@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/dist/auth/sign.js

@@ -1,24 +0,0 @@
-/**
- * JWT signing utilities for outbound composed credentials.
- */
-import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
-import { SignJWT, importJWK } from 'jose';
-/**
- * Sign a credential JWT with the given claims and identity config.
- */
-export async function signCredential(claims, config) {
-    const alg = deriveAllowedAlgorithms(config.privateKey)[0];
-    if (!alg) {
-        throw new Error(`Cannot derive algorithm from JWK: kty=${config.privateKey.kty}`);
-    }
-    const key = await importJWK(config.privateKey, alg);
-    return new SignJWT(claims)
-        .setProtectedHeader({ alg })
-        .setIssuer(config.issuer)
-        .setSubject(config.subject)
-        .setAudience(config.audience)
-        .setIssuedAt()
-        .setExpirationTime(config.ttl ?? '60s')
-        .sign(key);
-}
-//# sourceMappingURL=sign.js.map

package/dist/auth/sign.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/auth/sign.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA+B,EAC/B,MAOC;IAED,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEnD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;SAC3B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;SACxB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC5B,WAAW,EAAE;SACb,iBAAiB,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC;SACtC,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/auth/verify.d.ts

@@ -1,28 +0,0 @@
-/**
- * Inbound credential verification.
- *
- * Uses kernel-core's credential verification infrastructure
- * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
- * Not tied to JWT — supports any credential method kernel-core provides.
- */
-import type { Attestation, CredentialInput, Delegation, VerifiedCredential } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type VerifiedInbound = {
-    /** The full verified credential (iss, sub, aud, claims) */
-    verified: VerifiedCredential;
-    /** Issuer URL (from credential's iss claim) */
-    issuer: string;
-    /** Attestation — proves caller can invoke this function */
-    attestation: Attestation;
-    /** Delegation — scoped caller permissions as kernel-signed credential */
-    delegation: Delegation;
-};
-/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
-export declare function clearJwksCache(): void;
-/**
- * Verify an inbound delegation credential using kernel-core's verification.
- *
- * @throws AuthenticationError subclasses from kernel-core on verification failure
- */
-export declare function verifyInboundCredential(credential: CredentialInput, config: RemoteIdentityConfig): Promise<VerifiedInbound>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/auth/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/auth/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,UAAU,EAEV,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAYhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,eAAe,GAAG;IAC5B,2DAA2D;IAC3D,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,WAAW,EAAE,WAAW,CAAA;IACxB,yEAAyE;IACzE,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAkBD,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAiFD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA+C1B"}

package/dist/auth/verify.js

@@ -1,151 +0,0 @@
-/**
- * Inbound credential verification.
- *
- * Uses kernel-core's credential verification infrastructure
- * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
- * Not tied to JWT — supports any credential method kernel-core provides.
- */
-import { CredentialMethodResolver, MethodRegistry, SignatureVerificationError, SigningKeyNotFoundError, verifyAudience, verifyCredential, } from '@astrale-os/kernel-core';
-import { createLocalJWKSet, createRemoteJWKSet } from 'jose';
-import { derivePublicJwk } from '../server/jwks.js';
-import { canonicalizeServingUrl } from '../server/serving-url.js';
-const methodResolver = new CredentialMethodResolver(new MethodRegistry());
-// JWKS resolvers cached per JWKS URL (module-level, like the pools/selfIds
-// Maps in kernel-client.ts). jose handles freshness WITHIN a resolver: 10min
-// max-age, 30s fetch cooldown, and auto-refetch on kid-miss when not cooling
-// down. The one gap — issuer restarts with new keys while the cooldown pins
-// the old set (the incident that got a prior indefinite cache removed) — is
-// covered by evict-and-retry-once in `verifyInboundCredential`, so indefinite
-// Map residency is safe and the per-call JWKS fetch is gone.
-const remoteResolvers = new Map();
-// Self-issued credentials verify against the worker's own in-memory key;
-// cache the local JWKS per canonical self-issuer (one key per worker) so the
-// public-JWK derivation isn't redone on every request.
-const localResolvers = new Map();
-/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
-export function clearJwksCache() {
-    remoteResolvers.clear();
-    localResolvers.clear();
-}
-/**
- * M-28 fix: a bare-slug iss (`mails.localhost`) makes
- * `new URL('mails.localhost/.well-known/jwks.json')` throw "Invalid URL
- * string". The dispatcher's identity map normalizes the iss it signs with,
- * but inbound creds from older clients may still carry the slug form. Coerce
- * to a URL with a default `https://` scheme (matches kernel.astrale.ai
- * canonical form). If the actual receiver is on http://localhost the
- * receiver-side resolver still works because both endpoints are on localhost
- * — but for prod targets requiring TLS this is the right default.
- */
-function jwksUrlFor(issuer) {
-    const normalized = /^https?:\/\//.test(issuer) ? issuer : `https://${issuer}`;
-    return `${normalized}/.well-known/jwks.json`;
-}
-function getRemoteResolver(jwksUrl) {
-    let resolver = remoteResolvers.get(jwksUrl);
-    if (!resolver) {
-        resolver = createRemoteJWKSet(new URL(jwksUrl));
-        remoteResolvers.set(jwksUrl, resolver);
-    }
-    return resolver;
-}
-function getLocalResolver(selfIssuer, privateKey) {
-    let resolver = localResolvers.get(selfIssuer);
-    if (!resolver) {
-        resolver = createLocalJWKSet({ keys: [derivePublicJwk(privateKey)] });
-        localResolvers.set(selfIssuer, resolver);
-    }
-    return resolver;
-}
-/**
- * Build the key resolver for one verifying server. Captures `config` so it can
- * short-circuit the server's OWN issuer (`config.issuer`): a self-issued
- * credential is verified against the in-memory public key, never fetched — a
- * Worker can't fetch its own hostname, and it already holds the key. Every other
- * issuer is resolved via the cached per-URL JWKS resolvers above; every JWKS
- * URL touched is recorded in `resolvedJwksUrls` so the caller can evict
- * exactly those resolvers if verification fails on an unknown signing key.
- */
-function makeResolveKeys(config, resolvedJwksUrls) {
-    // The worker's own canonical iss. STRICT: `config.issuer` is the serving URL
-    // by contract (both producers — buildIdentityMap / buildAuxIdentityMap — feed
-    // it `canonicalizeServingUrl(config.url)`), so a value that doesn't parse is
-    // a construction-time config error. Swallowing it would silently disable
-    // self-verification and route self-issued credentials to a JWKS fetch on the
-    // worker's own hostname — which Cloudflare forbids — turning a config bug
-    // into an opaque per-call failure.
-    const selfIssuer = canonicalizeServingUrl(config.issuer);
-    return async (issuer, _method, _kid) => {
-        const url = issuer;
-        // Self-issued credential (iss == this worker's own serving URL): resolve
-        // from the in-memory public key. Never fetch self — Cloudflare forbids a
-        // Worker fetching its own hostname, and the published JWKS is this key.
-        if (selfIssuer !== undefined) {
-            let canonical;
-            try {
-                canonical = canonicalizeServingUrl(url);
-            }
-            catch {
-                canonical = undefined;
-            }
-            if (canonical === selfIssuer) {
-                return getLocalResolver(selfIssuer, config.privateKey);
-            }
-        }
-        const jwksUrl = jwksUrlFor(url);
-        resolvedJwksUrls.add(jwksUrl);
-        return getRemoteResolver(jwksUrl);
-    };
-}
-/**
- * Verify an inbound delegation credential using kernel-core's verification.
- *
- * @throws AuthenticationError subclasses from kernel-core on verification failure
- */
-export async function verifyInboundCredential(credential, config) {
-    // Verify using kernel-core's credential verification pipeline
-    const resolvedJwksUrls = new Set();
-    const deps = { methodResolver, resolveKeys: makeResolveKeys(config, resolvedJwksUrls) };
-    let verified;
-    try {
-        verified = await verifyCredential(deps, credential);
-    }
-    catch (error) {
-        // A cached resolver can hold a stale key set after the issuer rotates:
-        //  - new kid → jose kid-misses but its 30s fetch cooldown blocks the
-        //    refetch (SigningKeyNotFoundError) — the incident that got a prior
-        //    indefinite cache removed;
-        //  - SAME kid, new key material (kernel kids derive from the subject, so
-        //    a re-keyed issuer reuses its kid) → the signature check fails
-        //    (SignatureVerificationError).
-        // Both: evict the resolver(s) this verification touched and retry ONCE
-        // with fresh ones. Forged-token spam thus costs at most one JWKS fetch
-        // per bad credential — equal to the uncached per-call baseline, never
-        // worse. An empty set means self-issued — refetching can't help, rethrow.
-        const staleKeySuspect = error instanceof SigningKeyNotFoundError || error instanceof SignatureVerificationError;
-        if (!staleKeySuspect || resolvedJwksUrls.size === 0)
-            throw error;
-        for (const url of resolvedJwksUrls)
-            remoteResolvers.delete(url);
-        verified = await verifyCredential(deps, credential);
-    }
-    // Validate audience matches this function's issuer (its serving URL).
-    // kernel-core's verifyAudience compares canonically.
-    verifyAudience(verified, (config.audience ?? config.issuer));
-    // Extract attestation and delegation from claims
-    const attestation = verified.claims.attestation;
-    if (!attestation?.expr) {
-        throw new Error('Credential missing attestation');
-    }
-    const delegation = verified.claims.delegation;
-    if (!delegation?.credential) {
-        throw new Error('Credential missing delegation');
-    }
-    return {
-        verified,
-        issuer: verified.iss,
-        attestation,
-        delegation,
-    };
-}
-//# sourceMappingURL=verify.js.map

package/dist/auth/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/auth/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,0BAA0B,EAC1B,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAY,MAAM,MAAM,CAAA;AAItE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAajE,MAAM,cAAc,GAAG,IAAI,wBAAwB,CAAC,IAAI,cAAc,EAAE,CAAC,CAAA;AAEzE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiD,CAAA;AAEhF,yEAAyE;AACzE,6EAA6E;AAC7E,uDAAuD;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgD,CAAA;AAE9E,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC5B,eAAe,CAAC,KAAK,EAAE,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAA;IAC7E,OAAO,GAAG,UAAU,wBAAwB,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAkB,EAClB,UAA8C;IAE9C,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,UAAU,CAAQ,CAAC,EAAE,CAAC,CAAA;QAC5E,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAA4B,EAAE,gBAA6B;IAClF,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAExD,OAAO,KAAK,EAAE,MAAgB,EAAE,OAAe,EAAE,IAAa,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,MAAgB,CAAA;QAE5B,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,SAA6B,CAAA;YACjC,IAAI,CAAC;gBACH,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,SAAS,CAAA;YACvB,CAAC;YACD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7B,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAA2B,EAC3B,MAA4B;IAE5B,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAA;IACvF,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,+BAA+B;QAC/B,yEAAyE;QACzE,mEAAmE;QACnE,mCAAmC;QACnC,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,eAAe,GACnB,KAAK,YAAY,uBAAuB,IAAI,KAAK,YAAY,0BAA0B,CAAA;QACzF,IAAI,CAAC,eAAe,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;QAChE,KAAK,MAAM,GAAG,IAAI,gBAAgB;YAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAa,CAAC,CAAA;IAExE,iDAAiD;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAsC,CAAA;IAC1E,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAoC,CAAA;IACvE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,GAAa;QAC9B,WAAW;QACX,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/cli/spec.d.ts

@@ -1,19 +0,0 @@
-/**
- * Build a diagnostic spec (wire graph + schema hash) from the project's
- * `defineDomain` definition. This mirrors what the codegen'd worker assembles —
- * but only for inspection / `/meta` provenance. The live install bundle is
- * always produced by the worker at request time, so a failure here is non-fatal
- * for dev/deploy (the CLI logs and continues) and fatal only for
- * `astrale-domain build`, where the spec IS the product.
- *
- * The modules (`schema` / `methods` / `views` / `functions`) come straight off
- * the definition — the SAME values the author wired into `defineDomain`, which
- * the adapter codegen also assembles. One source, no second filesystem probe to
- * drift from it.
- */
-import type { DomainDefinition } from '../config/define-domain.js';
-export declare function buildProjectSpec(def: DomainDefinition, url: string): Promise<{
-    wire: Record<string, unknown>;
-    schemaHash: string;
-}>;
-//# sourceMappingURL=spec.d.ts.map

package/dist/cli/spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/cli/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAKlE,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBhE"}

package/dist/cli/spec.js

@@ -1,33 +0,0 @@
-/**
- * Build a diagnostic spec (wire graph + schema hash) from the project's
- * `defineDomain` definition. This mirrors what the codegen'd worker assembles —
- * but only for inspection / `/meta` provenance. The live install bundle is
- * always produced by the worker at request time, so a failure here is non-fatal
- * for dev/deploy (the CLI logs and continues) and fatal only for
- * `astrale-domain build`, where the spec IS the product.
- *
- * The modules (`schema` / `methods` / `views` / `functions`) come straight off
- * the definition — the SAME values the author wired into `defineDomain`, which
- * the adapter codegen also assembles. One source, no second filesystem probe to
- * drift from it.
- */
-import { hashInstallGraph } from '@astrale-os/kernel-core/domain';
-import { buildInstallGraph, defineRemoteDomain } from '../domain/index.js';
-export async function buildProjectSpec(def, url) {
-    // The definition's module values are untyped against `RemoteDomainConfig` by
-    // nature (deps/schema generics erased on `DomainDefinition`); funnel them
-    // through ONE cast into the config shape `defineRemoteDomain` validates.
-    const config = {
-        schema: def.schema,
-        methods: def.methods,
-        ...(def.core ? { core: def.core } : {}),
-        ...(def.views ? { views: def.views } : {}),
-        ...(def.functions ? { remoteFunctions: def.functions } : {}),
-        ...(def.path ? { path: def.path } : {}),
-    };
-    const domain = defineRemoteDomain()(config);
-    const wire = buildInstallGraph(domain, url);
-    const schemaHash = await hashInstallGraph(wire);
-    return { wire: wire, schemaHash };
-}
-//# sourceMappingURL=spec.js.map

package/dist/cli/spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../src/cli/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAKjE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,GAAW;IAEX,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACD,CAAA;IAExC,MAAM,MAAM,GAAG,kBAAkB,EAAW,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,EAAE,IAAI,EAAE,IAA0C,EAAE,UAAU,EAAE,CAAA;AACzE,CAAC"}

package/dist/config/adapter.d.ts

@@ -1,148 +0,0 @@
-/**
- * The deployment-adapter contract.
- *
- * A deployment target = one npm package implementing `DomainAdapter<Params>`.
- * The adapter is GENERIC over its own `Params` so envs AND provider settings
- * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
- * nothing like a Node adapter's `{ port }`). The CLI resolves
- * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
- * with the resolved params — install of the resulting URL and the `requires`
- * check are generic and live in the CLI, never in the adapter.
- *
- * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
- * what the CLI prints, what `astrale domain install <url>` consumes, and
- * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
- * in the contract asks an adapter to predict it ahead of time.
- */
-/**
- * Generic, target-independent domain metadata the CLI hands every adapter so
- * it can codegen the worker entry. (Extends the bare `WatchCtx`/`DeployCtx` of
- * the spec with the fields a real codegen needs.)
- */
-export interface DomainInfo {
-    /**
-     * The domain's addressing name — the graph slug it mounts under (e.g.
-     * `'crm.acme.dev'`). NOT the cryptographic identity: the JWT `iss` is the
-     * worker's serving URL, pinned by the kernel at install time.
-     */
-    origin: string;
-    /** Cross-domain deps by origin — verified at install (CLI/kernel), not here. */
-    requires: readonly string[];
-    /** Optional Astrale Path called by the kernel after install (as __SYSTEM__). */
-    postInstall?: string;
-    /**
-     * Whether the domain declares Views / standalone Functions — read from the
-     * `defineDomain` definition, NOT probed from the filesystem. The adapter
-     * codegen imports the corresponding module only when true.
-     */
-    hasViews: boolean;
-    hasFunctions: boolean;
-    /**
-     * Views whose binding is backed by a worker-relative SPA mount. This is domain
-     * contract metadata (`defineView({ mount })`), not a frontend source folder:
-     * adapters decide, per env, which client assets serve these mounts.
-     */
-    mountedViews: Array<{
-        slug: string;
-        mount: string;
-    }>;
-    /**
-     * Whether the domain declares a `deps` mapper (`defineDomain({ deps })`).
-     * When true the adapter codegen imports it from the domain's fixed `deps`
-     * module and passes it to the worker entry; when false the worker passes the
-     * raw env straight through as `ctx.deps`. Read from the definition, never
-     * probed from the filesystem.
-     */
-    hasDeps: boolean;
-}
-export interface WatchCtx {
-    /** Absolute path to the domain project root. */
-    projectDir: string;
-    /** Absolute path where the CLI writes the diagnostic `spec.json`. */
-    specPath: string;
-    /** Flat secret map loaded from the env's `secrets` file — injected locally in dev. */
-    secrets: Record<string, string>;
-    /** Domain metadata for codegen. */
-    domain: DomainInfo;
-    /** The env key being watched (e.g. 'dev'). */
-    env: string;
-    /** Invoked by the adapter on every hot-reload so the CLI can re-log. */
-    onReload(): void;
-}
-export interface DeployCtx {
-    projectDir: string;
-    specPath: string;
-    /** Flat secret map loaded from the env's `secrets` file (gitignored). */
-    secrets: Record<string, string>;
-    domain: DomainInfo;
-    /** The env key being deployed (e.g. 'dev' | 'prod' | 'canary'). */
-    env: string;
-    /**
-     * Build the expected install-graph hash for a concrete serving URL from the
-     * current domain definition. Adapters that must verify live drift during
-     * deploy should use this instead of reading `.astrale/spec.json`, which is a
-     * post-deploy diagnostic artifact and may be stale.
-     */
-    schemaHashForUrl?(url: string): Promise<string | undefined>;
-}
-/** A running local watch — exposes its URL and a stop handle. */
-export interface WatchHandle {
-    /** Local URL the worker is reachable at (e.g. http://localhost:8787). */
-    url: string;
-    stop(): Promise<void>;
-}
-/** A completed deploy — the authoritative public URL. */
-export interface DeployResult {
-    url: string;
-    /**
-     * Adapter-specific next-steps block printed INSTEAD of the CLI's default
-     * "install on an instance" footer — managed deploys already installed the
-     * domain, so the default hint is wrong there. Pre-indented plain lines.
-     */
-    nextSteps?: string;
-}
-export interface DomainAdapter<Params> {
-    /** 'astrale-host' | 'cloudflare' | 'node' | … */
-    name: string;
-    /** Resolve an env key to this adapter's typed params. Throws on unknown key. */
-    params(env: string): Params;
-    /** Local + hot-reload (watch) → controllable handle. Orthogonal to env. */
-    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
-    /**
-     * Optional: re-run codegen for an ALREADY-RUNNING `watch` after
-     * `astrale.config.ts` changed — same shape as `watch` but it must NOT spawn
-     * anything: it only rewrites the generated files, and the running dev server
-     * (which watches them, e.g. `wrangler dev` on its `--config`) picks them up.
-     * Adapters without it fall back to "restart to apply config changes".
-     */
-    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
-    /** Build + bundle + ship (the adapter owns ITS build) → authoritative URL. */
-    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
-    /**
-     * Optional: the path (relative to the project root) of the gitignored secrets
-     * file for these params. The CLI loads it and passes the parsed map as
-     * `ctx.secrets` — keeping secret-file loading generic while the path stays
-     * provider-typed. Return `undefined` for "no secrets file".
-     */
-    secretsFile?(params: Params): string | undefined;
-}
-/**
- * Spec passed to `defineAdapter` — identical to `DomainAdapter` minus the
- * `params(env)` resolver, which the helper attaches from `envs`. Custom adapter
- * authors use this so they never re-implement env→params resolution.
- */
-export interface AdapterSpec<Params> {
-    name: string;
-    /** The provider-typed env map (`{ dev: {...}, prod: {...}, … }`). */
-    envs: Record<string, Params>;
-    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
-    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
-    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
-    secretsFile?(params: Params): string | undefined;
-}
-/**
- * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
- * resolver that throws a clear error on an unknown key (listing the valid ones).
- */
-export declare function defineAdapter<Params>(spec: AdapterSpec<Params>): DomainAdapter<Params>;
-//# sourceMappingURL=adapter.d.ts.map

package/dist/config/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;OAIG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,mCAAmC;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,QAAQ,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC5D;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa,CAAC,MAAM;IACnC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IAEZ,gFAAgF;IAChF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAE3B,2EAA2E;IAC3E,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAE1D;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzD,8EAA8E;IAC9E,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1D,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7D,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAoBtF"}

package/dist/config/adapter.js

@@ -1,40 +0,0 @@
-/**
- * The deployment-adapter contract.
- *
- * A deployment target = one npm package implementing `DomainAdapter<Params>`.
- * The adapter is GENERIC over its own `Params` so envs AND provider settings
- * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
- * nothing like a Node adapter's `{ port }`). The CLI resolves
- * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
- * with the resolved params — install of the resulting URL and the `requires`
- * check are generic and live in the CLI, never in the adapter.
- *
- * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
- * what the CLI prints, what `astrale domain install <url>` consumes, and
- * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
- * in the contract asks an adapter to predict it ahead of time.
- */
-/**
- * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
- * resolver that throws a clear error on an unknown key (listing the valid ones).
- */
-export function defineAdapter(spec) {
-    const keys = Object.keys(spec.envs);
-    return {
-        name: spec.name,
-        params(env) {
-            const params = spec.envs[env];
-            if (params === undefined) {
-                const known = keys.length ? keys.join(', ') : '(none)';
-                throw new Error(`Adapter "${spec.name}": unknown env "${env}". Known envs: ${known}. ` +
-                    `Add it to the adapter's env map in astrale.config.ts.`);
-            }
-            return params;
-        },
-        watch: spec.watch,
-        deploy: spec.deploy,
-        ...(spec.regenerate ? { regenerate: spec.regenerate } : {}),
-        ...(spec.secretsFile ? { secretsFile: spec.secretsFile } : {}),
-    };
-}
-//# sourceMappingURL=adapter.js.map

package/dist/config/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAyIH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAS,IAAyB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAW;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;gBACtD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,IAAI,mBAAmB,GAAG,kBAAkB,KAAK,IAAI;oBACpE,uDAAuD,CAC1D,CAAA;YACH,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAA;AACH,CAAC"}