@base44-preview/vite-plugin 1.0.48-pr.138.622eb14 → 1.0.48-pr.142.9fcc12e

package/dist/private-data-sources/redis-auth.js

@@ -0,0 +1,72 @@
+const MAX_AUTH_RESPONSE_BYTES = 4096;
+function isCloudflareTcpSocket(socket) {
+    const candidate = socket;
+    return (candidate !== null &&
+        typeof candidate === "object" &&
+        !!candidate.readable &&
+        typeof candidate.readable.getReader === "function" &&
+        !!candidate.writable &&
+        typeof candidate.writable.getWriter === "function");
+}
+function encodeRespArray(values) {
+    const encoder = new TextEncoder();
+    const chunks = [encoder.encode(`*${values.length}\r\n`)];
+    for (const value of values) {
+        const bytes = encoder.encode(value);
+        chunks.push(encoder.encode(`$${bytes.byteLength}\r\n`), bytes, encoder.encode("\r\n"));
+    }
+    const result = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
+async function readResponseLine(reader) {
+    const bytes = [];
+    while (bytes.length <= MAX_AUTH_RESPONSE_BYTES) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        for (const byte of value ?? []) {
+            bytes.push(byte);
+            const length = bytes.length;
+            if (length >= 2 && bytes[length - 2] === 13 && bytes[length - 1] === 10) {
+                return new TextDecoder().decode(new Uint8Array(bytes.slice(0, -2)));
+            }
+            if (length > MAX_AUTH_RESPONSE_BYTES)
+                break;
+        }
+    }
+    throw new Error("Redis authentication failed: invalid or missing server response");
+}
+async function authenticateRedisSocket(socket, username, password) {
+    if (!isCloudflareTcpSocket(socket)) {
+        throw new Error("Redis private data source did not return a readable/writable TCP socket");
+    }
+    const reader = socket.readable.getReader();
+    const writer = socket.writable.getWriter();
+    try {
+        await socket.opened;
+        const auth = username ? ["AUTH", username, password] : ["AUTH", password];
+        await writer.write(encodeRespArray(auth));
+        const response = await readResponseLine(reader);
+        if (response === "+OK")
+            return socket;
+        const message = response.startsWith("-") ? response.slice(1) : `unexpected response ${JSON.stringify(response)}`;
+        throw new Error(`Redis authentication failed: ${message}`);
+    }
+    catch (error) {
+        socket.close?.();
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+        writer.releaseLock();
+    }
+}
+export function authenticateRedisSocketIfNeeded(socket, username, password) {
+    return password ? authenticateRedisSocket(socket, username, password) : socket;
+}
+//# sourceMappingURL=redis-auth.js.map

package/dist/private-data-sources/redis-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-auth.js","sourceRoot":"","sources":["../../src/private-data-sources/redis-auth.ts"],"names":[],"mappings":"AAEA,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,qBAAqB,CAAC,MAAe;IAC5C,MAAM,SAAS,GAAG,MAA6C,CAAC;IAChE,OAAO,CACL,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,CAAC,SAAS,CAAC,QAAQ;QACpB,OAAO,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;QAClD,CAAC,CAAC,SAAS,CAAC,QAAQ;QACpB,OAAO,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAgB;IACvC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAA+C;IAC7E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,KAAK,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,MAAM,GAAG,uBAAuB;gBAAE,MAAM;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAAe,EACf,QAA4B,EAC5B,QAAgB;IAEhB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAAe,EACf,QAA4B,EAC5B,QAA4B;IAE5B,OAAO,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjF,CAAC"}

package/dist/private-data-sources/redis.d.ts

@@ -0,0 +1,46 @@
+export declare function redis(name: unknown): Readonly<Readonly<{
+    name: string | undefined;
+    type: string | undefined;
+    readonly bindingName: string | undefined;
+    readonly host: string | undefined;
+    readonly port: number | undefined;
+    readonly database: string | undefined;
+    readonly username: string | undefined;
+    readonly user: string | undefined;
+    readonly password: string | undefined;
+    connect(options?: unknown): unknown;
+    readonly binding: unknown;
+}> & {
+    connect: (options?: unknown) => unknown;
+} & {
+    connect(options?: unknown): unknown;
+    ioredisConnector(): {
+        new (options?: {
+            disconnectTimeout?: number;
+        }): {
+            firstError?: Error;
+            "__#private@#stream": import("./ioredis-adapter.js").IoredisNetStream | undefined;
+            "__#private@#disconnectTimeout": number;
+            check(): boolean;
+            connect(errorEmitter?: (type: string, err: Error) => void): Promise<import("./ioredis-adapter.js").IoredisNetStream>;
+            disconnect(): void;
+        };
+    };
+    ioredisOptions(): Readonly<{
+        password?: string;
+        username?: string;
+        Connector: {
+            new (options?: {
+                disconnectTimeout?: number;
+            }): {
+                firstError?: Error;
+                "__#private@#stream": import("./ioredis-adapter.js").IoredisNetStream | undefined;
+                "__#private@#disconnectTimeout": number;
+                check(): boolean;
+                connect(errorEmitter?: (type: string, err: Error) => void): Promise<import("./ioredis-adapter.js").IoredisNetStream>;
+                disconnect(): void;
+            };
+        };
+    }>;
+}>;
+//# sourceMappingURL=redis.d.ts.map

package/dist/private-data-sources/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/redis.ts"],"names":[],"mappings":"AAKA,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO;;;;;;;;;;;;;aAItB,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO;;sBAKrB,OAAO;;;6BAiCmpI,CAAC;;;;;;;;;;;;;;;iCAAD,CAAC;;;;;;;;;;;GADhrI"}

package/dist/private-data-sources/redis.js

@@ -0,0 +1,27 @@
+import { buildIoredisConnectorFactory } from "./ioredis-adapter.js";
+import { privateDataSourceReference } from "./manifest.js";
+import { authenticateRedisSocketIfNeeded } from "./redis-auth.js";
+import { buildTcpPrivateDataSource } from "./tcp.js";
+export function redis(name) {
+    const source = buildTcpPrivateDataSource(privateDataSourceReference(name, "redis"));
+    const { connect: _connect, ...descriptors } = Object.getOwnPropertyDescriptors(source);
+    const extension = {
+        connect(options) {
+            return authenticateRedisSocketIfNeeded(source.connect(options), source.username, source.password);
+        },
+        ioredisConnector() {
+            return buildIoredisConnectorFactory(() => authenticateRedisSocketIfNeeded(source.connect(), source.username, source.password));
+        },
+        ioredisOptions() {
+            return Object.freeze({
+                Connector: buildIoredisConnectorFactory(() => source.connect()),
+                ...(source.password && source.username
+                    ? { username: source.username }
+                    : {}),
+                ...(source.password ? { password: source.password } : {}),
+            });
+        },
+    };
+    return Object.freeze(Object.defineProperties(extension, descriptors));
+}
+//# sourceMappingURL=redis.js.map

package/dist/private-data-sources/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/private-data-sources/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAErD,MAAM,UAAU,KAAK,CAAC,IAAa;IACjC,MAAM,MAAM,GAAG,yBAAyB,CACtC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAG1C,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GACzC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG;QAChB,OAAO,CAAC,OAAiB;YACvB,OAAO,+BAA+B,CACpC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,CAChB,CAAC;QACJ,CAAC;QACD,gBAAgB;YACd,OAAO,4BAA4B,CAAC,GAAG,EAAE,CACvC,+BAA+B,CAC7B,MAAM,CAAC,OAAO,EAAE,EAChB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,CAChB,CACF,CAAC;QACJ,CAAC;QACD,cAAc;YACZ,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,SAAS,EAAE,4BAA4B,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;oBACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBAC/B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,gBAAgB,CACrB,SAAS,EACT,WAAW,CACwB,CACtC,CAAC;AACJ,CAAC"}

package/dist/private-data-sources/runtime-environment.d.ts

@@ -0,0 +1,2 @@
+export declare function workerEnvironment(): Record<string, unknown>;
+//# sourceMappingURL=runtime-environment.d.ts.map

package/dist/private-data-sources/runtime-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-environment.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/runtime-environment.ts"],"names":[],"mappings":"AAGA,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE3D"}

package/dist/private-data-sources/runtime-environment.js

@@ -0,0 +1,6 @@
+import { env } from "cloudflare:workers";
+// TanStack server code reads the bindings and the manifest off the ambient worker `env`.
+export function workerEnvironment() {
+    return env;
+}
+//# sourceMappingURL=runtime-environment.js.map

package/dist/private-data-sources/runtime-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-environment.js","sourceRoot":"","sources":["../../src/private-data-sources/runtime-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,yFAAyF;AACzF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAA8B,CAAC;AACxC,CAAC"}

package/dist/private-data-sources/sqlserver.d.ts

@@ -0,0 +1,18 @@
+export declare function sqlserver(name: unknown): Readonly<Readonly<{
+    name: string | undefined;
+    type: string | undefined;
+    readonly bindingName: string | undefined;
+    readonly host: string | undefined;
+    readonly port: number | undefined;
+    readonly database: string | undefined;
+    readonly username: string | undefined;
+    readonly user: string | undefined;
+    readonly password: string | undefined;
+    connect(options?: unknown): unknown;
+    readonly binding: unknown;
+}> & {
+    connect: (options?: unknown) => unknown;
+} & {
+    tediousConnector(): (_connectOptions?: unknown, _lookup?: unknown, signal?: AbortSignal) => Promise<import("./node-net-adapter.js").NodeNetSocket>;
+}>;
+//# sourceMappingURL=sqlserver.d.ts.map

package/dist/private-data-sources/sqlserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlserver.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/sqlserver.ts"],"names":[],"mappings":"AAIA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO;;;;;;;;;;;;;aAI1B,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO;;;GAa1C"}

package/dist/private-data-sources/sqlserver.js

@@ -0,0 +1,13 @@
+import { buildTediousConnectorFactory } from "./tedious-adapter.js";
+import { privateDataSourceReference } from "./manifest.js";
+import { buildTcpPrivateDataSource } from "./tcp.js";
+export function sqlserver(name) {
+    const source = buildTcpPrivateDataSource(privateDataSourceReference(name, "sqlserver"));
+    const extension = {
+        tediousConnector() {
+            return buildTediousConnectorFactory(() => source.connect());
+        },
+    };
+    return Object.freeze(Object.defineProperties(extension, Object.getOwnPropertyDescriptors(source)));
+}
+//# sourceMappingURL=sqlserver.js.map

package/dist/private-data-sources/sqlserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlserver.js","sourceRoot":"","sources":["../../src/private-data-sources/sqlserver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAErD,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,MAAM,GAAG,yBAAyB,CACtC,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAG9C,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,gBAAgB;YACd,OAAO,4BAA4B,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,gBAAgB,CACrB,SAAS,EACT,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CACL,CACtC,CAAC;AACJ,CAAC"}

package/dist/private-data-sources/tcp.d.ts

@@ -0,0 +1,29 @@
+import type { CloudflareTcpSocket, PrivateDataSourceManifestEntry } from "./types.js";
+export declare function buildTcpPrivateDataSource(entry: PrivateDataSourceManifestEntry): Readonly<{
+    name: string | undefined;
+    type: string | undefined;
+    readonly bindingName: string | undefined;
+    readonly host: string | undefined;
+    readonly port: number | undefined;
+    readonly database: string | undefined;
+    readonly username: string | undefined;
+    readonly user: string | undefined;
+    readonly password: string | undefined;
+    connect(options?: unknown): unknown;
+    readonly binding: unknown;
+}>;
+export declare function isCloudflareTcpSocket(socket: unknown): socket is CloudflareTcpSocket;
+export declare function tcp(name: unknown, expectedType: string): Readonly<{
+    name: string | undefined;
+    type: string | undefined;
+    readonly bindingName: string | undefined;
+    readonly host: string | undefined;
+    readonly port: number | undefined;
+    readonly database: string | undefined;
+    readonly username: string | undefined;
+    readonly user: string | undefined;
+    readonly password: string | undefined;
+    connect(options?: unknown): unknown;
+    readonly binding: unknown;
+}>;
+//# sourceMappingURL=tcp.d.ts.map

package/dist/private-data-sources/tcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/tcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,mBAAmB,EACnB,8BAA8B,EAE/B,MAAM,YAAY,CAAC;AAUpB,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B;;;;;;;;;;sBAyBzD,OAAO;;GAuB5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAUpF;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM;;;;;;;;;;sBArCjC,OAAO;;GAyC5B"}

package/dist/private-data-sources/tcp.js

@@ -0,0 +1,63 @@
+import { currentPrivateDataSource, privateDataSourceReference, privateDataSourceBinding, } from "./manifest.js";
+function hasConnect(binding) {
+    return (binding !== null &&
+        typeof binding === "object" &&
+        typeof binding.connect === "function");
+}
+export function buildTcpPrivateDataSource(entry) {
+    return Object.freeze({
+        name: entry.name,
+        type: entry.type,
+        get bindingName() {
+            return currentPrivateDataSource(entry).bindingName;
+        },
+        get host() {
+            return currentPrivateDataSource(entry).host;
+        },
+        get port() {
+            return currentPrivateDataSource(entry).port;
+        },
+        get database() {
+            return currentPrivateDataSource(entry).database;
+        },
+        get username() {
+            return currentPrivateDataSource(entry).username;
+        },
+        get user() {
+            return currentPrivateDataSource(entry).username;
+        },
+        get password() {
+            return currentPrivateDataSource(entry).password;
+        },
+        connect(options) {
+            const current = currentPrivateDataSource(entry);
+            const binding = privateDataSourceBinding(current);
+            if (!hasConnect(binding)) {
+                throw new Error(`Private data source "${current.name}" does not expose connect()`);
+            }
+            const address = typeof current.host === "string" && typeof current.port === "number"
+                ? { hostname: current.host, port: current.port }
+                : null;
+            if (!address) {
+                throw new Error(`Private data source "${current.name}" has no TCP address`);
+            }
+            return binding.connect(address, options);
+        },
+        get binding() {
+            return privateDataSourceBinding(entry);
+        },
+    });
+}
+export function isCloudflareTcpSocket(socket) {
+    const socketObject = socket;
+    return (socketObject !== null &&
+        typeof socketObject === "object" &&
+        !!socketObject.readable &&
+        typeof socketObject.readable.getReader === "function" &&
+        !!socketObject.writable &&
+        typeof socketObject.writable.getWriter === "function");
+}
+export function tcp(name, expectedType) {
+    return buildTcpPrivateDataSource(privateDataSourceReference(name, expectedType));
+}
+//# sourceMappingURL=tcp.js.map

package/dist/private-data-sources/tcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp.js","sourceRoot":"","sources":["../../src/private-data-sources/tcp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAOvB,SAAS,UAAU,CAAC,OAAgB;IAClC,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAQ,OAAiC,CAAC,OAAO,KAAK,UAAU,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,WAAW;YACb,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QACrD,CAAC;QACD,IAAI,IAAI;YACN,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI;YACN,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAClD,CAAC;QACD,IAAI,IAAI;YACN,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,OAAiB;YACvB,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,IAAI,6BAA6B,CAClE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBAChD,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,IAAI,sBAAsB,CAC3D,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO;YACT,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,YAAY,GAAG,MAA6C,CAAC;IACnE,OAAO,CACL,YAAY,KAAK,IAAI;QACrB,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,CAAC,YAAY,CAAC,QAAQ;QACvB,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU;QACrD,CAAC,CAAC,YAAY,CAAC,QAAQ;QACvB,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,YAAoB;IACrD,OAAO,yBAAyB,CAC9B,0BAA0B,CAAC,IAAI,EAAE,YAAY,CAAC,CAC/C,CAAC;AACJ,CAAC"}

package/dist/private-data-sources/tedious-adapter.d.ts

@@ -0,0 +1,2 @@
+export declare function buildTediousConnectorFactory(connect: () => unknown): (_connectOptions?: unknown, _lookup?: unknown, signal?: AbortSignal) => Promise<import("./node-net-adapter.js").NodeNetSocket>;
+//# sourceMappingURL=tedious-adapter.d.ts.map

package/dist/private-data-sources/tedious-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tedious-adapter.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/tedious-adapter.ts"],"names":[],"mappings":"AA4DA,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,OAAO,IACnD,kBAAkB,OAAO,EAAE,UAAU,OAAO,EAAE,SAAS,WAAW,4DAKjF"}

package/dist/private-data-sources/tedious-adapter.js

@@ -0,0 +1,63 @@
+import { isCloudflareTcpSocket } from "./tcp.js";
+import { buildNodeNetSocket } from "./node-net-adapter.js";
+function abortError(label, signal) {
+    return signal.reason instanceof Error
+        ? signal.reason
+        : new Error(`${label} connection aborted`);
+}
+async function waitForCloudflareTcpSocketOpen(socket, label, signal) {
+    if (!isCloudflareTcpSocket(socket)) {
+        throw new Error(`${label} did not return a readable/writable TCP socket`);
+    }
+    if (!socket.opened)
+        return;
+    if (!signal) {
+        await socket.opened;
+        return;
+    }
+    if (signal.aborted) {
+        try {
+            socket.close?.();
+        }
+        catch {
+            // Best-effort cleanup; surface the abort reason below.
+        }
+        throw abortError(label, signal);
+    }
+    let onAbort = null;
+    try {
+        await Promise.race([
+            socket.opened,
+            new Promise((_, reject) => {
+                onAbort = () => reject(abortError(label, signal));
+                signal.addEventListener("abort", onAbort, { once: true });
+            }),
+        ]);
+    }
+    catch (error) {
+        try {
+            socket.close?.();
+        }
+        catch {
+            // Preserve the original connection/abort error.
+        }
+        throw error;
+    }
+    finally {
+        if (onAbort)
+            signal.removeEventListener("abort", onAbort);
+    }
+}
+function buildTediousNetSocket(socket) {
+    return buildNodeNetSocket(socket, "SQL Server private data source", {
+        deferConnectEvent: true,
+    });
+}
+export function buildTediousConnectorFactory(connect) {
+    return async (_connectOptions, _lookup, signal) => {
+        const socket = connect();
+        await waitForCloudflareTcpSocketOpen(socket, "SQL Server private data source", signal);
+        return buildTediousNetSocket(socket);
+    };
+}
+//# sourceMappingURL=tedious-adapter.js.map

package/dist/private-data-sources/tedious-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tedious-adapter.js","sourceRoot":"","sources":["../../src/private-data-sources/tedious-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,SAAS,UAAU,CAAC,KAAa,EAAE,MAAmB;IACpD,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK;QACnC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,MAAe,EACf,KAAa,EACb,MAAoB;IAEpB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,MAAM,CAAC,MAAM;YACb,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACxB,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,OAAO,kBAAkB,CAAC,MAAM,EAAE,gCAAgC,EAAE;QAClE,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAsB;IACjE,OAAO,KAAK,EAAE,eAAyB,EAAE,OAAiB,EAAE,MAAoB,EAAE,EAAE;QAClF,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,8BAA8B,CAAC,MAAM,EAAE,gCAAgC,EAAE,MAAM,CAAC,CAAC;QACvF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC"}

package/dist/private-data-sources/types.d.ts

@@ -0,0 +1,27 @@
+export interface PrivateDataSourceManifestEntry {
+    name?: string;
+    type?: string;
+    bindingName?: string;
+    bindingKind?: string;
+    networkScope?: string;
+    baseUrl?: string;
+    host?: string;
+    port?: number;
+    database?: string;
+    username?: string;
+    password?: string;
+}
+export interface FetchPrivateDataSourceBinding {
+    fetch: (resource: RequestInfo | URL, init?: RequestInit) => Response | Promise<Response>;
+}
+export interface TcpPrivateDataSourceBinding {
+    connect: (address: unknown, options?: unknown) => unknown;
+}
+export interface CloudflareTcpSocket {
+    readable: ReadableStream<Uint8Array>;
+    writable: WritableStream<Uint8Array>;
+    opened?: Promise<unknown>;
+    close?: () => void;
+    closed?: Promise<unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/private-data-sources/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/private-data-sources/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;CAC3D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3B"}

package/dist/private-data-sources/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/private-data-sources/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/private-data-sources/types.ts"],"names":[],"mappings":""}

package/dist/private-data-sources-plugin.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "vite";
+export declare function privateDataSourcesPlugin(): Plugin;
+//# sourceMappingURL=private-data-sources-plugin.d.ts.map

package/dist/private-data-sources-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-data-sources-plugin.d.ts","sourceRoot":"","sources":["../src/private-data-sources-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAiCnC,wBAAgB,wBAAwB,IAAI,MAAM,CAmBjD"}

package/dist/private-data-sources-plugin.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Serves `base44:private-data-sources/<type>` to TanStack server code, so it
+ * reaches a workspace private data source with the SAME import a backend
+ * function uses:
+ *
+ *   import { sqlserver } from "base44:private-data-sources/sqlserver";
+ *
+ * The modules are this package's own copy of the backend-function adapters
+ * (`@base44/functions-compiler`), reading the worker's bindings and manifest off
+ * `env` from `cloudflare:workers`. Each specifier resolves to the compiled file
+ * so Vite bundles it like any source module.
+ *
+ * The bindings exist only on the deployed worker: in the editor's dev preview a
+ * lookup throws, saying the source is available on the published app.
+ */
+const PREFIX = "base44:private-data-sources/";
+const SOURCE_TYPES = new Set([
+    "elasticsearch",
+    "http",
+    "mariadb",
+    "mongodb",
+    "mysql",
+    "oracle",
+    "postgres",
+    "redis",
+    "sqlserver",
+]);
+const MODULES_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "private-data-sources");
+export function privateDataSourcesPlugin() {
+    return {
+        name: "base44-private-data-sources",
+        // Ahead of Vite's own resolution so the bare scheme is never read as a URL.
+        enforce: "pre",
+        resolveId(id) {
+            if (!id.startsWith(PREFIX))
+                return null;
+            const sourceType = id.slice(PREFIX.length);
+            if (!SOURCE_TYPES.has(sourceType)) {
+                this.error(`"${id}" is not a private data source type. Use one of: ${[...SOURCE_TYPES].join(", ")}.`);
+            }
+            // The source carries credentials, so it must never reach the browser bundle.
+            if (this.environment?.name === "client") {
+                this.error(`"${id}" is server-only. Move this import into a server function or server route.`);
+            }
+            return path.join(MODULES_DIR, `${sourceType}.js`);
+        },
+    };
+}
+//# sourceMappingURL=private-data-sources-plugin.js.map

package/dist/private-data-sources-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-data-sources-plugin.js","sourceRoot":"","sources":["../src/private-data-sources-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,eAAe;IACf,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAEpG,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,4EAA4E;QAC5E,OAAO,EAAE,KAAK;QAEd,SAAS,CAAC,EAAE;YACV,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,oDAAoD,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxG,CAAC;YACD,6EAA6E;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,4EAA4E,CAAC,CAAC;YACjG,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,KAAK,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/vite-plugin",
-  "version": "1.0.48-pr.138.622eb14",
+  "version": "1.0.48-pr.142.9fcc12e",
   "description": "The Vite plugin for base44 based applications",
   "type": "module",
   "license": "MIT",

package/src/index.ts

@@ -8,9 +8,12 @@ import { htmlInjectionsPlugin } from "./html-injections-plugin.js";
 import { buildStatusPlugin } from "./build-status-plugin.js";
 import { base44RuntimePlugin } from "./base44-runtime-plugin.js";
 import { workerdCompatPlugin } from "./workerd-compat-plugin.js";
+import { privateDataSourcesPlugin } from "./private-data-sources-plugin.js";
 import { routeRequestLogPlugin } from "./route-request-log/vite-plugin.js";
 export type { DocumentScript } from "./consts.js";
 
+const PLATFORM_API_PROXY_PATH = "^/api/(apps|app-logs)([/?]|$)";
+
 const isRunningInSandbox = !!process.env.MODAL_SANDBOX_ID;
 
 // Both optimizer spellings mean the same thing here: treat .js files as JSX,
@@ -158,12 +161,14 @@ export default function vitePlugin(
             : (() => {
                 if (env.VITE_BASE44_APP_BASE_URL) {
                   console.log(
-                    `[base44] Proxy enabled: /api -> ${env.VITE_BASE44_APP_BASE_URL}`
+                    `[base44] Proxy enabled: /api/apps, /api/app-logs -> ${env.VITE_BASE44_APP_BASE_URL}`
                   );
                   return {
                     server: {
                       proxy: {
-                        "/api": {
+                        // Only the platform's paths: the rest of /api is the app's own server
+                        // routes, and under `base44 dev` proxying them loops back to the CLI.
+                        [PLATFORM_API_PROXY_PATH]: {
                           target: env.VITE_BASE44_APP_BASE_URL,
                           changeOrigin: true,
                         },
@@ -304,6 +309,8 @@ export default function vitePlugin(
     // `ws` and `AsyncLocalStorage.enterWith()` for Cloudflare Workers server code.
     // Inert outside environments that resolve with the "workerd" condition.
     workerdCompatPlugin(),
+    // Serves `base44:private-data-sources/*` to TanStack server code.
+    privateDataSourcesPlugin(),
     // Dev-only: tags a full-stack route's console output with the request's
     // X-B44-Request-Id. Registered as a Nitro module (the `nitro` property)
     // because Nitro runs dev routes in a worker whose console the Vite process

package/src/private-data-sources/build-http.ts

@@ -0,0 +1,51 @@
+import { resolveHttpPrivateDataSourceUrl } from "./http-url.js";
+import {
+  currentPrivateDataSource,
+  privateDataSourceBinding,
+} from "./manifest.js";
+import type { FetchPrivateDataSourceBinding, PrivateDataSourceManifestEntry } from "./types.js";
+
+// Internal, NOT a public virtual module: app code cannot import this builder to
+// hand-forge a manifest entry. The only public entrypoints — http()/elasticsearch()
+// — resolve their entry from the immutable runtime manifest via lookupPrivateDataSource.
+
+function hasFetch(binding: unknown): binding is FetchPrivateDataSourceBinding {
+  return (
+    binding !== null &&
+    typeof binding === "object" &&
+    typeof (binding as { fetch?: unknown }).fetch === "function"
+  );
+}
+
+export function buildHttpPrivateDataSource(entry: PrivateDataSourceManifestEntry) {
+  return Object.freeze({
+    name: entry.name,
+    type: entry.type,
+    get bindingName() {
+      return currentPrivateDataSource(entry).bindingName;
+    },
+    fetch(resource: RequestInfo | URL, init?: RequestInit) {
+      const current = currentPrivateDataSource(entry);
+      const binding = privateDataSourceBinding(current);
+      if (!hasFetch(binding)) {
+        throw new Error(
+          `Private data source "${current.name}" does not expose fetch()`,
+        );
+      }
+      return binding.fetch(
+        resolveHttpPrivateDataSourceUrl(current, resource),
+        init,
+      );
+    },
+    // Fixed services expose the raw binding (Cloudflare pins their single
+    // target). Deferred Actor handles decide this from the request manifest,
+    // after their request environment exists.
+    get binding() {
+      const current = currentPrivateDataSource(entry);
+      return current.bindingName !== undefined
+        && current.networkScope !== "network"
+        ? privateDataSourceBinding(current)
+        : undefined;
+    },
+  });
+}

package/src/private-data-sources/cloudflare-workers.d.ts

@@ -0,0 +1,3 @@
+declare module "cloudflare:workers" {
+  export const env: unknown;
+}

package/src/private-data-sources/elasticsearch.ts

@@ -0,0 +1,8 @@
+import { buildHttpPrivateDataSource } from "./build-http.js";
+import { privateDataSourceReference } from "./manifest.js";
+
+export function elasticsearch(name: unknown) {
+  return buildHttpPrivateDataSource(
+    privateDataSourceReference(name, "elasticsearch"),
+  );
+}