@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/src/server/service-entry.ts

@@ -1,209 +0,0 @@
-import type { FunctionBinding } from '@astrale-os/kernel-api/routed'
-import type { Node } from '@astrale-os/kernel-core'
-import type { CorsConfig } from '@astrale-os/kernel-server'
-
-import { K } from '@astrale-os/kernel-core'
-import { Hono } from 'hono'
-
-import type { RemoteIdentityConfig } from '../auth/identity.js'
-import type { AnyRemoteFunctionDef } from '../define/remote-function.js'
-import type { Fetcher, WorkerEntry } from './worker-entry.js'
-
-import { makeFunctionContext } from '../auth/function-context.js'
-import { buildFunctionSchemas, DEFAULT_FUNCTIONS_FOLDER } from '../domain/extend-functions.js'
-import {
-  SERVICE_FUNCTIONS_PATH,
-  ServiceFunctionDiscoveryRequestSchema,
-  signServiceFunctionManifest,
-  toServiceFunctionManifestEntries,
-} from '../service/functions.js'
-import { mountAuxiliaryRoutes } from './auxiliary-routes.js'
-import { createAppWorkerEntry } from './worker-entry.js'
-
-export interface ServiceWorkerIdentityEnv {
-  IDENTITY_ISS?: string
-  IDENTITY_SUB?: string
-  IDENTITY_PRIVATE_KEY?: string
-  ASTRALE_KERNEL_AUDIENCE?: string
-}
-
-export interface ServiceWorkerEntryConfig<TEnv extends ServiceWorkerIdentityEnv> {
-  functions?: Record<string, AnyRemoteFunctionDef>
-  functionsFolder?: string
-  cors?: CorsConfig
-  resolveUrl?: (env: TEnv, requestOrigin: string) => string
-  selfBinding?: (env: TEnv) => Fetcher | null | undefined
-  routeSubrequest?: (url: URL, env: TEnv) => Fetcher | null | undefined
-}
-
-/** A Service worker with zero or more first-class kernel Functions.
- *
- * The function map is the only declaration: it drives both HTTP routes and the
- * signed deploy-time manifest. Function identities are read lazily from the
- * graph after Services has reconciled them, while every Function reuses the
- * Service's one private signing key. */
-export function serviceWorkerEntry<TEnv extends ServiceWorkerIdentityEnv>(
-  config: ServiceWorkerEntryConfig<TEnv>,
-): WorkerEntry<TEnv> {
-  const functions = config.functions ?? {}
-  const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER
-
-  return createAppWorkerEntry<TEnv>({
-    buildApp: (url, env) => {
-      const app = new Hono()
-      const serviceIdentity = identityFromEnv(env)
-      const { schemas, bindings } = buildFunctionSchemas(functions, url, functionsFolder)
-      assertLocalBindings(url, bindings)
-      const resolveFunctionIdentity = createFunctionIdentityResolver(env, serviceIdentity)
-
-      app.get('/', (c) => c.json({ ok: true, kind: 'astrale-service' }))
-      app.post(SERVICE_FUNCTIONS_PATH, async (c) => {
-        const parsed = ServiceFunctionDiscoveryRequestSchema.safeParse(
-          await c.req.json().catch(() => null),
-        )
-        if (!parsed.success) {
-          return c.json({ error: 'Invalid service function discovery request' }, 400)
-        }
-        const response = await signServiceFunctionManifest(
-          {
-            version: 1,
-            service: {
-              issuer: serviceIdentity.issuer,
-              subject: serviceIdentity.subject,
-            },
-            functions: toServiceFunctionManifestEntries(schemas),
-          },
-          parsed.data,
-          serviceIdentity,
-        )
-        return c.json(response)
-      })
-
-      mountAuxiliaryRoutes({
-        app,
-        url,
-        remoteFunctions: functions,
-        remoteFunctionBindings: bindings,
-        deps: env,
-        resolveIdentity: (kind, slug) => {
-          if (kind !== 'remoteFunction') {
-            throw new Error(`serviceWorkerEntry cannot resolve ${kind} identity ${slug}`)
-          }
-          return resolveFunctionIdentity(slug)
-        },
-        cors: config.cors ?? { origin: '*' },
-      })
-      return app
-    },
-    resolveUrl: config.resolveUrl ?? ((_env, requestOrigin) => requestOrigin),
-    selfBinding: config.selfBinding,
-    routeSubrequest: config.routeSubrequest,
-  })
-}
-
-function identityFromEnv<TEnv extends ServiceWorkerIdentityEnv>(env: TEnv): RemoteIdentityConfig {
-  return {
-    issuer: required(env, 'IDENTITY_ISS'),
-    subject: required(env, 'IDENTITY_SUB'),
-    privateKey: parsePrivateKey(required(env, 'IDENTITY_PRIVATE_KEY')),
-  }
-}
-
-function createFunctionIdentityResolver<TEnv extends ServiceWorkerIdentityEnv>(
-  env: TEnv,
-  serviceIdentity: RemoteIdentityConfig,
-): (slug: string) => Promise<RemoteIdentityConfig> {
-  const kernelUrl = required(env, 'ASTRALE_KERNEL_AUDIENCE')
-  let cachedAt = 0
-  let identities = new Map<string, { issuer: string; subject: string }>()
-  const ttlMs = 60_000
-
-  return async (slug) => {
-    if (Date.now() - cachedAt >= ttlMs || !identities.has(slug)) {
-      const kernel = await makeFunctionContext(serviceIdentity, env, {
-        ref: 'service',
-        defaultKernelUrl: kernelUrl,
-      }).kernel()
-      const service = await kernel.get(`@${serviceIdentity.subject}`)
-      if (!service) throw new Error(`Service @${serviceIdentity.subject} is not readable`)
-      const folder = await kernel.get(`${service.path.raw}/functions`)
-      const nodes = folder
-        ? await (
-            await kernel.children(folder.path, {
-              classes: [K.$.c('Function').path.class],
-              limit: 500,
-            })
-          ).all()
-        : []
-      identities = readFunctionIdentities(nodes, serviceIdentity.issuer)
-      cachedAt = Date.now()
-    }
-    const identity = identities.get(slug)
-    if (!identity) throw new Error(`Function identity function.${slug} is not registered`)
-    return hostedFunctionIdentity(identity, serviceIdentity)
-  }
-}
-
-/** Reuse only the Service's signing key. A hosted Function's inbound audience
- * defaults to its own issuer; the Service HTTP origin is merely transport. */
-export function hostedFunctionIdentity(
-  identity: { issuer: string; subject: string },
-  serviceIdentity: RemoteIdentityConfig,
-): RemoteIdentityConfig {
-  return { ...identity, privateKey: serviceIdentity.privateKey }
-}
-
-function readFunctionIdentities(
-  nodes: readonly Node[],
-  serviceIssuer: string,
-): Map<string, { issuer: string; subject: string }> {
-  const result = new Map<string, { issuer: string; subject: string }>()
-  for (const node of nodes) {
-    const ref = node.props[K.$.i('Function').ref.key]
-    const issuer = node.props[K.Identity.iss.key]
-    const subject = node.props[K.Identity.sub.key]
-    if (
-      typeof ref !== 'string' ||
-      !ref.startsWith('function.') ||
-      typeof issuer !== 'string' ||
-      typeof subject !== 'string'
-    ) {
-      continue
-    }
-    if (issuer !== serviceIssuer) {
-      throw new Error(`Function ${ref} does not share its hosting Service issuer`)
-    }
-    result.set(ref.slice('function.'.length), { issuer, subject })
-  }
-  return result
-}
-
-function assertLocalBindings(url: string, bindings: Record<string, FunctionBinding>): void {
-  const origin = new URL(url).origin
-  for (const [slug, binding] of Object.entries(bindings)) {
-    if (!binding.remoteUrl || new URL(binding.remoteUrl).origin !== origin) {
-      throw new Error(`serviceWorkerEntry function.${slug} must be hosted by this Service origin`)
-    }
-  }
-}
-
-function required<TEnv extends ServiceWorkerIdentityEnv>(env: TEnv, key: keyof TEnv): string {
-  const value = env[key]
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(`Missing service variable ${String(key)}`)
-  }
-  return value
-}
-
-function parsePrivateKey(value: string): JsonWebKey {
-  let parsed: unknown
-  try {
-    parsed = JSON.parse(value)
-  } catch (error) {
-    throw new Error('IDENTITY_PRIVATE_KEY is not valid JSON', { cause: error })
-  }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error('IDENTITY_PRIVATE_KEY is not a JWK object')
-  }
-  return parsed as JsonWebKey
-}

package/src/server/serving-url.ts

@@ -1,28 +0,0 @@
-/**
- * Canonicalize a worker's serving URL into its `iss` identity.
- *
- * Returns the full URL with trailing slash(es) stripped — the base path is
- * preserved (an issuer may carry a non-empty path, like `…/kernel/host`). This
- * is the single canonical form used for outbound signing, the JWKS issuer,
- * `/meta`, the install credential, and any `Identity.iss` a domain seeds, so the
- * value a worker SIGNS always matches the value the kernel LOOKS UP (the kernel
- * canonicalizes the verified `iss` the same way and does an exact-match lookup).
- *
- * Throws if `url` is not a parseable absolute URL.
- */
-// INVARIANT (cross-repo): issuer PRODUCERS must strip trailing path slashes
-// BEFORE a value becomes an iss. kernel-core's `normalizeIssuerId` only strips
-// a lone trailing slash on an EMPTY path, so `https://x/base/` and
-// `https://x/base` are distinct issuer identities to the kernel — this
-// function and the kernel's `installSourceBase` both pre-strip with the same
-// rule so the two sides can never mint diverging identities for one worker.
-export function canonicalizeServingUrl(url: string): string {
-  try {
-    return new URL(url).href.replace(/\/+$/, '')
-  } catch {
-    throw new Error(
-      `canonicalizeServingUrl: expected a full URL (got "${url}") — ` +
-        'it is the worker serving URL and its JWT issuer identity.',
-    )
-  }
-}

package/src/server/start.ts

@@ -1,42 +0,0 @@
-/**
- * Node HTTP convenience starter.
- *
- * Dynamically imports `@hono/node-server` so the SDK stays runtime-agnostic
- * — only Node consumers actually pull in the dep. For Bun / Deno /
- * Cloudflare, consumers go through `server.app.fetch` directly.
- */
-
-import type { serve as nodeServe } from '@hono/node-server'
-import type { Hono } from 'hono'
-
-import type { RemoteServerHandle } from './handle.js'
-
-export async function startNodeServer(app: Hono, port = 3000): Promise<RemoteServerHandle> {
-  // Opaque specifier: the `./server` barrel re-exports this module, so worker
-  // bundles (wrangler/esbuild) traverse it even though they never call it. A
-  // literal import() would make them resolve the optional peer and fail.
-  const nodeServerModule = '@hono/node-server'
-  const { serve } = (await import(nodeServerModule)) as { serve: typeof nodeServe }
-  // oxlint-disable-next-line no-explicit-any
-  const server = serve({ fetch: app.fetch, port }) as any
-
-  await new Promise<void>((resolve, reject) => {
-    if (server.listening) return resolve()
-    server.once('listening', () => resolve())
-    // Without this, a bind failure (e.g. EADDRINUSE on a busy port) emits
-    // `'error'` and never `'listening'`, leaving the Promise — and startup —
-    // hung forever with no diagnostic.
-    server.once('error', (err: Error) => reject(err))
-  })
-
-  const address = server.address() as { port: number; address: string } | null
-  const actualPort = address?.port ?? port
-
-  return {
-    port: actualPort,
-    close: () =>
-      new Promise<void>((resolve, reject) => {
-        server.close((err: Error | null) => (err ? reject(err) : resolve()))
-      }),
-  }
-}

package/src/server/worker-entry.ts

@@ -1,286 +0,0 @@
-/**
- * `createWorkerEntry` — the shared worker `fetch` plumbing every Astrale domain
- * worker (and the cloudflare adapter's codegen) needs, so it lives in ONE place
- * instead of being copy-pasted per worker:
- *
- *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
- *     what `createRemoteServer` signs with and the kernel pins), and cache the
- *     built app per distinct URL;
- *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
- *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
- *     certain outbound fetches through a caller-supplied binding — `selfBinding`
- *     for same-host fetches (a Worker can't fetch its own hostname), and the
- *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
- *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
- *     backend or topology; the caller owns the predicate + the fetcher;
- *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
- *
- * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
- * route by `createRemoteServer`; the verifier resolves a self-issued credential
- * from the in-memory key (see `auth/verify.ts`), so no self-fetch shim is needed.
- *
- * The worker file is then just schema + methods + a `build(url, env)` callback.
- */
-
-import type { ExecutionContext } from 'hono'
-
-import type { RemoteServerConfig } from './config.js'
-
-import { createRemoteServer } from './create.js'
-import { requireEnv } from './require-env.js'
-import { canonicalizeServingUrl } from './serving-url.js'
-
-export type Fetcher = { fetch(request: Request): Response | Promise<Response> }
-export type WorkerApp = {
-  fetch(
-    request: Request,
-    env?: unknown,
-    executionCtx?: ExecutionContext,
-  ): Response | Promise<Response>
-}
-
-/** A built app cached by its serving URL: `origin` for same-origin matching,
- * `app` for in-process self-dispatch. */
-type CachedApp = { origin: string; app: WorkerApp }
-
-/**
- * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
- * real `fetch` handle it. Order matters and same-origin wins FIRST: a call to
- * this worker's OWN serving origin is a self-dispatch, not an edge fetch — and
- * the caller's `routeSubrequest` policy may itself match our own host (e.g. an
- * `isInstanceHost` predicate matches every `*.svc.astrale.ai`, ours included),
- * so it must never get first look at a same-origin call.
- *
- *   • same-origin + SELF binding present → the SELF fetcher: a fresh same-script
- *     invocation. The normal Cloudflare path — a Worker can't fetch its own
- *     hostname over the edge, so it re-enters itself through the binding.
- *   • same-origin + NO SELF binding → the cached app, dispatched IN-PROCESS. A
- *     Workers-for-Platforms dispatch-namespace tenant can't service-bind to
- *     itself (its script name is platform-renamed), so it has no SELF binding; an
- *     in-process dispatch reaches the same script with no edge hop and no binding.
- *     `App` and the SELF `Fetcher` share the `{ fetch(request) }` shape, so the
- *     caller drives both identically.
- *   • else, the caller's `routeSubrequest` policy matched → its fetcher.
- *   • else → `null`: passthrough to the real network fetch.
- *
- * Pure (no closure over instance state) so the routing decision is unit-testable
- * without standing up a real app.
- */
-export function selectSubrequestTarget<TDeps>(
-  u: URL,
-  ctx: {
-    self: Fetcher | null
-    apps: Iterable<CachedApp>
-    routeEnv: TDeps | null
-    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined
-  },
-): { fetch(request: Request): Response | Promise<Response> } | null {
-  // Same-origin self-subrequest → the same script (SELF binding, else in-process).
-  for (const cached of ctx.apps) {
-    if (cached.origin === u.origin) return ctx.self ?? cached.app
-  }
-  // Caller policy (e.g. a platform router on the same zone) → its fetcher.
-  if (ctx.routeSubrequest && ctx.routeEnv) {
-    const via = ctx.routeSubrequest(u, ctx.routeEnv)
-    if (via) return via
-  }
-  return null
-}
-
-export interface WorkerEntryConfig<TDeps> {
-  /**
-   * Build the `createRemoteServer` config for the resolved serving `url`. Called
-   * once per distinct URL (the resulting app is cached), with the same `env` the
-   * request carries — so it can read additional bindings (e.g. a base domain).
-   */
-  build: (url: string, env: TDeps) => RemoteServerConfig<TDeps>
-  /**
-   * Resolve the raw serving URL from `env` (+ the per-request origin, for workers
-   * that fall back to the request host). Defaults to the `WORKER_URL` env var.
-   * The result is always canonicalized before use.
-   *
-   * The `requestOrigin` honors an `X-Forwarded-Proto: https` upgrade (see
-   * `clientOrigin`), so a dev worker behind a TLS-terminating proxy (cloudflared
-   * tunnel, reverse proxy) resolves its public `https://` origin, not the raw
-   * `http://` one workerd sees.
-   */
-  resolveUrl?: (env: TDeps, requestOrigin: string) => string
-  /** Optional: the `SELF` service binding used to route same-host subrequests. */
-  selfBinding?: (env: TDeps) => Fetcher | null | undefined
-  /**
-   * Optional, vendor-neutral: route an OUTBOUND subrequest through a
-   * caller-supplied fetcher instead of the network — for hosts a Worker can't
-   * reach directly over the edge (e.g. a platform router on the SAME zone:
-   * Cloudflare 522s a same-zone Worker→Worker public `fetch`). Return a `Fetcher`
-   * to route the request through, or null/undefined to fall through to the normal
-   * fetch. The SDK names no backend or topology — the CALLER owns BOTH the
-   * predicate (which hosts) and the fetcher (the binding). This generalizes
-   * `selfBinding` (same-origin → SELF) to any caller policy; both are honored.
-   */
-  routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined
-  /**
-   * Optional: handle a request before it reaches the kernel app — e.g. serve a
-   * SPA under `/ui/*` or a same-origin `/api/*` endpoint the view calls. Return
-   * a `Response` to short-circuit, or `undefined` to fall through to the domain
-   * dispatch.
-   */
-  before?: (
-    env: TDeps,
-    url: URL,
-    request: Request,
-  ) => Response | undefined | Promise<Response | undefined>
-  /**
-   * Optional: transform the request on the fall-through path, just before it
-   * reaches the kernel app (e.g. rewrite the hostname for wildcard-subdomain
-   * routing). Not applied when `before` short-circuits.
-   */
-  rewriteRequest?: (env: TDeps, request: Request) => Request
-}
-
-export interface AppWorkerEntryConfig<TDeps> extends Omit<WorkerEntryConfig<TDeps>, 'build'> {
-  buildApp: (url: string, env: TDeps) => WorkerApp
-}
-
-export interface WorkerEntry<TDeps> {
-  fetch(request: Request, env: TDeps, executionCtx?: ExecutionContext): Response | Promise<Response>
-}
-
-/**
- * The request origin as the CLIENT reached it — i.e. the origin a fallback
- * serving URL (and therefore the `iss`) may be derived from. Behind a
- * TLS-terminating proxy (a cloudflared tunnel in front of `wrangler dev`, any
- * reverse proxy) the worker sees plain HTTP, so `request.url` says `http://…`
- * while the public URL is `https://…`; the proxy advertises the original
- * scheme via `X-Forwarded-Proto`. Honoring it is restricted to the http→https
- * UPGRADE of the SAME host (never a downgrade, never a host change), so a
- * spoofed header can at worst derive an `iss` the kernel's JWKS check then
- * fails — it can never make this worker speak for another origin.
- */
-export function clientOrigin(url: URL, request: Request): string {
-  if (url.protocol !== 'http:') return url.origin
-  const forwarded = request.headers.get('x-forwarded-proto')
-  // Multiple proxies append: "https, http" — the first hop is the client-facing one.
-  const scheme = forwarded?.split(',')[0]?.trim().toLowerCase()
-  return scheme === 'https' ? `https://${url.host}` : url.origin
-}
-
-/**
- * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
- * Assets binding) mounted under `base` (default `/ui`) — the runtime half of an
- * adapter env's client-asset config. Returns `undefined` for non-matching paths
- * (and when no binding is present) so the request falls through to domain dispatch.
- *
- * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
- * this hook strips that prefix before delegating to the binding, so
- * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
- * (local dev), requests are proxied there instead — the seam for a bundler's
- * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
- * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
- * here.
- *
- * Lives here, type-checked and testable, instead of being emitted as a string
- * by every adapter's worker codegen.
- */
-export function assets<TDeps>(opts: {
-  base?: string
-  binding: (env: TDeps) => Fetcher | null | undefined
-  devProxy?: (env: TDeps) => string | null | undefined
-}): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined {
-  const base = (opts.base ?? '/ui').replace(/\/+$/, '')
-  const prefix = `${base}/`
-  return (env, url, request) => {
-    const binding = opts.binding(env)
-    if (!binding) return undefined
-    if (url.pathname !== base && !url.pathname.startsWith(prefix)) return undefined
-    const devUrl = opts.devProxy?.(env)
-    if (devUrl) {
-      const devBase = devUrl.replace(/\/+$/, '')
-      return fetch(new Request(`${devBase}${url.pathname}${url.search}`, request))
-    }
-    // `<base>` → `/`, `<base>/x` → `/x`: serve from the binding's root.
-    const stripped = url.pathname.slice(base.length) || '/'
-    const rewritten = new URL(stripped + url.search, url.origin)
-    return binding.fetch(new Request(rewritten, request))
-  }
-}
-
-export function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps> {
-  return createAppWorkerEntry({
-    ...config,
-    buildApp: (url, env) => createRemoteServer<TDeps>(config.build(url, env)).app,
-  })
-}
-
-export function createAppWorkerEntry<TDeps>(
-  config: AppWorkerEntryConfig<TDeps>,
-): WorkerEntry<TDeps> {
-  // Cache the built app per distinct resolved URL — plural and bounded. On the
-  // request-origin fallback the URL legitimately alternates for one worker
-  // (direct http hits vs https-upgraded tunnel hits, workers.dev + custom
-  // domain), and a single slot would tear down and rebuild the whole app on
-  // every alternation. The bound caps abuse via attacker-minted Host /
-  // X-Forwarded-Proto values on that same fallback path.
-  const MAX_CACHED_APPS = 4
-  const apps = new Map<string, CachedApp>()
-  let self: Fetcher | null = null
-  let routeEnv: TDeps | null = null
-
-  function getApp(url: string, env: TDeps): WorkerApp {
-    const cached = apps.get(url)
-    if (cached) return cached.app
-    const app = config.buildApp(url, env)
-    if (apps.size >= MAX_CACHED_APPS) {
-      const oldest = apps.keys().next().value
-      if (oldest !== undefined) apps.delete(oldest)
-    }
-    apps.set(url, { origin: new URL(url).origin, app })
-    return app
-  }
-
-  // A Worker can't fetch its own hostname over the edge, nor — on Cloudflare — a
-  // same-zone hostname routed to another Worker (the `routeSubrequest` case).
-  // When either is configured, override `globalThis.fetch` to redirect those
-  // subrequests through the right target (see `selectSubrequestTarget`). Workers
-  // with neither selfBinding nor routeSubrequest get no global mutation. (A
-  // self-issued credential's JWKS is resolved in-memory by the verifier, not
-  // fetched — see `auth/verify.ts` — so no self-JWKS shim is needed.)
-  if (config.selfBinding || config.routeSubrequest) {
-    const originalFetch = globalThis.fetch
-    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
-      try {
-        const target = selectSubrequestTarget(new URL(href), {
-          self,
-          apps: apps.values(),
-          routeEnv,
-          routeSubrequest: config.routeSubrequest,
-        })
-        if (target) return target.fetch(new Request(input, init))
-      } catch {
-        // non-absolute URL — fall through to the original fetch
-      }
-      return originalFetch(input, init)
-    }) as typeof fetch
-  }
-
-  return {
-    async fetch(request: Request, env: TDeps, executionCtx?: ExecutionContext): Promise<Response> {
-      if (config.selfBinding) self ??= config.selfBinding(env) ?? null
-      if (config.routeSubrequest) routeEnv = env
-      // Only parse the request URL when a hook actually needs it.
-      const requestUrl = config.before || config.resolveUrl ? new URL(request.url) : null
-      if (config.before && requestUrl) {
-        // Await so an async `before` that resolves to `undefined` falls through
-        // (a returned Promise<undefined> would otherwise be sent as the response).
-        const handled = await config.before(env, requestUrl, request)
-        if (handled !== undefined) return handled
-      }
-      const raw = config.resolveUrl
-        ? config.resolveUrl(env, clientOrigin(requestUrl!, request))
-        : requireEnv(env, 'WORKER_URL', "the worker's public serving URL (its iss identity)")
-      const url = canonicalizeServingUrl(raw)
-      const dispatched = config.rewriteRequest ? config.rewriteRequest(env, request) : request
-      return getApp(url, env).fetch(dispatched, env, executionCtx)
-    },
-  }
-}