
 //   export default deploy(domain, astrale({
-//     dev: { client: { dir: 'client' }, secrets: '.env.dev' },               // local wrangler dev
-//     prod: { client: { dir: 'client' }, instance: '<your-instance-slug>' }, // managed deploy
+//     dev: { secrets: '.env.dev' },               // local wrangler dev
+//     prod: { instance: '<your-instance-slug>' }, // managed deploy
 //   }))
 
-import { domain } from './domain'
+import { domain } from './implementation'
 
 export default deploy(
   domain,
   cloudflare({
     // Local dev: `wrangler dev`. No route → URL is http://localhost:8787.
-    dev: { client: { dir: 'client' }, secrets: '.env.dev' },
+    dev: { secrets: '.env.dev' },
     // Custom-domain prod. Drop `route` to ship to *.workers.dev instead.
-    prod: { client: { dir: 'client' }, route: 'astrale-domain.example.dev', secrets: '.env.prod' },
+    prod: { route: 'astrale-domain.example.dev', secrets: '.env.prod' },
     // Author secrets ship via `secrets: '.env.prod'` on any env. Extra bindings
     // (KV, R2, D1, queues, …) ride a `wrangler` block on any env (deep-merged).
   }),

package/dist/assets-pack.d.ts

@@ -1,8 +0,0 @@
-/**
- * Pack a built client SPA (the `CLIENT_DIST_DIR` build) into the host box's asset-archive
- * format: `gzip(JSON [{ path, contentBase64 }])` — the exact shape
- * `downloadAssets` on the box consumes (kernel/host workerd service layout).
- */
-/** Gzip the SPA dir into the box's asset archive. Returns null when empty. */
-export declare function packAssets(distClientDir: string): Buffer | null;
-//# sourceMappingURL=assets-pack.d.ts.map

package/dist/assets-pack.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets-pack.d.ts","sourceRoot":"","sources":["../src/assets-pack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D"}

package/dist/assets-pack.js

@@ -1,30 +0,0 @@
-/**
- * Pack a built client SPA (the `CLIENT_DIST_DIR` build) into the host box's asset-archive
- * format: `gzip(JSON [{ path, contentBase64 }])` — the exact shape
- * `downloadAssets` on the box consumes (kernel/host workerd service layout).
- */
-import { readdirSync, readFileSync, statSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { gzipSync } from 'node:zlib';
-function walk(dir, root, out) {
-    for (const name of readdirSync(dir)) {
-        const full = join(dir, name);
-        if (statSync(full).isDirectory())
-            walk(full, root, out);
-        else {
-            out.push({
-                path: relative(root, full).split('\\').join('/'),
-                contentBase64: readFileSync(full).toString('base64'),
-            });
-        }
-    }
-}
-/** Gzip the SPA dir into the box's asset archive. Returns null when empty. */
-export function packAssets(distClientDir) {
-    const files = [];
-    walk(distClientDir, distClientDir, files);
-    if (files.length === 0)
-        return null;
-    return gzipSync(Buffer.from(JSON.stringify(files)));
-}
-//# sourceMappingURL=assets-pack.js.map

package/dist/assets-pack.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets-pack.js","sourceRoot":"","sources":["../src/assets-pack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAIpC,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAgB;IACvD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;aAClD,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAChD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC"}

package/dist/build.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/build.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEzE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/client.d.ts

@@ -1,17 +0,0 @@
-/** Client SPA build helpers. The source dir is adapter env config, not domain config. */
-import type { DomainInfo } from '@astrale-os/sdk';
-export type ClientConfig = {
-    /** Vite project directory, relative to the domain project root unless absolute. */
-    dir: string;
-};
-/** Built client output, relative to the project root. The Vite config must emit here. */
-export declare const CLIENT_DIST_DIR = ".dist";
-export declare function resolveClientDir(args: {
-    adapterName: string;
-    env: string;
-    projectDir: string;
-    client?: ClientConfig;
-    domain: DomainInfo;
-}): string | undefined;
-export declare function buildClient(clientDir: string, projectDir: string, onLog?: (line: string) => void): Promise<void>;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAMjD,MAAM,MAAM,YAAY,GAAG;IACzB,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,yFAAyF;AACzF,eAAO,MAAM,eAAe,UAAU,CAAA;AAEtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,MAAM,GAAG,SAAS,CAoBrB;AAMD,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/client.js

@@ -1,59 +0,0 @@
-/** Client SPA build helpers. The source dir is adapter env config, not domain config. */
-import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { isAbsolute, join } from 'node:path';
-/** Built client output, relative to the project root. The Vite config must emit here. */
-export const CLIENT_DIST_DIR = '.dist';
-export function resolveClientDir(args) {
-    const { adapterName, projectDir, client, domain } = args;
-    for (const view of domain.mountedViews) {
-        if (!isUiMount(view.mount)) {
-            throw new Error(`${adapterName} adapter: mounted view "${view.slug}" uses mount "${view.mount}", ` +
-                'but adapter-managed client assets currently serve only /ui routes.');
-        }
-    }
-    if (domain.mountedViews.length > 0 && !client) {
-        const mounts = domain.mountedViews.map((v) => `${v.slug}:${v.mount}`).join(', ');
-        throw new Error(`${adapterName} adapter: ${domain.origin} declares mounted view(s) (${mounts}) ` +
-            `but env "${args.env}" has no \`client: { dir: ... }\` config. ` +
-            'Add `client` to the selected adapter env in astrale.config.ts.');
-    }
-    if (!client)
-        return undefined;
-    return isAbsolute(client.dir) ? client.dir : join(projectDir, client.dir);
-}
-function isUiMount(mount) {
-    return mount === '/ui' || mount.startsWith('/ui/');
-}
-export async function buildClient(clientDir, projectDir, onLog) {
-    const viteBin = [
-        join(clientDir, 'node_modules', '.bin', 'vite'),
-        join(projectDir, 'node_modules', '.bin', 'vite'),
-    ].find((p) => existsSync(p));
-    if (!viteBin) {
-        throw new Error(`client build: vite not found in ${clientDir}. Run \`pnpm install\` at the project root ` +
-            `first.`);
-    }
-    const { code, out } = await runCapture(viteBin, ['build'], clientDir, onLog);
-    if (code !== 0) {
-        throw new Error(`client build failed (code ${code}):\n${out.slice(-1500)}`);
-    }
-}
-function runCapture(cmd, args, cwd, onLog) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(cmd, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
-        let out = '';
-        const onData = (buf) => {
-            const text = buf.toString();
-            out += text;
-            for (const line of text.split('\n'))
-                if (line.trim())
-                    onLog?.(line);
-        };
-        child.stdout?.on('data', onData);
-        child.stderr?.on('data', onData);
-        child.on('exit', (code) => resolve({ code: code ?? 1, out }));
-        child.on('error', reject);
-    });
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAIzF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAO5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AAEtC,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,2BAA2B,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,KAAK,KAAK;gBAChF,oEAAoE,CACvE,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,aAAa,MAAM,CAAC,MAAM,8BAA8B,MAAM,IAAI;YAC9E,YAAY,IAAI,CAAC,GAAG,4CAA4C;YAChE,gEAAgE,CACnE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,UAAkB,EAClB,KAA8B;IAE9B,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC;KACjD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,6CAA6C;YACvF,QAAQ,CACX,CAAA;IACH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW,EACX,KAA8B;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC3B,GAAG,IAAI,IAAI,CAAA;YACX,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/codegen/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/codegen/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtF"}

package/dist/codegen/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/codegen/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAM;IAE5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,CAA4B,CAAA;IACpE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;IACjB,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,MAAM,CAAA;IAEzB,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,SAAS,CACb,IAAI,EACJ,kDAAkD,MAAM,mCAAmC;QACzF,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAC1E,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,2DAA2D;IAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gFAAgF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM;QACnG,kBAAkB,MAAM,+DAA+D;QACvF,gGAAgG,CACnG,CAAA;AACH,CAAC"}

package/dist/codegen/merge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/codegen/merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB"}

package/dist/codegen/merge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/codegen/merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,OAAgC;IAEhC,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,CAAY,EAAE,CAAY;IAC7C,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAW,CAAA;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACtC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA,CAAC,oDAAoD;YACzE,SAAQ;QACV,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAA;IAC3C,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,KAAK,CAAW,EAAE,CAAA;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,UAAU,CAAC,CAAA;AACzE,CAAC"}

package/dist/codegen/worker.d.ts

@@ -1,51 +0,0 @@
-/**
- * Codegen for the Cloudflare Worker entry (`.astrale/worker.gen.ts`).
- *
- * The dev wires the domain ONCE in a worker-safe `domain.ts`
- * (`export const domain = defineDomain({ schema, methods, deps, views,
- * functions })`) and binds it to an adapter in `astrale.config.ts`
- * (`deploy(domain, cloudflare({ … }))`). This generates the
- * `export default { fetch }` plumbing the adapter owns by importing that single
- * `domain` and SPREADING it into `domainWorkerEntry` — so the author's folder
- * layout is irrelevant (any internal organization works as long as `domain.ts`
- * re-exports the wired definition) and the node-only deploy adapter, which lives
- * in `astrale.config.ts`, never enters this worker bundle.
- *
- * Everything the entry needs — schema/methods/deps/views/functions/requires/
- * postInstall — rides on the spread; the only build-time signal left is whether
- * this adapter env serves a client SPA (`hasClient`), which gates the `/ui`
- * asset hook and its import. Key properties:
- *
- *  • Per-request `url` = the live serving origin (`scheme://host`). It is passed
- *    only to `createRemoteServer({ url })`; the SDK stamps every
- *    `binding.remoteUrl` from that single value at spec-build time — so deployed
- *    Function nodes point back at THIS worker with zero hardcoded URLs.
- *  • Self-issued JWKS: a Worker can't fetch its own hostname; the verifier
- *    resolves a credential whose `iss` is this worker from the in-memory key,
- *    so no self-fetch is attempted (the worker's JWKS is served as a normal
- *    route by createRemoteServer).
- *  • Self-binding (autobinding): when a handler calls back into its OWN domain
- *    (`ctx.kernel.call` / `ctx.fn.kernel().call`), the redirect resolves to
- *    this worker's own host — a forbidden same-host subrequest. We route those
- *    through the `SELF` service binding instead.
- *  • SPA: `/ui/*` is served from the `ASSETS` binding (or proxied to Vite in
- *    dev via `VIEW_DEV_URL`).
- */
-export interface WorkerCodegenOptions {
-    origin: string;
-    hasClient: boolean;
-    /**
-     * When set, the worker routes subrequests to platform INSTANCE hostnames
-     * through `<binding>` (a service binding to a router Worker) instead of the
-     * public edge — a same-zone Worker→Worker public fetch 522s, which otherwise
-     * blocks fetching an instance kernel's JWKS to verify a cross-instance
-     * credential.
-     */
-    router?: {
-        binding: string;
-        hostSuffix: string;
-        minLabels: number;
-    };
-}
-export declare function generateWorkerEntry(opts: WorkerCodegenOptions): string;
-//# sourceMappingURL=worker.d.ts.map

package/dist/codegen/worker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/codegen/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CACpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAwFtE"}