@astrale-os/sdk 0.1.6 → 0.1.7

package/dist/server/domain-entry.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import type { Core, Schema } from '@astrale-os/kernel-dsl';
+import type { Hono } from 'hono';
+import type { AnyRemoteFunctionDef, ViewDef } from '../define';
+import type { SchemaMethodsImpl } from '../method';
+import type { RemoteServerConfig } from './config';
+import type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
+    /** The domain schema. */
+    schema: S;
+    /** Method implementations, typed against `schema` under `TDeps`. */
+    methods: SchemaMethodsImpl<S, TDeps>;
+    /** Optional Core override (extra genesis nodes / wiring). */
+    core?: Core<S>;
+    /** Views (iframe-mountable UIs) keyed by slug. */
+    views?: Record<string, ViewDef<TDeps>>;
+    /** Standalone Functions (callables not bound to a class) keyed by slug. */
+    functions?: Record<string, AnyRemoteFunctionDef>;
+    /**
+     * The worker's signing key (its `iss` identity material). A static JWK, or a
+     * resolver from `env` for keys injected as a secret / shared globally.
+     */
+    privateKey: JsonWebKey | ((env: TEnv) => JsonWebKey);
+    /** Cross-domain deps by origin — verified present at install. */
+    requires?: readonly string[];
+    /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
+    postInstall?: string;
+    /** Provenance stamped on `/meta`. */
+    meta?: RemoteServerConfig<TDeps>['meta'];
+    /**
+     * Map the worker `env` to the handler dependency container. Defaults to
+     * passing `env` straight through (the common case where handlers read
+     * bindings directly).
+     */
+    deps?: (env: TEnv, url: string) => TDeps;
+    /** Optional pre-built host Hono app (CORS / logging / extra routes). */
+    app?: (env: TEnv) => Hono;
+    resolveUrl?: WorkerEntryConfig<TEnv>['resolveUrl'];
+    selfBinding?: WorkerEntryConfig<TEnv>['selfBinding'];
+    routeSubrequest?: WorkerEntryConfig<TEnv>['routeSubrequest'];
+    before?: WorkerEntryConfig<TEnv>['before'];
+    rewriteRequest?: WorkerEntryConfig<TEnv>['rewriteRequest'];
+}
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export declare function domainWorkerEntry<TEnv, TDeps = TEnv>(): <S extends Schema>(config: DomainWorkerEntryConfig<S, TEnv, TDeps>) => WorkerEntry<TEnv>;
+//# sourceMappingURL=domain-entry.d.ts.map

package/dist/server/domain-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAKpE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAExC;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAiCrB"}

package/dist/server/domain-entry.js

@@ -0,0 +1,58 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import { defineRemoteDomain } from '../domain';
+import { createWorkerEntry } from './worker-entry';
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export function domainWorkerEntry() {
+    return function (config) {
+        const domain = defineRemoteDomain()({
+            schema: config.schema,
+            methods: config.methods,
+            ...(config.core ? { core: config.core } : {}),
+            ...(config.views ? { views: config.views } : {}),
+            ...(config.functions ? { remoteFunctions: config.functions } : {}),
+        });
+        return createWorkerEntry({
+            ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),
+            ...(config.selfBinding ? { selfBinding: config.selfBinding } : {}),
+            ...(config.routeSubrequest ? { routeSubrequest: config.routeSubrequest } : {}),
+            ...(config.before ? { before: config.before } : {}),
+            ...(config.rewriteRequest ? { rewriteRequest: config.rewriteRequest } : {}),
+            // `createWorkerEntry` conflates the worker env and the handler deps into a
+            // single type param; we keep them distinct in the public config and bridge
+            // here. The runtime deps (and the methods typed against them) are correct;
+            // only this assembly is cast.
+            build: (url, env) => ({
+                domain,
+                deps: config.deps ? config.deps(env, url) : env,
+                url,
+                privateKey: typeof config.privateKey === 'function' ? config.privateKey(env) : config.privateKey,
+                ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
+                ...(config.postInstall ? { postInstall: config.postInstall } : {}),
+                ...(config.meta ? { meta: config.meta } : {}),
+                ...(config.app ? { app: config.app(env) } : {}),
+            }),
+        });
+    };
+}
+//# sourceMappingURL=domain-entry.js.map

package/dist/server/domain-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AA2ClD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,8 +4,10 @@ export type { RemoteServer, RemoteServerHandle } from './handle';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
 export type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
+export type { DomainWorkerEntryConfig } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/index.js

@@ -2,7 +2,8 @@ export { createRemoteServer } from './create';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/worker-entry.d.ts

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -43,6 +45,17 @@ export interface WorkerEntryConfig<TDeps> {
     resolveUrl?: (env: TDeps, requestOrigin: string) => string;
     /** Optional: the `SELF` service binding used to route same-host subrequests. */
     selfBinding?: (env: TDeps) => Fetcher | null | undefined;
+    /**
+     * Optional, vendor-neutral: route an OUTBOUND subrequest through a
+     * caller-supplied fetcher instead of the network — for hosts a Worker can't
+     * reach directly over the edge (e.g. a platform router on the SAME zone:
+     * Cloudflare 522s a same-zone Worker→Worker public `fetch`). Return a `Fetcher`
+     * to route the request through, or null/undefined to fall through to the normal
+     * fetch. The SDK names no backend or topology — the CALLER owns BOTH the
+     * predicate (which hosts) and the fetcher (the binding). This generalizes
+     * `selfBinding` (same-origin → SELF) to any caller policy; both are honored.
+     */
+    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
     /**
      * Optional: handle a request before it reaches the kernel app — e.g. serve a
      * SPA under `/ui/*` or a same-origin `/api/*` endpoint the view calls. Return
@@ -72,6 +85,28 @@ export interface WorkerEntry<TDeps> {
  * fails — it can never make this worker speak for another origin.
  */
 export declare function clientOrigin(url: URL, request: Request): string;
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export declare function assets<TDeps>(opts: {
+    base?: string;
+    binding: (env: TDeps) => Fetcher | null | undefined;
+    devProxy?: (env: TDeps) => string | null | undefined;
+}): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined;
 export declare function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
 export {};
 //# sourceMappingURL=worker-entry.d.ts.map

package/dist/server/worker-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAGxE,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAmE7F"}
+{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAGxE,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CA0E7F"}

package/dist/server/worker-entry.js

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -41,6 +43,43 @@ export function clientOrigin(url, request) {
     const scheme = forwarded?.split(',')[0]?.trim().toLowerCase();
     return scheme === 'https' ? `https://${url.host}` : url.origin;
 }
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export function assets(opts) {
+    const base = (opts.base ?? '/ui').replace(/\/+$/, '');
+    const prefix = `${base}/`;
+    return (env, url, request) => {
+        const binding = opts.binding(env);
+        if (!binding)
+            return undefined;
+        if (url.pathname !== base && !url.pathname.startsWith(prefix))
+            return undefined;
+        const devUrl = opts.devProxy?.(env);
+        if (devUrl) {
+            const devBase = devUrl.replace(/\/+$/, '');
+            return fetch(new Request(`${devBase}${url.pathname}${url.search}`, request));
+        }
+        // `<base>` → `/`, `<base>/x` → `/x`: serve from the binding's root.
+        const stripped = url.pathname.slice(base.length) || '/';
+        const rewritten = new URL(stripped + url.search, url.origin);
+        return binding.fetch(new Request(rewritten, request));
+    };
+}
 export function createWorkerEntry(config) {
     // Cache the built app per distinct resolved URL — plural and bounded. On the
     // request-origin fallback the URL legitimately alternates for one worker
@@ -51,6 +90,7 @@ export function createWorkerEntry(config) {
     const MAX_CACHED_APPS = 4;
     const apps = new Map();
     let self = null;
+    let routeEnv = null;
     function getApp(url, env) {
         const cached = apps.get(url);
         if (cached)
@@ -64,28 +104,35 @@ export function createWorkerEntry(config) {
         apps.set(url, { origin: new URL(url).origin, app });
         return app;
     }
-    // A Worker can't fetch its own hostname. When a SELF service binding is
-    // configured, route same-host subrequests (e.g. `ctx.callRemote` back into
-    // this domain) through it. This is the only reason to override
-    // `globalThis.fetch` — workers without a `selfBinding` get no global mutation.
-    // (A self-issued credential's JWKS is resolved in-memory by the verifier, not
-    // fetched — see `auth/verify.ts` — so no self-JWKS interception is needed.)
-    if (config.selfBinding) {
+    // A Worker can't fetch its own hostname (SELF), nor — on Cloudflare — a
+    // same-zone hostname routed to another Worker (the `routeSubrequest` case).
+    // When either is configured, override `globalThis.fetch` to redirect those
+    // subrequests through the caller's fetcher. Workers with neither get no global
+    // mutation. (A self-issued credential's JWKS is resolved in-memory by the
+    // verifier, not fetched — see `auth/verify.ts` — so no self-JWKS shim is needed.)
+    if (config.selfBinding || config.routeSubrequest) {
         const originalFetch = globalThis.fetch;
         globalThis.fetch = (async (input, init) => {
-            if (apps.size > 0 && self) {
-                const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
-                try {
-                    const origin = new URL(href).origin;
+            const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+            try {
+                const u = new URL(href);
+                // same-origin → SELF (a Worker can't fetch its own hostname)
+                if (self && apps.size > 0) {
                     for (const cached of apps.values()) {
-                        if (cached.origin === origin)
+                        if (cached.origin === u.origin)
                             return self.fetch(new Request(input, init));
                     }
                 }
-                catch {
-                    // non-absolute URL — fall through to the original fetch
+                // caller policy → its fetcher (e.g. a platform router on the same zone)
+                if (config.routeSubrequest && routeEnv) {
+                    const via = config.routeSubrequest(u, routeEnv);
+                    if (via)
+                        return via.fetch(new Request(input, init));
                 }
             }
+            catch {
+                // non-absolute URL — fall through to the original fetch
+            }
             return originalFetch(input, init);
         });
     }
@@ -93,6 +140,8 @@ export function createWorkerEntry(config) {
         async fetch(request, env) {
             if (config.selfBinding)
                 self ??= config.selfBinding(env) ?? null;
+            if (config.routeSubrequest)
+                routeEnv = env;
             // Only parse the request URL when a hook actually needs it.
             const requestUrl = config.before || config.resolveUrl ? new URL(request.url) : null;
             if (config.before && requestUrl) {

package/dist/server/worker-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAgDtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,IAAI,IAAI,GAAmB,IAAI,CAAA;IAE/B,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,+DAA+D;IAC/D,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;gBACnF,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;oBACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;4BAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBAC3E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AA2DtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,kFAAkF;IAClF,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,6DAA6D;gBAC7D,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;4BAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBAC7E,CAAC;gBACH,CAAC;gBACD,wEAAwE;gBACxE,IAAI,MAAM,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;oBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;oBAC/C,IAAI,GAAG;wBAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
   "keywords": [
     "astrale",
@@ -15,6 +15,9 @@
     "type": "git",
     "url": "git+https://github.com/astrale-os/sdk.git"
   },
+  "bin": {
+    "astrale-domain": "./dist/cli/bin.js"
+  },
   "files": [
     "dist",
     "src"
@@ -31,6 +34,14 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
     },
+    "./domain": {
+      "types": "./dist/domain/index.d.ts",
+      "import": "./dist/domain/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "import": "./dist/cli/index.js"
+    },
     "./deploy": {
       "types": "./dist/deploy/index.d.ts",
       "import": "./dist/deploy/index.js"
@@ -50,8 +61,6 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@astrale-os/kernel-host": ">=0.4.0 <1.0.0",
-    "@astrale-os/kernel-test": ">=0.4.0 <1.0.0",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.0",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",

package/src/cli/bin.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env bun
+/**
+ * `astrale-domain` bin entry. Runs under bun (native TS) so it can import the
+ * project's `astrale.config.ts` directly — matching the `astrale` CLI.
+ */
+
+import { run } from './run'
+
+run(process.argv.slice(2))
+  .then((code) => process.exit(code))
+  .catch((err: unknown) => {
+    process.stderr.write(`\x1b[31m✗\x1b[0m ${(err as Error).message ?? String(err)}\n`)
+    if (process.env.DEBUG) process.stderr.write(`${(err as Error).stack ?? ''}\n`)
+    process.exit(1)
+  })

package/src/cli/dotenv.ts

@@ -0,0 +1,45 @@
+/**
+ * Minimal dotenv parser — the secrets-file boundary.
+ *
+ * `secrets: '.env.<env>'` in an adapter's params points a gitignored file whose
+ * entire contents are secrets. `loadDotenvFile` reads it into a flat
+ * `Record<string,string>` the CLI hands the adapter (injected into the local
+ * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
+ * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
+ */
+
+import { readFileSync } from 'node:fs'
+
+export function parseDotenv(contents: string): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const raw of contents.split('\n')) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#')) continue
+    const match = /^(?:export\s+)?([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line)
+    if (!match) continue
+    const [, key, rawValue] = match
+    let value = rawValue.trim()
+    // Single quotes mean a LITERAL value (standard dotenv): no `${VAR}`
+    // interpolation, so a secret that legitimately contains a literal `${...}`
+    // (e.g. a password) survives intact instead of being silently blanked.
+    const singleQuoted = value.length >= 2 && value.startsWith("'") && value.endsWith("'")
+    if ((value.length >= 2 && value.startsWith('"') && value.endsWith('"')) || singleQuoted) {
+      value = value.slice(1, -1)
+    }
+    out[key] = singleQuoted
+      ? value
+      : value.replace(/\$\{(\w+)\}/g, (_, name: string) => out[name] ?? '')
+  }
+  return out
+}
+
+/** Read + parse a dotenv file. Returns `{}` if the file is absent (CI-safe). */
+export function loadDotenvFile(path: string): Record<string, string> {
+  let contents: string
+  try {
+    contents = readFileSync(path, 'utf-8')
+  } catch {
+    return {}
+  }
+  return parseDotenv(contents)
+}

package/src/cli/index.ts

@@ -0,0 +1,15 @@
+/**
+ * `@astrale-os/sdk/cli` — the `astrale-domain` CLI (dev | build | deploy) and
+ * the dotenv secrets-file boundary, folded in from the former
+ * `@astrale-os/devkit` package.
+ *
+ * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
+ * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
+ * deliberately NOT re-exported from the package barrel — pulling it into the
+ * isomorphic `.` entry would poison browser/worker bundlers that traverse every
+ * re-export (the same rule that keeps `./server` and `./deploy` off the barrel).
+ * The bin lives at `./bin`.
+ */
+
+export { run, parseArgs } from './run'
+export { parseDotenv, loadDotenvFile } from './dotenv'