@astrale-os/sdk 0.1.6 → 0.1.8

package/dist/method/single.d.ts

@@ -13,7 +13,7 @@ import type { AuthPolicy, RouteBinding } from '@astrale-os/kernel-api/routed';
 import type { MethodClassKeys, ClassMethodConfig, NonSealedMethodKeys, OwnMethodKeys } from '@astrale-os/kernel-core/domain';
 import type { Schema } from '@astrale-os/kernel-dsl';
 import type { SelfResult } from '../dispatch/self';
-import type { RemoteContext } from './context';
+import type { KernelForAuth, RemoteContext } from './context';
 /**
  * Remote function handler — execute with full typed context.
  *
@@ -27,9 +27,9 @@ import type { RemoteContext } from './context';
  * dispatcher throws — that's a programmer error indicating a stub leaked into
  * a code path that was supposed to execute it.
  */
-export type RemoteHandler<TParams, TResult, TSelf, TDeps> = {
+export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPolicy = 'required'> = {
     /** The handler body. May be async or an async generator (for `output: 'stream'`). */
-    execute?: (ctx: RemoteContext<TParams, TSelf, TDeps>) => TResult | Promise<TResult> | AsyncGenerator<TResult>;
+    execute?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>) => TResult | Promise<TResult> | AsyncGenerator<TResult>;
     /**
      * Optional REST binding — attaches a native HTTP route to this method.
      * Uses the kernel's canonical `RouteBinding` type directly.
@@ -43,8 +43,13 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps> = {
     remoteUrl?: string;
     /** Optional human-readable description. Appears in generated docs. */
     description?: string;
-    /** Authentication policy. Defaults to `'required'` when absent. */
-    auth?: AuthPolicy;
+    /**
+     * Authentication policy. Defaults to `'required'` when absent. Captured as a
+     * literal type so it drives {@link KernelForAuth} on the `execute`/`authorize`
+     * context: omit it (or set `'required'`) and `ctx.kernel` is non-null;
+     * `'optional'` widens it to `… | null`; `'public'` makes it `null`.
+     */
+    auth?: TAuth;
     /**
      * Optional pre-execute authorization check. Runs after auth resolution and
      * `_self` resolution, before `execute`. Throw any error to deny the call —
@@ -59,19 +64,19 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps> = {
      * The kernel still enforces `has_perm` independently — `authorize` is
      * additive ergonomic gating on top, not a replacement.
      */
-    authorize?: (ctx: RemoteContext<TParams, TSelf, TDeps>) => void | Promise<void>;
+    authorize?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>) => void | Promise<void>;
 };
-export type AnyRemoteHandler = RemoteHandler<any, any, any, any>;
+export type AnyRemoteHandler = RemoteHandler<any, any, any, any, AuthPolicy>;
 /**
  * Fully typed method implementation — resolves params/result/self from the
  * schema, wraps in `RemoteHandler` with deps.
  */
-export type MethodImpl<S extends Schema, K extends MethodClassKeys<S> & string, M extends string, TDeps = unknown> = ClassMethodConfig<S, K, M> extends {
+export type MethodImpl<S extends Schema, K extends MethodClassKeys<S> & string, M extends string, TDeps = unknown, TAuth extends AuthPolicy = 'required'> = ClassMethodConfig<S, K, M> extends {
     params: infer P;
     result: infer R;
     self: unknown;
     isStatic: infer St;
-} ? RemoteHandler<P, R, St extends true ? undefined : SelfResult, TDeps> : never;
+} ? RemoteHandler<P, R, St extends true ? undefined : SelfResult, TDeps, TAuth> : never;
 type ImplementableMethodName<S extends Schema, K extends MethodClassKeys<S> & string> = (OwnMethodKeys<S, K> | NonSealedMethodKeys<S, K>) & string;
 /**
  * Identity helper for authoring one remote method with full schema-driven typing.
@@ -82,7 +87,7 @@ type ImplementableMethodName<S extends Schema, K extends MethodClassKeys<S> & st
  *  - `remoteMethod(schema, className, methodName, impl)` — direct form with
  *     `unknown` deps.
  */
-export declare function remoteMethod<TDeps>(): <S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M, TDeps>) => MethodImpl<S, K, M, TDeps>;
-export declare function remoteMethod<S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M>): MethodImpl<S, K, M>;
+export declare function remoteMethod<TDeps>(): <S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>, TAuth extends AuthPolicy = 'required'>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M, TDeps, TAuth>) => MethodImpl<S, K, M, TDeps, TAuth>;
+export declare function remoteMethod<S extends Schema, K extends MethodClassKeys<S> & string, M extends ImplementableMethodName<S, K>, TAuth extends AuthPolicy = 'required'>(schema: S, className: K, methodName: M, impl: MethodImpl<S, K, M, unknown, TAuth>): MethodImpl<S, K, M, unknown, TAuth>;
 export {};
 //# sourceMappingURL=single.d.ts.map

package/dist/method/single.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI;IAC1D,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KACtC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mEAAmE;IACnE,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChF,CAAA;AAGD,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEhE;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,IAEf,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,KAAK,CAAC,GACpE,KAAK,CAAA;AAEX,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EAEvC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAC7B,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;AAC/B,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA"}
+{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACjG,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC5D,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B,CAAA;AAOD,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IAErC,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAC3E,KAAK,CAAA;AAEX,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KACpC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACtC,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GACxC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA"}

package/dist/method/single.js.map

@@ -1 +1 @@
-{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoHH,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}
+{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuIH,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}

package/dist/server/domain-entry.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import type { Core, Schema } from '@astrale-os/kernel-dsl';
+import type { Hono } from 'hono';
+import type { AnyRemoteFunctionDef, ViewDef } from '../define';
+import type { SchemaMethodsImpl } from '../method';
+import type { RemoteServerConfig } from './config';
+import type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
+    /** The domain schema. */
+    schema: S;
+    /** Method implementations, typed against `schema` under `TDeps`. */
+    methods: SchemaMethodsImpl<S, TDeps>;
+    /** Optional Core override (extra genesis nodes / wiring). */
+    core?: Core<S>;
+    /** Views (iframe-mountable UIs) keyed by slug. */
+    views?: Record<string, ViewDef<TDeps>>;
+    /** Standalone Functions (callables not bound to a class) keyed by slug. */
+    functions?: Record<string, AnyRemoteFunctionDef>;
+    /**
+     * The worker's signing key (its `iss` identity material). A static JWK, or a
+     * resolver from `env` for keys injected as a secret / shared globally.
+     */
+    privateKey: JsonWebKey | ((env: TEnv) => JsonWebKey);
+    /** Cross-domain deps by origin — verified present at install. */
+    requires?: readonly string[];
+    /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
+    postInstall?: string;
+    /** Provenance stamped on `/meta`. */
+    meta?: RemoteServerConfig<TDeps>['meta'];
+    /**
+     * Map the worker `env` to the handler dependency container. Defaults to
+     * passing `env` straight through (the common case where handlers read
+     * bindings directly).
+     */
+    deps?: (env: TEnv, url: string) => TDeps;
+    /** Optional pre-built host Hono app (CORS / logging / extra routes). */
+    app?: (env: TEnv) => Hono;
+    resolveUrl?: WorkerEntryConfig<TEnv>['resolveUrl'];
+    selfBinding?: WorkerEntryConfig<TEnv>['selfBinding'];
+    routeSubrequest?: WorkerEntryConfig<TEnv>['routeSubrequest'];
+    before?: WorkerEntryConfig<TEnv>['before'];
+    rewriteRequest?: WorkerEntryConfig<TEnv>['rewriteRequest'];
+}
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export declare function domainWorkerEntry<TEnv, TDeps = TEnv>(): <S extends Schema>(config: DomainWorkerEntryConfig<S, TEnv, TDeps>) => WorkerEntry<TEnv>;
+//# sourceMappingURL=domain-entry.d.ts.map

package/dist/server/domain-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAKpE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IAExC;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAiCrB"}

package/dist/server/domain-entry.js

@@ -0,0 +1,58 @@
+/**
+ * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
+ *
+ * It folds the three steps every hand-rolled worker used to wire by hand —
+ * compile the runtime domain (`defineRemoteDomain`), build the server
+ * (`createRemoteServer`), and wrap it in the shared fetch plumbing
+ * (`createWorkerEntry`) — into a single declaration. The author passes the raw
+ * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
+ * deploy bits; the helper does the rest. This is what the cloudflare adapter's
+ * codegen emits, and the recommended surface for a hand-rolled worker.
+ *
+ * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
+ * `@astrale-os/sdk/domain`) only when the worker needs something this config
+ * can't express — e.g. a serving-URL-dependent domain build (views stamped with
+ * the live url) or a globally-injected signing key resolved per request.
+ */
+import { defineRemoteDomain } from '../domain';
+import { createWorkerEntry } from './worker-entry';
+/**
+ * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
+ * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
+ * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
+ * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
+ * handler deps differ from the worker bindings and a `deps` mapper is supplied.
+ */
+export function domainWorkerEntry() {
+    return function (config) {
+        const domain = defineRemoteDomain()({
+            schema: config.schema,
+            methods: config.methods,
+            ...(config.core ? { core: config.core } : {}),
+            ...(config.views ? { views: config.views } : {}),
+            ...(config.functions ? { remoteFunctions: config.functions } : {}),
+        });
+        return createWorkerEntry({
+            ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),
+            ...(config.selfBinding ? { selfBinding: config.selfBinding } : {}),
+            ...(config.routeSubrequest ? { routeSubrequest: config.routeSubrequest } : {}),
+            ...(config.before ? { before: config.before } : {}),
+            ...(config.rewriteRequest ? { rewriteRequest: config.rewriteRequest } : {}),
+            // `createWorkerEntry` conflates the worker env and the handler deps into a
+            // single type param; we keep them distinct in the public config and bridge
+            // here. The runtime deps (and the methods typed against them) are correct;
+            // only this assembly is cast.
+            build: (url, env) => ({
+                domain,
+                deps: config.deps ? config.deps(env, url) : env,
+                url,
+                privateKey: typeof config.privateKey === 'function' ? config.privateKey(env) : config.privateKey,
+                ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
+                ...(config.postInstall ? { postInstall: config.postInstall } : {}),
+                ...(config.meta ? { meta: config.meta } : {}),
+                ...(config.app ? { app: config.app(env) } : {}),
+            }),
+        });
+    };
+}
+//# sourceMappingURL=domain-entry.js.map

package/dist/server/domain-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AA2ClD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -4,8 +4,10 @@ export type { RemoteServer, RemoteServerHandle } from './handle';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
 export type { WorkerEntry, WorkerEntryConfig } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
+export type { DomainWorkerEntryConfig } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/index.js

@@ -2,7 +2,8 @@ export { createRemoteServer } from './create';
 export { derivePublicJwk } from './jwks';
 export { requireEnv } from './require-env';
 export { canonicalizeServingUrl } from './serving-url';
-export { createWorkerEntry } from './worker-entry';
+export { assets, createWorkerEntry } from './worker-entry';
+export { domainWorkerEntry } from './domain-entry';
 export { workerMeta } from './worker-meta';
 export { startNodeServer } from './start';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/worker-entry.d.ts

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -23,6 +25,46 @@ import type { RemoteServerConfig } from './config';
 type Fetcher = {
     fetch(request: Request): Response | Promise<Response>;
 };
+type App = {
+    fetch(request: Request): Response | Promise<Response>;
+};
+/** A built app cached by its serving URL: `origin` for same-origin matching,
+ * `app` for in-process self-dispatch. */
+type CachedApp = {
+    origin: string;
+    app: App;
+};
+/**
+ * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
+ * real `fetch` handle it. Order matters and same-origin wins FIRST: a call to
+ * this worker's OWN serving origin is a self-dispatch, not an edge fetch — and
+ * the caller's `routeSubrequest` policy may itself match our own host (e.g. an
+ * `isInstanceHost` predicate matches every `*.svc.astrale.ai`, ours included),
+ * so it must never get first look at a same-origin call.
+ *
+ *   • same-origin + SELF binding present → the SELF fetcher: a fresh same-script
+ *     invocation. The normal Cloudflare path — a Worker can't fetch its own
+ *     hostname over the edge, so it re-enters itself through the binding.
+ *   • same-origin + NO SELF binding → the cached app, dispatched IN-PROCESS. A
+ *     Workers-for-Platforms dispatch-namespace tenant can't service-bind to
+ *     itself (its script name is platform-renamed), so it has no SELF binding; an
+ *     in-process dispatch reaches the same script with no edge hop and no binding.
+ *     `App` and the SELF `Fetcher` share the `{ fetch(request) }` shape, so the
+ *     caller drives both identically.
+ *   • else, the caller's `routeSubrequest` policy matched → its fetcher.
+ *   • else → `null`: passthrough to the real network fetch.
+ *
+ * Pure (no closure over instance state) so the routing decision is unit-testable
+ * without standing up a real app.
+ */
+export declare function selectSubrequestTarget<TDeps>(u: URL, ctx: {
+    self: Fetcher | null;
+    apps: Iterable<CachedApp>;
+    routeEnv: TDeps | null;
+    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
+}): {
+    fetch(request: Request): Response | Promise<Response>;
+} | null;
 export interface WorkerEntryConfig<TDeps> {
     /**
      * Build the `createRemoteServer` config for the resolved serving `url`. Called
@@ -43,6 +85,17 @@ export interface WorkerEntryConfig<TDeps> {
     resolveUrl?: (env: TDeps, requestOrigin: string) => string;
     /** Optional: the `SELF` service binding used to route same-host subrequests. */
     selfBinding?: (env: TDeps) => Fetcher | null | undefined;
+    /**
+     * Optional, vendor-neutral: route an OUTBOUND subrequest through a
+     * caller-supplied fetcher instead of the network — for hosts a Worker can't
+     * reach directly over the edge (e.g. a platform router on the SAME zone:
+     * Cloudflare 522s a same-zone Worker→Worker public `fetch`). Return a `Fetcher`
+     * to route the request through, or null/undefined to fall through to the normal
+     * fetch. The SDK names no backend or topology — the CALLER owns BOTH the
+     * predicate (which hosts) and the fetcher (the binding). This generalizes
+     * `selfBinding` (same-origin → SELF) to any caller policy; both are honored.
+     */
+    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
     /**
      * Optional: handle a request before it reaches the kernel app — e.g. serve a
      * SPA under `/ui/*` or a same-origin `/api/*` endpoint the view calls. Return
@@ -72,6 +125,28 @@ export interface WorkerEntry<TDeps> {
  * fails — it can never make this worker speak for another origin.
  */
 export declare function clientOrigin(url: URL, request: Request): string;
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export declare function assets<TDeps>(opts: {
+    base?: string;
+    binding: (env: TDeps) => Fetcher | null | undefined;
+    devProxy?: (env: TDeps) => string | null | undefined;
+}): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined;
 export declare function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
 export {};
 //# sourceMappingURL=worker-entry.d.ts.map

package/dist/server/worker-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAGxE,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAmE7F"}
+{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAMlD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AACxE,KAAK,GAAG,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAEpE;yCACyC;AACzC,KAAK,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,CAAC,EAAE,GAAG,EACN,GAAG,EAAE;IACH,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACzB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACvE,GACA;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,GAAG,IAAI,CAWlE;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAsE7F"}

package/dist/server/worker-entry.js

@@ -6,11 +6,13 @@
  *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
  *     what `createRemoteServer` signs with and the kernel pins), and cache the
  *     built app per distinct URL;
- *   • optional self-binding routing: when a `SELF` service binding is provided,
- *     route same-host subrequests (e.g. `ctx.callRemote` back into this domain)
- *     through it — Cloudflare forbids a Worker fetching its own hostname. This is
- *     the ONLY reason a `globalThis.fetch` override is installed, and only when a
- *     `selfBinding` is configured;
+ *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
+ *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
+ *     certain outbound fetches through a caller-supplied binding — `selfBinding`
+ *     for same-host fetches (a Worker can't fetch its own hostname), and the
+ *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
+ *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
+ *     backend or topology; the caller owns the predicate + the fetcher;
  *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
  *
  * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
@@ -22,6 +24,43 @@
 import { createRemoteServer } from './create';
 import { requireEnv } from './require-env';
 import { canonicalizeServingUrl } from './serving-url';
+/**
+ * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
+ * real `fetch` handle it. Order matters and same-origin wins FIRST: a call to
+ * this worker's OWN serving origin is a self-dispatch, not an edge fetch — and
+ * the caller's `routeSubrequest` policy may itself match our own host (e.g. an
+ * `isInstanceHost` predicate matches every `*.svc.astrale.ai`, ours included),
+ * so it must never get first look at a same-origin call.
+ *
+ *   • same-origin + SELF binding present → the SELF fetcher: a fresh same-script
+ *     invocation. The normal Cloudflare path — a Worker can't fetch its own
+ *     hostname over the edge, so it re-enters itself through the binding.
+ *   • same-origin + NO SELF binding → the cached app, dispatched IN-PROCESS. A
+ *     Workers-for-Platforms dispatch-namespace tenant can't service-bind to
+ *     itself (its script name is platform-renamed), so it has no SELF binding; an
+ *     in-process dispatch reaches the same script with no edge hop and no binding.
+ *     `App` and the SELF `Fetcher` share the `{ fetch(request) }` shape, so the
+ *     caller drives both identically.
+ *   • else, the caller's `routeSubrequest` policy matched → its fetcher.
+ *   • else → `null`: passthrough to the real network fetch.
+ *
+ * Pure (no closure over instance state) so the routing decision is unit-testable
+ * without standing up a real app.
+ */
+export function selectSubrequestTarget(u, ctx) {
+    // Same-origin self-subrequest → the same script (SELF binding, else in-process).
+    for (const cached of ctx.apps) {
+        if (cached.origin === u.origin)
+            return ctx.self ?? cached.app;
+    }
+    // Caller policy (e.g. a platform router on the same zone) → its fetcher.
+    if (ctx.routeSubrequest && ctx.routeEnv) {
+        const via = ctx.routeSubrequest(u, ctx.routeEnv);
+        if (via)
+            return via;
+    }
+    return null;
+}
 /**
  * The request origin as the CLIENT reached it — i.e. the origin a fallback
  * serving URL (and therefore the `iss`) may be derived from. Behind a
@@ -41,6 +80,43 @@ export function clientOrigin(url, request) {
     const scheme = forwarded?.split(',')[0]?.trim().toLowerCase();
     return scheme === 'https' ? `https://${url.host}` : url.origin;
 }
+/**
+ * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
+ * Assets binding) mounted under `base` (default `/ui`) — the runtime half of a
+ * domain's `client` binding. Returns `undefined` for non-matching paths (and
+ * when no binding is present) so the request falls through to domain dispatch.
+ *
+ * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
+ * this hook strips that prefix before delegating to the binding, so
+ * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
+ * (local dev), requests are proxied there instead — the seam for a bundler's
+ * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
+ * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
+ * here.
+ *
+ * Lives here, type-checked and testable, instead of being emitted as a string
+ * by every adapter's worker codegen.
+ */
+export function assets(opts) {
+    const base = (opts.base ?? '/ui').replace(/\/+$/, '');
+    const prefix = `${base}/`;
+    return (env, url, request) => {
+        const binding = opts.binding(env);
+        if (!binding)
+            return undefined;
+        if (url.pathname !== base && !url.pathname.startsWith(prefix))
+            return undefined;
+        const devUrl = opts.devProxy?.(env);
+        if (devUrl) {
+            const devBase = devUrl.replace(/\/+$/, '');
+            return fetch(new Request(`${devBase}${url.pathname}${url.search}`, request));
+        }
+        // `<base>` → `/`, `<base>/x` → `/x`: serve from the binding's root.
+        const stripped = url.pathname.slice(base.length) || '/';
+        const rewritten = new URL(stripped + url.search, url.origin);
+        return binding.fetch(new Request(rewritten, request));
+    };
+}
 export function createWorkerEntry(config) {
     // Cache the built app per distinct resolved URL — plural and bounded. On the
     // request-origin fallback the URL legitimately alternates for one worker
@@ -51,6 +127,7 @@ export function createWorkerEntry(config) {
     const MAX_CACHED_APPS = 4;
     const apps = new Map();
     let self = null;
+    let routeEnv = null;
     function getApp(url, env) {
         const cached = apps.get(url);
         if (cached)
@@ -64,27 +141,29 @@ export function createWorkerEntry(config) {
         apps.set(url, { origin: new URL(url).origin, app });
         return app;
     }
-    // A Worker can't fetch its own hostname. When a SELF service binding is
-    // configured, route same-host subrequests (e.g. `ctx.callRemote` back into
-    // this domain) through it. This is the only reason to override
-    // `globalThis.fetch` — workers without a `selfBinding` get no global mutation.
-    // (A self-issued credential's JWKS is resolved in-memory by the verifier, not
-    // fetched — see `auth/verify.ts` — so no self-JWKS interception is needed.)
-    if (config.selfBinding) {
+    // A Worker can't fetch its own hostname over the edge, nor — on Cloudflare — a
+    // same-zone hostname routed to another Worker (the `routeSubrequest` case).
+    // When either is configured, override `globalThis.fetch` to redirect those
+    // subrequests through the right target (see `selectSubrequestTarget`). Workers
+    // with neither selfBinding nor routeSubrequest get no global mutation. (A
+    // self-issued credential's JWKS is resolved in-memory by the verifier, not
+    // fetched — see `auth/verify.ts` — so no self-JWKS shim is needed.)
+    if (config.selfBinding || config.routeSubrequest) {
         const originalFetch = globalThis.fetch;
         globalThis.fetch = (async (input, init) => {
-            if (apps.size > 0 && self) {
-                const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
-                try {
-                    const origin = new URL(href).origin;
-                    for (const cached of apps.values()) {
-                        if (cached.origin === origin)
-                            return self.fetch(new Request(input, init));
-                    }
-                }
-                catch {
-                    // non-absolute URL — fall through to the original fetch
-                }
+            const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+            try {
+                const target = selectSubrequestTarget(new URL(href), {
+                    self,
+                    apps: apps.values(),
+                    routeEnv,
+                    routeSubrequest: config.routeSubrequest,
+                });
+                if (target)
+                    return target.fetch(new Request(input, init));
+            }
+            catch {
+                // non-absolute URL — fall through to the original fetch
             }
             return originalFetch(input, init);
         });
@@ -93,6 +172,8 @@ export function createWorkerEntry(config) {
         async fetch(request, env) {
             if (config.selfBinding)
                 self ??= config.selfBinding(env) ?? null;
+            if (config.routeSubrequest)
+                routeEnv = env;
             // Only parse the request URL when a hook actually needs it.
             const requestUrl = config.before || config.resolveUrl ? new URL(request.url) : null;
             if (config.before && requestUrl) {

package/dist/server/worker-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAgDtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,IAAI,IAAI,GAAmB,IAAI,CAAA;IAE/B,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,+DAA+D;IAC/D,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;gBACnF,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;oBACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;wBACnC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;4BAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBAC3E,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAStD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,GAKC;IAED,iFAAiF;IACjF,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAA;IAC/D,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAwDD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IACzC,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE;oBACnD,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnB,QAAQ;oBACR,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC,CAAA;gBACF,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU;YACtC,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;AACH,CAAC"}