@astrale-os/sdk 0.4.13 → 0.4.14

package/dist/server/service-entry.js

@@ -0,0 +1,150 @@
+import { K } from '@astrale-os/kernel-core';
+import { Hono } from 'hono';
+import { makeFunctionContext } from '../auth/function-context.js';
+import { buildFunctionSchemas, DEFAULT_FUNCTIONS_FOLDER } from '../domain/extend-functions.js';
+import { SERVICE_FUNCTIONS_PATH, ServiceFunctionDiscoveryRequestSchema, signServiceFunctionManifest, toServiceFunctionManifestEntries, } from '../service/functions.js';
+import { mountAuxiliaryRoutes } from './auxiliary-routes.js';
+import { createAppWorkerEntry } from './worker-entry.js';
+/** A Service worker with zero or more first-class kernel Functions.
+ *
+ * The function map is the only declaration: it drives both HTTP routes and the
+ * signed deploy-time manifest. Function identities are read lazily from the
+ * graph after Services has reconciled them, while every Function reuses the
+ * Service's one private signing key. */
+export function serviceWorkerEntry(config) {
+    const functions = config.functions ?? {};
+    const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER;
+    return createAppWorkerEntry({
+        buildApp: (url, env) => {
+            const app = new Hono();
+            const serviceIdentity = identityFromEnv(env);
+            const { schemas, bindings } = buildFunctionSchemas(functions, url, functionsFolder);
+            assertLocalBindings(url, bindings);
+            const resolveFunctionIdentity = createFunctionIdentityResolver(env, serviceIdentity);
+            app.get('/', (c) => c.json({ ok: true, kind: 'astrale-service' }));
+            app.post(SERVICE_FUNCTIONS_PATH, async (c) => {
+                const parsed = ServiceFunctionDiscoveryRequestSchema.safeParse(await c.req.json().catch(() => null));
+                if (!parsed.success) {
+                    return c.json({ error: 'Invalid service function discovery request' }, 400);
+                }
+                const response = await signServiceFunctionManifest({
+                    version: 1,
+                    service: {
+                        issuer: serviceIdentity.issuer,
+                        subject: serviceIdentity.subject,
+                    },
+                    functions: toServiceFunctionManifestEntries(schemas),
+                }, parsed.data, serviceIdentity);
+                return c.json(response);
+            });
+            mountAuxiliaryRoutes({
+                app,
+                url,
+                remoteFunctions: functions,
+                remoteFunctionBindings: bindings,
+                deps: env,
+                resolveIdentity: (kind, slug) => {
+                    if (kind !== 'remoteFunction') {
+                        throw new Error(`serviceWorkerEntry cannot resolve ${kind} identity ${slug}`);
+                    }
+                    return resolveFunctionIdentity(slug);
+                },
+                cors: config.cors ?? { origin: '*' },
+            });
+            return app;
+        },
+        resolveUrl: config.resolveUrl ?? ((_env, requestOrigin) => requestOrigin),
+        selfBinding: config.selfBinding,
+        routeSubrequest: config.routeSubrequest,
+    });
+}
+function identityFromEnv(env) {
+    return {
+        issuer: required(env, 'IDENTITY_ISS'),
+        subject: required(env, 'IDENTITY_SUB'),
+        privateKey: parsePrivateKey(required(env, 'IDENTITY_PRIVATE_KEY')),
+    };
+}
+function createFunctionIdentityResolver(env, serviceIdentity) {
+    const kernelUrl = required(env, 'ASTRALE_KERNEL_AUDIENCE');
+    let cachedAt = 0;
+    let identities = new Map();
+    const ttlMs = 60_000;
+    return async (slug) => {
+        if (Date.now() - cachedAt >= ttlMs || !identities.has(slug)) {
+            const kernel = await makeFunctionContext(serviceIdentity, env, {
+                ref: 'service',
+                defaultKernelUrl: kernelUrl,
+            }).kernel();
+            const service = await kernel.get(`@${serviceIdentity.subject}`);
+            if (!service)
+                throw new Error(`Service @${serviceIdentity.subject} is not readable`);
+            const folder = await kernel.get(`${service.path.raw}/functions`);
+            const nodes = folder
+                ? await (await kernel.children(folder.path, {
+                    classes: [K.$.c('Function').path.class],
+                    limit: 500,
+                })).all()
+                : [];
+            identities = readFunctionIdentities(nodes, serviceIdentity.issuer);
+            cachedAt = Date.now();
+        }
+        const identity = identities.get(slug);
+        if (!identity)
+            throw new Error(`Function identity function.${slug} is not registered`);
+        return hostedFunctionIdentity(identity, serviceIdentity);
+    };
+}
+/** Reuse only the Service's signing key. A hosted Function's inbound audience
+ * defaults to its own issuer; the Service HTTP origin is merely transport. */
+export function hostedFunctionIdentity(identity, serviceIdentity) {
+    return { ...identity, privateKey: serviceIdentity.privateKey };
+}
+function readFunctionIdentities(nodes, serviceIssuer) {
+    const result = new Map();
+    for (const node of nodes) {
+        const ref = node.props[K.$.i('Function').ref.key];
+        const issuer = node.props[K.Identity.iss.key];
+        const subject = node.props[K.Identity.sub.key];
+        if (typeof ref !== 'string' ||
+            !ref.startsWith('function.') ||
+            typeof issuer !== 'string' ||
+            typeof subject !== 'string') {
+            continue;
+        }
+        if (issuer !== serviceIssuer) {
+            throw new Error(`Function ${ref} does not share its hosting Service issuer`);
+        }
+        result.set(ref.slice('function.'.length), { issuer, subject });
+    }
+    return result;
+}
+function assertLocalBindings(url, bindings) {
+    const origin = new URL(url).origin;
+    for (const [slug, binding] of Object.entries(bindings)) {
+        if (!binding.remoteUrl || new URL(binding.remoteUrl).origin !== origin) {
+            throw new Error(`serviceWorkerEntry function.${slug} must be hosted by this Service origin`);
+        }
+    }
+}
+function required(env, key) {
+    const value = env[key];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`Missing service variable ${String(key)}`);
+    }
+    return value;
+}
+function parsePrivateKey(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        throw new Error('IDENTITY_PRIVATE_KEY is not valid JSON', { cause: error });
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('IDENTITY_PRIVATE_KEY is not a JWK object');
+    }
+    return parsed;
+}
+//# sourceMappingURL=service-entry.js.map

package/dist/server/service-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-entry.js","sourceRoot":"","sources":["../../src/server/service-entry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,yBAAyB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAkBxD;;;;;wCAKwC;AACxC,MAAM,UAAU,kBAAkB,CAChC,MAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAA;IACxC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,wBAAwB,CAAA;IAE1E,OAAO,oBAAoB,CAAO;QAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YACnF,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAClC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAEpF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;YAClE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3C,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC5D,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACrC,CAAA;gBACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;oBACE,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE;wBACP,MAAM,EAAE,eAAe,CAAC,MAAM;wBAC9B,OAAO,EAAE,eAAe,CAAC,OAAO;qBACjC;oBACD,SAAS,EAAE,gCAAgC,CAAC,OAAO,CAAC;iBACrD,EACD,MAAM,CAAC,IAAI,EACX,eAAe,CAChB,CAAA;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,oBAAoB,CAAC;gBACnB,GAAG;gBACH,GAAG;gBACH,eAAe,EAAE,SAAS;gBAC1B,sBAAsB,EAAE,QAAQ;gBAChC,IAAI,EAAE,GAAG;gBACT,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAA;oBAC/E,CAAC;oBACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAA;gBACtC,CAAC;gBACD,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;QACzE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAwC,GAAS;IACvE,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QACrC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QACtC,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;KACnE,CAAA;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,GAAS,EACT,eAAqC;IAErC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IAC1D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,UAAU,GAAG,IAAI,GAAG,EAA+C,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,CAAA;IAEpB,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE,GAAG,EAAE;gBAC7D,GAAG,EAAE,SAAS;gBACd,gBAAgB,EAAE,SAAS;aAC5B,CAAC,CAAC,MAAM,EAAE,CAAA;YACX,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,eAAe,CAAC,OAAO,kBAAkB,CAAC,CAAA;YACpF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,MAAM;gBAClB,CAAC,CAAC,MAAM,CACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;oBACjC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,GAAG;iBACX,CAAC,CACH,CAAC,GAAG,EAAE;gBACT,CAAC,CAAC,EAAE,CAAA;YACN,UAAU,GAAG,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,oBAAoB,CAAC,CAAA;QACtF,OAAO,sBAAsB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC1D,CAAC,CAAA;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,sBAAsB,CACpC,QAA6C,EAC7C,eAAqC;IAErC,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAsB,EACtB,aAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+C,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9C,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC5B,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAO,OAAO,KAAK,QAAQ,EAC3B,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,4CAA4C,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,QAAyC;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,wCAAwC,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAwC,GAAS,EAAE,GAAe;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,MAAoB,CAAA;AAC7B,CAAC"}

package/dist/server/worker-entry.d.ts

@@ -23,17 +23,17 @@
  */
 import type { ExecutionContext } from 'hono';
 import type { RemoteServerConfig } from './config.js';
-type Fetcher = {
+export type Fetcher = {
     fetch(request: Request): Response | Promise<Response>;
 };
-type App = {
+export type WorkerApp = {
     fetch(request: Request, env?: unknown, executionCtx?: ExecutionContext): Response | Promise<Response>;
 };
 /** A built app cached by its serving URL: `origin` for same-origin matching,
  * `app` for in-process self-dispatch. */
 type CachedApp = {
     origin: string;
-    app: App;
+    app: WorkerApp;
 };
 /**
  * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
@@ -111,6 +111,9 @@ export interface WorkerEntryConfig<TDeps> {
      */
     rewriteRequest?: (env: TDeps, request: Request) => Request;
 }
+export interface AppWorkerEntryConfig<TDeps> extends Omit<WorkerEntryConfig<TDeps>, 'build'> {
+    buildApp: (url: string, env: TDeps) => WorkerApp;
+}
 export interface WorkerEntry<TDeps> {
     fetch(request: Request, env: TDeps, executionCtx?: ExecutionContext): Response | Promise<Response>;
 }
@@ -149,5 +152,6 @@ export declare function assets<TDeps>(opts: {
     devProxy?: (env: TDeps) => string | null | undefined;
 }): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined;
 export declare function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
+export declare function createAppWorkerEntry<TDeps>(config: AppWorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
 export {};
 //# sourceMappingURL=worker-entry.d.ts.map

package/dist/server/worker-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAE5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAMrD,KAAK,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AACxE,KAAK,GAAG,GAAG;IACT,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,OAAO,EACb,YAAY,CAAC,EAAE,gBAAgB,GAC9B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA;AAED;yCACyC;AACzC,KAAK,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,CAAC,EAAE,GAAG,EACN,GAAG,EAAE;IACH,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACzB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACvE,GACA;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,GAAG,IAAI,CAWlE;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAsE7F"}
+{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAE5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAMrD,MAAM,MAAM,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAC/E,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,OAAO,EACb,YAAY,CAAC,EAAE,gBAAgB,GAC9B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA;AAED;yCACyC;AACzC,KAAK,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,CAAC,EAAE,GAAG,EACN,GAAG,EAAE;IACH,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACzB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACvE,GACA;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,GAAG,IAAI,CAWlE;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,oBAAoB,CAAC,KAAK,CAAE,SAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAC1F,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,SAAS,CAAA;CACjD;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAK7F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EACxC,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAClC,WAAW,CAAC,KAAK,CAAC,CAsEpB"}

package/dist/server/worker-entry.js

@@ -118,6 +118,12 @@ export function assets(opts) {
     };
 }
 export function createWorkerEntry(config) {
+    return createAppWorkerEntry({
+        ...config,
+        buildApp: (url, env) => createRemoteServer(config.build(url, env)).app,
+    });
+}
+export function createAppWorkerEntry(config) {
     // Cache the built app per distinct resolved URL — plural and bounded. On the
     // request-origin fallback the URL legitimately alternates for one worker
     // (direct http hits vs https-upgraded tunnel hits, workers.dev + custom
@@ -132,7 +138,7 @@ export function createWorkerEntry(config) {
         const cached = apps.get(url);
         if (cached)
             return cached.app;
-        const { app } = createRemoteServer(config.build(url, env));
+        const app = config.buildApp(url, env);
         if (apps.size >= MAX_CACHED_APPS) {
             const oldest = apps.keys().next().value;
             if (oldest !== undefined)

package/dist/server/worker-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAezD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,GAKC;IAED,iFAAiF;IACjF,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAA;IAC/D,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAwDD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IACzC,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE;oBACnD,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnB,QAAQ;oBACR,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC,CAAA;gBACF,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU,EAAE,YAA+B;YACvE,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAezD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,GAKC;IAED,iFAAiF;IACjF,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAA;IAC/D,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AA4DD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,OAAO,oBAAoB,CAAC;QAC1B,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG;KAC9E,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAmC;IAEnC,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IACzC,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE;oBACnD,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnB,QAAQ;oBACR,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC,CAAA;gBACF,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU,EAAE,YAA+B;YACvE,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/service/functions.d.ts

@@ -0,0 +1,148 @@
+import type { FunctionBinding } from '@astrale-os/kernel-api/routed';
+import type { FunctionSchema } from '@astrale-os/kernel-core/domain';
+import { z } from 'zod';
+import type { RemoteIdentityConfig } from '../auth/identity.js';
+export declare const SERVICE_FUNCTIONS_PATH = "/_astrale/functions";
+export declare const SERVICE_FUNCTIONS_PURPOSE = "astrale.service-functions.v1";
+export declare const ServiceFunctionManifestEntrySchema: z.ZodObject<{
+    slug: z.ZodString;
+    ref: z.ZodString;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    output: z.ZodDefault<z.ZodEnum<{
+        binary: "binary";
+        stream: "stream";
+        value: "value";
+    }>>;
+    binding: z.ZodObject<{
+        remoteUrl: z.ZodOptional<z.ZodString>;
+        route: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<{
+                "*": "*";
+                DELETE: "DELETE";
+                GET: "GET";
+                PATCH: "PATCH";
+                POST: "POST";
+                PUT: "PUT";
+            }>;
+            path: z.ZodString;
+            self: z.ZodOptional<z.ZodString>;
+            query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            body: z.ZodOptional<z.ZodUnknown>;
+            credential: z.ZodOptional<z.ZodUnknown>;
+        }, z.core.$strip>>;
+        auth: z.ZodOptional<z.ZodEnum<{
+            optional: "optional";
+            public: "public";
+            required: "required";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ServiceFunctionManifestSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    service: z.ZodObject<{
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strip>;
+    functions: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        ref: z.ZodString;
+        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        output: z.ZodDefault<z.ZodEnum<{
+            binary: "binary";
+            stream: "stream";
+            value: "value";
+        }>>;
+        binding: z.ZodObject<{
+            remoteUrl: z.ZodOptional<z.ZodString>;
+            route: z.ZodOptional<z.ZodObject<{
+                method: z.ZodEnum<{
+                    "*": "*";
+                    DELETE: "DELETE";
+                    GET: "GET";
+                    PATCH: "PATCH";
+                    POST: "POST";
+                    PUT: "PUT";
+                }>;
+                path: z.ZodString;
+                self: z.ZodOptional<z.ZodString>;
+                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                body: z.ZodOptional<z.ZodUnknown>;
+                credential: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strip>>;
+            auth: z.ZodOptional<z.ZodEnum<{
+                optional: "optional";
+                public: "public";
+                required: "required";
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ServiceFunctionDiscoveryRequestSchema: z.ZodObject<{
+    kernelIssuer: z.ZodString;
+    nonce: z.ZodString;
+}, z.core.$strip>;
+export declare const ServiceFunctionDiscoveryResponseSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    service: z.ZodObject<{
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strip>;
+    functions: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        ref: z.ZodString;
+        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        output: z.ZodDefault<z.ZodEnum<{
+            binary: "binary";
+            stream: "stream";
+            value: "value";
+        }>>;
+        binding: z.ZodObject<{
+            remoteUrl: z.ZodOptional<z.ZodString>;
+            route: z.ZodOptional<z.ZodObject<{
+                method: z.ZodEnum<{
+                    "*": "*";
+                    DELETE: "DELETE";
+                    GET: "GET";
+                    PATCH: "PATCH";
+                    POST: "POST";
+                    PUT: "PUT";
+                }>;
+                path: z.ZodString;
+                self: z.ZodOptional<z.ZodString>;
+                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                body: z.ZodOptional<z.ZodUnknown>;
+                credential: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strip>>;
+            auth: z.ZodOptional<z.ZodEnum<{
+                optional: "optional";
+                public: "public";
+                required: "required";
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    identity: z.ZodObject<{
+        credential: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ServiceFunctionManifestEntry = z.infer<typeof ServiceFunctionManifestEntrySchema>;
+export type ServiceFunctionManifest = z.infer<typeof ServiceFunctionManifestSchema>;
+export type ServiceFunctionDiscoveryRequest = z.infer<typeof ServiceFunctionDiscoveryRequestSchema>;
+export type ServiceFunctionDiscoveryResponse = z.infer<typeof ServiceFunctionDiscoveryResponseSchema>;
+export declare function toServiceFunctionManifestEntries(schemas: readonly FunctionSchema[]): ServiceFunctionManifestEntry[];
+export declare function signServiceFunctionManifest(manifest: ServiceFunctionManifest, request: ServiceFunctionDiscoveryRequest, identity: RemoteIdentityConfig): Promise<ServiceFunctionDiscoveryResponse>;
+export declare function verifyServiceFunctionManifest(input: unknown, expected: {
+    kernelIssuer: string;
+    nonce: string;
+    serviceIssuer: string;
+    serviceSubject: string;
+    publicKey: JsonWebKey;
+}): Promise<ServiceFunctionDiscoveryResponse>;
+export declare function hashServiceFunctionManifest(manifest: ServiceFunctionManifest): Promise<string>;
+export declare function functionBindingForManifest(binding: FunctionBinding, auth: 'required' | 'optional' | 'public' | undefined): FunctionBinding;
+//# sourceMappingURL=functions.d.ts.map

package/dist/service/functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAKpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAI/D,eAAO,MAAM,sBAAsB,wBAAwB,CAAA;AAC3D,eAAO,MAAM,yBAAyB,iCAAiC,CAAA;AAIvE,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO7C,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIxC,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;iBAGhD,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEjD,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAC7F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AACnF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAA;AACnG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,4BAA4B,EAAE,CAchC;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAc3C;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,UAAU,CAAA;CACtB,GACA,OAAO,CAAC,gCAAgC,CAAC,CAkC3C;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GACnD,eAAe,CAEjB"}

package/dist/service/functions.js

@@ -0,0 +1,115 @@
+import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
+import { functionBindingSchema, functionOutputSchema } from '@astrale-os/kernel-core/domain';
+import { importJWK, jwtVerify } from 'jose';
+import { z } from 'zod';
+import { signCredential } from '../auth/sign.js';
+export const SERVICE_FUNCTIONS_PATH = '/_astrale/functions';
+export const SERVICE_FUNCTIONS_PURPOSE = 'astrale.service-functions.v1';
+const JsonSchema = z.record(z.string(), z.unknown());
+export const ServiceFunctionManifestEntrySchema = z.object({
+    slug: z.string().regex(/^[a-z][a-z0-9-]*$/),
+    ref: z.string().regex(/^function\.[a-z][a-z0-9-]*$/),
+    inputSchema: JsonSchema,
+    outputSchema: JsonSchema,
+    output: functionOutputSchema.default('value'),
+    binding: functionBindingSchema.unwrap(),
+});
+export const ServiceFunctionManifestSchema = z.object({
+    version: z.literal(1),
+    service: z.object({ issuer: z.string().min(1), subject: z.string().min(1) }),
+    functions: z.array(ServiceFunctionManifestEntrySchema).max(500),
+});
+export const ServiceFunctionDiscoveryRequestSchema = z.object({
+    kernelIssuer: z.string().url(),
+    nonce: z.string().min(16).max(256),
+});
+export const ServiceFunctionDiscoveryResponseSchema = ServiceFunctionManifestSchema.extend({
+    identity: z.object({ credential: z.string().min(1) }),
+});
+export function toServiceFunctionManifestEntries(schemas) {
+    return schemas
+        .map((schema) => {
+        const slug = schema.ref.slice('function.'.length);
+        return ServiceFunctionManifestEntrySchema.parse({
+            slug,
+            ref: schema.ref,
+            inputSchema: schema.inputSchema,
+            outputSchema: schema.outputSchema,
+            output: schema.output ?? 'value',
+            binding: schema.binding,
+        });
+    })
+        .sort((a, b) => a.slug.localeCompare(b.slug));
+}
+export async function signServiceFunctionManifest(manifest, request, identity) {
+    const parsedManifest = ServiceFunctionManifestSchema.parse(manifest);
+    const manifestHash = await hashServiceFunctionManifest(parsedManifest);
+    const credential = await signCredential({ purpose: SERVICE_FUNCTIONS_PURPOSE, nonce: request.nonce, manifestHash }, {
+        issuer: identity.issuer,
+        subject: identity.subject,
+        audience: request.kernelIssuer,
+        privateKey: identity.privateKey,
+        ttl: '2m',
+    });
+    return { ...parsedManifest, identity: { credential } };
+}
+export async function verifyServiceFunctionManifest(input, expected) {
+    const response = ServiceFunctionDiscoveryResponseSchema.parse(input);
+    if (response.service.issuer !== expected.serviceIssuer ||
+        response.service.subject !== expected.serviceSubject) {
+        throw new Error('service function manifest identity does not match the deployed Service');
+    }
+    const algorithms = deriveAllowedAlgorithms(expected.publicKey);
+    const algorithm = algorithms[0];
+    if (!algorithm)
+        throw new Error('service function manifest public key has no supported algorithm');
+    const key = await importJWK(expected.publicKey, algorithm);
+    const verified = await jwtVerify(response.identity.credential, key, {
+        algorithms,
+        issuer: expected.serviceIssuer,
+        subject: expected.serviceSubject,
+        audience: expected.kernelIssuer,
+    });
+    const expectedHash = await hashServiceFunctionManifest({
+        version: response.version,
+        service: response.service,
+        functions: response.functions,
+    });
+    if (verified.payload.purpose !== SERVICE_FUNCTIONS_PURPOSE) {
+        throw new Error('service function manifest credential has the wrong purpose');
+    }
+    if (verified.payload.nonce !== expected.nonce) {
+        throw new Error('service function manifest credential has the wrong nonce');
+    }
+    if (verified.payload.manifestHash !== expectedHash) {
+        throw new Error('service function manifest credential does not cover the returned manifest');
+    }
+    return response;
+}
+export async function hashServiceFunctionManifest(manifest) {
+    const bytes = new TextEncoder().encode(canonicalJson(ServiceFunctionManifestSchema.parse(manifest)));
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return `sha256:${hex(new Uint8Array(digest))}`;
+}
+export function functionBindingForManifest(binding, auth) {
+    return { ...binding, auth: auth ?? 'required' };
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries
+        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
+        .join(',')}}`;
+}
+function hex(bytes) {
+    let value = '';
+    for (const byte of bytes)
+        value += byte.toString(16).padStart(2, '0');
+    return value;
+}
+//# sourceMappingURL=functions.js.map

package/dist/service/functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.js","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAA;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAA;AAEvE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAEpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IACpD,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU;IACxB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7C,OAAO,EAAE,qBAAqB,CAAC,MAAM,EAAE;CACxC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,6BAA6B,CAAC,MAAM,CAAC;IACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACtD,CAAC,CAAA;AASF,MAAM,UAAU,gCAAgC,CAC9C,OAAkC;IAElC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,kCAAkC,CAAC,KAAK,CAAC;YAC9C,IAAI;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO;YAChC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAA;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC,EACjC,OAAwC,EACxC,QAA8B;IAE9B,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,cAAc,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,EAC1E;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,EAAE,IAAI;KACV,CACF,CAAA;IACD,OAAO,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAc,EACd,QAMC;IAED,MAAM,QAAQ,GAAG,sCAAsC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACpE,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa;QAClD,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,cAAc,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAClG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QAClE,UAAU;QACV,MAAM,EAAE,QAAQ,CAAC,aAAa;QAC9B,OAAO,EAAE,QAAQ,CAAC,cAAc;QAChC,QAAQ,EAAE,QAAQ,CAAC,YAAY;KAChC,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,aAAa,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC7D,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,UAAU,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAwB,EACxB,IAAoD;IAEpD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,UAAU,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,IAAI,OAAO;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;SACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/service/index.d.ts

@@ -0,0 +1,3 @@
+export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
+export type { ServiceFunctionDiscoveryRequest, ServiceFunctionDiscoveryResponse, ServiceFunctionManifest, ServiceFunctionManifestEntry, } from './functions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/service/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,+BAA+B,EAC/B,gCAAgC,EAChC,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAA"}

package/dist/service/index.js

@@ -0,0 +1,2 @@
+export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
+//# sourceMappingURL=index.js.map

package/dist/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
   "keywords": [
     "astrale",

package/src/domain/extend-functions.ts

@@ -24,6 +24,7 @@ import { zodToJsonSchema } from '@astrale-os/kernel-core/domain'
 
 import type { AnyRemoteFunctionDef } from '../define/remote-function.js'
 
+import { functionBindingForManifest } from '../service/functions.js'
 import { resolveBinding } from './binding.js'
 
 /**
@@ -92,7 +93,10 @@ export function buildFunctionSchemas(
   const schemas: FunctionSchema[] = []
   const bindings: Record<string, FunctionBinding> = {}
   for (const [slug, def] of Object.entries(functions)) {
-    const binding = resolveBinding(def.binding, url, functionsFolder, slug)
+    const binding = functionBindingForManifest(
+      resolveBinding(def.binding, url, functionsFolder, slug),
+      def.auth,
+    )
     bindings[slug] = binding
     schemas.push({
       ref: `function.${slug}`,

package/src/index.ts

@@ -97,6 +97,24 @@ export type { Defer, DeferredTask, Sleep } from '@astrale-os/kernel-server'
 export { MetaSchema } from './deploy/meta.js'
 export type { Meta } from './deploy/meta.js'
 
+// ─── Service-hosted Functions ───────────────────────────────────────────
+export {
+  SERVICE_FUNCTIONS_PATH,
+  ServiceFunctionDiscoveryRequestSchema,
+  ServiceFunctionDiscoveryResponseSchema,
+  ServiceFunctionManifestEntrySchema,
+  ServiceFunctionManifestSchema,
+  hashServiceFunctionManifest,
+  signServiceFunctionManifest,
+  verifyServiceFunctionManifest,
+} from './service/index.js'
+export type {
+  ServiceFunctionDiscoveryRequest,
+  ServiceFunctionDiscoveryResponse,
+  ServiceFunctionManifest,
+  ServiceFunctionManifestEntry,
+} from './service/index.js'
+
 // ─── Route binding (re-exported from kernel-api for consumer convenience) ─
 export type {
   AuthPolicy,

package/src/linter/docs/RULES.md

@@ -57,7 +57,7 @@ claim that its SDK or analyzer implementation exists.
 
 | Slug | Owner | Scope | Automation | Default | Fix | Invariant and detection contract |
 | --- | --- | --- | --- | --- | --- | --- |
-| `core-is-pure` | `analyzer` | `project` | `implement` | error | none | Production files under `core/` must not reach known effectful Astrale/Node packages or the project's `runtime`, `functions`, `integrations`, `client`, or `simulation` layers; detection follows resolved relative imports and excludes tests. Unknown third-party packages are not guessed to be effectful. |
+| `core-is-pure` | `analyzer` | `project` | `implement` | error | none | Production files under `core/` must not reach known effectful Astrale/Node packages or the project's `runtime`, `functions`, `integrations`, `client`, or `simulation` layers; detection follows resolved local imports, including package-import aliases, and excludes tests. Unknown third-party packages are not guessed to be effectful. |
 | `core-has-no-async` | `oxlint` | `file` | `implement` | error | none | Production files under `core/` must not declare async functions or async generators, or use top-level `await`/`for await`; tests are excluded. |
 | `integrations-enter-through-deps` | `analyzer` | `project` | `research` | off | none | Runtime handlers receive external clients through the domain dependency container and must not construct provider clients or import configured singletons directly. |
 | `deps-construction-has-no-effects` | `oxlint` | `file` | `research` | off | none | The dependency factory may construct clients from configuration but must not await, fetch, call the kernel, read time/randomness, or perform request-specific I/O. |