@astrale-os/adapter-cloudflare 0.1.1 → 0.1.2

package/dist/client.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Build the optional client SPA (the Views' UI). Best-effort: if the project
+ * has no `client/` or no resolvable Vite, we skip — the RPC surface and inline
+ * Views still work without a built SPA.
+ */
+export declare function buildClient(clientDir: string, projectDir: string, onLog?: (line: string) => void): Promise<void>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/client.js

@@ -0,0 +1,43 @@
+/**
+ * Build the optional client SPA (the Views' UI). Best-effort: if the project
+ * has no `client/` or no resolvable Vite, we skip — the RPC surface and inline
+ * Views still work without a built SPA.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+export async function buildClient(clientDir, projectDir, onLog) {
+    const viteBin = [
+        join(clientDir, 'node_modules', '.bin', 'vite'),
+        join(projectDir, 'node_modules', '.bin', 'vite'),
+    ].find((p) => existsSync(p));
+    if (!viteBin) {
+        // The project has a client/ but its deps aren't installed — wrangler would
+        // otherwise fail cryptically on the missing dist-client assets dir. Fail
+        // loud with the fix (the client is a workspace package — one install covers it).
+        throw new Error(`client build: vite not found in ${clientDir}. Run \`pnpm install\` at the project root ` +
+            `first (the client/ SPA is a workspace package).`);
+    }
+    const { code, out } = await runCapture(viteBin, ['build'], clientDir, onLog);
+    if (code !== 0) {
+        throw new Error(`client build failed (code ${code}):\n${out.slice(-1500)}`);
+    }
+}
+function runCapture(cmd, args, cwd, onLog) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        const onData = (buf) => {
+            const text = buf.toString();
+            out += text;
+            for (const line of text.split('\n'))
+                if (line.trim())
+                    onLog?.(line);
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('exit', (code) => resolve({ code: code ?? 1, out }));
+        child.on('error', reject);
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,UAAkB,EAClB,KAA8B;IAE9B,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC;KACjD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,yEAAyE;QACzE,iFAAiF;QACjF,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,6CAA6C;YACvF,iDAAiD,CACpD,CAAA;IACH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW,EACX,KAA8B;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC3B,GAAG,IAAI,IAAI,CAAA;YACX,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/cloudflare.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `cloudflare(envs)` — the Cloudflare deployment adapter.
+ *
+ * Owns everything target-specific: it codegens the Worker entry + wrangler
+ * config (the dev never sees a `wrangler.jsonc`), builds the optional client
+ * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
+ * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
+ * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the devkit
+ * prints and `astrale instance install <url>` consumes.
+ */
+import type { DomainAdapter } from '@astrale-os/devkit';
+import type { CloudflareParams } from './params';
+export declare function cloudflare(envs: Record<string, CloudflareParams>): DomainAdapter<CloudflareParams>;
+export declare function workerName(params: CloudflareParams, origin: string): string;
+//# sourceMappingURL=cloudflare.d.ts.map

package/dist/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../src/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAa,aAAa,EAAY,MAAM,oBAAoB,CAAA;AAM5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAUhD,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACrC,aAAa,CAAC,gBAAgB,CAAC,CAsDjC;AAsHD,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsB3E"}

package/dist/cloudflare.js

@@ -0,0 +1,186 @@
+/**
+ * `cloudflare(envs)` — the Cloudflare deployment adapter.
+ *
+ * Owns everything target-specific: it codegens the Worker entry + wrangler
+ * config (the dev never sees a `wrangler.jsonc`), builds the optional client
+ * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
+ * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
+ * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the devkit
+ * prints and `astrale instance install <url>` consumes.
+ */
+import { defineAdapter, hasStarModule } from '@astrale-os/devkit';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { buildClient } from './client';
+import { ensureIdentity } from './codegen/identity';
+import { generateWorkerEntry } from './codegen/worker';
+import { generateWranglerConfig } from './codegen/wrangler';
+import { bulkPutSecrets, runWranglerDeploy, runWranglerDev } from './wrangler-cli';
+const DEFAULT_PORT = 8787;
+export function cloudflare(envs) {
+    return defineAdapter({
+        name: 'cloudflare',
+        envs,
+        async watch(params, ctx) {
+            const { configPath, port } = await prepare(params, ctx, 'dev');
+            if (ctx.clientDir)
+                await buildClient(ctx.clientDir, ctx.projectDir, logTo());
+            const handle = await runWranglerDev({
+                projectDir: ctx.projectDir,
+                configPath,
+                port,
+                remote: Boolean(params.remote),
+                onReload: ctx.onReload,
+                onLog: logTo(),
+            });
+            return { url: handle.url, stop: handle.stop };
+        },
+        async deploy(params, ctx) {
+            const { configPath, fallbackConfigPath, workerName: name, } = await prepare(params, ctx, 'deploy');
+            if (ctx.clientDir)
+                await buildClient(ctx.clientDir, ctx.projectDir, logTo());
+            const { url } = await runWranglerDeploy({
+                projectDir: ctx.projectDir,
+                configPath,
+                workerName: name,
+                ...(fallbackConfigPath ? { fallbackConfigPath } : {}),
+                ...(params.route ? { route: params.route } : {}),
+                onLog: logTo(),
+            });
+            if (Object.keys(ctx.secrets).length > 0) {
+                await bulkPutSecrets({
+                    projectDir: ctx.projectDir,
+                    configPath,
+                    secrets: ctx.secrets,
+                    onLog: logTo(),
+                });
+            }
+            // A first deploy on a fresh `*.workers.dev` host can take ~30-60s to
+            // propagate; an `astrale instance install <url>` issued right away would
+            // 404 (Cloudflare 1042). Block until the URL actually serves so the
+            // install line we print is immediately actionable.
+            await waitUntilLive(url, logTo());
+            return { url };
+        },
+        secretsFile(params) {
+            return params.secrets;
+        },
+    });
+}
+// ── codegen orchestration ──────────────────────────────────────────────────
+async function prepare(params, ctx, mode) {
+    const astraleDir = join(ctx.projectDir, '.astrale');
+    await mkdir(astraleDir, { recursive: true });
+    await ensureIdentity(astraleDir, ctx.domain.origin);
+    const name = workerName(params, ctx.domain.origin);
+    // Shared ★-files probe: must agree with the codegen's `import { views } from
+    // '../views'` resolution (folder index OR sibling file) — a folder-only
+    // existsSync would deploy a worker whose graph silently lacks a sibling-file
+    // module the diagnostic spec includes.
+    const hasViews = hasStarModule(ctx.projectDir, 'views');
+    const hasFunctions = hasStarModule(ctx.projectDir, 'functions');
+    const hasClient = Boolean(ctx.clientDir);
+    await writeFile(join(astraleDir, 'worker.gen.ts'), generateWorkerEntry({
+        origin: ctx.domain.origin,
+        ...(ctx.domain.postInstall ? { postInstall: ctx.domain.postInstall } : {}),
+        requires: ctx.domain.requires,
+        hasViews,
+        hasFunctions,
+        hasClient,
+    }));
+    // Pin the worker's canonical serving URL (its `iss` identity) for routed
+    // deploys: a routed worker may ALSO be reachable via `*.workers.dev`, so
+    // resolving the URL from the per-request Host would let `iss` drift between
+    // hostnames. Dev + workers.dev-only deploys are single-host, so the worker
+    // falls back to the per-request Host (always the canonical URL there).
+    // An explicit `vars.WORKER_URL` (e.g. a tunnel/proxy front) wins.
+    const workerUrl = mode === 'deploy' && params.route ? `https://${params.route}` : undefined;
+    // Dev injects secrets as local vars (the gitignored .astrale config never
+    // ships); deploy keeps secrets out of the config and pushes them encrypted.
+    const vars = {
+        ...(workerUrl ? { WORKER_URL: workerUrl } : {}),
+        ...(mode === 'dev' ? { ...params.vars, ...ctx.secrets } : { ...params.vars }),
+    };
+    const baseConfig = {
+        workerName: name,
+        ...(mode === 'deploy' && params.route ? { route: params.route } : {}),
+        hasClient,
+        vars,
+        // Escape hatch: extra bindings (KV/R2/D1/queues/…) deep-merged on top. Same
+        // overlay in dev and deploy — it's infra, not env-specific plumbing — and it
+        // flows into both the SELF and the SELF-less fallback config below.
+        ...(params.wrangler ? { wrangler: params.wrangler } : {}),
+    };
+    // Always self-bind: it enables autobinding (a handler calling its own domain).
+    // Locally the dev registry resolves it; on deploy the first deploy of a fresh
+    // worker can't (the script doesn't exist yet), so we also emit a SELF-less
+    // fallback config that `runWranglerDeploy` uses for a one-time two-pass deploy.
+    const configPath = join(astraleDir, 'wrangler.gen.jsonc');
+    await writeFile(configPath, generateWranglerConfig({ ...baseConfig, selfBinding: true }));
+    let fallbackConfigPath;
+    if (mode === 'deploy') {
+        fallbackConfigPath = join(astraleDir, 'wrangler.no-self.gen.jsonc');
+        await writeFile(fallbackConfigPath, generateWranglerConfig({ ...baseConfig, selfBinding: false }));
+    }
+    return {
+        configPath,
+        ...(fallbackConfigPath ? { fallbackConfigPath } : {}),
+        port: params.port ?? DEFAULT_PORT,
+        workerName: name,
+    };
+}
+/**
+ * Poll the deployed URL until the worker answers (anything but the Cloudflare
+ * 1042 "no script on this host" 404), or give up after `timeoutMs`. Resolves
+ * silently on the fast path; logs only when propagation actually makes us wait.
+ */
+async function waitUntilLive(url, onLog, timeoutMs = 90_000) {
+    const probe = new URL('/health', url);
+    const deadline = Date.now() + timeoutMs;
+    let waited = false;
+    for (;;) {
+        try {
+            const res = await fetch(probe, { redirect: 'manual' });
+            if (res.status !== 404)
+                return;
+        }
+        catch {
+            // Network hiccup — treat like "not live yet" and keep polling.
+        }
+        if (Date.now() >= deadline) {
+            onLog(`URL not reachable yet after ${Math.round(timeoutMs / 1000)}s — it may need a moment.`);
+            return;
+        }
+        if (!waited) {
+            waited = true;
+            onLog('waiting for the URL to go live (first deploys can take ~30-60s)…');
+        }
+        await new Promise((r) => setTimeout(r, 3000));
+    }
+}
+const WORKER_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+export function workerName(params, origin) {
+    // An explicit name is the deployed worker's identity (and the SELF service
+    // target) — validate and reject an invalid one rather than silently rewriting
+    // it, so the dev fixes it instead of deploying under a surprising name.
+    if (params.workerName !== undefined) {
+        if (!WORKER_NAME_RE.test(params.workerName) || params.workerName.length > 63) {
+            throw new Error(`cloudflare adapter: invalid \`workerName\` "${params.workerName}". A Cloudflare worker ` +
+                'name must be lowercase, start with a letter or digit, contain only letters, digits and ' +
+                'dashes, and be at most 63 chars.');
+        }
+        return params.workerName;
+    }
+    // Derive from the origin: lowercase, collapse non-alphanumerics to a dash, then
+    // SLICE before trimming dashes so a cut landing mid-dash can't leave a trailing
+    // "-" (which wrangler rejects).
+    return origin
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .slice(0, 54)
+        .replace(/^-+|-+$/g, '');
+}
+function logTo() {
+    return (line) => process.stderr.write(`\x1b[2m  ${line}\x1b[0m\n`);
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../src/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAElF,MAAM,YAAY,GAAG,IAAI,CAAA;AAEzB,MAAM,UAAU,UAAU,CACxB,IAAsC;IAEtC,OAAO,aAAa,CAAmB;QACrC,IAAI,EAAE,YAAY;QAClB,IAAI;QAEJ,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACrB,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9D,IAAI,GAAG,CAAC,SAAS;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,EACJ,UAAU,EACV,kBAAkB,EAClB,UAAU,EAAE,IAAI,GACjB,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YACxC,IAAI,GAAG,CAAC,SAAS;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBACtC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,cAAc,CAAC;oBACnB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,UAAU;oBACV,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,KAAK,EAAE;iBACf,CAAC,CAAA;YACJ,CAAC;YACD,qEAAqE;YACrE,yEAAyE;YACzE,oEAAoE;YACpE,mDAAmD;YACnD,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACjC,OAAO,EAAE,GAAG,EAAE,CAAA;QAChB,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,OAAO,CACpB,MAAwB,EACxB,GAAyB,EACzB,IAAsB;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IACnD,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEnD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAExC,MAAM,SAAS,CACb,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EACjC,mBAAmB,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;QACzB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;QAC7B,QAAQ;QACR,YAAY;QACZ,SAAS;KACV,CAAC,CACH,CAAA;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,SAAS,GAAG,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAE3F,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;KAC9E,CAAA;IAED,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,IAAI;QACJ,4EAA4E;QAC5E,6EAA6E;QAC7E,oEAAoE;QACpE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAA;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAA;IACzD,MAAM,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEzF,IAAI,kBAAsC,CAAA;IAC1C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QACnE,MAAM,SAAS,CACb,kBAAkB,EAClB,sBAAsB,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAC9D,CAAA;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;QACjC,UAAU,EAAE,IAAI;KACjB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,KAA6B,EAC7B,SAAS,GAAG,MAAM;IAElB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAM;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,+BAA+B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAC7F,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,CAAA;YACb,KAAK,CAAC,kEAAkE,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,sBAAsB,CAAA;AAE7C,MAAM,UAAU,UAAU,CAAC,MAAwB,EAAE,MAAc;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CACb,+CAA+C,MAAM,CAAC,UAAU,yBAAyB;gBACvF,yFAAyF;gBACzF,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,gCAAgC;IAChC,OAAO,MAAM;SACV,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC,CAAA;AAC5E,CAAC"}

package/dist/codegen/identity.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ensure the domain has a stable Ed25519 signing identity at
+ * `.astrale/identity.ts`. Generated ONCE (first `dev`/`deploy` or by the
+ * scaffolder) and never regenerated — the private key IS the domain's identity,
+ * so rotating it would orphan every instance that installed the old key. The
+ * file is gitignored; for real production this key should graduate to a managed
+ * secret.
+ */
+export declare function ensureIdentity(astraleDir: string, origin: string): Promise<void>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/codegen/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/codegen/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtF"}

package/dist/codegen/identity.js

@@ -0,0 +1,32 @@
+/**
+ * Ensure the domain has a stable Ed25519 signing identity at
+ * `.astrale/identity.ts`. Generated ONCE (first `dev`/`deploy` or by the
+ * scaffolder) and never regenerated — the private key IS the domain's identity,
+ * so rotating it would orphan every instance that installed the old key. The
+ * file is gitignored; for real production this key should graduate to a managed
+ * secret.
+ */
+import { exportJWK, generateKeyPair } from 'jose';
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export async function ensureIdentity(astraleDir, origin) {
+    const file = join(astraleDir, 'identity.ts');
+    if (existsSync(file))
+        return;
+    const { privateKey } = await generateKeyPair('EdDSA', { extractable: true });
+    const jwk = (await exportJWK(privateKey));
+    jwk.alg = 'EdDSA';
+    jwk.kid = `${origin}-key`;
+    await mkdir(astraleDir, { recursive: true });
+    await writeFile(file, `// AUTO-GENERATED stable signing identity for "${origin}" — do not edit, do not commit.\n` +
+        `export const PRIVATE_JWK = ${JSON.stringify(jwk, null, 2)} as const\n`);
+    // Loud on purpose: the file is gitignored, so a fresh clone / CI runner
+    // silently mints a NEW key — and a redeploy with a new key breaks JWKS
+    // verification on every instance that installed the old one, with no hint
+    // why. Make the lifecycle visible the one time it happens.
+    process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.ts (kid ${String(jwk.kid)}).\n` +
+        `  This key IS "${origin}"'s identity: back it up (or move it to a managed secret) —\n` +
+        `  deploying from another machine without it re-keys the domain and breaks existing installs.\n`);
+}
+//# sourceMappingURL=identity.js.map

package/dist/codegen/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/codegen/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAM;IAE5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,CAA4B,CAAA;IACpE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;IACjB,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,MAAM,CAAA;IAEzB,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,SAAS,CACb,IAAI,EACJ,kDAAkD,MAAM,mCAAmC;QACzF,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAC1E,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,2DAA2D;IAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gFAAgF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM;QACnG,kBAAkB,MAAM,+DAA+D;QACvF,gGAAgG,CACnG,CAAA;AACH,CAAC"}

package/dist/codegen/merge.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Deep-merge for the generated wrangler config. `base` is what the adapter
+ * generates; `overlay` is the dev's `params.wrangler` escape hatch. The merge
+ * is additive so a dev can declare extra bindings without losing the adapter's
+ * invariants:
+ *   - plain objects      → recurse
+ *   - arrays             → concat, de-duplicating BOTH primitive members and
+ *                          object bindings by an identity key (`binding` /
+ *                          `pattern` / `queue` / `name`, else structural value),
+ *                          with the overlay entry overriding a base entry of the
+ *                          same identity. So a dev overlay that re-declares the
+ *                          adapter's `SELF` service (or any binding) replaces it
+ *                          instead of emitting a duplicate wrangler rejects.
+ *   - scalars / new keys → overlay wins
+ *
+ * Protecting the load-bearing keys (`main`, `assets`, …) is policy enforced by
+ * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
+ */
+export declare function deepMergeConfig(base: Record<string, unknown>, overlay: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=merge.d.ts.map

package/dist/codegen/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/codegen/merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB"}

package/dist/codegen/merge.js

@@ -0,0 +1,91 @@
+/**
+ * Deep-merge for the generated wrangler config. `base` is what the adapter
+ * generates; `overlay` is the dev's `params.wrangler` escape hatch. The merge
+ * is additive so a dev can declare extra bindings without losing the adapter's
+ * invariants:
+ *   - plain objects      → recurse
+ *   - arrays             → concat, de-duplicating BOTH primitive members and
+ *                          object bindings by an identity key (`binding` /
+ *                          `pattern` / `queue` / `name`, else structural value),
+ *                          with the overlay entry overriding a base entry of the
+ *                          same identity. So a dev overlay that re-declares the
+ *                          adapter's `SELF` service (or any binding) replaces it
+ *                          instead of emitting a duplicate wrangler rejects.
+ *   - scalars / new keys → overlay wins
+ *
+ * Protecting the load-bearing keys (`main`, `assets`, …) is policy enforced by
+ * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
+ */
+export function deepMergeConfig(base, overlay) {
+    const out = { ...base };
+    for (const [key, value] of Object.entries(overlay)) {
+        const prev = out[key];
+        if (isPlainObject(prev) && isPlainObject(value)) {
+            out[key] = deepMergeConfig(prev, value);
+        }
+        else if (Array.isArray(prev) && Array.isArray(value)) {
+            out[key] = mergeArrays(prev, value);
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/**
+ * Concat two arrays, de-duplicating by identity. Primitives dedup by value;
+ * objects dedup by an identity key (`binding`/`pattern`/`queue`/`name`, else
+ * their structural JSON) with the later (overlay) entry overriding an earlier
+ * (base) one at the base entry's position. This stops a re-declared object
+ * binding (e.g. a second `SELF` service) from producing a duplicate that
+ * wrangler rejects, while still appending genuinely distinct bindings.
+ */
+function mergeArrays(a, b) {
+    const out = [];
+    const seenPrimitives = new Set();
+    const indexByKey = new Map();
+    for (const item of [...a, ...b]) {
+        if (isPrimitive(item)) {
+            if (seenPrimitives.has(item))
+                continue;
+            seenPrimitives.add(item);
+            out.push(item);
+            continue;
+        }
+        const key = identityKey(item);
+        const existing = indexByKey.get(key);
+        if (existing !== undefined) {
+            out[existing] = item; // overlay (later) overrides the base entry in place
+            continue;
+        }
+        indexByKey.set(key, out.length);
+        out.push(item);
+    }
+    return out;
+}
+/**
+ * Stable identity for an array's object member: the first recognized wrangler
+ * binding field (`binding` for services/KV/R2/D1/queue producers, `pattern` for
+ * routes, `queue` for consumers, `name` as a generic fallback), else the member's
+ * full structural JSON so identical objects dedup but distinct ones all survive.
+ */
+function identityKey(item) {
+    const rec = item;
+    for (const field of ['binding', 'pattern', 'queue', 'name']) {
+        if (typeof rec[field] === 'string')
+            return `${field}:${rec[field]}`;
+    }
+    try {
+        return `json:${JSON.stringify(item)}`;
+    }
+    catch {
+        return `ref:${String(item)}`;
+    }
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function isPrimitive(v) {
+    return v === null || (typeof v !== 'object' && typeof v !== 'function');
+}
+//# sourceMappingURL=merge.js.map

package/dist/codegen/merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/codegen/merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,OAAgC;IAEhC,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACzC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,CAAY,EAAE,CAAY;IAC7C,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAW,CAAA;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACtC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA,CAAC,oDAAoD;YACzE,SAAQ;QACV,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAA;IAC3C,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,KAAK,CAAW,EAAE,CAAA;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,UAAU,CAAC,CAAA;AACzE,CAAC"}

package/dist/codegen/worker.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Codegen for the Cloudflare Worker entry (`.astrale/worker.gen.ts`).
+ *
+ * The dev writes only schema/methods/views/functions; this generates the
+ * `export default { fetch }` plumbing the adapter owns. Key properties:
+ *
+ *  • Per-request `url` = the live serving origin (`scheme://host`). It is passed
+ *    only to `createRemoteServer({ url })`; the SDK stamps every
+ *    `binding.remoteUrl` from that single value at spec-build time — so deployed
+ *    Function nodes point back at THIS worker with zero hardcoded URLs.
+ *  • Self-issued JWKS: a Worker can't fetch its own hostname; the verifier
+ *    resolves a credential whose `iss` is this worker from the in-memory key,
+ *    so no self-fetch is attempted (the worker's JWKS is served as a normal
+ *    route by createRemoteServer).
+ *  • Self-binding (autobinding): when a handler calls back into its OWN domain
+ *    (`ctx.callRemote`), the redirect resolves to this worker's own host — a
+ *    forbidden same-host subrequest. We route those through the `SELF` service
+ *    binding instead.
+ *  • SPA: `/ui/*` is served from the `ASSETS` binding (or proxied to Vite in
+ *    dev via `VIEW_DEV_URL`).
+ */
+export interface WorkerCodegenOptions {
+    origin: string;
+    postInstall?: string;
+    requires: readonly string[];
+    hasViews: boolean;
+    hasFunctions: boolean;
+    hasClient: boolean;
+}
+export declare function generateWorkerEntry(opts: WorkerCodegenOptions): string;
+//# sourceMappingURL=worker.d.ts.map

package/dist/codegen/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/codegen/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAyEtE"}

package/dist/codegen/worker.js

@@ -0,0 +1,93 @@
+/**
+ * Codegen for the Cloudflare Worker entry (`.astrale/worker.gen.ts`).
+ *
+ * The dev writes only schema/methods/views/functions; this generates the
+ * `export default { fetch }` plumbing the adapter owns. Key properties:
+ *
+ *  • Per-request `url` = the live serving origin (`scheme://host`). It is passed
+ *    only to `createRemoteServer({ url })`; the SDK stamps every
+ *    `binding.remoteUrl` from that single value at spec-build time — so deployed
+ *    Function nodes point back at THIS worker with zero hardcoded URLs.
+ *  • Self-issued JWKS: a Worker can't fetch its own hostname; the verifier
+ *    resolves a credential whose `iss` is this worker from the in-memory key,
+ *    so no self-fetch is attempted (the worker's JWKS is served as a normal
+ *    route by createRemoteServer).
+ *  • Self-binding (autobinding): when a handler calls back into its OWN domain
+ *    (`ctx.callRemote`), the redirect resolves to this worker's own host — a
+ *    forbidden same-host subrequest. We route those through the `SELF` service
+ *    binding instead.
+ *  • SPA: `/ui/*` is served from the `ASSETS` binding (or proxied to Vite in
+ *    dev via `VIEW_DEV_URL`).
+ */
+export function generateWorkerEntry(opts) {
+    const optionalImports = [
+        opts.hasViews ? `import { views } from '../views'` : `const views = undefined`,
+        opts.hasFunctions ? `import { functions } from '../functions'` : `const functions = undefined`,
+    ].join('\n');
+    const postInstallLine = opts.postInstall !== undefined
+        ? `const POST_INSTALL = ${JSON.stringify(opts.postInstall)}`
+        : `const POST_INSTALL = undefined`;
+    return `// AUTO-GENERATED by @astrale-os/adapter-cloudflare — do not edit.
+// Regenerated on every \`astrale-domain dev|deploy\`. Edit schema/methods/views
+// instead. (origin: ${opts.origin})
+import { defineRemoteDomain } from '@astrale-os/sdk'
+import { createWorkerEntry } from '@astrale-os/sdk/server'
+
+import { schema } from '../schema'
+import { methods } from '../methods'
+${optionalImports}
+import { PRIVATE_JWK } from './identity'
+
+const REQUIRES = ${JSON.stringify(opts.requires)}
+${postInstallLine}
+
+interface Env {
+  WORKER_URL?: string
+  ASSETS?: { fetch(request: Request): Promise<Response> }
+  SELF?: { fetch(request: Request): Promise<Response> }
+  VIEW_DEV_URL?: string
+  [key: string]: unknown
+}
+
+// All the shared worker plumbing — JWKS self-fetch shim, SELF-binding routing,
+// per-URL app cache, canonical iss resolution — lives in createWorkerEntry.
+export default createWorkerEntry<Env>({
+  // The worker's serving URL = its identity (iss). Prefer the adapter-injected
+  // WORKER_URL (pins one canonical host for routed deploys, so iss stays stable
+  // even when also reachable via *.workers.dev); fall back to the per-request
+  // host for dev / workers.dev-only (single-host → it IS the canonical URL).
+  resolveUrl: (env, requestOrigin) => env.WORKER_URL ?? requestOrigin,
+  selfBinding: (env) => env.SELF,
+  build: (url, env) => {
+    const domain = defineRemoteDomain()({
+      schema,
+      methods,
+      ...(views ? { views } : {}),
+      ...(functions ? { remoteFunctions: functions } : {}),
+    })
+    return {
+      domain,
+      deps: env,
+      url,
+      privateKey: PRIVATE_JWK,
+      ...(POST_INSTALL ? { postInstall: POST_INSTALL } : {}),
+      ...(REQUIRES.length ? { requires: REQUIRES } : {}),
+    }
+  },
+  // SPA under /ui/* (views with a client renderer).
+  before: (env, url, request) => {
+    if (env.ASSETS && (url.pathname === '/ui' || url.pathname.startsWith('/ui/'))) {
+      if (env.VIEW_DEV_URL) {
+        const devBase = env.VIEW_DEV_URL.replace(/\\/$/, '')
+        return fetch(new Request(\`\${devBase}\${url.pathname}\${url.search}\`, request))
+      }
+      const stripped = url.pathname.replace(/^\\/ui\\/?/, '/')
+      const rewritten = new URL(stripped + url.search, url.origin)
+      return env.ASSETS.fetch(new Request(rewritten, request))
+    }
+    return undefined
+  },
+})
+`;
+}
+//# sourceMappingURL=worker.js.map

package/dist/codegen/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/codegen/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,yBAAyB;QAC9E,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,6BAA6B;KAC/F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,eAAe,GACnB,IAAI,CAAC,WAAW,KAAK,SAAS;QAC5B,CAAC,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;QAC5D,CAAC,CAAC,gCAAgC,CAAA;IAEtC,OAAO;;uBAEc,IAAI,CAAC,MAAM;;;;;;EAMhC,eAAe;;;mBAGE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;EAC9C,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDhB,CAAA;AACD,CAAC"}

package/dist/codegen/wrangler.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Codegen for the Worker config (`.astrale/wrangler.gen.jsonc`). This is the
+ * `wrangler.jsonc` that used to be hand-copied into every domain — now an
+ * internal adapter detail the dev never sees.
+ *
+ * `main` is `./worker.gen.ts` (same dir). `assets.directory` is `../dist-client`
+ * (the project's Vite build). A `SELF` service binding enables autobinding
+ * (a handler calling back into its own domain). Custom-domain deploys attach a
+ * `custom_domain` route; otherwise the Worker ships to `*.workers.dev`.
+ *
+ * A dev's `params.wrangler` escape hatch is deep-merged on top of this base
+ * (extra bindings: KV, R2, D1, queues, …) — see `mergeUserConfig`.
+ */
+export interface WranglerCodegenOptions {
+    workerName: string;
+    /** Full custom hostname for a routed deploy (e.g. 'crm.acme.dev'). */
+    route?: string;
+    /** Whether the project has a built client SPA to serve under /ui/*. */
+    hasClient: boolean;
+    /** Plain (non-secret) vars to bake in. */
+    vars?: Record<string, string>;
+    /** Add the SELF service binding (autobinding). */
+    selfBinding: boolean;
+    /**
+     * Raw wrangler config to deep-merge over the generated base — the escape
+     * hatch for extra bindings (KV, R2, D1, queues, service bindings, extra
+     * `compatibility_flags`, cron `triggers`, …). Arrays concat; new keys are
+     * added as-is. The adapter-owned keys `name`, `main`, `assets`, `routes` are
+     * rejected (throws) — use `workerName` / `route` instead.
+     */
+    wrangler?: Record<string, unknown>;
+}
+export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
+//# sourceMappingURL=wrangler.d.ts.map

package/dist/codegen/wrangler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../src/codegen/wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAA;IAClB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,kDAAkD;IAClD,WAAW,EAAE,OAAO,CAAA;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAiC3E"}

package/dist/codegen/wrangler.js

@@ -0,0 +1,61 @@
+/**
+ * Codegen for the Worker config (`.astrale/wrangler.gen.jsonc`). This is the
+ * `wrangler.jsonc` that used to be hand-copied into every domain — now an
+ * internal adapter detail the dev never sees.
+ *
+ * `main` is `./worker.gen.ts` (same dir). `assets.directory` is `../dist-client`
+ * (the project's Vite build). A `SELF` service binding enables autobinding
+ * (a handler calling back into its own domain). Custom-domain deploys attach a
+ * `custom_domain` route; otherwise the Worker ships to `*.workers.dev`.
+ *
+ * A dev's `params.wrangler` escape hatch is deep-merged on top of this base
+ * (extra bindings: KV, R2, D1, queues, …) — see `mergeUserConfig`.
+ */
+import { deepMergeConfig } from './merge';
+const COMPATIBILITY_DATE = '2025-03-01';
+export function generateWranglerConfig(opts) {
+    const config = {
+        name: opts.workerName,
+        main: './worker.gen.ts',
+        compatibility_date: COMPATIBILITY_DATE,
+        compatibility_flags: ['nodejs_compat', 'nodejs_compat_populate_process_env'],
+        workers_dev: true,
+        observability: { enabled: true },
+    };
+    if (opts.route) {
+        config.routes = [{ pattern: opts.route, custom_domain: true }];
+    }
+    if (opts.hasClient) {
+        config.assets = {
+            directory: '../dist-client',
+            binding: 'ASSETS',
+            not_found_handling: 'single-page-application',
+            run_worker_first: true,
+        };
+    }
+    if (opts.selfBinding) {
+        config.services = [{ binding: 'SELF', service: opts.workerName }];
+    }
+    if (opts.vars && Object.keys(opts.vars).length > 0) {
+        config.vars = opts.vars;
+    }
+    const merged = opts.wrangler ? mergeUserConfig(config, opts.wrangler) : config;
+    return JSON.stringify(merged, null, 2) + '\n';
+}
+/** Keys the adapter owns and won't let `params.wrangler` clobber. */
+const ADAPTER_OWNED_KEYS = ['name', 'main', 'assets', 'routes'];
+/**
+ * Deep-merge the dev's raw wrangler overlay over the generated config, after
+ * refusing any attempt to override an adapter-owned key. Throwing (rather than
+ * silently dropping) keeps a stray `main` from breaking the Worker unnoticed.
+ */
+function mergeUserConfig(base, user) {
+    const collisions = ADAPTER_OWNED_KEYS.filter((k) => k in user);
+    if (collisions.length > 0) {
+        throw new Error(`wrangler: cannot override adapter-managed key(s): ${collisions.join(', ')}. ` +
+            'Use `workerName` for the worker name and `route` for routing; ' +
+            '`main` and `assets` are generated by the adapter.');
+    }
+    return deepMergeConfig(base, user);
+}
+//# sourceMappingURL=wrangler.js.map

package/dist/codegen/wrangler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler.js","sourceRoot":"","sources":["../../src/codegen/wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAsBzC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAEvC,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IACjE,MAAM,MAAM,GAA4B;QACtC,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,IAAI,EAAE,iBAAiB;QACvB,kBAAkB,EAAE,kBAAkB;QACtC,mBAAmB,EAAE,CAAC,eAAe,EAAE,oCAAoC,CAAC;QAC5E,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACjC,CAAA;IAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,GAAG;YACd,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,QAAQ;YACjB,kBAAkB,EAAE,yBAAyB;YAC7C,gBAAgB,EAAE,IAAI;SACvB,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;AAC/C,CAAC;AAED,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE/D;;;;GAIG;AACH,SAAS,eAAe,CACtB,IAA6B,EAC7B,IAA6B;IAE7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qDAAqD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5E,gEAAgE;YAChE,mDAAmD,CACtD,CAAA;IACH,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
+ * Cloudflare Worker.
+ *
+ *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
+ *
+ *   adapter: cloudflare({
+ *     dev:  { secrets: '.env.dev' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *   })
+ *
+ * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `*.workers.dev`; an env with a `route` ships to that custom domain.
+ */
+export { cloudflare } from './cloudflare';
+export type { CloudflareParams } from './params';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
+ * Cloudflare Worker.
+ *
+ *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
+ *
+ *   adapter: cloudflare({
+ *     dev:  { secrets: '.env.dev' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *   })
+ *
+ * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `*.workers.dev`; an env with a `route` ships to that custom domain.
+ */
+export { cloudflare } from './cloudflare';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}

package/dist/params.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `CloudflareParams` — the provider-typed config for the Cloudflare adapter.
+ *
+ * One type covers every env; per-env differences are just optional fields. The
+ * same `{ dev, prod, canary, … }` map a developer writes in `astrale.config.ts`
+ * is `Record<string, CloudflareParams>`.
+ *
+ * Three deployment shapes fall out of which fields are set:
+ *   • dev (local)      — `watch()` runs `wrangler dev`; URL = http://localhost:<port>
+ *   • dev-remote       — `deploy()` with no `route`; URL = https://<name>.<sub>.workers.dev
+ *   • remote (custom)  — `deploy()` with `route`; URL = https://<route>
+ */
+export interface CloudflareParams {
+    /**
+     * Custom route / hostname for a routed deploy, e.g. `'crm.acme.dev'`. Omit to
+     * deploy to `*.workers.dev`. Ignored by local `wrangler dev` (URL is
+     * localhost) but still used as the placeholder base domain there.
+     */
+    route?: string;
+    /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
+    secrets?: string;
+    /** Local dev port for `wrangler dev`. Default 8787. */
+    port?: number;
+    /** Override the Worker name. Default: derived from the domain origin. */
+    workerName?: string;
+    /** Run `wrangler dev --remote` (edge isolate) instead of local workerd. */
+    remote?: boolean;
+    /** Extra plain (non-secret) vars to inject as Worker vars. */
+    vars?: Record<string, string>;
+    /**
+     * Escape hatch: raw wrangler config deep-merged over the generated base. Use
+     * it to declare extra bindings the adapter has no typed field for — KV, R2,
+     * D1, queues, service bindings, extra `compatibility_flags`, cron `triggers`,
+     * Hyperdrive, etc.
+     *
+     *   wrangler: {
+     *     kv_namespaces: [{ binding: 'CACHE', id: '<kv-id>' }],
+     *     r2_buckets: [{ binding: 'FILES', bucket_name: 'my-bucket' }],
+     *   }
+     *
+     * The merge is additive: arrays concat (so your `services` keep the adapter's
+     * `SELF` binding and your `compatibility_flags` keep `nodejs_compat`); new
+     * keys are added as-is. The adapter-owned keys `name`, `main`, `assets`,
+     * `routes` are rejected — use `workerName` and `route` instead. Avoid
+     * the reserved binding names `SELF` and `ASSETS`. Durable Objects need extra
+     * worker-entry codegen and aren't supported through this field yet.
+     */
+    wrangler?: Record<string, unknown>;
+}
+//# sourceMappingURL=params.d.ts.map

package/dist/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC"}

package/dist/params.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":""}

package/dist/parse-output.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Pure parsers for `wrangler` stdout. Kept separate from the process-spawning in
+ * `wrangler-cli.ts` so the brittle bit — scraping wrangler's human output — is
+ * unit-testable against captured fixtures without shelling out.
+ */
+/**
+ * Local dev URL from `wrangler dev` output, normalized to an origin on the given
+ * port. Returns `undefined` when the output hasn't reported readiness yet.
+ *
+ * The fallback (when no explicit "Ready on" line) only accepts a localhost URL
+ * on the EXPECTED port — wrangler may print unrelated localhost URLs (e.g. an
+ * inspector/devtools endpoint on a different port) before readiness, and taking
+ * one of those would point `astrale instance install <url>` at a dead endpoint.
+ */
+export declare function parseDevReadyUrl(text: string, port: number): string | undefined;
+/**
+ * Authoritative public URL from `wrangler deploy` output. A custom-domain
+ * `route` wins (the deploy attaches it); otherwise the printed `*.workers.dev`
+ * URL. Returns `undefined` when neither is available (caller surfaces the raw
+ * output).
+ */
+export declare function parseDeployUrl(text: string, route?: string): string | undefined;
+/** Normalize a local dev URL to an origin: `0.0.0.0` → `localhost`, fill the port. */
+export declare function normalizeLocal(url: string, port: number): string;
+//# sourceMappingURL=parse-output.d.ts.map

package/dist/parse-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-output.d.ts","sourceRoot":"","sources":["../src/parse-output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW/E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI/E;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAShE"}

package/dist/parse-output.js

@@ -0,0 +1,53 @@
+/**
+ * Pure parsers for `wrangler` stdout. Kept separate from the process-spawning in
+ * `wrangler-cli.ts` so the brittle bit — scraping wrangler's human output — is
+ * unit-testable against captured fixtures without shelling out.
+ */
+const READY_RE = /(?:Ready on|Listening on|⎔.*?at)\s+(https?:\/\/[^\s]+)/i;
+const WORKERS_DEV_RE = /(https:\/\/[^\s]+\.workers\.dev)/i;
+/**
+ * Local dev URL from `wrangler dev` output, normalized to an origin on the given
+ * port. Returns `undefined` when the output hasn't reported readiness yet.
+ *
+ * The fallback (when no explicit "Ready on" line) only accepts a localhost URL
+ * on the EXPECTED port — wrangler may print unrelated localhost URLs (e.g. an
+ * inspector/devtools endpoint on a different port) before readiness, and taking
+ * one of those would point `astrale instance install <url>` at a dead endpoint.
+ */
+export function parseDevReadyUrl(text, port) {
+    const ready = READY_RE.exec(text);
+    if (ready)
+        return normalizeLocal(ready[1], port);
+    // `port` is a number, so it's safe to interpolate into the pattern. The
+    // negative lookahead stops `:8787` from matching inside `:87870`.
+    const localhostOnPort = new RegExp(`(https?://(?:localhost|127\\.0\\.0\\.1):${port})(?![0-9])`, 'i');
+    const m = localhostOnPort.exec(text);
+    return m ? normalizeLocal(m[1], port) : undefined;
+}
+/**
+ * Authoritative public URL from `wrangler deploy` output. A custom-domain
+ * `route` wins (the deploy attaches it); otherwise the printed `*.workers.dev`
+ * URL. Returns `undefined` when neither is available (caller surfaces the raw
+ * output).
+ */
+export function parseDeployUrl(text, route) {
+    if (route)
+        return `https://${route.replace(/\/.*$/, '')}`;
+    const m = WORKERS_DEV_RE.exec(text);
+    return m ? m[1] : undefined;
+}
+/** Normalize a local dev URL to an origin: `0.0.0.0` → `localhost`, fill the port. */
+export function normalizeLocal(url, port) {
+    try {
+        const u = new URL(url);
+        if (u.hostname === '0.0.0.0')
+            u.hostname = 'localhost';
+        if (!u.port)
+            u.port = String(port);
+        return u.origin;
+    }
+    catch {
+        return `http://localhost:${port}`;
+    }
+}
+//# sourceMappingURL=parse-output.js.map

package/dist/parse-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-output.js","sourceRoot":"","sources":["../src/parse-output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,QAAQ,GAAG,yDAAyD,CAAA;AAC1E,MAAM,cAAc,GAAG,mCAAmC,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,KAAK;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAA;IACjD,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,2CAA2C,IAAI,YAAY,EAC3D,GAAG,CACJ,CAAA;IACD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,IAAI,KAAK;QAAE,OAAO,WAAW,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAA;IACzD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAY;IACtD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAA;QACtD,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,MAAM,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,IAAI,EAAE,CAAA;IACnC,CAAC;AACH,CAAC"}

package/dist/wrangler-cli.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Thin wrapper around the `wrangler` binary — the only place the adapter shells
+ * out. `watch` runs `wrangler dev` (local workerd) and resolves once the worker
+ * reports its local URL; `deploy` runs `wrangler deploy` and parses the
+ * authoritative public URL from the output; secrets go through `wrangler secret
+ * bulk`. The wrangler binary is resolved from the project's `node_modules/.bin`,
+ * falling back to `npx wrangler`.
+ */
+export interface DevHandle {
+    url: string;
+    stop(): Promise<void>;
+}
+export declare function runWranglerDev(args: {
+    projectDir: string;
+    configPath: string;
+    port: number;
+    remote: boolean;
+    onReload: () => void;
+    onLog?: (line: string) => void;
+}): Promise<DevHandle>;
+export interface DeployArgs {
+    configPath: string;
+    /** SELF-less config for the first-deploy two-pass (see `deployWithSelfFallback`). */
+    fallbackConfigPath?: string;
+    /** The worker's own name, to scope the self-binding-missing detection. */
+    workerName?: string;
+    route?: string;
+    onLog?: (line: string) => void;
+}
+export declare function runWranglerDeploy(args: DeployArgs & {
+    projectDir: string;
+}): Promise<{
+    url: string;
+    raw: string;
+}>;
+/**
+ * Deploy with a one-time SELF-binding first-deploy recovery. A fresh worker that
+ * declares a `services: SELF` binding can't deploy (its own script doesn't exist
+ * yet); on THAT specific failure we deploy the SELF-less fallback to create the
+ * script, then redeploy WITH SELF so autobinding works. Steady state (every
+ * deploy after the first) is a single pass. The `deploy` runner is injected so
+ * the orchestration is unit-testable without shelling out.
+ */
+export declare function deployWithSelfFallback(deploy: (configPath: string) => Promise<{
+    code: number;
+    out: string;
+}>, args: DeployArgs): Promise<{
+    url: string;
+    raw: string;
+}>;
+/**
+ * True when wrangler failed specifically because the worker's OWN `SELF` service
+ * binding can't resolve yet (first deploy of a fresh script). Requires the
+ * worker name so an unrelated missing-service error doesn't trigger the two-pass.
+ */
+export declare function isSelfBindingMissing(out: string, workerName?: string): boolean;
+export declare function bulkPutSecrets(args: {
+    projectDir: string;
+    configPath: string;
+    secrets: Record<string, string>;
+    onLog?: (line: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=wrangler-cli.d.ts.map

package/dist/wrangler-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-cli.d.ts","sourceRoot":"","sources":["../src/wrangler-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkBH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B,GAAG,OAAO,CAAC,SAAS,CAAC,CAkErB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAKvC;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EACtE,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBvC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB"}

package/dist/wrangler-cli.js

@@ -0,0 +1,185 @@
+/**
+ * Thin wrapper around the `wrangler` binary — the only place the adapter shells
+ * out. `watch` runs `wrangler dev` (local workerd) and resolves once the worker
+ * reports its local URL; `deploy` runs `wrangler deploy` and parses the
+ * authoritative public URL from the output; secrets go through `wrangler secret
+ * bulk`. The wrangler binary is resolved from the project's `node_modules/.bin`,
+ * falling back to `npx wrangler`.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parseDeployUrl, parseDevReadyUrl } from './parse-output';
+function wranglerCommand(projectDir) {
+    const local = join(projectDir, 'node_modules', '.bin', 'wrangler');
+    if (existsSync(local))
+        return { cmd: local, prefix: [] };
+    return { cmd: 'npx', prefix: ['--yes', 'wrangler'] };
+}
+export async function runWranglerDev(args) {
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const wranglerArgs = [
+        ...prefix,
+        'dev',
+        '--config',
+        args.configPath,
+        '--port',
+        String(args.port),
+        '--local-protocol',
+        'http',
+        '--ip',
+        '127.0.0.1',
+        ...(args.remote ? ['--remote'] : []),
+    ];
+    const child = spawn(cmd, wranglerArgs, {
+        cwd: args.projectDir,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, WRANGLER_SEND_METRICS: 'false' },
+    });
+    const fallbackUrl = `http://localhost:${args.port}`;
+    let resolved = false;
+    const url = await new Promise((resolve, reject) => {
+        const onData = (buf) => {
+            const text = buf.toString();
+            for (const line of text.split('\n')) {
+                if (line.trim())
+                    args.onLog?.(line);
+            }
+            if (!resolved) {
+                const ready = parseDevReadyUrl(text, args.port);
+                if (ready) {
+                    resolved = true;
+                    resolve(ready);
+                }
+            }
+            else if (/Reloading|Detected changes|Updated/i.test(text)) {
+                args.onReload();
+            }
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('exit', (code) => {
+            if (!resolved) {
+                resolved = true;
+                reject(new Error(`wrangler dev exited before becoming ready (code ${code ?? 'null'}).`));
+            }
+        });
+        child.on('error', (err) => {
+            if (!resolved) {
+                resolved = true;
+                reject(err);
+            }
+        });
+        // Safety net: if we never matched a URL but the process is alive, assume the
+        // conventional localhost URL after a grace period.
+        setTimeout(() => {
+            if (!resolved && child.exitCode === null) {
+                resolved = true;
+                resolve(fallbackUrl);
+            }
+        }, 15_000).unref?.();
+    });
+    return { url, stop: () => stopChild(child) };
+}
+export async function runWranglerDeploy(args) {
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const deploy = (configPath) => runCapture(cmd, [...prefix, 'deploy', '--config', configPath], args.projectDir, args.onLog);
+    return deployWithSelfFallback(deploy, args);
+}
+/**
+ * Deploy with a one-time SELF-binding first-deploy recovery. A fresh worker that
+ * declares a `services: SELF` binding can't deploy (its own script doesn't exist
+ * yet); on THAT specific failure we deploy the SELF-less fallback to create the
+ * script, then redeploy WITH SELF so autobinding works. Steady state (every
+ * deploy after the first) is a single pass. The `deploy` runner is injected so
+ * the orchestration is unit-testable without shelling out.
+ */
+export async function deployWithSelfFallback(deploy, args) {
+    let { code, out } = await deploy(args.configPath);
+    if (code !== 0 && args.fallbackConfigPath && isSelfBindingMissing(out, args.workerName)) {
+        args.onLog?.('SELF service binding not resolvable yet (first deploy) — creating the worker, then re-binding SELF');
+        const first = await deploy(args.fallbackConfigPath);
+        if (first.code !== 0) {
+            throw new Error(`wrangler deploy (no-self pass) failed (code ${first.code}):\n${first.out.slice(-2000)}`);
+        }
+        ;
+        ({ code, out } = await deploy(args.configPath));
+    }
+    if (code !== 0) {
+        throw new Error(`wrangler deploy failed (code ${code}):\n${out.slice(-2000)}`);
+    }
+    const url = parseDeployUrl(out, args.route);
+    if (!url) {
+        throw new Error(`could not determine deployed URL from wrangler output:\n${out.slice(-2000)}`);
+    }
+    return { url, raw: out };
+}
+/**
+ * True when wrangler failed specifically because the worker's OWN `SELF` service
+ * binding can't resolve yet (first deploy of a fresh script). Requires the
+ * worker name so an unrelated missing-service error doesn't trigger the two-pass.
+ */
+export function isSelfBindingMissing(out, workerName) {
+    const bindingError = /could not resolve binding/i.test(out) ||
+        /service\b[^\n]*\bnot found/i.test(out) ||
+        /script\b[^\n]*\bnot found/i.test(out);
+    if (!bindingError || !/\bSELF\b/.test(out))
+        return false;
+    return workerName ? out.includes(workerName) : true;
+}
+export async function bulkPutSecrets(args) {
+    const names = Object.keys(args.secrets);
+    if (names.length === 0)
+        return;
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const dir = await mkdtemp(join(tmpdir(), 'astrale-secrets-'));
+    const file = join(dir, 'secrets.json');
+    try {
+        await writeFile(file, JSON.stringify(args.secrets));
+        const { code, out } = await runCapture(cmd, [...prefix, 'secret', 'bulk', file, '--config', args.configPath], args.projectDir, args.onLog);
+        if (code !== 0) {
+            throw new Error(`wrangler secret bulk failed (code ${code}):\n${out.slice(-1500)}`);
+        }
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+// ── internals ──────────────────────────────────────────────────────────────
+function runCapture(cmd, args, cwd, onLog) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: { ...process.env, WRANGLER_SEND_METRICS: 'false' },
+        });
+        let out = '';
+        const onData = (buf) => {
+            const text = buf.toString();
+            out += text;
+            for (const line of text.split('\n'))
+                if (line.trim())
+                    onLog?.(line);
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('exit', (code) => resolve({ code: code ?? 1, out }));
+        child.on('error', reject);
+    });
+}
+async function stopChild(child) {
+    if (child.exitCode !== null)
+        return;
+    await new Promise((resolve) => {
+        child.on('exit', () => resolve());
+        child.kill('SIGTERM');
+        setTimeout(() => {
+            if (child.exitCode === null)
+                child.kill('SIGKILL');
+            resolve();
+        }, 4000).unref?.();
+    });
+}
+//# sourceMappingURL=wrangler-cli.js.map

package/dist/wrangler-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-cli.js","sourceRoot":"","sources":["../src/wrangler-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjE,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAClE,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACxD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAA;AACtD,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAOpC;IACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,MAAM;QACT,KAAK;QACL,UAAU;QACV,IAAI,CAAC,UAAU;QACf,QAAQ;QACR,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACjB,kBAAkB;QAClB,MAAM;QACN,MAAM;QACN,WAAW;QACX,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;QACrC,GAAG,EAAE,IAAI,CAAC,UAAU;QACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE;KACxD,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;YACrC,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/C,IAAI,KAAK,EAAE,CAAC;oBACV,QAAQ,GAAG,IAAI,CAAA;oBACf,OAAO,CAAC,KAAK,CAAC,CAAA;gBAChB,CAAC;YACH,CAAC;iBAAM,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAA;YACjB,CAAC;QACH,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,CAAA;YAC1F,CAAC;QACH,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;QACF,6EAA6E;QAC7E,mDAAmD;QACnD,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACzC,QAAQ,GAAG,IAAI,CAAA;gBACf,OAAO,CAAC,WAAW,CAAC,CAAA;YACtB,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAyC;IAEzC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAE,EAAE,CACpC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7F,OAAO,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAsE,EACtE,IAAgB;IAEhB,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAEjD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,CACV,oGAAoG,CACrG,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACnD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CACzF,CAAA;QACH,CAAC;QACD,CAAC;QAAA,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,2DAA2D,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,UAAmB;IACnE,MAAM,YAAY,GAChB,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;QACtC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAKpC;IACC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC9B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,CACpC,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAChE,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,KAAK,CACX,CAAA;QACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,GAAW,EACX,KAA8B;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE;SACxD,CAAC,CAAA;QACF,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC3B,GAAG,IAAI,IAAI,CAAA;YACX,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAmB;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAM;IACnC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrB,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,EAAE,CAAA;QACX,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Deploy an Astrale domain as a standalone Cloudflare Worker",
   "keywords": [
     "adapter",
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "jose": "^6.1.3",
-    "@astrale-os/devkit": "^0.1.1"
+    "@astrale-os/devkit": "^0.1.2"
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.0 <1.0.0",