@base44/functions-compiler 0.1.0

package/lib/src/static-egress-marker.js

@@ -0,0 +1,7 @@
+// Leaf module: no imports, so the server graph never reaches worker-only code.
+// `static-egress.ts` imports the runtime-context virtual specifier, which only
+// esbuild (or the vitest alias) can resolve — importing it from a server module
+// crashes Node at startup with ERR_UNSUPPORTED_ESM_URL_SCHEME.
+// Keep in sync with STATIC_EGRESS_ARTIFACT_MARKER in backend/app/static_egress/config.py.
+export const STATIC_EGRESS_ARTIFACT_MARKER = "base44.static-egress.request-env.v2";
+//# sourceMappingURL=static-egress-marker.js.map

package/lib/src/static-egress-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-egress-marker.js","sourceRoot":"","sources":["../../src/static-egress-marker.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,+DAA+D;AAC/D,0FAA0F;AAC1F,MAAM,CAAC,MAAM,6BAA6B,GACxC,qCAAqC,CAAC"}

package/lib/src/telemetry.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Post-response detached-work telemetry for generated Worker entries — a
+ * usage gauge for fetches that outlive the handler's Response
+ * (docs/features/post-response-telemetry.md). workerd cancels such fetches
+ * (Deno Deploy tolerated them), so the Deno→CFW migration breaks apps that
+ * rely on the pattern.
+ *
+ * When the bundle request carries `postResponseTelemetry: true` (backend
+ * evaluates the app-keyed `post-response-telemetry` flag at deploy time),
+ * the entry templates append this prelude and route the handler's response
+ * through `_b44AttachTelemetry`. Flag off appends nothing — the generated
+ * entry stays byte-identical to the pre-telemetry prod baseline.
+ *
+ * A request that returns with fetches pending logs one `inflight_at_response`
+ * line (through the console patch, so it carries function attribution) naming
+ * the target origins (refcounted, cap 10) and mirrors it onto the
+ * `X-B44-Post-Response-Telemetry` response header; the platform proxy relays
+ * that to Datadog and strips it before the client. Every observed fetch also
+ * rides ctx.waitUntil platform-side, so pending fetches complete (bounded by
+ * the waitUntil budget) instead of being cancelled, keeping the detached
+ * chain alive — its follow-up fetches log `fetch_started_post_response`
+ * without user code ever calling Base44.waitUntil. Clean traffic emits
+ * nothing and carries no header.
+ *
+ * Must be self-contained JS (no imports) — inlined into the generated entry
+ * after CONSOLE_PATCH. The entry provides `_b44Context` and the patched console.
+ */
+export declare const TELEMETRY_PATCH: string;
+/** Request-store fields the flag-ON entry seeds. Flag-OFF entries omit them
+ *  and every telemetry call site — control must stay byte-identical to the
+ *  pre-telemetry prod entry. */
+export declare const TELEMETRY_STORE_FIELDS = "reqId: crypto.randomUUID(), respondedAt: null, inflight: new Map(), inflightTotal: 0, hadRejection: false, hadNonOk: false, logBudget: 5";

package/lib/src/telemetry.js

@@ -0,0 +1,84 @@
+/**
+ * Post-response detached-work telemetry for generated Worker entries — a
+ * usage gauge for fetches that outlive the handler's Response
+ * (docs/features/post-response-telemetry.md). workerd cancels such fetches
+ * (Deno Deploy tolerated them), so the Deno→CFW migration breaks apps that
+ * rely on the pattern.
+ *
+ * When the bundle request carries `postResponseTelemetry: true` (backend
+ * evaluates the app-keyed `post-response-telemetry` flag at deploy time),
+ * the entry templates append this prelude and route the handler's response
+ * through `_b44AttachTelemetry`. Flag off appends nothing — the generated
+ * entry stays byte-identical to the pre-telemetry prod baseline.
+ *
+ * A request that returns with fetches pending logs one `inflight_at_response`
+ * line (through the console patch, so it carries function attribution) naming
+ * the target origins (refcounted, cap 10) and mirrors it onto the
+ * `X-B44-Post-Response-Telemetry` response header; the platform proxy relays
+ * that to Datadog and strips it before the client. Every observed fetch also
+ * rides ctx.waitUntil platform-side, so pending fetches complete (bounded by
+ * the waitUntil budget) instead of being cancelled, keeping the detached
+ * chain alive — its follow-up fetches log `fetch_started_post_response`
+ * without user code ever calling Base44.waitUntil. Clean traffic emits
+ * nothing and carries no header.
+ *
+ * Must be self-contained JS (no imports) — inlined into the generated entry
+ * after CONSOLE_PATCH. The entry provides `_b44Context` and the patched console.
+ */
+export const TELEMETRY_PATCH = [
+    "const _b44Tele = (c, event, fields) => {",
+    "  if (!(c.logBudget > 0)) return;",
+    "  c.logBudget -= 1;",
+    "  try { console.log(JSON.stringify({ b44_telemetry: 'post_response_work', event, request_id: c.reqId, ...fields })); } catch (e) {}",
+    "};",
+    // origin only — both query strings and paths can carry secrets (Slack
+    // webhook URLs, Telegram bot tokens); the census only needs the host.
+    "const _b44Target = (input) => { try { const u = typeof input === 'string' ? new URL(input) : (input instanceof URL ? input : new URL(input.url)); return u.origin; } catch (e) { return 'unknown'; } };",
+    "const _b44OrigFetch = globalThis.fetch.bind(globalThis);",
+    "globalThis.fetch = (input, init) => {",
+    "  const c = _b44Context();",
+    "  if (!c || c.respondedAt === undefined) return _b44OrigFetch(input, init);",
+    "  const t = _b44Target(input);",
+    "  if (c.respondedAt !== null) _b44Tele(c, 'fetch_started_post_response', { target: t, ms_after_response: Date.now() - c.respondedAt });",
+    // Refcounted (cap 10 distinct): same-target siblings must not lose the
+    // target when the first settles.
+    "  const tracked = c.inflight.has(t) || c.inflight.size < 10;",
+    "  if (tracked) c.inflight.set(t, (c.inflight.get(t) ?? 0) + 1);",
+    "  c.inflightTotal += 1;",
+    "  const done = () => { c.inflightTotal -= 1; if (tracked) { const n = c.inflight.get(t); if (n !== undefined) { if (n <= 1) c.inflight.delete(t); else c.inflight.set(t, n - 1); } } };",
+    // Ride ctx.waitUntil on every observed fetch (platform-side — user code
+    // needs no Base44.waitUntil): workerd then keeps the request context alive
+    // until the fetch settles, so a fetch pending at response completes instead
+    // of being cancelled, and follow-up fetches in the detached chain run and
+    // get logged. Bounded by Cloudflare's waitUntil budget; a no-op for fetches
+    // that settle in-request.
+    // Fail-fast discriminators: a pre-response rejection, or a pre-response
+    // non-ok resolution (an SDK/helper throws on !res.ok and the rejection
+    // fail-fasts Promise.all), marks the request as likely orphaning fallout
+    // rather than deliberate fire-and-forget — which has neither.
+    "  const failed = () => { if (c.respondedAt === null) c.hadRejection = true; done(); };",
+    "  const settled = (res) => { if (c.respondedAt === null && res && res.ok === false) c.hadNonOk = true; done(); };",
+    "  try { const p = _b44OrigFetch(input, init); p.then(settled, failed); if (c.waitUntil) { try { c.waitUntil(p.then(() => {}, () => {})); } catch (e) {} } return p; } catch (e) { failed(); throw e; }",
+    "};",
+    "const _b44AttachTelemetry = (res) => {",
+    "  const c = _b44Context();",
+    "  if (!c || c.respondedAt === undefined) return res;",
+    "  c.respondedAt = Date.now();",
+    // Upgrade responses can't be reconstructed; a live socket's fetches
+    // aren't post-response work anyway.
+    "  if (c.inflightTotal <= 0 || res.status === 101 || res.webSocket) return res;",
+    "  const pending = { request_id: c.reqId, inflight: c.inflightTotal, targets: [...c.inflight.keys()], rejected_pre_response: c.hadRejection, non_ok_pre_response: c.hadNonOk };",
+    "  _b44Tele(c, 'inflight_at_response', pending);",
+    // Once the wrap exists the original body stream is transferred — always
+    // return the wrap then; fall back to res only if construction itself threw.
+    "  let wrapped;",
+    "  try { wrapped = new Response(res.body, res); } catch (e) { return res; }",
+    "  try { wrapped.headers.set('X-B44-Post-Response-Telemetry', JSON.stringify({ pending })); } catch (e) {}",
+    "  return wrapped;",
+    "};",
+].join("\n");
+/** Request-store fields the flag-ON entry seeds. Flag-OFF entries omit them
+ *  and every telemetry call site — control must stay byte-identical to the
+ *  pre-telemetry prod entry. */
+export const TELEMETRY_STORE_FIELDS = "reqId: crypto.randomUUID(), respondedAt: null, inflight: new Map(), inflightTotal: 0, hadRejection: false, hadNonOk: false, logBudget: 5";
+//# sourceMappingURL=telemetry.js.map

package/lib/src/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,0CAA0C;IAC1C,mCAAmC;IACnC,qBAAqB;IACrB,qIAAqI;IACrI,IAAI;IACJ,sEAAsE;IACtE,sEAAsE;IACtE,yMAAyM;IACzM,0DAA0D;IAC1D,uCAAuC;IACvC,4BAA4B;IAC5B,6EAA6E;IAC7E,gCAAgC;IAChC,yIAAyI;IACzI,uEAAuE;IACvE,iCAAiC;IACjC,8DAA8D;IAC9D,iEAAiE;IACjE,yBAAyB;IACzB,yLAAyL;IACzL,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,0BAA0B;IAC1B,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,8DAA8D;IAC9D,wFAAwF;IACxF,mHAAmH;IACnH,wMAAwM;IACxM,IAAI;IACJ,wCAAwC;IACxC,4BAA4B;IAC5B,sDAAsD;IACtD,+BAA+B;IAC/B,oEAAoE;IACpE,oCAAoC;IACpC,gFAAgF;IAChF,gLAAgL;IAChL,iDAAiD;IACjD,wEAAwE;IACxE,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAC5E,2GAA2G;IAC3G,mBAAmB;IACnB,IAAI;CACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;gCAEgC;AAChC,MAAM,CAAC,MAAM,sBAAsB,GACjC,0IAA0I,CAAC"}

package/lib/src/tracing.d.ts

@@ -0,0 +1,9 @@
+export interface CompilerTracer {
+    withSpan<T>(name: string, fn: () => Promise<T>): Promise<T>;
+    setSpanTags(tags: Record<string, string | number | undefined>): Promise<void>;
+}
+/** Register the host's tracer; `null` restores the no-op. Must be called in the
+ *  same thread that runs the compile — spans are process-local. */
+export declare function setCompilerTracer(next: CompilerTracer | null): void;
+export declare function withSpan<T>(name: string, fn: () => Promise<T>): Promise<T>;
+export declare function setSpanTags(tags: Record<string, string | number | undefined>): Promise<void>;

package/lib/src/tracing.js

@@ -0,0 +1,21 @@
+// The compiler emits spans through whatever tracer the host registers. Apper's
+// bundler service registers its dd-trace adapter at worker startup; a CLI-local
+// build leaves the no-op in place. Keeps dd-trace and its initialization out of
+// the compiler's own dependencies.
+const noopTracer = {
+    withSpan: (_name, fn) => fn(),
+    setSpanTags: async () => { },
+};
+let tracer = noopTracer;
+/** Register the host's tracer; `null` restores the no-op. Must be called in the
+ *  same thread that runs the compile — spans are process-local. */
+export function setCompilerTracer(next) {
+    tracer = next ?? noopTracer;
+}
+export function withSpan(name, fn) {
+    return tracer.withSpan(name, fn);
+}
+export function setSpanTags(tags) {
+    return tracer.setSpanTags(tags);
+}
+//# sourceMappingURL=tracing.js.map

package/lib/src/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/tracing.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,mCAAmC;AAOnC,MAAM,UAAU,GAAmB;IACjC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,WAAW,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CAC5B,CAAC;AAEF,IAAI,MAAM,GAAmB,UAAU,CAAC;AAExC;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,GAAG,IAAI,IAAI,UAAU,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAI,IAAY,EAAE,EAAoB;IAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAiD;IAEjD,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/lib/src/worker-entry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Assembles user functions into the input the bundler compiles: the user
+ * sources (passed through verbatim — the Deno resolver understands their
+ * `npm:`/`jsr:`/`https:` specifiers) plus an injected shim and a generated
+ * Worker entry. This is the layer that understands "functions" and "an app".
+ */
+import type { AppFunctionInput } from "./contracts.js";
+export declare const SHIM_FILENAME = "__base44_deno_shim.mjs";
+export declare const ACTIVATION_FILENAME = "__base44_activation.mjs";
+export interface PreparedWorker {
+    entry: string;
+    files: Record<string, string>;
+}
+export declare function workerRuntimeFiles(): Record<string, string>;
+/** Shared console-patching prelude injected into every generated Worker entry.
+ *  Exported so tests can build minimal bundles with the same patch applied. */
+export declare const CONSOLE_PATCH: string;
+/** Assemble a single Deno function into a bundle-ready Worker. */
+export declare function prepareFunction(entry: string, files: Record<string, string>, postResponseTelemetry?: boolean, runtimeSecrets?: boolean): Promise<PreparedWorker>;
+/** One app function paired with the stable key its files and diagnostics are
+ *  namespaced under (`fn_<index>`). The index is the function's original
+ *  position so attribution stays correct across an exclude-and-rebuild. */
+export interface AppFunctionEntry {
+    index: number;
+    fn: AppFunctionInput;
+}
+/** Assemble the whole app into ONE bundle-ready Worker: every function's files
+ *  namespaced under `fn_<index>/`, one shared shim, and a router that routes by
+ *  function name. A single compile resolves and DEDUPES npm deps across all
+ *  functions (vs one inlined copy per chunk) — but esbuild fails the whole build
+ *  on any unresolved import, so the caller excludes the offending functions
+ *  (identified by their `fn_<index>/` path) and rebuilds the survivors. Each
+ *  function is sealed to its own `fn_<index>/` keyspace, so one can't import
+ *  another's files. */
+export declare function prepareApp(entries: AppFunctionEntry[], postResponseTelemetry?: boolean, runtimeSecrets?: boolean): PreparedWorker;
+export declare function assertNoReservedFilenames(files: Record<string, string>): void;

package/lib/src/worker-entry.js

@@ -0,0 +1,320 @@
+/**
+ * Assembles user functions into the input the bundler compiles: the user
+ * sources (passed through verbatim — the Deno resolver understands their
+ * `npm:`/`jsr:`/`https:` specifiers) plus an injected shim and a generated
+ * Worker entry. This is the layer that understands "functions" and "an app".
+ */
+import { readFileSync } from "node:fs";
+import { DenoCompatError } from "./errors.js";
+import { RUNTIME_CONTEXT_SPECIFIER } from "./esbuild/runtime-context-virtual.js";
+import { TELEMETRY_PATCH, TELEMETRY_STORE_FIELDS } from "./telemetry.js";
+// Pre-built by scripts/build-shim.ts; regenerate it after changing the shim.
+// Read LAZILY, not at module load: build-shim.ts transitively imports this
+// module through the esbuild plugins, and on a fresh checkout dist/ doesn't
+// exist yet — a load-time read would crash the very script that produces these
+// files (and only pass locally where dist/ already exists).
+let _denoShimSource;
+function denoShimSource() {
+    _denoShimSource ??= readFileSync(new URL("../dist/deno-shim.mjs", import.meta.url), "utf8");
+    return _denoShimSource;
+}
+let _activationShimSource;
+function activationShimSource() {
+    _activationShimSource ??= readFileSync(new URL("../dist/activation-shim.mjs", import.meta.url), "utf8");
+    return _activationShimSource;
+}
+// Synthetic files injected into the bundle; asserted absent from user input.
+export const SHIM_FILENAME = "__base44_deno_shim.mjs";
+const ENTRY_FILENAME = "__base44_entry.mjs";
+// Injected only for runtime-secrets bundles — old-mode output stays byte-identical.
+export const ACTIVATION_FILENAME = "__base44_activation.mjs";
+// Actor shim filename is also reserved (handled by actor-compat.ts).
+const ACTOR_ENTRY_FILENAME = "__base44_actor_entry.mjs";
+export function workerRuntimeFiles() {
+    return { [SHIM_FILENAME]: denoShimSource() };
+}
+/** Shared console-patching prelude injected into every generated Worker entry.
+ *  Exported so tests can build minimal bundles with the same patch applied. */
+// Runs at module scope before any user code so module-level logs are captured.
+// Generated entries import `_b44Context` from the private runtime module.
+export const CONSOLE_PATCH = [
+    "const _b44Orig = console.log;",
+    "const _b44S = x => { if (x instanceof Error) return x.stack || x.message; try { return typeof x === 'string' ? x : (JSON.stringify(x) ?? String(x)); } catch (e) { return String(x); } };",
+    "const _b44Fmt = (a) => {",
+    "  if (typeof a[0] !== 'string' || !a[0].includes('%')) return a.map(_b44S).join(' ');",
+    "  let i = 1;",
+    "  const s = a[0].replace(/%([sdifoOc])/g, (_, t) => {",
+    "    if (i >= a.length) return '%' + t;",
+    "    const v = a[i++];",
+    "    if (t === 'd' || t === 'i') { try { return String(Math.trunc(+v)); } catch(_) { return _b44S(v); } }",
+    "    if (t === 'f') { try { return String(+v); } catch(_) { return _b44S(v); } }",
+    "    if (t === 'c') return '';",
+    "    return _b44S(v);",
+    "  });",
+    "  const tail = a.slice(i).map(_b44S).join(' ');",
+    "  return tail ? s + ' ' + tail : s;",
+    "};",
+    // The store holds { env, fn, secrets, workerEnv, waitUntil }; fn is set only
+    // by per-app bundles, where one script serves every function and log queries
+    // need per-function attribution. `secrets` and `workerEnv` reference the
+    // request's authoritative Worker env binding.
+    "const _b44Wrap = (lvl, a) => { const _c = _b44Context() ?? {}; _b44Orig({ _b44_env: _c.env ?? 'preview', ...(_c.fn ? { _b44_function: _c.fn } : {}), level: lvl, message: _b44Fmt(a) }); };",
+    "console.log = (...a) => _b44Wrap('info', a);",
+    "console.info = (...a) => _b44Wrap('info', a);",
+    "console.warn = (...a) => _b44Wrap('warn', a);",
+    "console.error = (...a) => _b44Wrap('error', a);",
+    "console.debug = (...a) => _b44Wrap('debug', a);",
+    // Request-scoped background-work hook. Cloudflare cancels promises left
+    // pending after the response unless they ride ctx.waitUntil, and user code
+    // has no other path to ctx — expose it via the same store as env/fn so
+    // functions can ack fast and finish work reliably afterwards. The global
+    // reads the store per call, so concurrent requests get their own ctx.
+    // `secrets` reads the request's Worker env binding the same way. Two filters:
+    //  - reserved platform keys (the private-data-sources manifest, which carries
+    //    plaintext VPC DB credentials) are denied — user code reaches data sources
+    //    via the base44:private-data-sources/* imports, never the raw manifest;
+    //  - only string values are returned, so non-secret bindings (Hyperdrive
+    //    objects, etc.) stay hidden.
+    // This global is the internal bridge behind the "base44:runtime" virtual
+    // module (src/runtime/index.ts) — keep the two shapes in sync (the actor
+    // shim installs the same bridge from the DO env: src/shim/actor.ts).
+    "const _b44ReservedSecrets = new Set(['BASE44_ACTOR_PRIVATE_KEY', 'BASE44_ACTOR_PUBLIC_KEY', 'BASE44_ACTOR_SCRIPT_ID', 'BASE44_PRIVATE_DATA_SOURCES']);",
+    // Coerce to a primitive string BEFORE the reserved-key check: a boxed
+    // `new String('BASE44_PRIVATE_DATA_SOURCES')` fails Set.has (object identity)
+    // but would coerce back to the reserved key on the `env[...]` lookup, leaking
+    // the manifest. `String(n)` normalizes both the check and the lookup.
+    "globalThis.Base44 = Object.assign(globalThis.Base44 ?? {}, { waitUntil: (p) => { const _c = _b44Context(); if (_c?.waitUntil) { _c.waitUntil(p); } else { Promise.resolve(p).catch(() => {}); } }, secrets: { get: (n) => { const _k = String(n); if (_b44ReservedSecrets.has(_k)) return undefined; const _v = _b44Context()?.secrets?.[_k]; return typeof _v === 'string' ? _v : undefined; } } });",
+    // Supabase-compat alias so copy-pasted EdgeRuntime.waitUntil code works.
+    "globalThis.EdgeRuntime = globalThis.EdgeRuntime ?? { waitUntil: (p) => globalThis.Base44.waitUntil(p) };",
+].join("\n");
+/** Assemble a single Deno function into a bundle-ready Worker. */
+export async function prepareFunction(entry, files, postResponseTelemetry = false, runtimeSecrets = false) {
+    assertNoReservedFilenames(files);
+    return {
+        entry: ENTRY_FILENAME,
+        files: {
+            ...userFiles(files),
+            ...workerRuntimeFiles(),
+            ...(runtimeSecrets
+                ? { [ACTIVATION_FILENAME]: activationShimSource() }
+                : {}),
+            [ENTRY_FILENAME]: buildEntrySource(entry, postResponseTelemetry, runtimeSecrets),
+        },
+    };
+}
+/** Assemble the whole app into ONE bundle-ready Worker: every function's files
+ *  namespaced under `fn_<index>/`, one shared shim, and a router that routes by
+ *  function name. A single compile resolves and DEDUPES npm deps across all
+ *  functions (vs one inlined copy per chunk) — but esbuild fails the whole build
+ *  on any unresolved import, so the caller excludes the offending functions
+ *  (identified by their `fn_<index>/` path) and rebuilds the survivors. Each
+ *  function is sealed to its own `fn_<index>/` keyspace, so one can't import
+ *  another's files. */
+export function prepareApp(entries, postResponseTelemetry = false, runtimeSecrets = false) {
+    const files = {
+        ...workerRuntimeFiles(),
+        ...(runtimeSecrets
+            ? { [ACTIVATION_FILENAME]: activationShimSource() }
+            : {}),
+    };
+    const moduleFiles = entries.map(({ index, fn }) => {
+        assertNoReservedFilenames(fn.files);
+        const dir = `fn_${index}`;
+        for (const [filePath, content] of Object.entries(userFiles(fn.files))) {
+            files[`${dir}/${filePath}`] = content;
+        }
+        const wrapper = `__base44_fn_${index}.mjs`;
+        files[wrapper] = buildFunctionModuleSource(fn.name, `${dir}/${fn.entry}`);
+        return wrapper;
+    });
+    files[ENTRY_FILENAME] = buildAppEntrySource(moduleFiles, postResponseTelemetry, runtimeSecrets);
+    return { entry: ENTRY_FILENAME, files };
+}
+// Activation prelude for runtime-secrets bundles: gate on the encrypted
+// handshake BEFORE any user module is imported (so a needs-activation response
+// implies no user side effect ran), then strip the envelope from the request.
+const ACTIVATION_GATE = `      const _b44Activation = await ensureActivation(request, env);
+      if (_b44Activation) return _b44Activation;
+      request = withoutRuntimeSecretsHeader(request);
+`;
+function activationImport(runtimeSecrets) {
+    return runtimeSecrets
+        ? `\nimport { ensureActivation, withoutActivationSignal, withoutRuntimeSecretsHeader } from "./${ACTIVATION_FILENAME}";`
+        : "";
+}
+/** Build the wrapper entry that loads the shim, lazily imports the user module
+ *  on the first request (so init logs are tagged with the real request env),
+ *  then exports a standard Worker fetch that delegates to that handler. */
+function buildEntrySource(userEntry, telemetry, runtimeSecrets = false) {
+    const userImport = `./${userEntry.replace(/^\.\//, "")}`;
+    // Handler responses get the activation-signal header stripped (user code must
+    // not be able to forge a signal after side effects and cause a re-execution).
+    const handlerExpr = telemetry
+        ? "_b44AttachTelemetry(await handler(request, info))"
+        : runtimeSecrets
+            ? "await handler(request, info)"
+            : "handler(request, info)";
+    const returnExpr = runtimeSecrets
+        ? `withoutActivationSignal(${handlerExpr})`
+        : handlerExpr;
+    return `// Auto-generated by the base44 bundler. Do not edit.
+
+import { currentWorkerRuntimeContext as _b44Context, runWithWorkerEnvironment as _b44Run } from ${JSON.stringify(RUNTIME_CONTEXT_SPECIFIER)};
+import { getRegisteredHandler, installStaticEgressFetch } from "./${SHIM_FILENAME}";${activationImport(runtimeSecrets)}
+
+${CONSOLE_PATCH}
+// Static egress reads workerEnv from the active request store. Install it
+// before telemetry so telemetry remains the outermost fetch wrapper.
+installStaticEgressFetch();
+${telemetry ? TELEMETRY_PATCH : ""}
+
+let _b44Init = null;
+export default {
+  async fetch(request, env, ctx) {
+    const _b44Env = (request.headers.get('base44-functions-version') ?? '') === 'prod' ? 'prod' : 'preview';
+    return _b44Run({ env: _b44Env, secrets: ${runtimeSecrets ? "process.env" : "env"}, workerEnv: env, waitUntil: (p) => ctx.waitUntil(p)${telemetry ? `, ${TELEMETRY_STORE_FIELDS}` : ""} }, async () => {
+${runtimeSecrets ? ACTIVATION_GATE : ""}      if (!_b44Init) _b44Init = import(${JSON.stringify(userImport)}).catch(e => { _b44Init = null; throw e; });
+      const _b44Mod = await _b44Init;
+      // Deno.serve capture wins (legacy contract, zero behavior change);
+      // a default-exported handler is the new-contract fallback.
+      const handler = getRegisteredHandler() ?? (typeof _b44Mod?.default === 'function' ? _b44Mod.default : null);
+      if (!handler) {
+        return new Response(
+          "The function must export default a request handler or call Deno.serve()",
+          { status: 503 },
+        );
+      }
+      // Deno's handler signature is (request, info). Cloudflare doesn't expose a
+      // connection address the same way; pass a best-effort placeholder. Real
+      // client IP is available via the "cf-connecting-ip" request header.
+      const info = {
+        remoteAddr: { transport: "tcp", hostname: "0.0.0.0", port: 0 },
+      };
+      return ${returnExpr};
+    });
+  },
+};
+`;
+}
+function buildFunctionModuleSource(functionName, userEntry) {
+    const userImport = `./${userEntry.replace(/^\.\//, "")}`;
+    return `// Auto-generated by the base44 bundler. Do not edit.
+import { registerLazy } from "./${SHIM_FILENAME}";
+
+registerLazy(${JSON.stringify(functionName)}, () => import(${JSON.stringify(userImport)}));
+`;
+}
+function buildAppEntrySource(functionModules, telemetry, runtimeSecrets = false) {
+    const moduleImports = functionModules
+        .map((file) => `import "./${file}";`)
+        .join("\n");
+    const handlerExpr = telemetry
+        ? "_b44AttachTelemetry(await handler(request, info))"
+        : "await handler(request, info)";
+    const returnExpr = runtimeSecrets
+        ? `withoutActivationSignal(${handlerExpr})`
+        : handlerExpr;
+    return `// Auto-generated by the base44 bundler. Do not edit.
+
+import { currentWorkerRuntimeContext as _b44Context, runWithWorkerEnvironment as _b44Run } from ${JSON.stringify(RUNTIME_CONTEXT_SPECIFIER)};
+import { installStaticEgressFetch, resolveHandler } from "./${SHIM_FILENAME}";${activationImport(runtimeSecrets)}
+${moduleImports}
+
+${CONSOLE_PATCH}
+// Static egress reads workerEnv from the active request store. Install it
+// before telemetry so telemetry remains the outermost fetch wrapper.
+installStaticEgressFetch();
+${telemetry ? TELEMETRY_PATCH : ""}
+
+export default {
+  async fetch(request, env, ctx) {
+    const _b44Env = (request.headers.get('base44-functions-version') ?? '') === 'prod' ? 'prod' : 'preview';
+    const functionName = request.headers.get("Base44-Function-Name");
+    return _b44Run({ env: _b44Env, fn: functionName ?? '', secrets: ${runtimeSecrets ? "process.env" : "env"}, workerEnv: env, waitUntil: (p) => ctx.waitUntil(p)${telemetry ? `, ${TELEMETRY_STORE_FIELDS}` : ""} }, async () => {
+${runtimeSecrets ? ACTIVATION_GATE : ""}      // Each early return below logs through the patch first: per-function log
+      // queries on per-app scripts keep only stamped lines, so a bare return
+      // would leave the failing invocation with no trace in its own logs.
+      const pendingHandler = functionName ? resolveHandler(functionName) : undefined;
+      if (pendingHandler === undefined) {
+        const message = \`No function registered for "\${functionName ?? ""}"\`;
+        console.error(message);
+        return new Response(message, { status: 404 });
+      }
+      let handler;
+      try {
+        handler = await pendingHandler;
+      } catch (e) {
+        console.error(\`Function "\${functionName}" failed to initialize:\`, e);
+        return new Response(
+          \`Function "\${functionName}" failed to initialize: \${e instanceof Error ? e.message : String(e)}\`,
+          { status: 500 },
+        );
+      }
+      if (handler === null) {
+        const message = \`Function "\${functionName}" must export default a request handler or call Deno.serve()\`;
+        console.error(message);
+        return new Response(message, { status: 503 });
+      }
+      // Real client IP is in the "cf-connecting-ip" header, not this placeholder.
+      const info = {
+        remoteAddr: { transport: "tcp", hostname: "0.0.0.0", port: 0 },
+      };
+      // Cloudflare reports uncaught exceptions as its own log events, outside
+      // the console patch and therefore without function attribution. Log the
+      // crash through the patch (stamped with _b44_function) before
+      // rethrowing; per-function log queries on per-app scripts keep only
+      // stamped lines (see log_query.event_matches_function). Known gap:
+      // exceptions thrown while a response body streams happen after this
+      // frame returns and cannot be stamped — those crash events are
+      // dropped from per-function views.
+      try {
+        return ${returnExpr};
+      } catch (e) {
+        console.error(e);
+        throw e;
+      }
+    });
+  },
+};
+`;
+}
+export function assertNoReservedFilenames(files) {
+    // Shim/entry/actor are reserved as exact root keys (unchanged — a flag-off
+    // bundle accepts exactly what prod accepts today).
+    if (SHIM_FILENAME in files ||
+        ENTRY_FILENAME in files ||
+        ACTOR_ENTRY_FILENAME in files) {
+        throw new DenoCompatError(`Reserved filenames "${SHIM_FILENAME}" / "${ENTRY_FILENAME}" / "${ACTOR_ENTRY_FILENAME}" must not be present in the function files.`);
+    }
+    // The activation shim is the ONLY importer allowed to reach the private
+    // PDS-manifest store (plaintext VPC/DB creds), and that gate keys on the
+    // ACTIVATION_FILENAME basename. Reserve that basename at ANY depth in EVERY
+    // mode — not just runtime-secrets. In flag-off / actor bundles no shim is
+    // injected, but a user file named `__base44_activation.mjs` would still match
+    // the store gate's allow-list and could forge the manifest to retarget a VPC
+    // binding; reserving it unconditionally (like shim/entry above) closes that.
+    for (const filePath of Object.keys(files)) {
+        if (filePath.slice(filePath.lastIndexOf("/") + 1) === ACTIVATION_FILENAME) {
+            throw new DenoCompatError(`Reserved filename "${ACTIVATION_FILENAME}" must not be present in the function files (found "${filePath}").`);
+        }
+    }
+}
+/** Pass user sources through verbatim, dropping any build-config files: we own
+ *  the `deno.json` (written into the bundle temp dir) and never honor a
+ *  user-supplied one, so it can't change dependency resolution. */
+function userFiles(files) {
+    const out = {};
+    for (const [filePath, content] of Object.entries(files)) {
+        if (isBuildConfig(filePath))
+            continue;
+        out[filePath] = content;
+    }
+    return out;
+}
+function isBuildConfig(filePath) {
+    return (filePath === "package.json" ||
+        filePath.endsWith("/package.json") ||
+        filePath === "deno.json" ||
+        filePath.endsWith("/deno.json"));
+}
+//# sourceMappingURL=worker-entry.js.map

package/lib/src/worker-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,IAAI,eAAmC,CAAC;AACxC,SAAS,cAAc;IACrB,eAAe,KAAK,YAAY,CAC9B,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EACjD,MAAM,CACP,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AACD,IAAI,qBAAyC,CAAC;AAC9C,SAAS,oBAAoB;IAC3B,qBAAqB,KAAK,YAAY,CACpC,IAAI,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EACvD,MAAM,CACP,CAAC;IACF,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AACtD,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAC5C,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAC7D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAOxD,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;+EAC+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,+BAA+B;IAC/B,2LAA2L;IAC3L,0BAA0B;IAC1B,uFAAuF;IACvF,cAAc;IACd,uDAAuD;IACvD,wCAAwC;IACxC,uBAAuB;IACvB,0GAA0G;IAC1G,iFAAiF;IACjF,+BAA+B;IAC/B,sBAAsB;IACtB,OAAO;IACP,iDAAiD;IACjD,qCAAqC;IACrC,IAAI;IACJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,8CAA8C;IAC9C,6LAA6L;IAC7L,8CAA8C;IAC9C,+CAA+C;IAC/C,+CAA+C;IAC/C,iDAAiD;IACjD,iDAAiD;IACjD,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,yEAAyE;IACzE,iCAAiC;IACjC,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,wJAAwJ;IACxJ,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,uYAAuY;IACvY,yEAAyE;IACzE,0GAA0G;CAC3G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,KAA6B,EAC7B,qBAAqB,GAAG,KAAK,EAC7B,cAAc,GAAG,KAAK;IAEtB,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE;YACL,GAAG,SAAS,CAAC,KAAK,CAAC;YACnB,GAAG,kBAAkB,EAAE;YACvB,GAAG,CAAC,cAAc;gBAChB,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,EAAE,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAChC,KAAK,EACL,qBAAqB,EACrB,cAAc,CACf;SACF;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;;uBAOuB;AACvB,MAAM,UAAU,UAAU,CACxB,OAA2B,EAC3B,qBAAqB,GAAG,KAAK,EAC7B,cAAc,GAAG,KAAK;IAEtB,MAAM,KAAK,GAA2B;QACpC,GAAG,kBAAkB,EAAE;QACvB,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,EAAE,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE;QAChD,yBAAyB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtE,KAAK,CAAC,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC;QACxC,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,KAAK,MAAM,CAAC;QAC3C,KAAK,CAAC,OAAO,CAAC,GAAG,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,cAAc,CAAC,GAAG,mBAAmB,CACzC,WAAW,EACX,qBAAqB,EACrB,cAAc,CACf,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,eAAe,GAAG;;;CAGvB,CAAC;AAEF,SAAS,gBAAgB,CAAC,cAAuB;IAC/C,OAAO,cAAc;QACnB,CAAC,CAAC,+FAA+F,mBAAmB,IAAI;QACxH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;2EAE2E;AAC3E,SAAS,gBAAgB,CACvB,SAAiB,EACjB,SAAkB,EAClB,cAAc,GAAG,KAAK;IAEtB,MAAM,UAAU,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;IACzD,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,cAAc;YACd,CAAC,CAAC,8BAA8B;YAChC,CAAC,CAAC,wBAAwB,CAAC;IAC/B,MAAM,UAAU,GAAG,cAAc;QAC/B,CAAC,CAAC,2BAA2B,WAAW,GAAG;QAC3C,CAAC,CAAC,WAAW,CAAC;IAChB,OAAO;;kGAEyF,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;oEACvE,aAAa,KAAK,gBAAgB,CAAC,cAAc,CAAC;;EAEpH,aAAa;;;;EAIb,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;;;;;;8CAMY,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,uDAAuD,SAAS,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE;EACvL,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,0CAA0C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;eAiB5F,UAAU;;;;CAIxB,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAoB,EACpB,SAAiB;IAEjB,MAAM,UAAU,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;IACzD,OAAO;kCACyB,aAAa;;eAEhC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;CACtF,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAC1B,eAAyB,EACzB,SAAkB,EAClB,cAAc,GAAG,KAAK;IAEtB,MAAM,aAAa,GAAG,eAAe;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,8BAA8B,CAAC;IACnC,MAAM,UAAU,GAAG,cAAc;QAC/B,CAAC,CAAC,2BAA2B,WAAW,GAAG;QAC3C,CAAC,CAAC,WAAW,CAAC;IAChB,OAAO;;kGAEyF,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;8DAC7E,aAAa,KAAK,gBAAgB,CAAC,cAAc,CAAC;EAC9G,aAAa;;EAEb,aAAa;;;;EAIb,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;;;;;;sEAMoC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,uDAAuD,SAAS,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE;EAC/M,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCtB,UAAU;;;;;;;;CAQ1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA6B;IACrE,2EAA2E;IAC3E,mDAAmD;IACnD,IACE,aAAa,IAAI,KAAK;QACtB,cAAc,IAAI,KAAK;QACvB,oBAAoB,IAAI,KAAK,EAC7B,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,uBAAuB,aAAa,QAAQ,cAAc,QAAQ,oBAAoB,8CAA8C,CACrI,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAC1E,MAAM,IAAI,eAAe,CACvB,sBAAsB,mBAAmB,uDAAuD,QAAQ,KAAK,CAC9G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;mEAEmE;AACnE,SAAS,SAAS,CAAC,KAA6B;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtC,GAAG,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,CACL,QAAQ,KAAK,cAAc;QAC3B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QAClC,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@base44/functions-compiler",
+  "version": "0.1.0",
+  "description": "Production compiler for Base44 backend functions — turns function sources into a single Cloudflare Workers module.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/src/index.d.ts",
+      "default": "./lib/src/index.js"
+    }
+  },
+  "files": [
+    "lib",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "bun run clean && bun run build:shim && tsc -p tsconfig.build.json && bun run scripts/copy-assets.ts",
+    "build:shim": "bun run scripts/build-shim.ts",
+    "clean": "rm -rf dist lib",
+    "typecheck": "tsc --noEmit",
+    "test": "bun run build:shim && vitest run"
+  },
+  "dependencies": {
+    "@deno/loader": "npm:@jsr/deno__loader@0.5.0",
+    "esbuild": "0.28.0",
+    "zod": "3.25.76"
+  },
+  "devDependencies": {
+    "@deno/shim-deno": "0.19.2",
+    "@types/node": "^22.10.0",
+    "miniflare": "^4.20260529.0",
+    "partyserver": "0.0.56",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  }
+}