@astrale-os/sdk 0.1.5 → 0.1.7

package/dist/server/domain-entry.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import type { Core, Schema } from '@astrale-os/kernel-dsl';
+import type { Hono } from 'hono';
+import type { AnyRemoteFunctionDef, ViewDef } from '../define';
+import type { SchemaMethodsImpl } from '../method';
+import type { RemoteServerConfig } from './config';
+import type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
+    /** The domain schema. */
+    schema: S;
+    /** Method implementations, typed against `schema` under `TDeps`. */
+    methods: SchemaMethodsImpl<S, TDeps>;
+    /** Optional Core override (extra genesis nodes / wiring). */
+    core?: Core<S>;
+    /** Views (iframe-mountable UIs) keyed by slug. */
+    views?: Record<string, ViewDef<TDeps>>;
+    /** Standalone Functions (callables not bound to a class) keyed by slug. */
+    functions?: Record<string, AnyRemoteFunctionDef>;
+    /**
+     * The worker's signing key (its `iss` identity material). A static JWK, or a
+     * resolver from `env` for keys injected as a secret / shared globally.
+     */
+    privateKey: JsonWebKey | ((env: TEnv) => JsonWebKey);
+    /** Cross-domain deps by origin — verified present at install. */
+    requires?: readonly string[];
+    /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
+    postInstall?: string;
+    /** Provenance stamped on `/meta`. */
+    meta?: RemoteServerConfig<TDeps>['meta'];
+    /**
+     * Map the worker `env` to the handler dependency container. Defaults to
+     * passing `env` straight through (the common case where handlers read
+     * bindings directly).
+     */
+    deps?: (env: TEnv, url: string) => TDeps;
+    /** Optional pre-built host Hono app (CORS / logging / extra routes). */
+    app?: (env: TEnv) => Hono;
+    resolveUrl?: WorkerEntryConfig<TEnv>['resolveUrl'];
+    selfBinding?: WorkerEntryConfig<TEnv>['selfBinding'];
+    routeSubrequest?: WorkerEntryConfig<TEnv>['routeSubrequest'];
+    before?: WorkerEntryConfig<TEnv>['before'];
+    rewriteRequest?: WorkerEntryConfig<TEnv>['rewriteRequest'];
+}
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export declare function domainWorkerEntry<TEnv, TDeps = TEnv>(): <S extends Schema>(config: DomainWorkerEntryConfig<S, TEnv, TDeps>) => WorkerEntry<TEnv>;
+//# sourceMappingURL=domain-entry.d.ts.map

package/dist/server/domain-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAKpE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAExC;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAiCrB"}

package/dist/server/domain-entry.js

@@ -0,0 +1,58 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import { defineRemoteDomain } from '../domain';
+import { createWorkerEntry } from './worker-entry';
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export function domainWorkerEntry() {
+    return function (config) {
+        const domain = defineRemoteDomain()({
+            schema: config.schema,
+            methods: config.methods,
+            ...(config.core ? { core: config.core } : {}),
+            ...(config.views ? { views: config.views } : {}),
+            ...(config.functions ? { remoteFunctions: config.functions } : {}),
+        });
+        return createWorkerEntry({
+            ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),
+            ...(config.selfBinding ? { selfBinding: config.selfBinding } : {}),
+            ...(config.routeSubrequest ? { routeSubrequest: config.routeSubrequest } : {}),
+            ...(config.before ? { before: config.before } : {}),
+            ...(config.rewriteRequest ? { rewriteRequest: config.rewriteRequest } : {}),
+            // `createWorkerEntry` conflates the worker env and the handler deps into a
+            // single type param; we keep them distinct in the public config and bridge
+            // here. The runtime deps (and the methods typed against them) are correct;
+            // only this assembly is cast.
+            build: (url, env) => ({
+                domain,
+                deps: config.deps ? config.deps(env, url) : env,
+                url,
+                privateKey: typeof config.privateKey === 'function' ? config.privateKey(env) : config.privateKey,
+                ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
+                ...(config.postInstall ? { postInstall: config.postInstall } : {}),
+                ...(config.meta ? { meta: config.meta } : {}),
+                ...(config.app ? { app: config.app(env) } : {}),
+            }),
+        });
+    };
+}
+//# sourceMappingURL=domain-entry.js.map

package/dist/server/domain-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AA2ClD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,8 +4,10 @@ export type { RemoteServer, RemoteServerHandle } from './handle';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
 export type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
+export type { DomainWorkerEntryConfig } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/index.js

@@ -2,7 +2,8 @@ export { createRemoteServer } from './create';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/worker-entry.d.ts

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -34,10 +36,26 @@ export interface WorkerEntryConfig<TDeps> {
      * Resolve the raw serving URL from `env` (+ the per-request origin, for workers
      * that fall back to the request host). Defaults to the `WORKER_URL` env var.
      * The result is always canonicalized before use.
+     *
+     * The `requestOrigin` honors an `X-Forwarded-Proto: https` upgrade (see
+     * `clientOrigin`), so a dev worker behind a TLS-terminating proxy (cloudflared
+     * tunnel, reverse proxy) resolves its public `https://` origin, not the raw
+     * `http://` one workerd sees.
      */
     resolveUrl?: (env: TDeps, requestOrigin: string) => string;
     /** Optional: the `SELF` service binding used to route same-host subrequests. */
     selfBinding?: (env: TDeps) => Fetcher | null | undefined;
+    /**
+     * Optional, vendor-neutral: route an OUTBOUND subrequest through a
+     * caller-supplied fetcher instead of the network — for hosts a Worker can't
+     * reach directly over the edge (e.g. a platform router on the SAME zone:
+     * Cloudflare 522s a same-zone Worker→Worker public `fetch`). Return a `Fetcher`
+     * to route the request through, or null/undefined to fall through to the normal
+     * fetch. The SDK names no backend or topology — the CALLER owns BOTH the
+     * predicate (which hosts) and the fetcher (the binding). This generalizes
+     * `selfBinding` (same-origin → SELF) to any caller policy; both are honored.
+     */
+    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
     /**
      * Optional: handle a request before it reaches the kernel app — e.g. serve a
      * SPA under `/ui/*` or a same-origin `/api/*` endpoint the view calls. Return
@@ -55,6 +73,40 @@ export interface WorkerEntryConfig<TDeps> {
 export interface WorkerEntry<TDeps> {
     fetch(request: Request, env: TDeps): Response | Promise<Response>;
 }
+/**
+ * The request origin as the CLIENT reached it — i.e. the origin a fallback
+ * serving URL (and therefore the `iss`) may be derived from. Behind a
+ * TLS-terminating proxy (a cloudflared tunnel in front of `wrangler dev`, any
+ * reverse proxy) the worker sees plain HTTP, so `request.url` says `http://…`
+ * while the public URL is `https://…`; the proxy advertises the original
+ * scheme via `X-Forwarded-Proto`. Honoring it is restricted to the http→https
+ * UPGRADE of the SAME host (never a downgrade, never a host change), so a
+ * spoofed header can at worst derive an `iss` the kernel's JWKS check then
+ * fails — it can never make this worker speak for another origin.
+ */
+export declare function clientOrigin(url: URL, request: Request): string;
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export declare function assets<TDeps>(opts: {
+    base?: string;
+    binding: (env: TDeps) => Fetcher | null | undefined;
+    devProxy?: (env: TDeps) => string | null | undefined;
+}): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined;
 export declare function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
 export {};
 //# sourceMappingURL=worker-entry.d.ts.map

package/dist/server/worker-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAGxE,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAoD7F"}
+{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAGxE,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CA0E7F"}

package/dist/server/worker-entry.js

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -22,35 +24,115 @@
 import { createRemoteServer } from './create';
 import { requireEnv } from './require-env';
 import { canonicalizeServingUrl } from './serving-url';
+/**
+ * The request origin as the CLIENT reached it — i.e. the origin a fallback
+ * serving URL (and therefore the `iss`) may be derived from. Behind a
+ * TLS-terminating proxy (a cloudflared tunnel in front of `wrangler dev`, any
+ * reverse proxy) the worker sees plain HTTP, so `request.url` says `http://…`
+ * while the public URL is `https://…`; the proxy advertises the original
+ * scheme via `X-Forwarded-Proto`. Honoring it is restricted to the http→https
+ * UPGRADE of the SAME host (never a downgrade, never a host change), so a
+ * spoofed header can at worst derive an `iss` the kernel's JWKS check then
+ * fails — it can never make this worker speak for another origin.
+ */
+export function clientOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto');
+    // Multiple proxies append: "https, http" — the first hop is the client-facing one.
+    const scheme = forwarded?.split(',')[0]?.trim().toLowerCase();
+    return scheme === 'https' ? `https://${url.host}` : url.origin;
+}
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export function assets(opts) {
+    const base = (opts.base ?? '/ui').replace(/\/+$/, '');
+    const prefix = `${base}/`;
+    return (env, url, request) => {
+        const binding = opts.binding(env);
+        if (!binding)
+            return undefined;
+        if (url.pathname !== base && !url.pathname.startsWith(prefix))
+            return undefined;
+        const devUrl = opts.devProxy?.(env);
+        if (devUrl) {
+            const devBase = devUrl.replace(/\/+$/, '');
+            return fetch(new Request(`${devBase}${url.pathname}${url.search}`, request));
+        }
+        // `<base>` → `/`, `<base>/x` → `/x`: serve from the binding's root.
+        const stripped = url.pathname.slice(base.length) || '/';
+        const rewritten = new URL(stripped + url.search, url.origin);
+        return binding.fetch(new Request(rewritten, request));
+    };
+}
 export function createWorkerEntry(config) {
-    let cache = null;
+    // Cache the built app per distinct resolved URL — plural and bounded. On the
+    // request-origin fallback the URL legitimately alternates for one worker
+    // (direct http hits vs https-upgraded tunnel hits, workers.dev + custom
+    // domain), and a single slot would tear down and rebuild the whole app on
+    // every alternation. The bound caps abuse via attacker-minted Host /
+    // X-Forwarded-Proto values on that same fallback path.
+    const MAX_CACHED_APPS = 4;
+    const apps = new Map();
     let self = null;
+    let routeEnv = null;
     function getApp(url, env) {
-        if (cache && cache.url === url)
-            return cache.app;
+        const cached = apps.get(url);
+        if (cached)
+            return cached.app;
         const { app } = createRemoteServer(config.build(url, env));
-        cache = { url, origin: new URL(url).origin, app };
+        if (apps.size >= MAX_CACHED_APPS) {
+            const oldest = apps.keys().next().value;
+            if (oldest !== undefined)
+                apps.delete(oldest);
+        }
+        apps.set(url, { origin: new URL(url).origin, app });
         return app;
     }
-    // A Worker can't fetch its own hostname. When a SELF service binding is
-    // configured, route same-host subrequests (e.g. `ctx.callRemote` back into
-    // this domain) through it. This is the only reason to override
-    // `globalThis.fetch` — workers without a `selfBinding` get no global mutation.
-    // (A self-issued credential's JWKS is resolved in-memory by the verifier, not
-    // fetched — see `auth/verify.ts` — so no self-JWKS interception is needed.)
-    if (config.selfBinding) {
+    // A Worker can't fetch its own hostname (SELF), nor — on Cloudflare — a
+    // same-zone hostname routed to another Worker (the `routeSubrequest` case).
+    // When either is configured, override `globalThis.fetch` to redirect those
+    // subrequests through the caller's fetcher. Workers with neither get no global
+    // mutation. (A self-issued credential's JWKS is resolved in-memory by the
+    // verifier, not fetched — see `auth/verify.ts` — so no self-JWKS shim is needed.)
+    if (config.selfBinding || config.routeSubrequest) {
         const originalFetch = globalThis.fetch;
         globalThis.fetch = (async (input, init) => {
-            if (cache && self) {
-                const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
-                try {
-                    if (new URL(href).origin === cache.origin)
-                        return self.fetch(new Request(input, init));
+            const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+            try {
+                const u = new URL(href);
+                // same-origin → SELF (a Worker can't fetch its own hostname)
+                if (self && apps.size > 0) {
+                    for (const cached of apps.values()) {
+                        if (cached.origin === u.origin)
+                            return self.fetch(new Request(input, init));
+                    }
                 }
-                catch {
-                    // non-absolute URL — fall through to the original fetch
+                // caller policy → its fetcher (e.g. a platform router on the same zone)
+                if (config.routeSubrequest && routeEnv) {
+                    const via = config.routeSubrequest(u, routeEnv);
+                    if (via)
+                        return via.fetch(new Request(input, init));
                 }
             }
+            catch {
+                // non-absolute URL — fall through to the original fetch
+            }
             return originalFetch(input, init);
         });
     }
@@ -58,6 +140,8 @@ export function createWorkerEntry(config) {
         async fetch(request, env) {
             if (config.selfBinding)
                 self ??= config.selfBinding(env) ?? null;
+            if (config.routeSubrequest)
+                routeEnv = env;
             // Only parse the request URL when a hook actually needs it.
             const requestUrl = config.before || config.resolveUrl ? new URL(request.url) : null;
             if (config.before && requestUrl) {
@@ -68,7 +152,7 @@ export function createWorkerEntry(config) {
                     return handled;
             }
             const raw = config.resolveUrl
-                ? config.resolveUrl(env, requestUrl.origin)
+                ? config.resolveUrl(env, clientOrigin(requestUrl, request))
                 : requireEnv(env, 'WORKER_URL', "the worker's public serving URL (its iss identity)");
             const url = canonicalizeServingUrl(raw);
             const dispatched = config.rewriteRequest ? config.rewriteRequest(env, request) : request;

package/dist/server/worker-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AA2CtD,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,IAAI,KAAK,GAAqD,IAAI,CAAA;IAClE,IAAI,IAAI,GAAmB,IAAI,CAAA;IAE/B,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,GAAG,CAAA;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAA;QACjD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,+DAA+D;IAC/D,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;gBACnF,IAAI,CAAC;oBACH,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;wBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;gBACxF,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,UAAW,CAAC,MAAM,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AA2DtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,kFAAkF;IAClF,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,6DAA6D;gBAC7D,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;4BAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBAC7E,CAAC;gBACH,CAAC;gBACD,wEAAwE;gBACxE,IAAI,MAAM,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;oBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;oBAC/C,IAAI,GAAG;wBAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
   "keywords": [
     "astrale",
@@ -15,6 +15,9 @@
     "type": "git",
     "url": "git+https://github.com/astrale-os/sdk.git"
   },
+  "bin": {
+    "astrale-domain": "./dist/cli/bin.js"
+  },
   "files": [
     "dist",
     "src"
@@ -31,6 +34,14 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
     },
+    "./domain": {
+      "types": "./dist/domain/index.d.ts",
+      "import": "./dist/domain/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "import": "./dist/cli/index.js"
+    },
     "./deploy": {
       "types": "./dist/deploy/index.d.ts",
       "import": "./dist/deploy/index.js"
@@ -50,8 +61,6 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@astrale-os/kernel-host": ">=0.4.0 <1.0.0",
-    "@astrale-os/kernel-test": ">=0.4.0 <1.0.0",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.0",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",