@base44-preview/cli 0.1.32-pr.664.89779c9 → 0.1.32-pr.665.1a74073

package/dist/cli/index.js

@@ -228838,7 +228838,7 @@ function normalizeBase44Env() {
 loadProjectEnvFiles();
 
 // src/cli/index.ts
-import { dirname as dirname29, join as join40 } from "node:path";
+import { dirname as dirname30, join as join40 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // ../../node_modules/@clack/core/dist/index.mjs
@@ -246963,7 +246963,8 @@ async function resolveBuildTarget(projectRoot, overrides = {}) {
     outputDir: resolve6(root, overrides.outputDir ?? site.outputDirectory ?? DEFAULT_SITE.outputDirectory),
     entitiesDir: project?.entitiesDir ?? "entities",
     agentsDir: project?.agentsDir ?? "agents",
-    functionsDir: project?.functionsDir ?? "functions"
+    functionsDir: project?.functionsDir ?? "functions",
+    actorsDir: project?.actorsDir ?? "actors"
   };
 }
 async function readSettingsIfPresent(projectRoot) {
@@ -250792,6 +250793,25 @@ function declaredBundle({
     }
   };
 }
+function declaredActor({
+  name,
+  entry,
+  source,
+  size,
+  digest,
+  staticEgress
+}) {
+  return {
+    name,
+    entry,
+    source,
+    module: { size, digest },
+    static_egress: staticEgress
+  };
+}
+function actorUploadPath(actor) {
+  return `actors/${actor.name}.mjs`;
+}
 function declaredServingConfig(config) {
   const stated = {
     html_handling: config?.htmlHandling ?? null,
@@ -250846,6 +250866,7 @@ async function createVersion(artifacts, options = {}) {
       }
     } : {},
     backend_bundles: artifacts.backendBundles.map(declaredBundle),
+    actors: artifacts.actors.map(declaredActor),
     entities: artifacts.entities,
     agents: artifacts.agents,
     source_commit: options.sourceCommit
@@ -250854,7 +250875,8 @@ async function createVersion(artifacts, options = {}) {
     ...artifacts.assets,
     ...artifacts.siteWorker?.modules ?? []
   ];
-  const slotCount = declaredFiles.length + artifacts.backendBundles.length;
+  const actorsAt = declaredFiles.length + artifacts.backendBundles.length;
+  const slotCount = actorsAt + artifacts.actors.length;
   options.progress?.onDeclared?.({ fileCount: slotCount });
   if (declared.uploads.length !== slotCount) {
     throw new InternalError(`Declared ${slotCount} files but the server signed ${declared.uploads.length} upload URLs.`);
@@ -250863,12 +250885,18 @@ async function createVersion(artifacts, options = {}) {
   if (drifted !== -1) {
     throw new InternalError(`Upload ${drifted} is signed for ${declared.uploads[drifted].path}, but that slot declared ${declaredFiles[drifted].path}.`);
   }
+  const actorDrifted = artifacts.actors.findIndex((actor, index) => declared.uploads[actorsAt + index].path !== actorUploadPath(actor));
+  if (actorDrifted !== -1) {
+    throw new InternalError(`Upload ${actorsAt + actorDrifted} is signed for ${declared.uploads[actorsAt + actorDrifted].path}, but that slot declared the actor ${artifacts.actors[actorDrifted].name}.`);
+  }
   let uploadedFiles = 0;
   await pMap(declared.uploads, async (upload, index) => {
     if (index < declaredFiles.length) {
       await putPresigned(upload, declaredFiles[index].absolutePath);
-    } else {
+    } else if (index < actorsAt) {
       await putPresignedBody(upload, artifacts.backendBundles[index - declaredFiles.length].module);
+    } else {
+      await putPresignedBody(upload, artifacts.actors[index - actorsAt].module);
     }
     uploadedFiles++;
     options.progress?.onUpload?.({
@@ -250886,11 +250914,10 @@ async function setEnvironmentVersion(environment, versionId, options = {}) {
 }
 // src/core/version/artifacts.ts
 import { createHash as createHash3 } from "node:crypto";
-import { join as join29, resolve as resolve13 } from "node:path";
+import { join as join29, resolve as resolve14 } from "node:path";
 
-// src/core/version/functions.ts
-import { createHash as createHash2 } from "node:crypto";
-import { relative as relative6 } from "node:path";
+// src/core/version/actors.ts
+import { dirname as dirname22, relative as relative7, resolve as resolve13 } from "node:path";
 
 // ../functions-compiler/src/assembly.ts
 import path17 from "node:path";
@@ -256424,6 +256451,18 @@ function consolePatch(runtimeSecrets) {
   return runtimeSecrets ? `${CONSOLE_PATCH}
 ${RUNTIME_SECRETS_RESERVED_PATCH}` : CONSOLE_PATCH;
 }
+async function prepareFunction(entry, files, postResponseTelemetry = false, runtimeSecrets = false) {
+  assertNoReservedFilenames(files);
+  return {
+    entry: ENTRY_FILENAME,
+    files: {
+      ...userFiles(files),
+      ...workerRuntimeFiles(),
+      ...runtimeSecrets ? { [ACTIVATION_FILENAME]: activationShimSource() } : {},
+      [ENTRY_FILENAME]: buildEntrySource(entry, postResponseTelemetry, runtimeSecrets)
+    }
+  };
+}
 var BANNER_FORMAT = 1;
 function buildBanner(entries, telemetry, runtimeSecrets) {
   return `//!b44:${BANNER_FORMAT} ${JSON.stringify({
@@ -256467,6 +256506,50 @@ function activationImport(runtimeSecrets) {
   return runtimeSecrets ? `
 import { ensureActivation, takeActivationChallenge, withoutActivationHeaders } from "./${ACTIVATION_FILENAME}";` : "";
 }
+function buildEntrySource(userEntry, telemetry, runtimeSecrets = false) {
+  const userImport = `./${userEntry.replace(/^\.\//, "")}`;
+  const handlerExpr = telemetry ? "_b44AttachTelemetry(await handler(request, info))" : runtimeSecrets ? "await handler(request, info)" : "handler(request, info)";
+  const guard = activationGuard(runtimeSecrets);
+  const returnExpr = guard(handlerExpr);
+  return `// Auto-generated by the base44 bundler. Do not edit.
+
+import { currentWorkerRuntimeContext as _b44Context, runWithWorkerEnvironment as _b44Run } from ${JSON.stringify(RUNTIME_CONTEXT_SPECIFIER)};
+import { getRegisteredHandler, installStaticEgressFetch } from "./${SHIM_FILENAME}";${activationImport(runtimeSecrets)}
+
+${consolePatch(runtimeSecrets)}
+// Static egress reads workerEnv from the active request store. Install it
+// before telemetry so telemetry remains the outermost fetch wrapper.
+installStaticEgressFetch();
+${telemetry ? TELEMETRY_PATCH : ""}
+
+let _b44Init = null;
+export default {
+  async fetch(request, env, ctx) {
+${runtimeSecrets ? ACTIVATION_TAKE : ""}    const _b44Env = (request.headers.get('base44-functions-version') ?? '') === 'prod' ? 'prod' : 'preview';
+    return _b44Run({ env: _b44Env, secrets: ${runtimeSecrets ? "process.env" : "env"}, workerEnv: env, waitUntil: (p) => ctx.waitUntil(p)${telemetry ? `, ${TELEMETRY_STORE_FIELDS}` : ""} }, async () => {
+${runtimeSecrets ? ACTIVATION_GATE : ""}      if (!_b44Init) _b44Init = import(${JSON.stringify(userImport)}).catch(e => { _b44Init = null; throw e; });
+      const _b44Mod = await _b44Init;
+      // Deno.serve capture wins (legacy contract, zero behavior change);
+      // a default-exported handler is the new-contract fallback.
+      const handler = getRegisteredHandler() ?? (typeof _b44Mod?.default === 'function' ? _b44Mod.default : null);
+      if (!handler) {
+        return ${guard(`new Response(
+          "The function must export default a request handler or call Deno.serve()",
+          { status: 503 },
+        )`)};
+      }
+      // Deno's handler signature is (request, info). Cloudflare doesn't expose a
+      // connection address the same way; pass a best-effort placeholder. Real
+      // client IP is available via the "cf-connecting-ip" request header.
+      const info = {
+        remoteAddr: { transport: "tcp", hostname: "0.0.0.0", port: 0 },
+      };
+      return ${returnExpr};
+    });
+  },
+};
+`;
+}
 function buildFunctionModuleSource(functionName, userEntry) {
   const userImport = `./${userEntry.replace(/^\.\//, "")}`;
   return `// Auto-generated by the base44 bundler. Do not edit.
@@ -256769,6 +256852,284 @@ function runtimeContextVirtualPlugin() {
   };
 }
 
+// ../functions-compiler/src/actor-compat.ts
+var ACTOR_ENTRY_FILENAME2 = "__base44_actor_entry.mjs";
+var ACTOR_PRELUDE_FILENAME = "__base44_actor_prelude.mjs";
+var ACTOR_AUTH_FILENAME = "__base44_actor_auth.mjs";
+var ACTORS_PREFIX = "base44/actors/";
+var ENTRY_SUFFIX = "/entry.ts";
+function actorNameFromEntry(entry) {
+  if (!entry.startsWith(ACTORS_PREFIX) || !entry.endsWith(ENTRY_SUFFIX))
+    return null;
+  const name = entry.slice(ACTORS_PREFIX.length, -ENTRY_SUFFIX.length);
+  return name && !name.includes("/") ? name : null;
+}
+function applyActorCompat(entry, files) {
+  const actorName = actorNameFromEntry(entry);
+  if (!actorName || files[entry] === undefined)
+    return null;
+  assertNoReservedFilenames(files);
+  if (ACTOR_PRELUDE_FILENAME in files) {
+    throw new Error(`Reserved filename "${ACTOR_PRELUDE_FILENAME}" in actor bundle — ` + "it is generated by the bundler. Rename the file.");
+  }
+  if (ACTOR_AUTH_FILENAME in files) {
+    throw new Error(`Reserved filename "${ACTOR_AUTH_FILENAME}" in actor bundle — ` + "it is generated by the bundler. Rename the file.");
+  }
+  const handlerName = actorName;
+  const doClassName = handlerName;
+  const prelude = buildPrelude();
+  const entryWrapper = buildEntryWrapper(doClassName, entry);
+  return {
+    entry: ACTOR_ENTRY_FILENAME2,
+    files: {
+      ...files,
+      ...workerRuntimeFiles(),
+      [ACTOR_AUTH_FILENAME]: buildActorAuth(),
+      [ACTOR_PRELUDE_FILENAME]: prelude,
+      [ACTOR_ENTRY_FILENAME2]: entryWrapper
+    },
+    handlerName,
+    doClassName
+  };
+}
+function buildActorAuth() {
+  return `// Auto-generated by the base44 bundler. Do not edit.
+const TOKEN_HEADER = "X-Base44-Actor-Token";
+const IDENTITY_HEADER = "X-Base44-Actor-Identity";
+const CLOCK_SKEW_SECONDS = 30;
+const TOKEN_TTL_SECONDS = 300;
+
+const decodeSegment = (segment) => {
+  const normalized = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  const binary = atob(padded);
+  return new Uint8Array([...binary].map((character) => character.charCodeAt(0)));
+};
+
+const decodeJsonSegment = (segment) =>
+  JSON.parse(new TextDecoder().decode(decodeSegment(segment)));
+
+const unauthorized = () => ({
+  ok: false,
+  response: new Response("Unauthorized", { status: 401 }),
+});
+
+const validPrincipal = (principal) => {
+  if (principal === null || typeof principal !== "object" || Array.isArray(principal)) return false;
+  if (principal.type === "authenticated") {
+    return typeof principal.userId === "string" && principal.userId.length > 0 && principal.userId.length <= 128;
+  }
+  if (principal.type === "anonymous") {
+    return typeof principal.anonymousId === "string" && principal.anonymousId.length > 0 && principal.anonymousId.length <= 128;
+  }
+  return false;
+};
+
+export async function verifyActorConnection(request, env, actorName, room) {
+  const publicKey = env.BASE44_ACTOR_PUBLIC_KEY;
+  const scriptId = env.BASE44_ACTOR_SCRIPT_ID;
+  const token = request.headers.get(TOKEN_HEADER) ?? new URL(request.url).searchParams.get("token");
+  if (
+    typeof publicKey !== "string" || !publicKey ||
+    typeof scriptId !== "string" || !scriptId ||
+    typeof token !== "string" || token.length > 4096
+  ) return unauthorized();
+
+  const parts = token.split(".");
+  if (parts.length !== 3) return unauthorized();
+  try {
+    const header = decodeJsonSegment(parts[0]);
+    const claims = decodeJsonSegment(parts[1]);
+    if (header?.alg !== "EdDSA" || (header.typ !== undefined && header.typ !== "JWT")) {
+      return unauthorized();
+    }
+    const key = await crypto.subtle.importKey(
+      "raw",
+      decodeSegment(publicKey),
+      { name: "Ed25519" },
+      false,
+      ["verify"],
+    );
+    const validSignature = await crypto.subtle.verify(
+      { name: "Ed25519" },
+      key,
+      decodeSegment(parts[2]),
+      new TextEncoder().encode(parts[0] + "." + parts[1]),
+    );
+    if (!validSignature) return unauthorized();
+
+    const now = Math.floor(Date.now() / 1000);
+    const times = [claims.iat, claims.nbf, claims.exp];
+    if (!times.every(Number.isInteger)) return unauthorized();
+    if (
+      claims.iss !== "base44" ||
+      claims.aud !== "base44-actor-connect" ||
+      claims.purpose !== "actor-connect" ||
+      claims.v !== 1 ||
+      typeof claims.jti !== "string" || !claims.jti || claims.jti.length > 64 ||
+      claims.iat > now + CLOCK_SKEW_SECONDS ||
+      claims.nbf > now + CLOCK_SKEW_SECONDS ||
+      claims.exp < now - CLOCK_SKEW_SECONDS ||
+      claims.exp <= claims.iat || claims.exp - claims.iat > TOKEN_TTL_SECONDS ||
+      claims.app_id !== env.BASE44_APP_ID ||
+      claims.actor_name !== actorName ||
+      claims.actor_script_id !== scriptId ||
+      claims.room !== room ||
+      claims.connection_id !== new URL(request.url).searchParams.get("_pk") ||
+      claims.runtime_mode !== (env.BASE44_FUNCTIONS_VERSION === "prod" ? "prod" : "preview") ||
+      !validPrincipal(claims.principal)
+    ) return unauthorized();
+
+    return {
+      ok: true,
+      identity: Object.freeze({ ...claims.principal }),
+      runtimeMode: claims.runtime_mode,
+    };
+  } catch {
+    return unauthorized();
+  }
+}
+
+export function authorizedActorRequest(request, identity, actorName, room, runtimeMode) {
+  const url = new URL(request.url);
+  url.searchParams.delete("token");
+  url.pathname = "/parties/" + encodeURIComponent(actorName) + "/" + encodeURIComponent(room);
+  const headers = new Headers(request.headers);
+  headers.delete(TOKEN_HEADER);
+  headers.set(IDENTITY_HEADER, JSON.stringify(identity));
+  headers.set("base44-functions-version", runtimeMode === "prod" ? "prod" : "preview");
+  return new Request(new Request(url.toString(), request), { headers });
+}
+`;
+}
+function buildPrelude() {
+  return `// Auto-generated by the base44 bundler. Do not edit.
+import { currentWorkerRuntimeContext as _b44Context } from ${JSON.stringify(RUNTIME_CONTEXT_SPECIFIER)};
+import { installStaticEgressFetch } from "./${SHIM_FILENAME}";
+
+${CONSOLE_PATCH}
+installStaticEgressFetch();
+`;
+}
+function buildEntryWrapper(doClassName, userEntry) {
+  const userImport = `./${userEntry.replace(/^\.\//, "")}`;
+  return `// Auto-generated by the base44 bundler. Do not edit.
+// The prelude is intentionally the first dependency: it installs the fetch
+// shim before the user module evaluates while this static default import keeps
+// missing-default actors as bundle-time errors.
+import "./${ACTOR_PRELUDE_FILENAME}";
+import Base44UserActor from ${JSON.stringify(userImport)};
+import { runWithWorkerEnvironment as _b44Run } from ${JSON.stringify(RUNTIME_CONTEXT_SPECIFIER)};
+import { authorizedActorRequest as _b44AuthorizedActorRequest, verifyActorConnection as _b44VerifyActorConnection } from "./${ACTOR_AUTH_FILENAME}";
+
+const _b44ActorState = new WeakMap();
+const _b44RunWithActorEnvironment = (ctx, env, runtimeEnv, callback) => _b44Run({
+  env: runtimeEnv,
+  secrets: env,
+  workerEnv: env,
+  waitUntil: (promise) => ctx.waitUntil(promise),
+}, callback);
+const _b44ConstructActor = (ctx, env, newTarget) => _b44RunWithActorEnvironment(
+  ctx,
+  env,
+  "prod",
+  () => {
+    // A derived constructor may return an explicitly constructed instance.
+    // This keeps the user's constructor and class-field initializers inside the
+    // request-scoped Worker environment without changing the exported subclass.
+    const actor = Reflect.construct(Base44UserActor, [ctx, env], newTarget);
+    _b44ActorState.set(actor, { ctx, env, runtimeEnv: null });
+    return actor;
+  },
+);
+const _b44RunActor = (actor, request, callback) => {
+  const state = _b44ActorState.get(actor);
+  const runtimeEnv = request
+    ? ((request.headers.get("base44-functions-version") ?? "") === "prod" ? "prod" : "preview")
+    : (state.runtimeEnv ?? "prod");
+  state.runtimeEnv = runtimeEnv;
+  return _b44RunWithActorEnvironment(state.ctx, state.env, runtimeEnv, callback);
+};
+
+export class ${doClassName} extends Base44UserActor {
+  // Read by the shim's service-token exchange: the assertion's actor_name claim
+  // selects the verification key on the platform side. A static (not .name) so
+  // minification can't change it.
+  static _b44ActorName = ${JSON.stringify(doClassName)};
+
+  constructor(ctx, env) {
+    return _b44ConstructActor(ctx, env, new.target);
+  }
+
+  fetch(request) {
+    return _b44RunActor(this, request, () => super.fetch(request));
+  }
+
+  onConnect(...args) {
+    return _b44RunActor(this, null, () => super.onConnect(...args));
+  }
+
+  onMessage(...args) {
+    return _b44RunActor(this, null, () => super.onMessage(...args));
+  }
+
+  onClose(...args) {
+    return _b44RunActor(this, null, () => super.onClose(...args));
+  }
+
+  onAlarm(...args) {
+    return _b44RunActor(this, null, () => super.onAlarm(...args));
+  }
+
+  onStart(...args) {
+    return _b44RunActor(this, null, () => super.onStart(...args));
+  }
+
+  onError(...args) {
+    return _b44RunActor(this, null, () => super.onError(...args));
+  }
+}
+export default {
+  async fetch(request, env, ctx) {
+    const url = new URL(request.url);
+    const parts = url.pathname.split("/");
+    const direct = parts[1] === "rooms" && parts.length === 3;
+    const legacy = parts[1] === "parties" && parts.length === 4;
+    if (direct || legacy) {
+      // Decode the room: the token was verified against the decoded instance id,
+      // so an escaped room must map to the same Durable Object.
+      const namespace = direct ? "${doClassName}" : parts[2];
+      const encodedRoom = direct ? parts[2] : parts[3];
+      let room;
+      try { room = decodeURIComponent(encodedRoom); } catch { return new Response("Invalid room", { status: 400 }); }
+      let actorRequest = request;
+      if (direct || typeof env.BASE44_ACTOR_PUBLIC_KEY === "string") {
+        const verification = await _b44VerifyActorConnection(request, env, "${doClassName}", room);
+        if (!verification.ok) return verification.response;
+        actorRequest = _b44AuthorizedActorRequest(
+          request,
+          verification.identity,
+          "${doClassName}",
+          room,
+          verification.runtimeMode,
+        );
+      }
+      const doNs = env["${doClassName}"];
+      if (doNs && typeof doNs.idFromName === "function") {
+        const stub = doNs.get(doNs.idFromName(room));
+        const req = new Request(actorRequest);
+        req.headers.set("x-partykit-room", room);
+        req.headers.set("x-partykit-namespace", namespace);
+        return stub.fetch(req);
+      }
+      return new Response("DO binding not found", { status: 503 });
+    }
+    return new Response("Not found", { status: 404 });
+  },
+};
+`;
+}
+
 // ../../node_modules/zod/v3/helpers/util.js
 var util;
 (function(util) {
@@ -261003,6 +261364,7 @@ var WS_SPECIFIER = /^(npm:)?ws(@[^/]+)?$/;
 var ADAPTER = `"use strict";
 const toBuffer = (value) => (globalThis.Buffer ? globalThis.Buffer.from(value) : value);
 const READY_STATES = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
+const later = (fn, ...args) => queueMicrotask(() => fn(...args));
 const upgradeHeaders = (options) => {
   const headers = new Headers(options?.headers);
   for (const name of headers.keys()) if (name !== "user-agent") return headers;
@@ -261017,6 +261379,7 @@ class WebSocket {
   #state = 0;
   #url;
   #closeRequested = null;
+  #terminated = false;
   #listeners = new Map();
   constructor(address, protocols, options) {
     if (protocols && typeof protocols === "object" && !Array.isArray(protocols)) {
@@ -261031,7 +261394,10 @@ class WebSocket {
       this.#attach(new globalThis.WebSocket(this.#url, protocols));
     }
   }
-  get readyState() { return this.#socket ? this.#socket.readyState : this.#state; }
+  get readyState() {
+    if (this.#terminated) return 3;
+    return this.#socket ? this.#socket.readyState : this.#state;
+  }
   get url() { return this.#url; }
   get protocol() { return this.#socket ? this.#socket.protocol ?? "" : ""; }
   on(name, listener) { return this.#add(name, listener, false); }
@@ -261075,7 +261441,20 @@ class WebSocket {
       this.#state = 2;
     }
   }
-  terminate() { this.close(); }
+  // \`ws\` tears the connection down at once. workerd has no abrupt close, so the
+  // socket is closed normally and "close" is reported now, not on the reply.
+  terminate() {
+    if (this.#terminated || this.readyState === 3) return;
+    this.#terminated = true;
+    if (this.#socket) {
+      try { this.#socket.close(); } catch {}
+    } else {
+      // Upgrade still in flight: close it on arrival, without an "open".
+      this.#closeRequested = [];
+      this.#state = 3;
+    }
+    later(() => this.emit("close", 1006, toBuffer("")));
+  }
   #attach(socket) {
     this.#socket = socket;
     try { socket.binaryType = "arraybuffer"; } catch {}
@@ -261085,7 +261464,9 @@ class WebSocket {
       this.emit("message", toBuffer(isBinary ? new Uint8Array(event.data) : event.data), isBinary);
     });
     socket.addEventListener("error", (event) => this.emit("error", event.error ?? new Error(event.message || "WebSocket error")));
-    socket.addEventListener("close", (event) => this.emit("close", event.code, toBuffer(event.reason ?? "")));
+    socket.addEventListener("close", (event) => {
+      if (!this.#terminated) this.emit("close", event.code, toBuffer(event.reason ?? ""));
+    });
   }
   #upgrade(headers, protocols) {
     headers.set("Upgrade", "websocket");
@@ -261093,6 +261474,7 @@ class WebSocket {
     const httpUrl = this.#url.replace(/^ws(s?):/i, "http$1:");
     const fail = (error) => {
       this.#state = 3;
+      if (this.#terminated) return;
       this.emit("error", error);
       this.emit("close", 1006, toBuffer(""));
     };
@@ -261252,6 +261634,51 @@ function setSpanTags(tags) {
 // ../functions-compiler/src/bundler.ts
 var NORMALIZED_MAIN_MODULE = "_bundled.mjs";
 var MAX_PARALLEL_COMPILES = 4;
+async function bundle(req) {
+  let actor;
+  try {
+    actor = applyActorCompat(req.entry, req.files);
+  } catch (e) {
+    return denoCompatErrorOrThrow(e);
+  }
+  if (actor) {
+    if (req.runtimeSecrets) {
+      return denoCompatErrorOrThrow(new DenoCompatError("runtimeSecrets is not supported for Actor entries: an Actor reads secrets " + "from its Durable Object env, so it must be deployed in binding mode."));
+    }
+    const outcome = await installAndCompile({
+      entry: actor.entry,
+      files: actor.files
+    });
+    if (outcome.ok) {
+      return {
+        ok: true,
+        module: outcome.module,
+        main_module: NORMALIZED_MAIN_MODULE,
+        warnings: outcome.warnings,
+        handler_name: actor.handlerName,
+        do_class_name: actor.doClassName
+      };
+    }
+    return { ok: false, stage: outcome.stage, errors: outcome.errors };
+  }
+  let prepared;
+  try {
+    prepared = await prepareFunction(req.entry, req.files, req.postResponseTelemetry, req.runtimeSecrets);
+  } catch (e) {
+    return denoCompatErrorOrThrow(e);
+  }
+  const outcome = await installAndCompile(prepared);
+  if (outcome.ok) {
+    return {
+      ok: true,
+      module: outcome.module,
+      main_module: NORMALIZED_MAIN_MODULE,
+      warnings: outcome.warnings,
+      ...activationField(req.runtimeSecrets ?? false)
+    };
+  }
+  return { ok: false, stage: outcome.stage, errors: outcome.errors };
+}
 function activationField(runtimeSecrets) {
   return runtimeSecrets ? { activation: ACTIVATION_MODE } : {};
 }
@@ -261439,6 +261866,16 @@ async function installAndCompile(prepared) {
     return { ok: false, stage: "esbuild", errors: result.errors };
   });
 }
+function denoCompatErrorOrThrow(e) {
+  if (e instanceof DenoCompatError) {
+    return {
+      ok: false,
+      stage: "deno_compat",
+      errors: [denoCompatErrorItem(e)]
+    };
+  }
+  throw e;
+}
 function denoCompatErrorItem(e) {
   return { message: e.message, file: e.file };
 }
@@ -261641,6 +262078,8 @@ async function mapWithConcurrency2(items, limit, fn) {
   return results;
 }
 // src/core/version/functions.ts
+import { createHash as createHash2 } from "node:crypto";
+import { relative as relative6 } from "node:path";
 var SHARD_POLICY = {
   shardSize: 100,
   globalShardSize: 100,
@@ -261648,11 +262087,11 @@ var SHARD_POLICY = {
   gzipCapBytes: 9500000
 };
 var COMPILE_MODES = { runtimeSecrets: false, postResponseTelemetry: false };
-async function requireCompilerRuntime() {
+async function requireCompilerRuntime(what = "Backend functions") {
   try {
     await Promise.all([import("esbuild"), import("@deno/loader")]);
   } catch (error) {
-    throw new DependencyNotFoundError("Backend functions cannot be compiled by this installation of the CLI.", {
+    throw new DependencyNotFoundError(`${what} cannot be compiled by this installation of the CLI.`, {
       hints: [{ message: "Install the CLI from npm: npm install -g base44" }],
       cause: error instanceof Error ? error : undefined
     });
@@ -261709,6 +262148,97 @@ async function compileBackendBundles(root, functionsDir) {
   });
 }
 
+// src/core/version/actors.ts
+var MAX_ACTORS = 50;
+var COMPILE_CONCURRENCY = 4;
+var ACTORS_ROOT = "base44/actors";
+var SHARED_ROOT = "base44/shared";
+function forwardSlashed(from, to) {
+  return relative7(from, to).split(/[/\\]/).join("/");
+}
+async function readSharedFiles2(actorsDir) {
+  const sharedDir = resolve13(actorsDir, "..", "shared");
+  if (!await pathExists(sharedDir)) {
+    return {};
+  }
+  const paths = await globby(BACKEND_FILE_GLOB, {
+    cwd: sharedDir,
+    absolute: true
+  });
+  const files = {};
+  for (const path of paths.sort()) {
+    files[`${SHARED_ROOT}/${forwardSlashed(sharedDir, path)}`] = await readTextFile(path);
+  }
+  return files;
+}
+async function compilerInput2(actor, shared) {
+  const actorDir = dirname22(actor.entryPath);
+  const entry = `${ACTORS_ROOT}/${actor.name}/entry.ts`;
+  const source = await readTextFile(actor.entryPath);
+  const candidates = { ...shared };
+  for (const filePath of actor.filePaths) {
+    if (filePath !== actor.entryPath) {
+      candidates[`${ACTORS_ROOT}/${actor.name}/${forwardSlashed(actorDir, filePath)}`] = await readTextFile(filePath);
+    }
+  }
+  candidates[entry] = source;
+  return {
+    entry,
+    files: await collectReachableFiles(entry, candidates),
+    source
+  };
+}
+async function compileActors(actorsDir) {
+  const actors = await readAllActors(actorsDir);
+  if (actors.length === 0) {
+    return [];
+  }
+  if (actors.length > MAX_ACTORS) {
+    throw new InvalidInputError(`Too many actors: found ${actors.length}, the limit is ${MAX_ACTORS}.`);
+  }
+  await requireCompilerRuntime("Actors");
+  const shared = await readSharedFiles2(actorsDir);
+  const sorted = [...actors].sort((a, b) => a.name < b.name ? -1 : 1);
+  const compiled = await pMap(sorted, async (actor) => {
+    const input = await compilerInput2(actor, shared);
+    const result = await bundle({ entry: input.entry, files: input.files });
+    return {
+      name: actor.name,
+      entry: input.entry,
+      source: input.source,
+      result
+    };
+  }, { concurrency: COMPILE_CONCURRENCY });
+  const failures = compiled.flatMap(({ name, result }) => result.ok ? [] : [
+    {
+      function: name,
+      message: `Actor "${name}" failed to compile.`,
+      errors: result.errors
+    }
+  ]);
+  if (failures.length > 0) {
+    throw new InvalidInputError(`Actors failed to compile (${failures.length} error${failures.length === 1 ? "" : "s"}).`, { details: failures.map(describeFailure) });
+  }
+  return compiled.map(({ name, entry, source, result }) => {
+    const module = new TextEncoder().encode(compiledModule(name, result));
+    return {
+      name,
+      entry,
+      source,
+      module,
+      size: module.byteLength,
+      digest: sha256(module),
+      staticEgress: STATIC_EGRESS_ARTIFACT_MARKER
+    };
+  });
+}
+function compiledModule(name, result) {
+  if (!result.ok || result.do_class_name !== name) {
+    throw new InternalError(`Actor "${name}" did not compile as an actor of that name.`);
+  }
+  return result.module;
+}
+
 // src/core/version/publish.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 var DEFAULT_ENVIRONMENT = "production";
@@ -261761,7 +262291,7 @@ async function collectBuildOutput(outputDir, options = {}) {
 }
 async function describeSiteWorker(built) {
   const { config, modules } = built;
-  const entry = resolve13(config.configDir, config.main);
+  const entry = resolve14(config.configDir, config.main);
   const main = modules.find((m) => m.absolutePath === entry)?.name;
   if (!main) {
     throw new InvalidInputError(`The Worker's entry module ${config.main} is not among the ${modules.length} modules collected from ${config.configDir}.`);
@@ -261812,6 +262342,7 @@ async function collectArtifacts(target) {
     }),
     ...siteWorker ? { siteWorker } : {},
     backendBundles: await tagStep2("build", () => compileBackendBundles(target.root, join29(target.configDir, target.functionsDir))),
+    actors: await tagStep2("build", () => compileActors(join29(target.configDir, target.actorsDir))),
     ...await collectResources(target.configDir, target)
   };
 }
@@ -262269,7 +262800,7 @@ function getSecretsListCommand() {
 }
 
 // src/cli/commands/secrets/set.ts
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 function parseEntries(entries) {
   const secrets = {};
   for (const entry of entries) {
@@ -262300,7 +262831,7 @@ async function setSecretsAction({ log, runTask }, entries, options) {
   validateInput(entries, options);
   let secrets;
   if (options.envFile) {
-    secrets = await parseEnvFile(resolve14(options.envFile));
+    secrets = await parseEnvFile(resolve15(options.envFile));
     if (Object.keys(secrets).length === 0) {
       throw new InvalidInputError("The env file contains no valid KEY=VALUE entries.");
     }
@@ -262329,7 +262860,7 @@ function getSecretsCommand() {
 }
 
 // src/cli/commands/site/deploy.ts
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 async function deployAction2(ctx, options) {
   const { isNonInteractive } = ctx;
   if (isNonInteractive && !options.yes) {
@@ -262398,7 +262929,7 @@ async function deployTarball({ runTask }, project) {
 }
 function siteOutputDir(project) {
   const { outputDirectory = DEFAULT_SITE.outputDirectory } = siteOrDefault(project);
-  return resolve15(project.root, outputDirectory);
+  return resolve16(project.root, outputDirectory);
 }
 function getSiteDeployCommand() {
   const command = new Base44Command("deploy").description("Deploy built site files to Base44 hosting").option("-y, --yes", "Skip confirmation prompt").option("--build", "Build the site before deploying (skips the prompt)").option("--no-build", "Deploy without building (skips the prompt)");
@@ -263226,7 +263757,7 @@ function getWorkspaceCommand() {
 // src/cli/dev/dev-server/main.ts
 var import_cors = __toESM(require_lib4(), 1);
 var import_express6 = __toESM(require_express(), 1);
-import { dirname as dirname27, join as join38 } from "node:path";
+import { dirname as dirname28, join as join38 } from "node:path";
 
 // ../../node_modules/get-port/index.js
 import net from "node:net";
@@ -263356,7 +263887,7 @@ var $tmpName = promisify12(tmp.tmpName);
 
 // src/cli/dev/dev-server/function-manager.ts
 import { spawn as spawn3 } from "node:child_process";
-import { dirname as dirname24, join as join34 } from "node:path";
+import { dirname as dirname25, join as join34 } from "node:path";
 import { pathToFileURL as pathToFileURL6 } from "node:url";
 
 // src/cli/dev/dev-server/base-function-manager.ts
@@ -263461,7 +263992,7 @@ class FunctionManager extends BaseFunctionManager {
   }
   spawnFunction(func, port) {
     this.logger.log(`Spawning function "${func.name}" on port ${port}`);
-    const importMapPath = join34(dirname24(this.wrapperPath), "import-map.json");
+    const importMapPath = join34(dirname25(this.wrapperPath), "import-map.json");
     const process2 = spawn3("deno", ["run", "--allow-all", "--import-map", importMapPath, this.wrapperPath], {
       env: {
         ...globalThis.process.env,
@@ -265190,7 +265721,7 @@ function createCustomIntegrationRoutes(remoteProxy, logger) {
 
 // src/cli/dev/dev-server/watcher.ts
 import { EventEmitter as EventEmitter4 } from "node:events";
-import { relative as relative10 } from "node:path";
+import { relative as relative11 } from "node:path";
 
 // ../../node_modules/chokidar/index.js
 import { EventEmitter as EventEmitter3 } from "node:events";
@@ -266875,7 +267406,7 @@ class WatchBase44 extends EventEmitter4 {
       ignoreInitial: true
     });
     watcher.on("all", import_debounce.default(async (_event, path) => {
-      this.emit("change", name, relative10(targetPath, path));
+      this.emit("change", name, relative11(targetPath, path));
     }, WATCH_DEBOUNCE_MS));
     watcher.on("error", (err) => {
       this.logger.error(`Watch handler failed for ${targetPath}`, err);
@@ -266987,8 +267518,8 @@ async function createDevServer(options) {
     broadcastEntityEvent(io, appId, entityName, event);
   };
   const base44ConfigWatcher = new WatchBase44({
-    functions: join38(dirname27(project.configPath), project.functionsDir),
-    entities: join38(dirname27(project.configPath), project.entitiesDir)
+    functions: join38(dirname28(project.configPath), project.functionsDir),
+    entities: join38(dirname28(project.configPath), project.entitiesDir)
   }, devLogger);
   base44ConfigWatcher.on("change", async (name) => {
     try {
@@ -267348,7 +267879,7 @@ Examples:
 }
 
 // src/cli/commands/project/eject.ts
-import { resolve as resolve19 } from "node:path";
+import { resolve as resolve20 } from "node:path";
 var import_kebabCase2 = __toESM(require_kebabCase(), 1);
 async function eject(ctx, options, command) {
   const { log, runTask, isNonInteractive } = ctx;
@@ -267412,7 +267943,7 @@ async function eject(ctx, options, command) {
     Ne("Operation cancelled.");
     throw new CLIExitError(0);
   }
-  const resolvedPath = resolve19(selectedPath);
+  const resolvedPath = resolve20(selectedPath);
   await runTask("Downloading your project's code...", async (updateMessage) => {
     await createProjectFilesForExistingProject({
       projectId,
@@ -267517,7 +268048,7 @@ var import_detect_agent = __toESM(require_dist5(), 1);
 import { release, type } from "node:os";
 
 // ../../node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname28, posix, sep as sep2 } from "path";
+import { dirname as dirname29, posix, sep as sep2 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -267526,7 +268057,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname28(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname29(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath2(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -271515,7 +272046,7 @@ function addCommandInfoToErrorReporter(program, errorReporter) {
   });
 }
 // src/cli/index.ts
-var __dirname4 = dirname29(fileURLToPath7(import.meta.url));
+var __dirname4 = dirname30(fileURLToPath7(import.meta.url));
 async function runCLI(options) {
   ensureNpmAssets(join40(__dirname4, "../assets"));
   const errorReporter = new ErrorReporter;
@@ -271556,4 +272087,4 @@ export {
   runCLI
 };
 
-//# debugId=B28345EB77F07FBF64756E2164756E21
+//# debugId=02073B02CE22EAE264756E2164756E21