@astrale-os/sdk 0.4.12 → 0.4.14

package/src/linter/source.ts

@@ -0,0 +1,323 @@
+export type SourceToken = {
+  kind: 'identifier' | 'string' | 'punctuation'
+  value: string
+  offset: number
+  length: number
+  line: number
+  column: number
+}
+
+export type SourceImport = {
+  specifier: string
+  token: SourceToken
+  bindings: ReadonlyMap<string, string>
+  namespace?: string
+}
+
+export type SourceFile = {
+  path: string
+  relativePath: string
+  text: string
+  tokens: readonly SourceToken[]
+  imports: readonly SourceImport[]
+}
+
+const identifierStart = /[A-Za-z_$]/
+const identifierPart = /[A-Za-z0-9_$]/
+
+export function scanSource(path: string, relativePath: string, text: string): SourceFile {
+  const tokens = tokenize(text)
+  return { path, relativePath, text, tokens, imports: parseImports(tokens) }
+}
+
+function tokenize(text: string): SourceToken[] {
+  const tokens: SourceToken[] = []
+  let offset = 0
+  let line = 1
+  let column = 1
+
+  const advance = (): string => {
+    const char = text[offset++]!
+    if (char === '\n') {
+      line++
+      column = 1
+    } else {
+      column++
+    }
+    return char
+  }
+
+  while (offset < text.length) {
+    const char = text[offset]!
+    if (/\s/.test(char)) {
+      advance()
+      continue
+    }
+
+    if (char === '/' && text[offset + 1] === '/') {
+      advance()
+      advance()
+      while (offset < text.length && text[offset] !== '\n') advance()
+      continue
+    }
+
+    if (char === '/' && text[offset + 1] === '*') {
+      advance()
+      advance()
+      while (offset < text.length) {
+        if (text[offset] === '*' && text[offset + 1] === '/') {
+          advance()
+          advance()
+          break
+        }
+        advance()
+      }
+      continue
+    }
+
+    if (char === "'" || char === '"') {
+      const quote = char
+      const start = offset
+      const startLine = line
+      const startColumn = column
+      advance()
+      let value = ''
+      while (offset < text.length) {
+        const current = advance()
+        if (current === '\\') {
+          if (offset < text.length) value += decodeEscape(advance())
+          continue
+        }
+        if (current === quote) break
+        value += current
+      }
+      tokens.push({
+        kind: 'string',
+        value,
+        offset: start,
+        length: offset - start,
+        line: startLine,
+        column: startColumn,
+      })
+      continue
+    }
+
+    if (char === '`') {
+      advance()
+      while (offset < text.length) {
+        const current = advance()
+        if (current === '\\') {
+          if (offset < text.length) advance()
+          continue
+        }
+        if (current === '`') break
+      }
+      continue
+    }
+
+    if (identifierStart.test(char)) {
+      const start = offset
+      const startLine = line
+      const startColumn = column
+      let value = advance()
+      while (offset < text.length && identifierPart.test(text[offset]!)) value += advance()
+      tokens.push({
+        kind: 'identifier',
+        value,
+        offset: start,
+        length: offset - start,
+        line: startLine,
+        column: startColumn,
+      })
+      continue
+    }
+
+    tokens.push({
+      kind: 'punctuation',
+      value: char,
+      offset,
+      length: 1,
+      line,
+      column,
+    })
+    advance()
+  }
+
+  return tokens
+}
+
+function decodeEscape(char: string): string {
+  switch (char) {
+    case 'n':
+      return '\n'
+    case 'r':
+      return '\r'
+    case 't':
+      return '\t'
+    default:
+      return char
+  }
+}
+
+function parseImports(tokens: readonly SourceToken[]): SourceImport[] {
+  const imports: SourceImport[] = []
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]!
+    if (token.kind !== 'identifier' || (token.value !== 'import' && token.value !== 'export')) {
+      continue
+    }
+
+    if (token.value === 'import' && tokens[index + 1]?.value === '(') {
+      const specifier = tokens[index + 2]
+      if (specifier?.kind === 'string') {
+        imports.push({ specifier: specifier.value, token, bindings: new Map() })
+      }
+      continue
+    }
+
+    const end = statementEnd(tokens, index + 1)
+    let specifierIndex = -1
+    for (let cursor = index + 1; cursor < end; cursor++) {
+      const candidate = tokens[cursor]!
+      if (candidate.kind === 'string') specifierIndex = cursor
+    }
+    if (specifierIndex < 0) continue
+
+    const specifier = tokens[specifierIndex]!
+    const bindings = new Map<string, string>()
+    let namespace: string | undefined
+    if (token.value === 'import') {
+      const fromIndex = findToken(tokens, index + 1, specifierIndex, 'from')
+      const bindingsEnd = fromIndex >= 0 ? fromIndex : specifierIndex
+      const open = findToken(tokens, index + 1, bindingsEnd, '{')
+      if (open >= 0) {
+        const close = findMatching(tokens, open, '{', '}', bindingsEnd)
+        if (close >= 0) parseNamedBindings(tokens, open + 1, close, bindings)
+      }
+      const star = findToken(tokens, index + 1, bindingsEnd, '*')
+      if (star >= 0 && tokens[star + 1]?.value === 'as') namespace = tokens[star + 2]?.value
+    }
+
+    imports.push({
+      specifier: specifier.value,
+      token,
+      bindings,
+      ...(namespace ? { namespace } : {}),
+    })
+    index = Math.max(index, specifierIndex)
+  }
+  return imports
+}
+
+function statementEnd(tokens: readonly SourceToken[], start: number): number {
+  let depth = 0
+  let sawSpecifier = false
+  for (let index = start; index < tokens.length; index++) {
+    const token = tokens[index]!
+    if (token.value === ';' && depth === 0) return index
+    if (token.value === '{' || token.value === '(' || token.value === '[') depth++
+    if (token.value === '}' || token.value === ')' || token.value === ']') depth--
+    if (token.kind === 'string' && depth === 0) sawSpecifier = true
+    const next = tokens[index + 1]
+    if (sawSpecifier && depth === 0 && next && next.line > token.line) return index + 1
+  }
+  return tokens.length
+}
+
+function findToken(
+  tokens: readonly SourceToken[],
+  start: number,
+  end: number,
+  value: string,
+): number {
+  for (let index = start; index < end; index++) {
+    if (tokens[index]?.value === value) return index
+  }
+  return -1
+}
+
+function findMatching(
+  tokens: readonly SourceToken[],
+  start: number,
+  open: string,
+  close: string,
+  end: number,
+): number {
+  let depth = 0
+  for (let index = start; index < end; index++) {
+    if (tokens[index]?.value === open) depth++
+    if (tokens[index]?.value === close && --depth === 0) return index
+  }
+  return -1
+}
+
+function parseNamedBindings(
+  tokens: readonly SourceToken[],
+  start: number,
+  end: number,
+  bindings: Map<string, string>,
+): void {
+  let index = start
+  while (index < end) {
+    if (tokens[index]?.value === ',' || tokens[index]?.value === 'type') {
+      index++
+      continue
+    }
+    const imported = tokens[index]
+    if (!imported || imported.kind !== 'identifier') {
+      index++
+      continue
+    }
+    if (tokens[index + 1]?.value === 'as' && tokens[index + 2]?.kind === 'identifier') {
+      bindings.set(imported.value, tokens[index + 2]!.value)
+      index += 3
+      continue
+    }
+    bindings.set(imported.value, imported.value)
+    index++
+  }
+}
+
+export function importedCalls(
+  file: SourceFile,
+  modules: ReadonlySet<string>,
+  names: ReadonlySet<string>,
+): SourceToken[] {
+  const locals = new Set<string>()
+  const namespaces = new Set<string>()
+  for (const sourceImport of file.imports) {
+    if (!modules.has(sourceImport.specifier)) continue
+    for (const name of names) {
+      const local = sourceImport.bindings.get(name)
+      if (local) locals.add(local)
+    }
+    if (sourceImport.namespace) namespaces.add(sourceImport.namespace)
+  }
+
+  const calls: SourceToken[] = []
+  for (let index = 0; index < file.tokens.length; index++) {
+    const token = file.tokens[index]!
+    if (token.kind !== 'identifier') continue
+    if (locals.has(token.value) && callFollows(file.tokens, index)) {
+      calls.push(token)
+      continue
+    }
+    if (
+      namespaces.has(token.value) &&
+      file.tokens[index + 1]?.value === '.' &&
+      names.has(file.tokens[index + 2]?.value ?? '') &&
+      callFollows(file.tokens, index + 2)
+    ) {
+      calls.push(file.tokens[index + 2]!)
+    }
+  }
+  return calls
+}
+
+function callFollows(tokens: readonly SourceToken[], index: number): boolean {
+  const next = tokens[index + 1]
+  if (next?.value === '(') return true
+  if (next?.value !== '<') return false
+  const close = findMatching(tokens, index + 1, '<', '>', tokens.length)
+  return close >= 0 && tokens[close + 1]?.value === '('
+}

package/src/linter/suppression.ts

@@ -0,0 +1,11 @@
+import type { SourceFile } from './source.js'
+
+const suppression = /^\s*\/\/\s*astrale-disable-next-line\s+(.+?)\s+--\s+\S.*$/
+
+export function isSuppressed(file: SourceFile, line: number, id: string): boolean {
+  if (line <= 1) return false
+  const previous = file.text.split(/\r?\n/)[line - 2]
+  const match = previous ? suppression.exec(previous) : null
+  if (!match) return false
+  return match[1]!.split(/[\s,]+/).includes(id)
+}

package/src/method/context.ts

@@ -13,10 +13,10 @@ import type { FnMap, SchemaBoundView } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
 import type { AuthContext } from '@astrale-os/kernel-core'
 import type { Schema } from '@astrale-os/kernel-dsl'
+import type { Defer, Sleep } from '@astrale-os/kernel-server'
 
 import type { FunctionContextApi } from '../auth/function-context.js'
 import type { DomainAuthority } from '../auth/issuer-mint.js'
-import type { Defer } from '../defer/index.js'
 import type { Step } from '../step/index.js'
 
 export type { GraphApi } from '@astrale-os/kernel-client/graph'
@@ -130,4 +130,6 @@ export interface RemoteContext<
   step: Step
   /** Run independent work without making its completion part of this result. */
   defer: Defer
+  /** Pause execution for a relative duration. Durable hosts may persist the wait. */
+  sleep: Sleep
 }

package/src/server/auxiliary-routes.ts

@@ -36,7 +36,12 @@ import {
   type FunctionBinding,
   type AuthPolicy,
 } from '@astrale-os/kernel-api/routed'
-import { buildCorsHeaders, type CorsConfig } from '@astrale-os/kernel-server'
+import {
+  buildCorsHeaders,
+  createCapabilityLifecycle,
+  honoCapabilityHost,
+  type CorsConfig,
+} from '@astrale-os/kernel-server'
 
 import type { RemoteIdentityConfig } from '../auth/identity.js'
 import type { AnyRemoteFunctionDef } from '../define/remote-function.js'
@@ -46,7 +51,6 @@ import type { AuxIdentityMap } from '../dispatch/identity.js'
 import { makeFunctionContext } from '../auth/function-context.js'
 import { makeDomainAuthority } from '../auth/issuer-mint.js'
 import { resolveInboundAuth } from '../auth/resolve.js'
-import { createHandlerLifecycle, executionLifetime } from '../defer/index.js'
 import { runAuthorize } from '../dispatch/authorize.js'
 import { SdkResultValidationError, SdkValidationError } from '../dispatch/errors.js'
 import { validateParams, validateResult } from '../dispatch/validate.js'
@@ -66,7 +70,13 @@ export type AuxiliaryRoutesConfig<TDeps> = {
    * one per RemoteFunction. Build via `buildAuxIdentityMap(compiled, key, issuer)`
    * from `sdk/src/dispatch/identity.ts`.
    */
-  identities: AuxIdentityMap
+  identities?: AuxIdentityMap
+  /** Resolve an identity lazily. Service-hosted Functions use this to read the
+   * Function node registered during deploy and reuse the Service signing key. */
+  resolveIdentity?: (
+    kind: 'view' | 'remoteFunction',
+    slug: string,
+  ) => RemoteIdentityConfig | Promise<RemoteIdentityConfig>
   /**
    * CORS policy applied to every mounted route: per-route `app.options(...)`
    * preflight and `Access-Control-Allow-*` headers on success + error
@@ -86,6 +96,7 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
     remoteFunctionBindings,
     deps,
     identities,
+    resolveIdentity,
     cors,
   } = config
 
@@ -96,7 +107,7 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
     for (const [slug, def] of Object.entries(views)) {
       const binding = viewBindings[slug]
       if (!binding || !def.render) continue
-      const identity = requireAuxIdentity('view', slug, identities.views[slug])
+      const identity = identityResolver('view', slug, identities?.views[slug], resolveIdentity)
       mountEntry({
         app,
         binding,
@@ -108,7 +119,7 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
         // Views are transport-only (iframe HTML/redirect). SERVER-rendered
         // views that read the graph use `ctx.fn.kernel()`: the view's own
         // identity, with narrow grants.
-        run: async ({ c, params, auth, kernel }) => {
+        run: async ({ c, params, auth, kernel, identity }) => {
           const inboundIss = auth?.credential?.verified?.iss as string | undefined
           const kernelUrl = kernel?.default ?? inboundIss
           const ctx = {
@@ -133,7 +144,12 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
     for (const [slug, def] of Object.entries(remoteFunctions)) {
       const binding = remoteFunctionBindings[slug]
       if (!binding) continue
-      const identity = requireAuxIdentity('remote function', slug, identities.remoteFunctions[slug])
+      const identity = identityResolver(
+        'remoteFunction',
+        slug,
+        identities?.remoteFunctions[slug],
+        resolveIdentity,
+      )
       mountEntry({
         app,
         binding,
@@ -142,7 +158,7 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
         auth: def.auth,
         identity,
         corsHeaders,
-        run: async ({ c, auth, kernel }) => {
+        run: async ({ c, auth, kernel, identity }) => {
           const input = await readRemoteFunctionInput(c)
           const validation = validateParams(def.inputSchema, input.params)
           if (!validation.ok) {
@@ -172,7 +188,7 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
             }),
           }
           if (def.authorize) await runAuthorize(def.authorize, ctx)
-          const lifecycle = createHandlerLifecycle(executionLifetime(c))
+          const lifecycle = createCapabilityLifecycle(honoCapabilityHost(c))
           const result = await (async () => {
             try {
               return await def.execute({
@@ -180,7 +196,8 @@ export function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>
                 step: createInlineStep({
                   scope: { kind: 'function', ref: `function.${slug}`, slug },
                 }),
-                defer: lifecycle.defer,
+                defer: lifecycle.capabilities.defer,
+                sleep: lifecycle.capabilities.sleep,
               })
             } finally {
               await lifecycle.settle()
@@ -222,11 +239,24 @@ function requireAuxIdentity(
   )
 }
 
+function identityResolver(
+  kind: 'view' | 'remoteFunction',
+  slug: string,
+  identity: RemoteIdentityConfig | undefined,
+  resolveIdentity: AuxiliaryRoutesConfig<unknown>['resolveIdentity'],
+): () => Promise<RemoteIdentityConfig> {
+  if (resolveIdentity) return async () => resolveIdentity(kind, slug)
+  const label = kind === 'view' ? 'view' : 'remote function'
+  const required = requireAuxIdentity(label, slug, identity)
+  return async () => required
+}
+
 type RunArgs = {
   c: Context
   params: Record<string, string>
   auth: AuthContext | null
   kernel: BoundClientSessionView<FnMap> | null
+  identity: RemoteIdentityConfig
 }
 
 type MountEntryArgs = {
@@ -236,7 +266,7 @@ type MountEntryArgs = {
   defaultMethod: 'GET' | 'POST'
   run: (args: RunArgs) => Promise<Response>
   auth?: AuthPolicy
-  identity: RemoteIdentityConfig
+  identity: () => Promise<RemoteIdentityConfig>
   corsHeaders: Record<string, string>
 }
 
@@ -291,10 +321,11 @@ function mountEntry(args: MountEntryArgs): void {
         if (value !== undefined) pathParams[name] = decodeURIComponent(value)
       }
 
+      const resolvedIdentity = await identity()
       const { auth: resolvedAuth, kernel } = await resolveInboundAuth(
         stripBearerPrefix(c.req.header('authorization') ?? ''),
         auth,
-        identity,
+        resolvedIdentity,
       )
 
       const response = await run({
@@ -302,6 +333,7 @@ function mountEntry(args: MountEntryArgs): void {
         params: { ...hostParams, ...pathParams },
         auth: resolvedAuth,
         kernel,
+        identity: resolvedIdentity,
       })
       return applyCorsToResponse(response, corsHeaders)
     } catch (err) {

package/src/server/create.ts

@@ -143,7 +143,7 @@ export function createRemoteServer<TDeps>(config: RemoteServerConfig<TDeps>): Re
   }
 
   const { app } = createKernelApp({
-    kernel: dispatcher,
+    dispatcher,
     domain: config.domain.methods.map(toSdkContract),
     host: { url: config.url },
     jwks,

package/src/server/index.ts

@@ -4,8 +4,16 @@ export type { RemoteServer, RemoteServerHandle } from './handle.js'
 export { derivePublicJwk } from './jwks.js'
 export { requireEnv } from './require-env.js'
 export { canonicalizeServingUrl } from './serving-url.js'
-export { assets, createWorkerEntry } from './worker-entry.js'
-export type { WorkerEntry, WorkerEntryConfig } from './worker-entry.js'
+export { assets, createAppWorkerEntry, createWorkerEntry } from './worker-entry.js'
+export type {
+  AppWorkerEntryConfig,
+  Fetcher,
+  WorkerApp,
+  WorkerEntry,
+  WorkerEntryConfig,
+} from './worker-entry.js'
 export { domainWorkerEntry } from './domain-entry.js'
 export type { DomainWorkerEntryConfig } from './domain-entry.js'
+export { serviceWorkerEntry } from './service-entry.js'
+export type { ServiceWorkerEntryConfig, ServiceWorkerIdentityEnv } from './service-entry.js'
 export { startNodeServer } from './start.js'