@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/dist/server/create.js

@@ -1,171 +0,0 @@
-/**
- * Remote-domain server entry point. The worker serving URL is the issuer; each
- * method/view/function signs with its own semantic subject.
- */
-import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
-import { collectFunctionSubs, domainInstallRequestSchema, hashInstallGraph, } from '@astrale-os/kernel-core/domain';
-import { createKernelApp } from '@astrale-os/kernel-server';
-import { Hono } from 'hono';
-import { importJWK, SignJWT } from 'jose';
-import { MetaSchema } from '../deploy/meta.js';
-import { SdkDispatcher } from '../dispatch/dispatcher.js';
-import { buildAuxIdentityMap } from '../dispatch/identity.js';
-import { buildMethodIndex } from '../dispatch/resolve.js';
-import { buildInstallGraph, buildInstallGraphHash } from '../domain/build-spec.js';
-import { toSdkContract } from '../domain/contract.js';
-import { materializeRemoteDomain } from '../domain/define.js';
-import { mountAuxiliaryRoutes } from './auxiliary-routes.js';
-import { derivePublicJwk } from './jwks.js';
-import { canonicalizeServingUrl } from './serving-url.js';
-export function createRemoteServer(config) {
-    const methods = buildMethodIndex(config.domain.methods);
-    // Canonical serving URL drives signing, JWKS, /meta, and install credentials.
-    const iss = canonicalizeServingUrl(config.url);
-    // Stamp aux bindings against the same URL used as issuer.
-    const { compiled, auxiliary } = materializeRemoteDomain(config.domain, iss);
-    const dispatcher = new SdkDispatcher({
-        compiled,
-        methods,
-        deps: config.deps,
-        privateKey: config.privateKey,
-        issuer: iss,
-        // The canonicalized serving URL, NOT the raw config.url: `ctx.env.url` is
-        // documented as the worker's `iss` identity, so the two must be one value.
-        url: iss,
-    });
-    const publicJwk = derivePublicJwk(config.privateKey);
-    const jwks = {
-        issuer: iss,
-        loadOwnKeys: async () => [publicJwk],
-    };
-    // Normal /meta schemaHash is the deterministic install-graph hash; explicit overrides win.
-    let cachedSchemaHash = null;
-    const resolveSchemaHash = () => config.meta?.schemaHash !== undefined
-        ? Promise.resolve(config.meta.schemaHash)
-        : (cachedSchemaHash ??= buildInstallGraphHash(config.domain, iss));
-    // Register `/meta` on the host app before `createKernelApp` mounts its
-    // catch-all routes so the verbatim path wins.
-    const hostApp = config.app ?? new Hono();
-    const metaBase = {
-        iss,
-        sdkCommit: config.meta?.sdkCommit,
-        domainName: config.meta?.domainName ?? compiled.$.origin,
-        ...(config.domain.manifest ? { manifest: config.domain.manifest } : {}),
-    };
-    hostApp.get('/meta', async (c) => c.json(MetaSchema.parse({ ...metaBase, schemaHash: await resolveSchemaHash() })));
-    hostApp.post('/_astrale/install-domain', async (c) => {
-        const parsed = domainInstallRequestSchema.safeParse(await c.req.json().catch(() => null));
-        if (!parsed.success) {
-            return c.json({ error: 'Invalid install request', issues: parsed.error.issues }, 400);
-        }
-        const token = bearerToken(c.req.header('authorization'));
-        try {
-            await config.install?.authorize?.({
-                c,
-                ...(token ? { token } : {}),
-                kernelIssuer: parsed.data.kernelIssuer,
-                nonce: parsed.data.nonce,
-                deps: config.deps,
-            });
-        }
-        catch (err) {
-            return c.json({ error: 'Install denied', message: err.message }, 403);
-        }
-        // The signed graph is built for this serving URL; the kernel verifies it as-is.
-        const graph = buildInstallGraph(config.domain, iss);
-        const graphHash = await hashInstallGraph(graph);
-        const origin = compiled.$.origin;
-        // Signed claims and bundle fields must agree exactly.
-        const bundleExtras = {
-            ...(config.postInstall ? { postInstall: config.postInstall } : {}),
-            ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
-        };
-        // Install credential issuer is the serving URL the kernel fetched.
-        const credential = await signInstallCredential({
-            privateKey: config.privateKey,
-            issuer: iss,
-            audience: parsed.data.kernelIssuer,
-            nonce: parsed.data.nonce,
-            graphHash,
-            subs: collectFunctionSubs(compiled),
-            ...bundleExtras,
-        });
-        return c.json({
-            origin,
-            graph,
-            identity: { credential },
-            ...bundleExtras,
-        });
-    });
-    // Resolved once and shared between the kernel envelope (createKernelApp) and
-    // the aux routes (mountAuxiliaryRoutes) so both honor the same policy.
-    const cors = config.cors ?? { origin: '*' };
-    // Aux routes mount before the kernel catch-all and sign with their member subjects.
-    if (auxiliary) {
-        const auxIdentities = buildAuxIdentityMap(compiled, config.privateKey, iss);
-        mountAuxiliaryRoutes({
-            app: hostApp,
-            url: auxiliary.url,
-            // oxlint-disable-next-line no-explicit-any
-            views: config.domain.views,
-            viewBindings: auxiliary.viewBindings,
-            remoteFunctions: config.domain.remoteFunctions,
-            remoteFunctionBindings: auxiliary.remoteFunctionBindings,
-            deps: config.deps,
-            identities: auxIdentities,
-            cors,
-        });
-    }
-    const { app } = createKernelApp({
-        dispatcher,
-        domain: config.domain.methods.map(toSdkContract),
-        host: { url: config.url },
-        jwks,
-        transports: config.transports,
-        cors,
-        health: config.health,
-        app: hostApp,
-        ws: config.ws,
-    });
-    return {
-        app,
-        // Expose the canonical issuer, not the raw env URL, for graph identity stamping.
-        iss,
-        async start(port) {
-            const nodeStartModule = './start';
-            const { startNodeServer } = await import(nodeStartModule);
-            return startNodeServer(app, port);
-        },
-    };
-}
-function bearerToken(header) {
-    if (!header)
-        return undefined;
-    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-    return match?.[1];
-}
-async function signInstallCredential(args) {
-    const alg = deriveAllowedAlgorithms(args.privateKey)[0];
-    if (!alg) {
-        throw new Error(`createRemoteServer: cannot derive install signing algorithm from JWK (kty=${args.privateKey.kty}).`);
-    }
-    const kid = args.privateKey.kid;
-    const header = typeof kid === 'string' ? { alg, kid } : { alg };
-    const key = await importJWK(args.privateKey, alg);
-    // postInstall/requires are signed, not just copied into the bundle.
-    return new SignJWT({
-        subs: args.subs,
-        nonce: args.nonce,
-        graph_hash: args.graphHash,
-        ...(args.postInstall ? { postInstall: args.postInstall } : {}),
-        ...(args.requires ? { requires: args.requires } : {}),
-    })
-        .setProtectedHeader(header)
-        .setIssuer(args.issuer)
-        .setSubject(args.issuer)
-        .setAudience(args.audience)
-        .setIssuedAt()
-        .setExpirationTime('10m')
-        .sign(key);
-}
-//# sourceMappingURL=create.js.map

package/dist/server/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,MAAM,UAAU,kBAAkB,CAAQ,MAAiC;IACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE9C,0DAA0D;IAC1D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE3E,MAAM,UAAU,GAAG,IAAI,aAAa,CAAQ;QAC1C,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,GAAG;QACX,0EAA0E;QAC1E,2EAA2E;QAC3E,GAAG,EAAE,GAAG;KACT,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAa;QACrB,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;KACrC,CAAA;IAED,2FAA2F;IAC3F,IAAI,gBAAgB,GAA2B,IAAI,CAAA;IACnD,MAAM,iBAAiB,GAAG,GAAoB,EAAE,CAC9C,MAAM,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAEtE,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,MAAM,QAAQ,GAAG;QACf,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS;QACjC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM;QACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC,CAAC,CACjF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,gFAAgF;QAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QAChC,sDAAsD;QACtD,MAAM,YAAY,GAAG;YACnB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAA;QACD,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;YAClC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,SAAS;YACT,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACnC,GAAG,YAAY;SAChB,CAAC,CAAA;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,KAAK;YACL,QAAQ,EAAE,EAAE,UAAU,EAAE;YACxB,GAAG,YAAY;SAChB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAE3C,oFAAoF;IACpF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC3E,oBAAoB,CAAQ;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,2CAA2C;YAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAmD;YACxE,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe;YAC9C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,aAAa;YACzB,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC;QAC9B,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAChD,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QACzB,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,OAAO;QACZ,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,iFAAiF;QACjF,GAAG;QACH,KAAK,CAAC,KAAK,CAAC,IAAa;YACvB,MAAM,eAAe,GAAG,SAAS,CAAA;YACjC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;YACzD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IASpC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CACrG,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAI,IAAI,CAAC,UAAiD,CAAC,GAAG,CAAA;IACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEjD,oEAAoE;IACpE,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;SACC,kBAAkB,CAAC,MAAM,CAAC;SAC1B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC1B,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/server/domain-entry.d.ts

@@ -1,77 +0,0 @@
-/**
- * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
- *
- * It folds the three steps every hand-rolled worker used to wire by hand —
- * compile the runtime domain (`defineRemoteDomain`), build the server
- * (`createRemoteServer`), and wrap it in the shared fetch plumbing
- * (`createWorkerEntry`) — into a single declaration. The author passes the raw
- * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
- * deploy bits; the helper does the rest. This is what the cloudflare adapter's
- * codegen emits, and the recommended surface for a hand-rolled worker.
- *
- * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
- * `@astrale-os/sdk/domain`) only when the worker needs something this config
- * can't express — e.g. a serving-URL-dependent domain build (views stamped with
- * the live url) or a globally-injected signing key resolved per request.
- */
-import type { Core, Schema } from '@astrale-os/kernel-dsl';
-import type { Hono } from 'hono';
-import type { DomainManifest } from '../config/define-domain.js';
-import type { AnyRemoteFunctionDef, ViewDef } from '../define/index.js';
-import type { SchemaMethodsImpl } from '../method/index.js';
-import type { RemoteServerConfig } from './config.js';
-import type { WorkerEntry, WorkerEntryConfig } from './worker-entry.js';
-export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
-    /** The domain schema. */
-    schema: S;
-    /** Method implementations, typed against `schema` under `TDeps`. */
-    methods: SchemaMethodsImpl<S, TDeps>;
-    /** Optional Core override (extra genesis nodes / wiring). */
-    core?: Core<S>;
-    /** Views (iframe-mountable UIs) keyed by slug. */
-    views?: Record<string, ViewDef<TDeps>>;
-    /** Standalone Functions (callables not bound to a class) keyed by slug. */
-    functions?: Record<string, AnyRemoteFunctionDef>;
-    /**
-     * The worker's signing key (its `iss` identity material). A static JWK, or a
-     * resolver from `env` for keys injected as a secret / shared globally.
-     */
-    privateKey: JsonWebKey | ((env: TEnv) => JsonWebKey);
-    /** Cross-domain deps by origin — verified present at install. */
-    requires?: readonly string[];
-    /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
-    postInstall?: string;
-    /**
-     * Physical tree path for the Domain node (absolute, e.g. `/domains/acme`);
-     * default `/domains/<origin>`. Rides in on the `...domain` spread from
-     * `defineDomain`; declared here so it is captured (not silently dropped like a
-     * spread prop absent from this type) and forwarded to `defineRemoteDomain`.
-     */
-    path?: string;
-    /** Provenance stamped on `/meta`. */
-    meta?: RemoteServerConfig<TDeps>['meta'];
-    /** Presentation metadata (logo / initial view) stamped on `/meta`. */
-    manifest?: DomainManifest;
-    /**
-     * Map the worker `env` to the handler dependency container. Defaults to
-     * passing `env` straight through (the common case where handlers read
-     * bindings directly).
-     */
-    deps?: (env: TEnv, url: string) => TDeps;
-    /** Optional pre-built host Hono app (CORS / logging / extra routes). */
-    app?: (env: TEnv) => Hono;
-    resolveUrl?: WorkerEntryConfig<TEnv>['resolveUrl'];
-    selfBinding?: WorkerEntryConfig<TEnv>['selfBinding'];
-    routeSubrequest?: WorkerEntryConfig<TEnv>['routeSubrequest'];
-    before?: WorkerEntryConfig<TEnv>['before'];
-    rewriteRequest?: WorkerEntryConfig<TEnv>['rewriteRequest'];
-}
-/**
- * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
- * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
- * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
- * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
- * handler deps differ from the worker bindings and a `deps` mapper is supplied.
- */
-export declare function domainWorkerEntry<TEnv, TDeps = TEnv>(): <S extends Schema>(config: DomainWorkerEntryConfig<S, TEnv, TDeps>) => WorkerEntry<TEnv>;
-//# sourceMappingURL=domain-entry.d.ts.map

package/dist/server/domain-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAKvE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IACxC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAmCrB"}

package/dist/server/domain-entry.js

@@ -1,60 +0,0 @@
-/**
- * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
- *
- * It folds the three steps every hand-rolled worker used to wire by hand —
- * compile the runtime domain (`defineRemoteDomain`), build the server
- * (`createRemoteServer`), and wrap it in the shared fetch plumbing
- * (`createWorkerEntry`) — into a single declaration. The author passes the raw
- * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
- * deploy bits; the helper does the rest. This is what the cloudflare adapter's
- * codegen emits, and the recommended surface for a hand-rolled worker.
- *
- * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
- * `@astrale-os/sdk/domain`) only when the worker needs something this config
- * can't express — e.g. a serving-URL-dependent domain build (views stamped with
- * the live url) or a globally-injected signing key resolved per request.
- */
-import { defineRemoteDomain } from '../domain/index.js';
-import { createWorkerEntry } from './worker-entry.js';
-/**
- * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
- * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
- * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
- * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
- * handler deps differ from the worker bindings and a `deps` mapper is supplied.
- */
-export function domainWorkerEntry() {
-    return function (config) {
-        const domain = defineRemoteDomain()({
-            schema: config.schema,
-            methods: config.methods,
-            ...(config.core ? { core: config.core } : {}),
-            ...(config.views ? { views: config.views } : {}),
-            ...(config.functions ? { remoteFunctions: config.functions } : {}),
-            ...(config.manifest ? { manifest: config.manifest } : {}),
-            ...(config.path ? { path: config.path } : {}),
-        });
-        return createWorkerEntry({
-            ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),
-            ...(config.selfBinding ? { selfBinding: config.selfBinding } : {}),
-            ...(config.routeSubrequest ? { routeSubrequest: config.routeSubrequest } : {}),
-            ...(config.before ? { before: config.before } : {}),
-            ...(config.rewriteRequest ? { rewriteRequest: config.rewriteRequest } : {}),
-            // `createWorkerEntry` conflates the worker env and the handler deps into a
-            // single type param; we keep them distinct in the public config and bridge
-            // here. The runtime deps (and the methods typed against them) are correct;
-            // only this assembly is cast.
-            build: (url, env) => ({
-                domain,
-                deps: config.deps ? config.deps(env, url) : env,
-                url,
-                privateKey: typeof config.privateKey === 'function' ? config.privateKey(env) : config.privateKey,
-                ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
-                ...(config.postInstall ? { postInstall: config.postInstall } : {}),
-                ...(config.meta ? { meta: config.meta } : {}),
-                ...(config.app ? { app: config.app(env) } : {}),
-            }),
-        });
-    };
-}
-//# sourceMappingURL=domain-entry.js.map

package/dist/server/domain-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAoDrD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/handle.d.ts

@@ -1,35 +0,0 @@
-/**
- * `RemoteServer` and `RemoteServerHandle` — output shapes for the SDK server.
- *
- * `RemoteServer` is what `createRemoteServer` returns: the assembled Hono
- * app plus a Node convenience helper. `RemoteServerHandle` is what `start()`
- * resolves to: the bound port and a `close()` function for graceful shutdown.
- */
-import type { Hono } from 'hono';
-export type RemoteServer = {
-    /**
-     * The assembled Hono app. Use `app.fetch` for any runtime
-     * (Bun, Deno, Cloudflare Workers, or Node via `@hono/node-server`).
-     */
-    app: Hono;
-    /**
-     * The worker's canonical serving URL — its `iss` identity (full URL, trailing
-     * slash stripped, base path preserved). The single value the dispatcher signs
-     * with and the kernel pins. Read it to seed `Identity.iss` on graph nodes so
-     * the seeded value matches the signing issuer (never re-derive from a raw env).
-     */
-    iss: string;
-    /**
-     * Convenience helper: start a Node HTTP server on the given port using
-     * `@hono/node-server` (loaded via dynamic import). For other runtimes,
-     * use `app.fetch` directly.
-     */
-    start: (port?: number) => Promise<RemoteServerHandle>;
-};
-export type RemoteServerHandle = {
-    /** The port the server is listening on (resolved even if `port: 0` was requested). */
-    port: number;
-    /** Stop the server and release the port. */
-    close: () => Promise<void>;
-};
-//# sourceMappingURL=handle.d.ts.map

package/dist/server/handle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../src/server/handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,GAAG,EAAE,IAAI,CAAA;IACT;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA"}

package/dist/server/handle.js

@@ -1,9 +0,0 @@
-/**
- * `RemoteServer` and `RemoteServerHandle` — output shapes for the SDK server.
- *
- * `RemoteServer` is what `createRemoteServer` returns: the assembled Hono
- * app plus a Node convenience helper. `RemoteServerHandle` is what `start()`
- * resolves to: the bound port and a `close()` function for graceful shutdown.
- */
-export {};
-//# sourceMappingURL=handle.js.map

package/dist/server/handle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../src/server/handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/server/jwks.d.ts

@@ -1,11 +0,0 @@
-/**
- * Derive a public JWK from a private one.
- *
- * Strips the private components for both EC keys (drops `d`) and RSA keys
- * (drops `d`, `p`, `q`, `dp`, `dq`, `qi`, and `oth` — the additional-primes
- * array on multi-prime RSA keys). The result is safe to publish at
- * `<url>/.well-known/jwks.json` so downstream verifiers can validate
- * signatures the server produced.
- */
-export declare function derivePublicJwk(privateKey: JsonWebKey): Record<string, unknown>;
-//# sourceMappingURL=jwks.d.ts.map

package/dist/server/jwks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/server/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO/E"}

package/dist/server/jwks.js

@@ -1,15 +0,0 @@
-/**
- * Derive a public JWK from a private one.
- *
- * Strips the private components for both EC keys (drops `d`) and RSA keys
- * (drops `d`, `p`, `q`, `dp`, `dq`, `qi`, and `oth` — the additional-primes
- * array on multi-prime RSA keys). The result is safe to publish at
- * `<url>/.well-known/jwks.json` so downstream verifiers can validate
- * signatures the server produced.
- */
-export function derivePublicJwk(privateKey) {
-    // oxlint-disable-next-line no-unused-vars
-    const { d, p, q, dp, dq, qi, oth, ...publicJwk } = privateKey;
-    return publicJwk;
-}
-//# sourceMappingURL=jwks.js.map

package/dist/server/jwks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../src/server/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,eAAe,CAAC,UAAsB;IACpD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,UAGlD,CAAA;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/server/require-env.d.ts

@@ -1,15 +0,0 @@
-/**
- * Read a string-typed env var (process.env on Node, the Worker `env` binding
- * on Cloudflare) and throw a clear error if it is missing or empty.
- *
- * Use this for **identity-bearing** values (issuer, baseDomain, audience,
- * worker URL) where a guessed default silently mints wrong JWTs or bakes
- * wrong refs into persisted artifacts. The conventional `?? 'literal'`
- * fallback is the anti-pattern this exists to replace.
- *
- * In local dev these live in each domain worker's `worker/.dev.vars` (read
- * natively by `wrangler dev`), so this throw never fires in a properly-prepared
- * dev environment — only when wiring is genuinely missing.
- */
-export declare function requireEnv(env: unknown, name: string, hint?: string): string;
-//# sourceMappingURL=require-env.d.ts.map

package/dist/server/require-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-env.d.ts","sourceRoot":"","sources":["../../src/server/require-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5E"}

package/dist/server/require-env.js

@@ -1,21 +0,0 @@
-/**
- * Read a string-typed env var (process.env on Node, the Worker `env` binding
- * on Cloudflare) and throw a clear error if it is missing or empty.
- *
- * Use this for **identity-bearing** values (issuer, baseDomain, audience,
- * worker URL) where a guessed default silently mints wrong JWTs or bakes
- * wrong refs into persisted artifacts. The conventional `?? 'literal'`
- * fallback is the anti-pattern this exists to replace.
- *
- * In local dev these live in each domain worker's `worker/.dev.vars` (read
- * natively by `wrangler dev`), so this throw never fires in a properly-prepared
- * dev environment — only when wiring is genuinely missing.
- */
-export function requireEnv(env, name, hint) {
-    const v = env?.[name];
-    if (typeof v === 'string' && v.length > 0)
-        return v;
-    const help = hint ? ` (${hint})` : '';
-    throw new Error(`Missing required env var: ${name}${help}`);
-}
-//# sourceMappingURL=require-env.js.map

package/dist/server/require-env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-env.js","sourceRoot":"","sources":["../../src/server/require-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,IAAY,EAAE,IAAa;IAClE,MAAM,CAAC,GAAI,GAAkD,EAAE,CAAC,IAAI,CAAC,CAAA;IACrE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;AAC7D,CAAC"}

package/dist/server/service-entry.d.ts

@@ -1,32 +0,0 @@
-import type { CorsConfig } from '@astrale-os/kernel-server';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-import type { AnyRemoteFunctionDef } from '../define/remote-function.js';
-import type { Fetcher, WorkerEntry } from './worker-entry.js';
-export interface ServiceWorkerIdentityEnv {
-    IDENTITY_ISS?: string;
-    IDENTITY_SUB?: string;
-    IDENTITY_PRIVATE_KEY?: string;
-    ASTRALE_KERNEL_AUDIENCE?: string;
-}
-export interface ServiceWorkerEntryConfig<TEnv extends ServiceWorkerIdentityEnv> {
-    functions?: Record<string, AnyRemoteFunctionDef>;
-    functionsFolder?: string;
-    cors?: CorsConfig;
-    resolveUrl?: (env: TEnv, requestOrigin: string) => string;
-    selfBinding?: (env: TEnv) => Fetcher | null | undefined;
-    routeSubrequest?: (url: URL, env: TEnv) => Fetcher | null | undefined;
-}
-/** A Service worker with zero or more first-class kernel Functions.
- *
- * The function map is the only declaration: it drives both HTTP routes and the
- * signed deploy-time manifest. Function identities are read lazily from the
- * graph after Services has reconciled them, while every Function reuses the
- * Service's one private signing key. */
-export declare function serviceWorkerEntry<TEnv extends ServiceWorkerIdentityEnv>(config: ServiceWorkerEntryConfig<TEnv>): WorkerEntry<TEnv>;
-/** Reuse only the Service's signing key. A hosted Function's inbound audience
- * defaults to its own issuer; the Service HTTP origin is merely transport. */
-export declare function hostedFunctionIdentity(identity: {
-    issuer: string;
-    subject: string;
-}, serviceIdentity: RemoteIdentityConfig): RemoteIdentityConfig;
-//# sourceMappingURL=service-entry.d.ts.map

package/dist/server/service-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-entry.d.ts","sourceRoot":"","sources":["../../src/server/service-entry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAK3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAa7D,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,wBAAwB,CAAC,IAAI,SAAS,wBAAwB;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAChD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACvD,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACtE;AAED;;;;;wCAKwC;AACxC,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,wBAAwB,EACtE,MAAM,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACrC,WAAW,CAAC,IAAI,CAAC,CAuDnB;AA6CD;8EAC8E;AAC9E,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,EAAE,oBAAoB,GACpC,oBAAoB,CAEtB"}