@astrale-os/adapter-cloudflare 0.5.0-beta.13 → 0.5.0-beta.131

package/src/cloudflare.ts

@@ -1,275 +0,0 @@
-/**
- * `cloudflare(envs)` — the Cloudflare deployment adapter.
- *
- * Owns everything target-specific: it codegens the Worker entry + wrangler
- * config (the dev never sees a `wrangler.jsonc`), materializes the optional frontend
- * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
- * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
- * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the CLI
- * prints and `astrale domain install <url>` consumes.
- */
-
-import type { DomainAdapter } from '@astrale-os/sdk'
-import type { DeployFetch } from '@astrale-os/sdk/deployment'
-
-import { defineAdapter } from '@astrale-os/sdk'
-import { deployCheck } from '@astrale-os/sdk/deployment'
-import { resolve } from 'node:path'
-
-import type { CloudflareParams } from './params.js'
-
-import {
-  bulkPutSecrets,
-  buildCloudflareWorker,
-  buildFrontend,
-  logTo,
-  prepare,
-  runWranglerDeploy,
-  runWranglerDev,
-  runWranglerTypes,
-  startFrontendDev,
-} from './build/index.js'
-
-export function cloudflare(
-  envs: Record<string, CloudflareParams>,
-): DomainAdapter<CloudflareParams> {
-  return cloudflareWithDependencies(envs, {
-    bulkPutSecrets,
-    buildCloudflareWorker,
-    buildFrontend,
-    logTo,
-    prepare,
-    runWranglerDeploy,
-    runWranglerDev,
-    runWranglerTypes,
-    startFrontendDev,
-    waitUntilLive,
-  })
-}
-
-interface CloudflareAdapterDependencies {
-  readonly bulkPutSecrets: typeof bulkPutSecrets
-  readonly buildCloudflareWorker: typeof buildCloudflareWorker
-  readonly buildFrontend: typeof buildFrontend
-  readonly logTo: typeof logTo
-  readonly prepare: typeof prepare
-  readonly runWranglerDeploy: typeof runWranglerDeploy
-  readonly runWranglerDev: typeof runWranglerDev
-  readonly runWranglerTypes: typeof runWranglerTypes
-  readonly startFrontendDev: typeof startFrontendDev
-  readonly waitUntilLive: typeof waitUntilLive
-}
-
-/** Exact orchestration seam used by adapter-level deployment qualification. */
-export function cloudflareWithDependencies(
-  envs: Record<string, CloudflareParams>,
-  dependencies: CloudflareAdapterDependencies,
-): DomainAdapter<CloudflareParams> {
-  const frontendDevUrls = new Map<string, string>()
-  return defineAdapter<CloudflareParams>({
-    name: 'cloudflare',
-    envs,
-
-    async build(params, ctx) {
-      await dependencies.buildCloudflareWorker({
-        params,
-        context: ctx,
-        onLog: dependencies.logTo(),
-      })
-    },
-
-    async watch(params, ctx) {
-      const onLog = dependencies.logTo()
-      const projectKey = resolve(ctx.projectDir)
-      let frontendDev: Awaited<ReturnType<typeof startFrontendDev>>
-      let handle: Awaited<ReturnType<typeof runWranglerDev>> | undefined
-      try {
-        frontendDev = await dependencies.startFrontendDev({
-          definition: ctx.definition,
-          projectDir: ctx.projectDir,
-          onLog,
-        })
-        if (frontendDev !== undefined) frontendDevUrls.set(projectKey, frontendDev.url)
-        const { configPath, port } = await dependencies.prepare(
-          params,
-          ctx,
-          'dev',
-          undefined,
-          frontendDev?.url,
-        )
-        handle = await dependencies.runWranglerDev({
-          projectDir: ctx.projectDir,
-          configPath,
-          port,
-          remote: Boolean(params.remote),
-          autoPickPort: params.port === undefined,
-          ...(params.host ? { ip: '0.0.0.0' } : {}),
-          onReload: ctx.onReload,
-          onLog,
-        })
-      } catch (error) {
-        frontendDevUrls.delete(projectKey)
-        try {
-          await frontendDev?.stop()
-        } catch (cleanupError) {
-          throw new AggregateError(
-            [error, cleanupError],
-            'cloudflare development startup failed and Vite cleanup also failed',
-          )
-        }
-        throw error
-      }
-      if (handle === undefined) throw new Error('cloudflare local Worker failed to start')
-      // With --host the actionable URL is the PUBLIC one (the tunnel/proxy
-      // front), not the local bind — print and spec-stamp that.
-      return {
-        url: params.host ?? handle.url,
-        localUrl: handle.url,
-        async stop() {
-          const errors: unknown[] = []
-          frontendDevUrls.delete(projectKey)
-          try {
-            await frontendDev?.stop()
-          } catch (error) {
-            errors.push(error)
-          }
-          try {
-            await handle.stop()
-          } catch (error) {
-            errors.push(error)
-          }
-          if (errors.length === 1) throw errors[0]
-          if (errors.length > 1) {
-            throw new AggregateError(errors, 'cloudflare development cleanup failed')
-          }
-        },
-      }
-    },
-
-    // Config hot-regen rewrites generated files only. Wrangler reloads its config and entry;
-    // the author-owned Vite process keeps its own source/config watch lifecycle.
-    async regenerate(params, ctx) {
-      const { configPath } = await dependencies.prepare(
-        params,
-        ctx,
-        'dev',
-        undefined,
-        frontendDevUrls.get(resolve(ctx.projectDir)),
-      )
-      await dependencies.runWranglerTypes({
-        projectDir: ctx.projectDir,
-        configPath,
-        onLog: dependencies.logTo(),
-      })
-    },
-
-    async deploy(params, ctx) {
-      const frontend = await dependencies.buildFrontend({
-        definition: ctx.definition,
-        projectDir: ctx.projectDir,
-        onLog: dependencies.logTo(),
-      })
-      const {
-        configPath,
-        fallbackConfigPath,
-        workerName: name,
-      } = await dependencies.prepare(params, ctx, 'deploy', frontend)
-      const { url, deploymentVersion } = await dependencies.runWranglerDeploy({
-        projectDir: ctx.projectDir,
-        configPath,
-        workerName: name,
-        ...(fallbackConfigPath ? { fallbackConfigPath } : {}),
-        ...(params.route ? { route: params.route } : {}),
-        onLog: dependencies.logTo(),
-      })
-      if (Object.keys(ctx.secrets).length > 0) {
-        await dependencies.bulkPutSecrets({
-          projectDir: ctx.projectDir,
-          configPath,
-          secrets: ctx.secrets,
-          onLog: dependencies.logTo(),
-        })
-      }
-      // A first deploy on a fresh `*.workers.dev` host can take ~30-60s to
-      // propagate; an `astrale domain install <url>` issued right away would
-      // 404 (Cloudflare 1042). Block until the URL actually serves so the
-      // install line we print is immediately actionable.
-      await dependencies.waitUntilLive(url, dependencies.logTo(), {
-        expectedOrigin: ctx.definition.schema.origin,
-        expectedRevision: ctx.definition.domain.$.revision,
-        ...(deploymentVersion === undefined
-          ? {}
-          : { expectedDeploymentVersion: deploymentVersion }),
-      })
-      return { url }
-    },
-
-    secretsFile(params) {
-      return params.secrets
-    },
-  })
-}
-
-/**
- * Poll until the deployed Worker exposes one complete canonical deployment chain.
- */
-export async function waitUntilLive(
-  url: string,
-  onLog: (line: string) => void,
-  expectations: {
-    readonly expectedOrigin: Parameters<typeof deployCheck>[0]['expectedOrigin']
-    readonly expectedRevision: Parameters<typeof deployCheck>[0]['expectedRevision']
-    readonly expectedDeploymentVersion?: string
-    readonly fetch?: DeployFetch
-    readonly timeoutMs?: number
-    readonly fetchTimeoutMs?: number
-    readonly retryMs?: number
-    readonly sleep?: (ms: number) => Promise<void>
-  },
-): Promise<void> {
-  const timeoutMs = expectations.timeoutMs ?? 90_000
-  const fetchTimeoutMs = expectations.fetchTimeoutMs ?? 5_000
-  const retryMs = expectations.retryMs ?? 3_000
-  const sleep =
-    expectations.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)))
-  const deadline = Date.now() + timeoutMs
-  let waited = false
-  let lastReason = 'not checked'
-  for (;;) {
-    try {
-      const deployed = await deployCheck({
-        url,
-        expectedOrigin: expectations.expectedOrigin,
-        expectedRevision: expectations.expectedRevision,
-        signal: AbortSignal.timeout(fetchTimeoutMs),
-        ...(expectations.fetch === undefined ? {} : { fetch: expectations.fetch }),
-        log: () => undefined,
-      })
-      const actualDeploymentVersion = new URL(deployed.schema.bundle.href).searchParams.get(
-        'deployment',
-      )
-      if (
-        expectations.expectedDeploymentVersion === undefined ||
-        actualDeploymentVersion === expectations.expectedDeploymentVersion
-      ) {
-        return
-      }
-      lastReason =
-        `bundle deployment=${JSON.stringify(actualDeploymentVersion)} ` +
-        `expected=${JSON.stringify(expectations.expectedDeploymentVersion)}`
-    } catch (error) {
-      lastReason = error instanceof Error ? error.message : String(error)
-    }
-    if (Date.now() >= deadline) {
-      throw new Error(
-        `deployed Worker did not expose a valid Publication chain within ` +
-          `${Math.round(timeoutMs / 1000)}s; last check: ${lastReason}`,
-      )
-    }
-    if (!waited) {
-      waited = true
-      onLog('waiting for the URL to go live (first deploys can take ~30-60s)…')
-    }
-    await sleep(Math.min(retryMs, Math.max(0, deadline - Date.now())))
-  }
-}

package/src/index.ts

@@ -1,21 +0,0 @@
-/**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
- *
- *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
- *
- *   adapter: cloudflare({
- *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
- *   })
- *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
- * `*.workers.dev`; an env with a `route` ships to that custom domain.
- *
- * Prefer a managed deploy (no Cloudflare account)? Use
- * `@astrale-os/adapter-astrale`, which builds the same bundle via this package's
- * `/build` toolkit and ships it through the Astrale platform.
- */
-
-export { cloudflare } from './cloudflare.js'
-export type { CloudflareParams } from './params.js'

package/src/params.ts

@@ -1,92 +0,0 @@
-/**
- * `CloudflareParams` — the provider-typed config for the Cloudflare adapter.
- *
- * One type covers every env; per-env differences are just optional fields. The
- * same `{ dev, prod, canary, … }` map a developer writes in `astrale.config.ts`
- * is `Record<string, CloudflareParams>`.
- *
- * Three deployment shapes fall out of which fields are set:
- *   • dev (local)      — `watch()` runs `wrangler dev`; URL = http://localhost:<port>
- *   • dev-remote       — `deploy()` with no `route`; URL = https://<name>.<sub>.workers.dev
- *   • remote (custom)  — `deploy()` with `route`; URL = https://<route>
- */
-export interface CloudflareParams {
-  /**
-   * Custom route / hostname for a routed deploy, e.g. `'crm.acme.dev'`. Omit to
-   * deploy to `*.workers.dev`. Ignored by local `wrangler dev` (URL is
-   * localhost) but still used as the placeholder base domain there.
-   */
-  readonly route?: string
-  /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
-  readonly secrets?: string
-  /** Local dev port for `wrangler dev`. Default 8787. */
-  readonly port?: number
-  /**
-   * Public URL the dev server is reached through (tunnel / sandbox preview /
-   * reverse proxy), e.g. `'https://my-box.preview.dev'`. Sets BOTH effects an
-   * off-localhost dev needs: wrangler binds 0.0.0.0 (reachable from outside)
-   * and `WORKER_URL` is pinned to this URL so the worker's per-request-Host
-   * identity (`iss`) doesn't drift to the proxy's internal hostname.
-   * Usually injected by `pnpm dev --host <url>` rather than written here.
-   */
-  readonly host?: string
-  /** Override the Worker name. Default: derived from the domain origin. */
-  readonly workerName?: string
-  /** Run `wrangler dev --remote` (edge isolate) instead of local workerd. */
-  readonly remote?: boolean
-  /** Extra plain (non-secret) vars to inject as Worker vars. */
-  readonly vars?: Record<string, string>
-  /**
-   * Escape hatch: raw wrangler config deep-merged over the generated base. Use
-   * it to declare extra bindings the adapter has no typed field for — KV, R2,
-   * D1, queues, service bindings, extra `compatibility_flags`, cron `triggers`,
-   * Hyperdrive, etc.
-   *
-   *   wrangler: {
-   *     kv_namespaces: [{ binding: 'CACHE', id: '<kv-id>' }],
-   *     r2_buckets: [{ binding: 'FILES', bucket_name: 'my-bucket' }],
-   *   }
-   *
-   * The merge is additive: arrays concat (so your `services` keep the adapter's
-   * `SELF` binding and your `compatibility_flags` keep `nodejs_compat`); new
-   * keys are added as-is. The adapter-owned keys `name`, `main`, `assets`,
-   * `routes` are rejected — use `workerName` and `route` instead. Avoid
-   * the reserved binding names `SELF` and `ASSETS`. Durable Objects need extra
-   * worker-entry codegen and aren't supported through this field yet.
-   */
-  readonly wrangler?: Record<string, unknown>
-  /**
-   * Route subrequests to platform INSTANCE hostnames through a service binding
-   * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
-   * hostname served by another Worker — Cloudflare 522s it — so without this the
-   * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-   * from that instance, and every cross-instance call (install hooks, the GUI's
-   * delegated calls, authed views) fails with `2002 Credential verification
-   * failed`. Point it at a router Worker that reaches those hosts internally
-   * (Astrale: `admin-router`).
-   *
-   * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
-   * generated wrangler config, and a `routeSubrequest` predicate in the worker
-   * entry that diverts matching hosts through it.
-   *
-   * ON BY DEFAULT (targets `admin-router`) so every adapter-deployed worker can
-   * verify cross-instance credentials out of the box. Pass `false` to disable
-   * (a domain that never talks to another instance, or an account without a
-   * router), or an object to override the target / binding name / host match.
-   *
-   *   router: false                      // opt out
-   *   router: { service: 'my-router' }   // override target
-   */
-  readonly router?:
-    | false
-    | {
-        /** Router Worker the binding targets. Default `'admin-router'`. */
-        readonly service?: string
-        /** Service-binding name the worker reads. Default `'ROUTER'`. */
-        readonly binding?: string
-        /** Host suffix that marks an instance host. Default `'.astrale.ai'`. */
-        readonly hostSuffix?: string
-        /** Min dot-separated label count for an instance host. Default `4` (`<slug>.<region>.astrale.ai`). */
-        readonly minLabels?: number
-      }
-}

package/src/worker/fetch.ts

@@ -1,46 +0,0 @@
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308])
-
-export type RequestDispatcher = (request: Request) => Response | Promise<Response>
-
-export interface CloudflareRequest {
-  readonly request: Request
-  readonly rejectRedirect: boolean
-}
-
-/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
-export function prepareCloudflareRequest(
-  input: Parameters<typeof fetch>[0],
-  init?: Parameters<typeof fetch>[1],
-): CloudflareRequest {
-  const rejectRedirect =
-    init?.redirect === 'error' ||
-    (init?.redirect === undefined && input instanceof Request && input.redirect === 'error')
-  const request = new Request(input, rejectRedirect ? { ...init, redirect: 'manual' } : init)
-  return Object.freeze({ request, rejectRedirect })
-}
-
-/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
-export async function dispatchCloudflareRequest(
-  request: Request,
-  rejectRedirect: boolean,
-  dispatch: RequestDispatcher,
-): Promise<Response> {
-  const response = adaptCloudflareResponse(request, await dispatch(request))
-  if (!rejectRedirect) return response
-  if (!response.redirected && !REDIRECT_STATUSES.has(response.status)) return response
-
-  await response.body?.cancel()
-  throw new TypeError('Redirects are not allowed for this request.')
-}
-
-/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
-export function adaptCloudflareResponse(request: Request, response: Response): Response {
-  if (response.url !== '') return response
-  return new Proxy(response, {
-    get(target, property) {
-      if (property === 'url') return request.url
-      const value = Reflect.get(target, property, target) as unknown
-      return typeof value === 'function' ? value.bind(target) : value
-    },
-  })
-}