@astrale-os/adapter-cloudflare 0.5.0-beta.3 → 0.5.0-beta.30

package/dist/worker/entry.js

@@ -0,0 +1,161 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { restoreBuild } from '@astrale-os/sdk/deployment/build/material';
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { createIdentity, serve } from '@astrale-os/sdk/execution';
+import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export function cloudflareWorkerEntry() {
+    return function (config) {
+        let currentIssuer;
+        let realized;
+        const realize = () => {
+            if (realized !== undefined)
+                return realized;
+            realized = Promise.resolve()
+                .then(config.load)
+                .then((source) => {
+                const build = restoreBuild(source.material, source.runtime);
+                const application = serve({
+                    runtime: source.runtime,
+                    load(environment) {
+                        if (currentIssuer !== environment.issuer) {
+                            throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
+                        }
+                        return assemble(build, addressing(environment.issuer));
+                    },
+                    initialize: (environment) => config.resolveEnvironment === undefined
+                        ? environment.bindings
+                        : config.resolveEnvironment(environment.bindings),
+                    identity(environment) {
+                        return createIdentity({
+                            issuer: issuer.accept(environment.issuer),
+                            subject: build.schema.compiled.root.origin,
+                            privateKey: typeof config.privateKey === 'function'
+                                ? config.privateKey(environment.bindings)
+                                : config.privateKey,
+                            fetch: routedFetch(application, environment, config),
+                            ...(new URL(environment.issuer).protocol === 'http:'
+                                ? { allowInsecureHttp: true }
+                                : {}),
+                        });
+                    },
+                    server: {
+                        health: { probe: { check: () => true } },
+                        limits: {
+                            maximumRequestBytes: 1024 * 1024,
+                            maximumPublicationBytes: 1024 * 1024,
+                            maximumBundleBytes: 8 * 1024 * 1024,
+                            maximumDeliveryBytes: 8 * 1024 * 1024,
+                            invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
+                        },
+                    },
+                });
+                return Object.freeze({ build, application });
+            });
+            return realized;
+        };
+        return Object.freeze({
+            async fetch(request, bindings, context) {
+                const url = new URL(request.url);
+                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                    bindings.IDENTITY_ISS ??
+                    config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
+                    requestOrigin(url, request));
+                if (config.providerAssignedWorker !== undefined &&
+                    bindings.WORKER_URL === undefined &&
+                    bindings.IDENTITY_ISS === undefined &&
+                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    return new Response('Request origin differs from provider-assigned Addressing.', {
+                        status: 421,
+                    });
+                }
+                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                    return new Response('Request origin differs from the current Release.', { status: 421 });
+                }
+                currentIssuer = issuer;
+                const { application, build } = await realize();
+                const frontend = await frontendAsset(build.frontend, bindings, url, request);
+                if (frontend !== undefined)
+                    return frontend;
+                return application.fetch(request, Object.freeze({ bindings, issuer }), context);
+            },
+        });
+    };
+}
+function routedFetch(application, environment, config) {
+    return async (input, init) => {
+        const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
+        const destination = new URL(request.url);
+        if (destination.origin === environment.issuer) {
+            const self = config.selfBinding?.(environment.bindings);
+            return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
+                ? application.fetch(selected, environment)
+                : self.fetch(selected));
+        }
+        const route = config.routeSubrequest?.(destination, environment.bindings);
+        return dispatchCloudflareRequest(request, rejectRedirect, (selected) => route === null || route === undefined ? fetch(selected) : route.fetch(selected));
+    };
+}
+async function frontendAsset(frontend, environment, url, request) {
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return undefined;
+    if (reserved(url.pathname) || (request.method !== 'GET' && request.method !== 'HEAD')) {
+        return undefined;
+    }
+    const development = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
+    if (development !== undefined && development.length > 0) {
+        return fetch(new Request(new URL(`${url.pathname}${url.search}`, `${development}/`), request));
+    }
+    const route = frontend.routes
+        .filter((candidate) => candidate.path === url.pathname ||
+        (frontend.source.kind === 'vite' &&
+            frontend.source.spa &&
+            (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
+        .sort((left, right) => right.path.length - left.path.length)[0];
+    if (route === undefined && !url.pathname.startsWith('/assets/'))
+        return undefined;
+    const assets = environment.ASSETS;
+    if (assets === undefined)
+        return undefined;
+    const response = await assets.fetch(request);
+    if (response.status !== 404 || route === undefined)
+        return response;
+    await response.body?.cancel();
+    return assets.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request));
+}
+function reserved(path) {
+    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function requestOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
+    return forwarded === 'https' ? `https://${url.host}` : url.origin;
+}
+function canonicalServingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/fetch.d.ts

@@ -0,0 +1,11 @@
+export type RequestDispatcher = (request: Request) => Response | Promise<Response>;
+export interface CloudflareRequest {
+    readonly request: Request;
+    readonly rejectRedirect: boolean;
+}
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export declare function prepareCloudflareRequest(input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): CloudflareRequest;
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export declare function dispatchCloudflareRequest(request: Request, rejectRedirect: boolean, dispatch: RequestDispatcher): Promise<Response>;
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export declare function adaptCloudflareResponse(request: Request, response: Response): Response;

package/dist/worker/fetch.js

@@ -0,0 +1,31 @@
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export function prepareCloudflareRequest(input, init) {
+    const rejectRedirect = init?.redirect === 'error' ||
+        (init?.redirect === undefined && input instanceof Request && input.redirect === 'error');
+    const request = new Request(input, rejectRedirect ? { ...init, redirect: 'manual' } : init);
+    return Object.freeze({ request, rejectRedirect });
+}
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export async function dispatchCloudflareRequest(request, rejectRedirect, dispatch) {
+    const response = adaptCloudflareResponse(request, await dispatch(request));
+    if (!rejectRedirect)
+        return response;
+    if (!response.redirected && !REDIRECT_STATUSES.has(response.status))
+        return response;
+    await response.body?.cancel();
+    throw new TypeError('Redirects are not allowed for this request.');
+}
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export function adaptCloudflareResponse(request, response) {
+    if (response.url !== '')
+        return response;
+    return new Proxy(response, {
+        get(target, property) {
+            if (property === 'url')
+                return request.url;
+            const value = Reflect.get(target, property, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/dist/worker/gateway.d.ts

@@ -0,0 +1,15 @@
+import type { Revision } from '@astrale-os/sdk/schema';
+export interface DispatchNamespace {
+    get(name: string): {
+        fetch(request: Request): Response | Promise<Response>;
+    };
+}
+export interface CloudflareGatewayBindings {
+    readonly RELEASES: DispatchNamespace;
+}
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export declare function cloudflareGatewayEntry(config: {
+    readonly current: Revision;
+}): {
+    fetch(request: Request, bindings: CloudflareGatewayBindings): Promise<Response>;
+};

package/dist/worker/gateway.js

@@ -0,0 +1,26 @@
+import { releaseUnavailable, requestedRevision } from '@astrale-os/sdk/deployment/release/runtime';
+import { releaseWorkerName } from '../release/target.js';
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export function cloudflareGatewayEntry(config) {
+    const current = releaseWorkerName(config.current);
+    return Object.freeze({
+        async fetch(request, bindings) {
+            const revision = requestedRevision(new URL(request.url).pathname);
+            const target = revision === undefined ? current : releaseWorkerName(revision);
+            let worker;
+            try {
+                worker = bindings.RELEASES.get(target);
+                return await worker.fetch(request);
+            }
+            catch (cause) {
+                if (isMissingWorker(cause))
+                    return releaseUnavailable();
+                throw cause;
+            }
+        },
+    });
+}
+/** Admit only Cloudflare's documented missing-script failure at the provider boundary. */
+function isMissingWorker(cause) {
+    return cause instanceof Error && /^Worker not found(?:: [^\r\n]+)?$/iu.test(cause.message);
+}

package/dist/worker/identity.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+/** Decode the secret representation at the Worker binding boundary. */
+export declare function decodeSigningIdentity(input: string): JsonWebKey;
+/** Remove adapter-owned signing material before Runtime initialization. */
+export declare function runtimeBindings<Bindings extends {
+    readonly ASTRALE_SIGNING_IDENTITY: string;
+}>(bindings: Bindings): Omit<Bindings, 'ASTRALE_SIGNING_IDENTITY'>;

package/dist/worker/identity.js

@@ -0,0 +1,23 @@
+/** Decode the secret representation at the Worker binding boundary. */
+export function decodeSigningIdentity(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid();
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare signing identity secret is invalid JSON.', { cause });
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded))
+        invalid();
+    return decoded;
+}
+/** Remove adapter-owned signing material before Runtime initialization. */
+export function runtimeBindings(bindings) {
+    const { ASTRALE_SIGNING_IDENTITY: _identity, ...runtime } = bindings;
+    return runtime;
+}
+function invalid() {
+    throw new TypeError('Cloudflare signing identity secret is invalid.');
+}

package/dist/worker/index.d.ts

@@ -1,59 +1,3 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { DomainDefinition } from '@astrale-os/sdk';
-import type { Application, RemoteDeploymentInput, RemoteIdentityInput } from '@astrale-os/sdk/server';
-import type { ExecutionContext } from 'hono';
-/** SDK-owned Publication manifest passed through without adapter interpretation. */
-export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>;
-export interface Fetcher {
-    fetch(request: Request): Response | Promise<Response>;
-}
-/** Adapter-owned bindings generated into every Cloudflare deployment. */
-export interface CloudflareAdapterBindings {
-    /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
-    readonly ASTRALE_VERSION_METADATA?: {
-        readonly id: string;
-        readonly tag: string;
-        readonly timestamp: string;
-    };
-    /** Content-derived generation supplied by providers without version metadata. */
-    readonly ASTRALE_DEPLOYMENT_VERSION?: string;
-    readonly WORKER_URL?: string;
-    readonly ASSETS?: Fetcher;
-    readonly SELF?: Fetcher;
-    readonly FRONTEND_DEV_URL?: string;
-    readonly DISPATCHER?: {
-        get(name: string): Fetcher;
-    };
-}
-interface CloudflareWorkerSharedConfig<Bindings extends CloudflareAdapterBindings, Environment> {
-    readonly privateKey: RemoteIdentityInput['privateKey'] | ((bindings: Bindings) => RemoteIdentityInput['privateKey']);
-    /** Compose provider bindings into the exact Domain environment once per deployment generation. */
-    readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>;
-    readonly manifest?: CloudflareManifest;
-    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
-    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
-}
-/**
- * Resolve a Domain lazily when its module graph is too expensive for provider startup admission.
- * The adapter resolves at most once concurrently and retries after a rejected resolution.
- */
-export type CloudflareWorkerConfig<S extends schema.DomainSchema, Bindings extends CloudflareAdapterBindings, Environment> = CloudflareWorkerSharedConfig<Bindings, Environment> & ({
-    readonly definition: DomainDefinition<S>;
-    readonly resolveDefinition?: never;
-} | {
-    readonly definition?: never;
-    readonly resolveDefinition: () => DomainDefinition<S> | Promise<DomainDefinition<S>>;
-});
-export interface CloudflareWorker<Environment> {
-    fetch(request: Request, environment: Environment, executionContext?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <const S extends schema.DomainSchema>(config: CloudflareWorkerConfig<S, Bindings, Environment>) => CloudflareWorker<Bindings>;
-/** Close an evicted Application before its environment bindings leave the cache. */
-export declare function closeEvictedApplication(application: Pick<Application, 'close'>, now?: () => number): Promise<void>;
-export {};
-//# sourceMappingURL=index.d.ts.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export * from './gateway.js';

package/dist/worker/index.js

@@ -1,209 +1,3 @@
-import { issuer } from '@astrale-os/kernel-core/auth';
-import { createRemoteApplication } from '@astrale-os/sdk/server';
-import { Hono as HonoApplication } from 'hono';
-const MAXIMUM_CACHED_APPLICATIONS = 4;
-const APPLICATION_CLOSE_TIMEOUT_MS = 5_000;
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export function cloudflareWorkerEntry() {
-    return function (config) {
-        const applications = new Map();
-        let resolvedDefinition = config.definition;
-        let pendingDefinition;
-        const definitionFor = async () => {
-            if (resolvedDefinition !== undefined)
-                return resolvedDefinition;
-            if (pendingDefinition !== undefined)
-                return pendingDefinition;
-            const resolve = config.resolveDefinition;
-            if (resolve === undefined)
-                throw new TypeError('Cloudflare Worker Domain definition is unavailable.');
-            const current = Promise.resolve().then(resolve);
-            pendingDefinition = current;
-            try {
-                const definition = await current;
-                resolvedDefinition = definition;
-                return definition;
-            }
-            finally {
-                if (pendingDefinition === current)
-                    pendingDefinition = undefined;
-            }
-        };
-        const applicationFor = async (url, bindings, definition) => {
-            const version = deploymentVersion(bindings);
-            const key = `${url}\u0000${version}`;
-            const cached = applications.get(key);
-            if (cached !== undefined)
-                return cached;
-            const environment = config.resolveEnvironment === undefined
-                ? bindings
-                : await config.resolveEnvironment(bindings);
-            const routedFetch = async (input, init) => {
-                const request = new Request(input, init);
-                const destination = new URL(request.url);
-                if (destination.origin === new URL(url).origin) {
-                    const self = config.selfBinding?.(bindings);
-                    if (self !== null && self !== undefined)
-                        return self.fetch(request);
-                    return serving.app.fetch(request, environment);
-                }
-                const route = config.routeSubrequest?.(destination, bindings);
-                return route === null || route === undefined ? fetch(request) : route.fetch(request);
-            };
-            const deploymentQuery = `deployment=${encodeURIComponent(version)}`;
-            const issuerId = issuer.accept(url);
-            const host = new HonoApplication();
-            host.get('/meta', (context) => context.json({
-                origin: definition.schema.origin,
-                issuer: issuerId,
-                schemaRevision: definition.domain.$.revision,
-                deploymentVersion: version,
-            }));
-            const serving = createRemoteApplication({
-                definition,
-                environment,
-                identity: {
-                    issuer: issuerId,
-                    subject: definition.schema.origin,
-                    privateKey: typeof config.privateKey === 'function'
-                        ? config.privateKey(bindings)
-                        : config.privateKey,
-                    fetch: routedFetch,
-                    ...(new URL(url).protocol === 'http:' ? { allowInsecureHttp: true } : {}),
-                },
-                deployment: {
-                    bundleHref: `${url}/.well-known/astrale/domain.bundle.json?${deploymentQuery}`,
-                    endpoint: { http: `${url}/invoke` },
-                    ...(definition.frontend === undefined
-                        ? {}
-                        : { frontendBaseHref: url, frontendCacheKey: version }),
-                    ...(config.manifest === undefined ? {} : { manifest: config.manifest }),
-                    installation: {
-                        href: `${url}/install`,
-                        method: 'POST',
-                        authentication: { kind: 'public' },
-                    },
-                },
-                app: host,
-                server: {
-                    path: '/invoke',
-                    health: { probe: { check: () => true } },
-                    limits: {
-                        maximumRequestBytes: 1024 * 1024,
-                        maximumPublicationBytes: 1024 * 1024,
-                        maximumBundleBytes: 8 * 1024 * 1024,
-                        maximumInstallationBytes: 8 * 1024 * 1024,
-                        invocationTimeoutMs: 30_000,
-                    },
-                },
-            });
-            const created = Object.freeze({
-                origin: new URL(url).origin,
-                application: serving,
-                environment,
-            });
-            if (applications.size >= MAXIMUM_CACHED_APPLICATIONS) {
-                const oldest = applications.keys().next().value;
-                if (oldest !== undefined) {
-                    const evicted = applications.get(oldest);
-                    applications.delete(oldest);
-                    if (evicted !== undefined) {
-                        try {
-                            await closeEvictedApplication(evicted.application);
-                        }
-                        catch (cause) {
-                            await serving
-                                .close({ deadline: Date.now() + APPLICATION_CLOSE_TIMEOUT_MS })
-                                .catch(() => undefined);
-                            throw cause;
-                        }
-                    }
-                }
-            }
-            applications.set(key, created);
-            return created;
-        };
-        return Object.freeze({
-            async fetch(request, bindings, executionContext) {
-                const requestUrl = new URL(request.url);
-                const definition = await definitionFor();
-                if (definition.frontend !== undefined) {
-                    const asset = await frontendAsset(definition, bindings, requestUrl, request);
-                    if (asset !== undefined)
-                        return asset;
-                }
-                const publicUrl = canonicalServingUrl(config.resolveUrl?.(bindings, requestOrigin(requestUrl, request)) ??
-                    bindings.WORKER_URL ??
-                    requestOrigin(requestUrl, request));
-                const serving = await applicationFor(publicUrl, bindings, definition);
-                return serving.application.app.fetch(request, serving.environment, executionContext);
-            },
-        });
-    };
-}
-/** Close an evicted Application before its environment bindings leave the cache. */
-export function closeEvictedApplication(application, now = Date.now) {
-    return application.close({ deadline: now() + APPLICATION_CLOSE_TIMEOUT_MS });
-}
-async function frontendAsset(definition, environment, url, request) {
-    const frontend = definition.frontend;
-    if (frontend === undefined || frontend.source.kind === 'external')
-        return undefined;
-    const routes = frontend.routes;
-    const route = Object.values(routes).find((candidate) => candidate.path === url.pathname);
-    const staticAsset = url.pathname.startsWith('/assets/');
-    if (route === undefined && !staticAsset)
-        return undefined;
-    if (request.method !== 'GET' && request.method !== 'HEAD')
-        return undefined;
-    const binding = environment.ASSETS;
-    if (binding === undefined)
-        return undefined;
-    const dev = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
-    if (dev !== undefined && dev.length > 0) {
-        return fetch(new Request(`${dev}${url.pathname}${url.search}`, request));
-    }
-    const path = route === undefined ? `${url.pathname}${url.search}` : `/${route.document}${url.search}`;
-    return binding.fetch(new Request(new URL(path, url.origin), request));
-}
-function requestOrigin(url, request) {
-    if (url.protocol !== 'http:')
-        return url.origin;
-    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
-    return forwarded === 'https' ? `https://${url.host}` : url.origin;
-}
-function canonicalServingUrl(input) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch (cause) {
-        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
-    }
-    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
-        url.username !== '' ||
-        url.password !== '' ||
-        url.pathname !== '/' ||
-        url.search !== '' ||
-        url.hash !== '') {
-        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
-    }
-    return url.origin;
-}
-function deploymentVersion(environment) {
-    const input = environment.ASTRALE_VERSION_METADATA;
-    if (input !== null &&
-        typeof input === 'object' &&
-        typeof input.id === 'string' &&
-        input.id.length > 0) {
-        return input.id;
-    }
-    const fallback = environment.ASTRALE_DEPLOYMENT_VERSION;
-    if (typeof fallback === 'string' && fallback.length > 0)
-        return fallback;
-    throw new TypeError('Cloudflare Worker deployment version is unavailable.');
-}
-//# sourceMappingURL=index.js.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export * from './gateway.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.3",
-  "description": "Deploy an Astrale domain as a standalone Cloudflare Worker",
+  "version": "0.5.0-beta.30",
+  "description": "Deploy an Astrale application through Cloudflare Workers",
   "keywords": [
     "adapter",
     "astrale",
@@ -11,16 +11,21 @@
   ],
   "license": "Apache-2.0",
   "author": "Astrale",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/astrale-os/sdk.git"
+  },
   "files": [
     "dist",
-    "src",
+    "!dist/**/*.map",
     "template",
-    "!template/node_modules",
-    "!template/pnpm-lock.yaml"
+    "!template/**/node_modules",
+    "!template/**/node_modules/**",
+    "!template/**/pnpm-lock.yaml"
   ],
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -37,31 +42,29 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.1",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.1",
     "hono": "^4.6.20",
     "jose": "^6.1.3",
-    "@astrale-os/sdk": "^0.5.0-beta.1"
+    "wrangler": "4.123.0",
+    "@astrale-os/sdk": "^0.5.0-beta.27"
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
     "@types/node": "^22.0.0",
-    "@typescript/native-preview": "latest",
-    "oxfmt": "0.52.0",
-    "oxlint": "latest",
-    "typescript": "~6.0.1-rc",
-    "vitest": "^3.0.0",
-    "wrangler": "4.121.0"
+    "oxfmt": "0.63.0",
+    "oxlint": "1.78.0",
+    "typescript": "7.0.2",
+    "vitest": "^4.1.10",
+    "zod": "^4.4.3"
   },
   "engines": {
     "node": ">=22"
   },
   "scripts": {
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "lint": "oxlint --disable-nested-config .",
     "format": "pnpm exec oxfmt --write .",
     "format:check": "pnpm exec oxfmt --check .",
-    "build": "rm -rf dist && tsgo"
+    "build": "rm -rf dist && tsc && node ../scripts/verify-no-source-maps.mjs dist"
   }
 }