Struct DomainConfig 

pub struct DomainConfig {
    pub schema_version: u32,
    pub name: String,
    pub domain: String,
    pub front_door: FrontDoor,
    pub cdn_bucket: String,
    pub worker_bundle_path: Option<String>,
    pub routes: Vec<DomainRoute>,
}

A routing manifest for one domain, from .yah/domains/<name>.toml.

The domain manifest is the only place that knows about path routing: services declare static/backend components by opaque ID, and this manifest binds those components to URL paths on a public-facing domain. Generated Worker bundles consume this. See .yah/docs/working/W118-yah-domain-tiers.md (R347).

Fields

schema_version: u32

name: String

Stable identifier for this domain (file stem of the manifest). Example: "yah-dev" for the yah.dev zone.

domain: String

The fully-qualified domain this manifest routes for. Example: "yah.dev", "app.yah.dev".

front_door: FrontDoor

Which front door serves this domain (R594-F12). Required — a default here would silently re-create the defect the field exists to close. Cross-checked against routes / worker_bundle_path by DomainConfig::validate_front_door at load time.

cdn_bucket: String

Public CDN bucket name. Static-mode route components publish into this bucket. Owned by the domain, not by any single service.

worker_bundle_path: Option<String>

Optional path (relative to workspace root) where the generated Worker bundle lands. None while the bundle generator (R347-F4) is still being wired up.

routes: Vec<DomainRoute>

Implementations

impl DomainConfig

pub fn load(path: &Path) -> Result<Self>

Parse a single .yah/domains/<name>.toml, rejecting a manifest whose declared front door contradicts its route table (Self::validate_front_door).

pub fn validate_front_door(&self) -> Result<()>

R594-F12 — the front door must agree with the rest of the manifest.

• bucket-direct is an R2 custom domain: a Worker route table would never be consulted, so declaring one means the author expected Worker behaviour (clean URLs, SPA fallback, branded errors) from a surface that cannot provide it. Rejected rather than silently ignored. Same for worker_bundle_path — nothing would deploy it.
• worker / passway with an empty route table is a silent 404 machine: the front door exists, has nothing to serve, and every request falls through to the catch-all.

Called from Self::load, so both CloudConfig::load and CloudConfig::load_from_config_dir enforce it.

pub fn route_headers_json(&self) -> String

The ROUTE_HEADERS Worker binding for this domain (R746) — the route table’s path + headers pairs, in manifest order, with routes that declare no headers dropped. "[]" when nothing declares any.

Order is load-bearing and must survive serialization: the front door applies the FIRST matching rule, so /app/* above /* is what gives the app its isolation headers and leaves the marketing site alone. That is why this is a Vec of pairs and not a map keyed by path.

Infallible by design — Self::validate_route_headers has already run at Self::load, so by the time a reconciler calls this the table is known to be one both front doors can apply.

pub fn validate_route_headers(&self) -> Result<()>

R749-T5 — everything Self::route_headers_json emits must be applicable, checked here where the table is PRODUCED.

That method serializes a typed struct, so the table’s JSON shape is sound by construction. Its contents are not: a route’s headers map is a free-form name -> value read verbatim out of hand-written TOML, so "Cross Origin Opener Policy" (spaces instead of hyphens) or a value carrying a newline ships a structurally-valid table that neither front door can apply — and they fail differently, neither naming the manifest line responsible:

• passway — mesofact::route_headers::RouteHeaderTable::parse refuses the start, so the origin is simply down.
• worker — validateRouteHeaderTable accepts it (it checks shape, not header validity) and applyRouteHeaders then throws inside the exported fetch, which is a 500 on every request, not the serve-without-the-headers degradation that code intends.

So the strictness lives at the producer: a table that cannot be applied fails yah cloud apply at manifest load, naming domain, route and header. This is deliberately not a second parser — the check is HeaderName/HeaderValue’s own, the very constructors the passway door runs on the far side, and route matching semantics stay defined once, at the doors. Only routes that contribute to the table are checked, so the invariant is exactly “route_headers_json’s output parses”.

Called from Self::load, alongside Self::validate_front_door.

pub fn serves_service(&self, service: &str) -> bool

Whether this domain’s route table binds any component of service.

pub fn save(&self, workspace_root: &Path) -> Result<()>

Persist to .yah/domains/<name>.toml, creating the domains directory if needed. Create-or-overwrite.

pub fn delete(workspace_root: &Path, name: &str) -> Result<bool>

Remove .yah/domains/<name>.toml. Returns false when the file was already absent.

Trait Implementations

impl Clone for DomainConfig

fn clone(&self) -> DomainConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DomainConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for DomainConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for DomainConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.