@astrale-os/sdk 0.4.19 → 0.5.0-beta.1

package/dist/server/domain-entry.d.ts

@@ -1,77 +0,0 @@
-/**
- * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
- *
- * It folds the three steps every hand-rolled worker used to wire by hand —
- * compile the runtime domain (`defineRemoteDomain`), build the server
- * (`createRemoteServer`), and wrap it in the shared fetch plumbing
- * (`createWorkerEntry`) — into a single declaration. The author passes the raw
- * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
- * deploy bits; the helper does the rest. This is what the cloudflare adapter's
- * codegen emits, and the recommended surface for a hand-rolled worker.
- *
- * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
- * `@astrale-os/sdk/domain`) only when the worker needs something this config
- * can't express — e.g. a serving-URL-dependent domain build (views stamped with
- * the live url) or a globally-injected signing key resolved per request.
- */
-import type { Core, Schema } from '@astrale-os/kernel-dsl';
-import type { Hono } from 'hono';
-import type { DomainManifest } from '../config/define-domain.js';
-import type { AnyRemoteFunctionDef, ViewDef } from '../define/index.js';
-import type { SchemaMethodsImpl } from '../method/index.js';
-import type { RemoteServerConfig } from './config.js';
-import type { WorkerEntry, WorkerEntryConfig } from './worker-entry.js';
-export interface DomainWorkerEntryConfig<S extends Schema, TEnv, TDeps> {
-    /** The domain schema. */
-    schema: S;
-    /** Method implementations, typed against `schema` under `TDeps`. */
-    methods: SchemaMethodsImpl<S, TDeps>;
-    /** Optional Core override (extra genesis nodes / wiring). */
-    core?: Core<S>;
-    /** Views (iframe-mountable UIs) keyed by slug. */
-    views?: Record<string, ViewDef<TDeps>>;
-    /** Standalone Functions (callables not bound to a class) keyed by slug. */
-    functions?: Record<string, AnyRemoteFunctionDef>;
-    /**
-     * The worker's signing key (its `iss` identity material). A static JWK, or a
-     * resolver from `env` for keys injected as a secret / shared globally.
-     */
-    privateKey: JsonWebKey | ((env: TEnv) => JsonWebKey);
-    /** Cross-domain deps by origin — verified present at install. */
-    requires?: readonly string[];
-    /** Typed colon-path the kernel calls once as __SYSTEM__ after install. */
-    postInstall?: string;
-    /**
-     * Physical tree path for the Domain node (absolute, e.g. `/domains/acme`);
-     * default `/domains/<origin>`. Rides in on the `...domain` spread from
-     * `defineDomain`; declared here so it is captured (not silently dropped like a
-     * spread prop absent from this type) and forwarded to `defineRemoteDomain`.
-     */
-    path?: string;
-    /** Provenance stamped on `/meta`. */
-    meta?: RemoteServerConfig<TDeps>['meta'];
-    /** Presentation metadata (logo / initial view) stamped on `/meta`. */
-    manifest?: DomainManifest;
-    /**
-     * Map the worker `env` to the handler dependency container. Defaults to
-     * passing `env` straight through (the common case where handlers read
-     * bindings directly).
-     */
-    deps?: (env: TEnv, url: string) => TDeps;
-    /** Optional pre-built host Hono app (CORS / logging / extra routes). */
-    app?: (env: TEnv) => Hono;
-    resolveUrl?: WorkerEntryConfig<TEnv>['resolveUrl'];
-    selfBinding?: WorkerEntryConfig<TEnv>['selfBinding'];
-    routeSubrequest?: WorkerEntryConfig<TEnv>['routeSubrequest'];
-    before?: WorkerEntryConfig<TEnv>['before'];
-    rewriteRequest?: WorkerEntryConfig<TEnv>['rewriteRequest'];
-}
-/**
- * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
- * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
- * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
- * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
- * handler deps differ from the worker bindings and a `deps` mapper is supplied.
- */
-export declare function domainWorkerEntry<TEnv, TDeps = TEnv>(): <S extends Schema>(config: DomainWorkerEntryConfig<S, TEnv, TDeps>) => WorkerEntry<TEnv>;
-//# sourceMappingURL=domain-entry.d.ts.map

package/dist/server/domain-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-entry.d.ts","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAKvE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,KAAK;IACpE,yBAAyB;IACzB,MAAM,EAAE,CAAC,CAAA;IACT,oEAAoE;IACpE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEhD;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC,CAAA;IACpD,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;IACxC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAA;IAGzB,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,WAAW,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAA;IACpD,eAAe,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,MAAM,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,cAAc,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,MACjC,CAAC,SAAS,MAAM,UACvB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAC9C,WAAW,CAAC,IAAI,CAAC,CAmCrB"}

package/dist/server/domain-entry.js

@@ -1,60 +0,0 @@
-/**
- * `domainWorkerEntry` — the one-call worker entry for a standalone domain.
- *
- * It folds the three steps every hand-rolled worker used to wire by hand —
- * compile the runtime domain (`defineRemoteDomain`), build the server
- * (`createRemoteServer`), and wrap it in the shared fetch plumbing
- * (`createWorkerEntry`) — into a single declaration. The author passes the raw
- * modules (`schema` / `methods` / `views` / `functions`) plus the identity and
- * deploy bits; the helper does the rest. This is what the cloudflare adapter's
- * codegen emits, and the recommended surface for a hand-rolled worker.
- *
- * Drop down to `createWorkerEntry` + `defineRemoteDomain` (from
- * `@astrale-os/sdk/domain`) only when the worker needs something this config
- * can't express — e.g. a serving-URL-dependent domain build (views stamped with
- * the live url) or a globally-injected signing key resolved per request.
- */
-import { defineRemoteDomain } from '../domain/index.js';
-import { createWorkerEntry } from './worker-entry.js';
-/**
- * Curried so `TDeps` can be fixed explicitly (it types `methods`/`views`) while
- * `S` is inferred from `schema` — mirroring `defineRemoteDomain`. The common
- * case `domainWorkerEntry<Env>()({ … })` leaves `TDeps = TEnv` (handlers read
- * the env directly); pass both — `domainWorkerEntry<Env, Deps>()` — when the
- * handler deps differ from the worker bindings and a `deps` mapper is supplied.
- */
-export function domainWorkerEntry() {
-    return function (config) {
-        const domain = defineRemoteDomain()({
-            schema: config.schema,
-            methods: config.methods,
-            ...(config.core ? { core: config.core } : {}),
-            ...(config.views ? { views: config.views } : {}),
-            ...(config.functions ? { remoteFunctions: config.functions } : {}),
-            ...(config.manifest ? { manifest: config.manifest } : {}),
-            ...(config.path ? { path: config.path } : {}),
-        });
-        return createWorkerEntry({
-            ...(config.resolveUrl ? { resolveUrl: config.resolveUrl } : {}),
-            ...(config.selfBinding ? { selfBinding: config.selfBinding } : {}),
-            ...(config.routeSubrequest ? { routeSubrequest: config.routeSubrequest } : {}),
-            ...(config.before ? { before: config.before } : {}),
-            ...(config.rewriteRequest ? { rewriteRequest: config.rewriteRequest } : {}),
-            // `createWorkerEntry` conflates the worker env and the handler deps into a
-            // single type param; we keep them distinct in the public config and bridge
-            // here. The runtime deps (and the methods typed against them) are correct;
-            // only this assembly is cast.
-            build: (url, env) => ({
-                domain,
-                deps: config.deps ? config.deps(env, url) : env,
-                url,
-                privateKey: typeof config.privateKey === 'function' ? config.privateKey(env) : config.privateKey,
-                ...(config.requires && config.requires.length > 0 ? { requires: config.requires } : {}),
-                ...(config.postInstall ? { postInstall: config.postInstall } : {}),
-                ...(config.meta ? { meta: config.meta } : {}),
-                ...(config.app ? { app: config.app(env) } : {}),
-            }),
-        });
-    };
-}
-//# sourceMappingURL=domain-entry.js.map

package/dist/server/domain-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-entry.js","sourceRoot":"","sources":["../../src/server/domain-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAoDrD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UACL,MAA+C;QAE/C,MAAM,MAAM,GAAG,kBAAkB,EAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAA;QAEF,OAAO,iBAAiB,CAAO;YAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,8BAA8B;YAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAClB,CAAC;gBACC,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,GAAwB;gBACrE,GAAG;gBACH,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;gBACtF,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAwC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/server/handle.d.ts

@@ -1,35 +0,0 @@
-/**
- * `RemoteServer` and `RemoteServerHandle` — output shapes for the SDK server.
- *
- * `RemoteServer` is what `createRemoteServer` returns: the assembled Hono
- * app plus a Node convenience helper. `RemoteServerHandle` is what `start()`
- * resolves to: the bound port and a `close()` function for graceful shutdown.
- */
-import type { Hono } from 'hono';
-export type RemoteServer = {
-    /**
-     * The assembled Hono app. Use `app.fetch` for any runtime
-     * (Bun, Deno, Cloudflare Workers, or Node via `@hono/node-server`).
-     */
-    app: Hono;
-    /**
-     * The worker's canonical serving URL — its `iss` identity (full URL, trailing
-     * slash stripped, base path preserved). The single value the dispatcher signs
-     * with and the kernel pins. Read it to seed `Identity.iss` on graph nodes so
-     * the seeded value matches the signing issuer (never re-derive from a raw env).
-     */
-    iss: string;
-    /**
-     * Convenience helper: start a Node HTTP server on the given port using
-     * `@hono/node-server` (loaded via dynamic import). For other runtimes,
-     * use `app.fetch` directly.
-     */
-    start: (port?: number) => Promise<RemoteServerHandle>;
-};
-export type RemoteServerHandle = {
-    /** The port the server is listening on (resolved even if `port: 0` was requested). */
-    port: number;
-    /** Stop the server and release the port. */
-    close: () => Promise<void>;
-};
-//# sourceMappingURL=handle.d.ts.map

package/dist/server/handle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../src/server/handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,GAAG,EAAE,IAAI,CAAA;IACT;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA"}

package/dist/server/handle.js

@@ -1,9 +0,0 @@
-/**
- * `RemoteServer` and `RemoteServerHandle` — output shapes for the SDK server.
- *
- * `RemoteServer` is what `createRemoteServer` returns: the assembled Hono
- * app plus a Node convenience helper. `RemoteServerHandle` is what `start()`
- * resolves to: the bound port and a `close()` function for graceful shutdown.
- */
-export {};
-//# sourceMappingURL=handle.js.map

package/dist/server/handle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../src/server/handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/server/jwks.d.ts

@@ -1,11 +0,0 @@
-/**
- * Derive a public JWK from a private one.
- *
- * Strips the private components for both EC keys (drops `d`) and RSA keys
- * (drops `d`, `p`, `q`, `dp`, `dq`, `qi`, and `oth` — the additional-primes
- * array on multi-prime RSA keys). The result is safe to publish at
- * `<url>/.well-known/jwks.json` so downstream verifiers can validate
- * signatures the server produced.
- */
-export declare function derivePublicJwk(privateKey: JsonWebKey): Record<string, unknown>;
-//# sourceMappingURL=jwks.d.ts.map

package/dist/server/jwks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/server/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO/E"}

package/dist/server/jwks.js

@@ -1,15 +0,0 @@
-/**
- * Derive a public JWK from a private one.
- *
- * Strips the private components for both EC keys (drops `d`) and RSA keys
- * (drops `d`, `p`, `q`, `dp`, `dq`, `qi`, and `oth` — the additional-primes
- * array on multi-prime RSA keys). The result is safe to publish at
- * `<url>/.well-known/jwks.json` so downstream verifiers can validate
- * signatures the server produced.
- */
-export function derivePublicJwk(privateKey) {
-    // oxlint-disable-next-line no-unused-vars
-    const { d, p, q, dp, dq, qi, oth, ...publicJwk } = privateKey;
-    return publicJwk;
-}
-//# sourceMappingURL=jwks.js.map

package/dist/server/jwks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../src/server/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,eAAe,CAAC,UAAsB;IACpD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,UAGlD,CAAA;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/server/require-env.d.ts

@@ -1,15 +0,0 @@
-/**
- * Read a string-typed env var (process.env on Node, the Worker `env` binding
- * on Cloudflare) and throw a clear error if it is missing or empty.
- *
- * Use this for **identity-bearing** values (issuer, baseDomain, audience,
- * worker URL) where a guessed default silently mints wrong JWTs or bakes
- * wrong refs into persisted artifacts. The conventional `?? 'literal'`
- * fallback is the anti-pattern this exists to replace.
- *
- * In local dev these live in each domain worker's `worker/.dev.vars` (read
- * natively by `wrangler dev`), so this throw never fires in a properly-prepared
- * dev environment — only when wiring is genuinely missing.
- */
-export declare function requireEnv(env: unknown, name: string, hint?: string): string;
-//# sourceMappingURL=require-env.d.ts.map

package/dist/server/require-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-env.d.ts","sourceRoot":"","sources":["../../src/server/require-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5E"}

package/dist/server/require-env.js

@@ -1,21 +0,0 @@
-/**
- * Read a string-typed env var (process.env on Node, the Worker `env` binding
- * on Cloudflare) and throw a clear error if it is missing or empty.
- *
- * Use this for **identity-bearing** values (issuer, baseDomain, audience,
- * worker URL) where a guessed default silently mints wrong JWTs or bakes
- * wrong refs into persisted artifacts. The conventional `?? 'literal'`
- * fallback is the anti-pattern this exists to replace.
- *
- * In local dev these live in each domain worker's `worker/.dev.vars` (read
- * natively by `wrangler dev`), so this throw never fires in a properly-prepared
- * dev environment — only when wiring is genuinely missing.
- */
-export function requireEnv(env, name, hint) {
-    const v = env?.[name];
-    if (typeof v === 'string' && v.length > 0)
-        return v;
-    const help = hint ? ` (${hint})` : '';
-    throw new Error(`Missing required env var: ${name}${help}`);
-}
-//# sourceMappingURL=require-env.js.map

package/dist/server/require-env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-env.js","sourceRoot":"","sources":["../../src/server/require-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,IAAY,EAAE,IAAa;IAClE,MAAM,CAAC,GAAI,GAAkD,EAAE,CAAC,IAAI,CAAC,CAAA;IACrE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;AAC7D,CAAC"}

package/dist/server/service-entry.d.ts

@@ -1,32 +0,0 @@
-import type { CorsConfig } from '@astrale-os/kernel-server';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-import type { AnyRemoteFunctionDef } from '../define/remote-function.js';
-import type { Fetcher, WorkerEntry } from './worker-entry.js';
-export interface ServiceWorkerIdentityEnv {
-    IDENTITY_ISS?: string;
-    IDENTITY_SUB?: string;
-    IDENTITY_PRIVATE_KEY?: string;
-    ASTRALE_KERNEL_AUDIENCE?: string;
-}
-export interface ServiceWorkerEntryConfig<TEnv extends ServiceWorkerIdentityEnv> {
-    functions?: Record<string, AnyRemoteFunctionDef>;
-    functionsFolder?: string;
-    cors?: CorsConfig;
-    resolveUrl?: (env: TEnv, requestOrigin: string) => string;
-    selfBinding?: (env: TEnv) => Fetcher | null | undefined;
-    routeSubrequest?: (url: URL, env: TEnv) => Fetcher | null | undefined;
-}
-/** A Service worker with zero or more first-class kernel Functions.
- *
- * The function map is the only declaration: it drives both HTTP routes and the
- * signed deploy-time manifest. Function identities are read lazily from the
- * graph after Services has reconciled them, while every Function reuses the
- * Service's one private signing key. */
-export declare function serviceWorkerEntry<TEnv extends ServiceWorkerIdentityEnv>(config: ServiceWorkerEntryConfig<TEnv>): WorkerEntry<TEnv>;
-/** Reuse only the Service's signing key. A hosted Function's inbound audience
- * defaults to its own issuer; the Service HTTP origin is merely transport. */
-export declare function hostedFunctionIdentity(identity: {
-    issuer: string;
-    subject: string;
-}, serviceIdentity: RemoteIdentityConfig): RemoteIdentityConfig;
-//# sourceMappingURL=service-entry.d.ts.map

package/dist/server/service-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-entry.d.ts","sourceRoot":"","sources":["../../src/server/service-entry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAK3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAa7D,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,wBAAwB,CAAC,IAAI,SAAS,wBAAwB;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAChD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACvD,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACtE;AAED;;;;;wCAKwC;AACxC,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,wBAAwB,EACtE,MAAM,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACrC,WAAW,CAAC,IAAI,CAAC,CAuDnB;AA6CD;8EAC8E;AAC9E,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,EAAE,oBAAoB,GACpC,oBAAoB,CAEtB"}

package/dist/server/service-entry.js

@@ -1,150 +0,0 @@
-import { K } from '@astrale-os/kernel-core';
-import { Hono } from 'hono';
-import { makeFunctionContext } from '../auth/function-context.js';
-import { buildFunctionSchemas, DEFAULT_FUNCTIONS_FOLDER } from '../domain/extend-functions.js';
-import { SERVICE_FUNCTIONS_PATH, ServiceFunctionDiscoveryRequestSchema, signServiceFunctionManifest, toServiceFunctionManifestEntries, } from '../service/functions.js';
-import { mountAuxiliaryRoutes } from './auxiliary-routes.js';
-import { createAppWorkerEntry } from './worker-entry.js';
-/** A Service worker with zero or more first-class kernel Functions.
- *
- * The function map is the only declaration: it drives both HTTP routes and the
- * signed deploy-time manifest. Function identities are read lazily from the
- * graph after Services has reconciled them, while every Function reuses the
- * Service's one private signing key. */
-export function serviceWorkerEntry(config) {
-    const functions = config.functions ?? {};
-    const functionsFolder = config.functionsFolder ?? DEFAULT_FUNCTIONS_FOLDER;
-    return createAppWorkerEntry({
-        buildApp: (url, env) => {
-            const app = new Hono();
-            const serviceIdentity = identityFromEnv(env);
-            const { schemas, bindings } = buildFunctionSchemas(functions, url, functionsFolder);
-            assertLocalBindings(url, bindings);
-            const resolveFunctionIdentity = createFunctionIdentityResolver(env, serviceIdentity);
-            app.get('/', (c) => c.json({ ok: true, kind: 'astrale-service' }));
-            app.post(SERVICE_FUNCTIONS_PATH, async (c) => {
-                const parsed = ServiceFunctionDiscoveryRequestSchema.safeParse(await c.req.json().catch(() => null));
-                if (!parsed.success) {
-                    return c.json({ error: 'Invalid service function discovery request' }, 400);
-                }
-                const response = await signServiceFunctionManifest({
-                    version: 1,
-                    service: {
-                        issuer: serviceIdentity.issuer,
-                        subject: serviceIdentity.subject,
-                    },
-                    functions: toServiceFunctionManifestEntries(schemas),
-                }, parsed.data, serviceIdentity);
-                return c.json(response);
-            });
-            mountAuxiliaryRoutes({
-                app,
-                url,
-                remoteFunctions: functions,
-                remoteFunctionBindings: bindings,
-                deps: env,
-                resolveIdentity: (kind, slug) => {
-                    if (kind !== 'remoteFunction') {
-                        throw new Error(`serviceWorkerEntry cannot resolve ${kind} identity ${slug}`);
-                    }
-                    return resolveFunctionIdentity(slug);
-                },
-                cors: config.cors ?? { origin: '*' },
-            });
-            return app;
-        },
-        resolveUrl: config.resolveUrl ?? ((_env, requestOrigin) => requestOrigin),
-        selfBinding: config.selfBinding,
-        routeSubrequest: config.routeSubrequest,
-    });
-}
-function identityFromEnv(env) {
-    return {
-        issuer: required(env, 'IDENTITY_ISS'),
-        subject: required(env, 'IDENTITY_SUB'),
-        privateKey: parsePrivateKey(required(env, 'IDENTITY_PRIVATE_KEY')),
-    };
-}
-function createFunctionIdentityResolver(env, serviceIdentity) {
-    const kernelUrl = required(env, 'ASTRALE_KERNEL_AUDIENCE');
-    let cachedAt = 0;
-    let identities = new Map();
-    const ttlMs = 60_000;
-    return async (slug) => {
-        if (Date.now() - cachedAt >= ttlMs || !identities.has(slug)) {
-            const kernel = await makeFunctionContext(serviceIdentity, env, {
-                ref: 'service',
-                defaultKernelUrl: kernelUrl,
-            }).kernel();
-            const service = await kernel.get(`@${serviceIdentity.subject}`);
-            if (!service)
-                throw new Error(`Service @${serviceIdentity.subject} is not readable`);
-            const folder = await kernel.get(`${service.path.raw}/functions`);
-            const nodes = folder
-                ? await (await kernel.children(folder.path, {
-                    classes: [K.$.c('Function').path.class],
-                    limit: 500,
-                })).all()
-                : [];
-            identities = readFunctionIdentities(nodes, serviceIdentity.issuer);
-            cachedAt = Date.now();
-        }
-        const identity = identities.get(slug);
-        if (!identity)
-            throw new Error(`Function identity function.${slug} is not registered`);
-        return hostedFunctionIdentity(identity, serviceIdentity);
-    };
-}
-/** Reuse only the Service's signing key. A hosted Function's inbound audience
- * defaults to its own issuer; the Service HTTP origin is merely transport. */
-export function hostedFunctionIdentity(identity, serviceIdentity) {
-    return { ...identity, privateKey: serviceIdentity.privateKey };
-}
-function readFunctionIdentities(nodes, serviceIssuer) {
-    const result = new Map();
-    for (const node of nodes) {
-        const ref = node.props[K.$.i('Function').ref.key];
-        const issuer = node.props[K.Identity.iss.key];
-        const subject = node.props[K.Identity.sub.key];
-        if (typeof ref !== 'string' ||
-            !ref.startsWith('function.') ||
-            typeof issuer !== 'string' ||
-            typeof subject !== 'string') {
-            continue;
-        }
-        if (issuer !== serviceIssuer) {
-            throw new Error(`Function ${ref} does not share its hosting Service issuer`);
-        }
-        result.set(ref.slice('function.'.length), { issuer, subject });
-    }
-    return result;
-}
-function assertLocalBindings(url, bindings) {
-    const origin = new URL(url).origin;
-    for (const [slug, binding] of Object.entries(bindings)) {
-        if (!binding.remoteUrl || new URL(binding.remoteUrl).origin !== origin) {
-            throw new Error(`serviceWorkerEntry function.${slug} must be hosted by this Service origin`);
-        }
-    }
-}
-function required(env, key) {
-    const value = env[key];
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`Missing service variable ${String(key)}`);
-    }
-    return value;
-}
-function parsePrivateKey(value) {
-    let parsed;
-    try {
-        parsed = JSON.parse(value);
-    }
-    catch (error) {
-        throw new Error('IDENTITY_PRIVATE_KEY is not valid JSON', { cause: error });
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('IDENTITY_PRIVATE_KEY is not a JWK object');
-    }
-    return parsed;
-}
-//# sourceMappingURL=service-entry.js.map

package/dist/server/service-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-entry.js","sourceRoot":"","sources":["../../src/server/service-entry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,yBAAyB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAkBxD;;;;;wCAKwC;AACxC,MAAM,UAAU,kBAAkB,CAChC,MAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAA;IACxC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,wBAAwB,CAAA;IAE1E,OAAO,oBAAoB,CAAO;QAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YACnF,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAClC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAEpF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;YAClE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3C,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC5D,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACrC,CAAA;gBACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;oBACE,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE;wBACP,MAAM,EAAE,eAAe,CAAC,MAAM;wBAC9B,OAAO,EAAE,eAAe,CAAC,OAAO;qBACjC;oBACD,SAAS,EAAE,gCAAgC,CAAC,OAAO,CAAC;iBACrD,EACD,MAAM,CAAC,IAAI,EACX,eAAe,CAChB,CAAA;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,oBAAoB,CAAC;gBACnB,GAAG;gBACH,GAAG;gBACH,eAAe,EAAE,SAAS;gBAC1B,sBAAsB,EAAE,QAAQ;gBAChC,IAAI,EAAE,GAAG;gBACT,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAA;oBAC/E,CAAC;oBACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAA;gBACtC,CAAC;gBACD,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;QACzE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAwC,GAAS;IACvE,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QACrC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QACtC,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;KACnE,CAAA;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,GAAS,EACT,eAAqC;IAErC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IAC1D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,UAAU,GAAG,IAAI,GAAG,EAA+C,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,CAAA;IAEpB,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE,GAAG,EAAE;gBAC7D,GAAG,EAAE,SAAS;gBACd,gBAAgB,EAAE,SAAS;aAC5B,CAAC,CAAC,MAAM,EAAE,CAAA;YACX,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,eAAe,CAAC,OAAO,kBAAkB,CAAC,CAAA;YACpF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,MAAM;gBAClB,CAAC,CAAC,MAAM,CACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;oBACjC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,GAAG;iBACX,CAAC,CACH,CAAC,GAAG,EAAE;gBACT,CAAC,CAAC,EAAE,CAAA;YACN,UAAU,GAAG,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,oBAAoB,CAAC,CAAA;QACtF,OAAO,sBAAsB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC1D,CAAC,CAAA;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,sBAAsB,CACpC,QAA6C,EAC7C,eAAqC;IAErC,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAsB,EACtB,aAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+C,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9C,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC5B,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAO,OAAO,KAAK,QAAQ,EAC3B,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,4CAA4C,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,QAAyC;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,wCAAwC,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAwC,GAAS,EAAE,GAAe;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,MAAoB,CAAA;AAC7B,CAAC"}

package/dist/server/serving-url.d.ts

@@ -1,14 +0,0 @@
-/**
- * Canonicalize a worker's serving URL into its `iss` identity.
- *
- * Returns the full URL with trailing slash(es) stripped — the base path is
- * preserved (an issuer may carry a non-empty path, like `…/kernel/host`). This
- * is the single canonical form used for outbound signing, the JWKS issuer,
- * `/meta`, the install credential, and any `Identity.iss` a domain seeds, so the
- * value a worker SIGNS always matches the value the kernel LOOKS UP (the kernel
- * canonicalizes the verified `iss` the same way and does an exact-match lookup).
- *
- * Throws if `url` is not a parseable absolute URL.
- */
-export declare function canonicalizeServingUrl(url: string): string;
-//# sourceMappingURL=serving-url.d.ts.map

package/dist/server/serving-url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serving-url.d.ts","sourceRoot":"","sources":["../../src/server/serving-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS1D"}

package/dist/server/serving-url.js

@@ -1,28 +0,0 @@
-/**
- * Canonicalize a worker's serving URL into its `iss` identity.
- *
- * Returns the full URL with trailing slash(es) stripped — the base path is
- * preserved (an issuer may carry a non-empty path, like `…/kernel/host`). This
- * is the single canonical form used for outbound signing, the JWKS issuer,
- * `/meta`, the install credential, and any `Identity.iss` a domain seeds, so the
- * value a worker SIGNS always matches the value the kernel LOOKS UP (the kernel
- * canonicalizes the verified `iss` the same way and does an exact-match lookup).
- *
- * Throws if `url` is not a parseable absolute URL.
- */
-// INVARIANT (cross-repo): issuer PRODUCERS must strip trailing path slashes
-// BEFORE a value becomes an iss. kernel-core's `normalizeIssuerId` only strips
-// a lone trailing slash on an EMPTY path, so `https://x/base/` and
-// `https://x/base` are distinct issuer identities to the kernel — this
-// function and the kernel's `installSourceBase` both pre-strip with the same
-// rule so the two sides can never mint diverging identities for one worker.
-export function canonicalizeServingUrl(url) {
-    try {
-        return new URL(url).href.replace(/\/+$/, '');
-    }
-    catch {
-        throw new Error(`canonicalizeServingUrl: expected a full URL (got "${url}") — ` +
-            'it is the worker serving URL and its JWT issuer identity.');
-    }
-}
-//# sourceMappingURL=serving-url.js.map

package/dist/server/serving-url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serving-url.js","sourceRoot":"","sources":["../../src/server/serving-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,4EAA4E;AAC5E,+EAA+E;AAC/E,mEAAmE;AACnE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qDAAqD,GAAG,OAAO;YAC7D,2DAA2D,CAC9D,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/server/start.d.ts

@@ -1,11 +0,0 @@
-/**
- * Node HTTP convenience starter.
- *
- * Dynamically imports `@hono/node-server` so the SDK stays runtime-agnostic
- * — only Node consumers actually pull in the dep. For Bun / Deno /
- * Cloudflare, consumers go through `server.app.fetch` directly.
- */
-import type { Hono } from 'hono';
-import type { RemoteServerHandle } from './handle.js';
-export declare function startNodeServer(app: Hono, port?: number): Promise<RemoteServerHandle>;
-//# sourceMappingURL=start.d.ts.map

package/dist/server/start.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/server/start.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,wBAAsB,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,SAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4BzF"}

package/dist/server/start.js

@@ -1,34 +0,0 @@
-/**
- * Node HTTP convenience starter.
- *
- * Dynamically imports `@hono/node-server` so the SDK stays runtime-agnostic
- * — only Node consumers actually pull in the dep. For Bun / Deno /
- * Cloudflare, consumers go through `server.app.fetch` directly.
- */
-export async function startNodeServer(app, port = 3000) {
-    // Opaque specifier: the `./server` barrel re-exports this module, so worker
-    // bundles (wrangler/esbuild) traverse it even though they never call it. A
-    // literal import() would make them resolve the optional peer and fail.
-    const nodeServerModule = '@hono/node-server';
-    const { serve } = (await import(nodeServerModule));
-    // oxlint-disable-next-line no-explicit-any
-    const server = serve({ fetch: app.fetch, port });
-    await new Promise((resolve, reject) => {
-        if (server.listening)
-            return resolve();
-        server.once('listening', () => resolve());
-        // Without this, a bind failure (e.g. EADDRINUSE on a busy port) emits
-        // `'error'` and never `'listening'`, leaving the Promise — and startup —
-        // hung forever with no diagnostic.
-        server.once('error', (err) => reject(err));
-    });
-    const address = server.address();
-    const actualPort = address?.port ?? port;
-    return {
-        port: actualPort,
-        close: () => new Promise((resolve, reject) => {
-            server.close((err) => (err ? reject(err) : resolve()));
-        }),
-    };
-}
-//# sourceMappingURL=start.js.map

package/dist/server/start.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/server/start.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAS,EAAE,IAAI,GAAG,IAAI;IAC1D,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAgC,CAAA;IACjF,2CAA2C;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAQ,CAAA;IAEvD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,OAAO,EAAE,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QACzC,sEAAsE;QACtE,yEAAyE;QACzE,mCAAmC;QACnC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAA8C,CAAA;IAC5E,MAAM,UAAU,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;IAExC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC;KACL,CAAA;AACH,CAAC"}