@astrale-os/adapter-cloudflare 0.5.0-beta.13 → 0.5.0-beta.131

package/dist/params.d.ts

@@ -1,41 +1,52 @@
+import type { ExchangeOptions } from '@astrale-os/sdk/execution';
 /**
  * `CloudflareParams` — the provider-typed config for the Cloudflare adapter.
  *
- * One type covers every env; per-env differences are just optional fields. The
- * same `{ dev, prod, canary, … }` map a developer writes in `astrale.config.ts`
- * is `Record<string, CloudflareParams>`.
- *
- * Three deployment shapes fall out of which fields are set:
- *   • dev (local)      — `watch()` runs `wrangler dev`; URL = http://localhost:<port>
- *   • dev-remote       — `deploy()` with no `route`; URL = https://<name>.<sub>.workers.dev
- *   • remote (custom)  — `deploy()` with `route`; URL = https://<route>
+ * One value configures one Project Environment. Omitting `route` deploys to the
+ * provider-assigned stable `*.workers.dev` address.
  */
 export interface CloudflareParams {
     /**
      * Custom route / hostname for a routed deploy, e.g. `'crm.acme.dev'`. Omit to
-     * deploy to `*.workers.dev`. Ignored by local `wrangler dev` (URL is
-     * localhost) but still used as the placeholder base domain there.
+     * deploy to `*.workers.dev`.
      */
     readonly route?: string;
+    /**
+     * Exact public Addressing expected after deployment. Use this for an already
+     * known provider-assigned address such as `*.workers.dev`; `route` remains
+     * the field that asks Cloudflare to attach a custom hostname. When both are
+     * present they must identify the same HTTPS origin.
+     */
+    readonly addressing?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
-    /** Local dev port for `wrangler dev`. Default 8787. */
-    readonly port?: number;
     /**
-     * Public URL the dev server is reached through (tunnel / sandbox preview /
-     * reverse proxy), e.g. `'https://my-box.preview.dev'`. Sets BOTH effects an
-     * off-localhost dev needs: wrangler binds 0.0.0.0 (reachable from outside)
-     * and `WORKER_URL` is pinned to this URL so the worker's per-request-Host
-     * identity (`iss`) doesn't drift to the proxy's internal hostname.
-     * Usually injected by `pnpm dev --host <url>` rather than written here.
+     * Private Ed25519 JWK file retained outside source control. Remote deploys
+     * require this explicit source so a fresh runner cannot silently rotate an
+     * installed Domain identity.
      */
-    readonly host?: string;
+    readonly signingIdentity?: string;
     /** Override the Worker name. Default: derived from the domain origin. */
     readonly workerName?: string;
-    /** Run `wrangler dev --remote` (edge isolate) instead of local workerd. */
-    readonly remote?: boolean;
     /** Extra plain (non-secret) vars to inject as Worker vars. */
     readonly vars?: Record<string, string>;
+    /**
+     * Maximum encoded invocation request bytes retained by the Worker Server.
+     * Defaults to 1 MiB and is capped at 16 MiB. Increase only from measured
+     * application traffic; Publication and Bundle delivery have separate limits.
+     */
+    readonly maximumRequestBytes?: number;
+    /**
+     * Maximum wall-clock lifetime of one invocation, including Workflow steps and
+     * returned streams. Defaults to 30 seconds. Increase this for intentionally
+     * long provider orchestration while retaining a finite application budget.
+     */
+    readonly invocationTimeoutMs?: number;
+    /**
+     * Configure the caller-only Domain token exchange lifetime, or disable exchange.
+     * The default maximum is 30 minutes; production and CI environments may select a shorter bound.
+     */
+    readonly tokenExchange?: ExchangeOptions | false;
     /**
      * Escape hatch: raw wrangler config deep-merged over the generated base. Use
      * it to declare extra bindings the adapter has no typed field for — KV, R2,
@@ -56,26 +67,20 @@ export interface CloudflareParams {
      */
     readonly wrangler?: Record<string, unknown>;
     /**
-     * Route subrequests to platform INSTANCE hostnames through a service binding
-     * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
-     * hostname served by another Worker — Cloudflare 522s it — so without this the
-     * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, the GUI's
-     * delegated calls, authed views) fails with `2002 Credential verification
-     * failed`. Point it at a router Worker that reaches those hosts internally
-     * (Astrale: `admin-router`).
+     * Optional private routing through a service binding. By default, subrequests use
+     * their public URLs; generated Workers enable `global_fetch_strictly_public` so
+     * same-zone Worker calls honor public routes too.
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
      * entry that diverts matching hosts through it.
      *
-     * ON BY DEFAULT (targets `admin-router`) so every adapter-deployed worker can
-     * verify cross-instance credentials out of the box. Pass `false` to disable
-     * (a domain that never talks to another instance, or an account without a
-     * router), or an object to override the target / binding name / host match.
+     * Opt in only when the selected router owns every hostname matched by the
+     * suffix/label predicate. A shared DNS suffix is not proof of router ownership:
+     * standalone Domain deployments may share it with managed instances.
      *
-     *   router: false                      // opt out
-     *   router: { service: 'my-router' }   // override target
+     *   router: false                     // explicit public routing (the default)
+     *   router: { service: 'my-router' }   // opt into a private router
      */
     readonly router?: false | {
         /** Router Worker the binding targets. Default `'admin-router'`. */
@@ -88,4 +93,3 @@ export interface CloudflareParams {
         readonly minLabels?: number;
     };
 }
-//# sourceMappingURL=params.d.ts.map

package/dist/params.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=params.js.map

package/dist/release/deployment.d.ts

@@ -0,0 +1,44 @@
+declare const WORKER_DEPLOYMENT_ID: unique symbol;
+/** Provider-local identity for one immutable staged Cloudflare implementation. */
+export type WorkerDeploymentId = `sha256:${string}` & {
+    readonly [WORKER_DEPLOYMENT_ID]: true;
+};
+export interface WorkerDeploymentInput {
+    readonly release: {
+        readonly entrypoint: string;
+        readonly modules: readonly {
+            readonly path: string;
+            readonly kind: 'esm' | 'wasm' | 'text' | 'data';
+            readonly content: Uint8Array;
+        }[];
+    };
+    readonly runtime: {
+        readonly compatibilityDate: string;
+        readonly compatibilityFlags: readonly string[];
+    };
+    readonly bindings: {
+        readonly vars: Readonly<Record<string, string>>;
+        readonly services: readonly {
+            readonly name: string;
+            readonly service: string;
+        }[];
+        readonly requiredSecrets: readonly string[];
+    };
+    readonly assets?: {
+        readonly files: readonly {
+            readonly path: string;
+            readonly content: Uint8Array;
+            readonly contentType?: string;
+        }[];
+        readonly notFound: 'none' | '404-page' | 'single-page-application';
+        readonly runWorkerFirst: boolean;
+        readonly htmlHandling?: 'none';
+    };
+}
+/** Canonical provider material used only for staging, promotion, rollback, and cleanup. */
+export declare function workerDeploymentMaterial(input: WorkerDeploymentInput): Uint8Array;
+/** Identify one immutable Cloudflare implementation without changing SDK or Publication identity. */
+export declare function workerDeployment(input: WorkerDeploymentInput): WorkerDeploymentId;
+/** Admit a serialized provider deployment identity at a Cloudflare boundary. */
+export declare function acceptWorkerDeployment(input: unknown): WorkerDeploymentId;
+export {};

package/dist/release/deployment.js

@@ -0,0 +1,141 @@
+import { sha256 } from '@noble/hashes/sha2.js';
+const DEPLOYMENT = /^sha256:[0-9a-f]{64}$/u;
+/** Canonical provider material used only for staging, promotion, rollback, and cleanup. */
+export function workerDeploymentMaterial(input) {
+    const release = executable(input.release);
+    const compatibilityFlags = uniqueStrings(input.runtime.compatibilityFlags, 'compatibility flag');
+    const vars = Object.fromEntries(Object.entries(input.bindings.vars)
+        .map(([name, value]) => {
+        stable(name, 'Variable binding name');
+        if (typeof value !== 'string')
+            invalid();
+        return [name, value];
+    })
+        .sort(([left], [right]) => compare(left, right)));
+    const services = [...input.bindings.services]
+        .map((binding) => ({
+        name: stable(binding.name, 'Service binding name'),
+        service: stable(binding.service, 'Service binding target'),
+    }))
+        .sort((left, right) => compare(left.name, right.name));
+    unique(services.map((binding) => binding.name), 'Service binding name');
+    const requiredSecrets = uniqueStrings(input.bindings.requiredSecrets, 'required secret');
+    unique([...Object.keys(vars), ...services.map((binding) => binding.name), ...requiredSecrets], 'Worker binding name');
+    const assets = input.assets === undefined ? undefined : canonicalAssets(input.assets);
+    return new TextEncoder().encode(`${JSON.stringify({
+        format: 'astrale.cloudflare.deployment',
+        version: 1,
+        release,
+        runtime: {
+            compatibilityDate: stable(input.runtime.compatibilityDate, 'compatibility date'),
+            compatibilityFlags,
+        },
+        bindings: { vars, services, requiredSecrets },
+        ...(assets === undefined ? {} : { assets }),
+    })}\n`);
+}
+/** Identify one immutable Cloudflare implementation without changing SDK or Publication identity. */
+export function workerDeployment(input) {
+    let hexadecimal = '';
+    for (const byte of sha256(workerDeploymentMaterial(input))) {
+        hexadecimal += byte.toString(16).padStart(2, '0');
+    }
+    return `sha256:${hexadecimal}`;
+}
+/** Admit a serialized provider deployment identity at a Cloudflare boundary. */
+export function acceptWorkerDeployment(input) {
+    if (typeof input !== 'string' || !DEPLOYMENT.test(input)) {
+        throw new TypeError('Cloudflare Worker deployment identity is invalid.');
+    }
+    return input;
+}
+function executable(input) {
+    const entrypoint = stablePath(input.entrypoint, 'Worker release entrypoint');
+    const modules = input.modules
+        .map((module) => ({
+        path: stablePath(module.path, 'Worker release module path'),
+        kind: module.kind,
+        digest: content(module.content),
+    }))
+        .sort((left, right) => compare(left.path, right.path));
+    unique(modules.map((module) => module.path), 'Worker release module path');
+    if (!modules.some((module) => module.path === entrypoint && module.kind === 'esm')) {
+        throw new TypeError('Worker release entrypoint must be an ES module in its module set.');
+    }
+    return { entrypoint, modules };
+}
+function canonicalAssets(input) {
+    const files = input.files
+        .map((file) => ({
+        path: stableAssetPath(file.path),
+        digest: content(file.content),
+        ...(file.contentType === undefined
+            ? {}
+            : { contentType: stable(file.contentType, 'Worker asset content type') }),
+    }))
+        .sort((left, right) => compare(left.path, right.path));
+    unique(files.map((file) => file.path), 'Worker asset path');
+    if (!['none', '404-page', 'single-page-application'].includes(input.notFound))
+        invalid();
+    if (input.htmlHandling !== undefined && input.htmlHandling !== 'none')
+        invalid();
+    return {
+        files,
+        notFound: input.notFound,
+        runWorkerFirst: input.runWorkerFirst,
+        htmlHandling: input.htmlHandling ?? 'none',
+    };
+}
+function uniqueStrings(input, label) {
+    const values = input.map((value) => stable(value, label)).sort(compare);
+    unique(values, label);
+    return values;
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length) {
+        throw new TypeError(`${label} must be unique.`);
+    }
+}
+function content(value) {
+    if (!(value instanceof Uint8Array))
+        invalid();
+    let hexadecimal = '';
+    for (const byte of sha256(value))
+        hexadecimal += byte.toString(16).padStart(2, '0');
+    return `sha256:${hexadecimal}`;
+}
+function stablePath(value, label) {
+    const admitted = stable(value, label);
+    if (admitted.startsWith('/') ||
+        admitted.includes('\\') ||
+        admitted.split('/').some((part) => part.length === 0 || part === '.' || part === '..')) {
+        invalid();
+    }
+    return admitted;
+}
+function stableAssetPath(value) {
+    const admitted = stable(value, 'Worker asset path');
+    if (!admitted.startsWith('/') ||
+        admitted.includes('\\') ||
+        admitted.includes('?') ||
+        admitted.includes('#') ||
+        admitted
+            .slice(1)
+            .split('/')
+            .some((part) => part.length === 0 || part === '.' || part === '..')) {
+        invalid();
+    }
+    return admitted;
+}
+function stable(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.trim() !== value) {
+        throw new TypeError(`${label} must be stable non-empty text.`);
+    }
+    return value;
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid() {
+    throw new TypeError('Cloudflare Worker deployment material is invalid.');
+}

package/dist/release/index.d.ts

@@ -0,0 +1,2 @@
+export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, type WorkerDeploymentId, type WorkerDeploymentInput, } from './deployment.js';
+export { stagedWorkerName } from './staged-worker-name.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, } from './deployment.js';
+export { stagedWorkerName } from './staged-worker-name.js';

package/dist/release/staged-worker-name.d.ts

@@ -0,0 +1,3 @@
+import type { WorkerDeploymentId } from './deployment.js';
+/** Provider deployment identities select immutable Workers inside the private namespace. */
+export declare function stagedWorkerName(deployment: WorkerDeploymentId): string;

package/dist/release/staged-worker-name.js

@@ -0,0 +1,10 @@
+import { acceptWorkerDeployment } from './deployment.js';
+const DEPLOYMENT = /^sha256:([0-9a-f]{64})$/u;
+/** Provider deployment identities select immutable Workers inside the private namespace. */
+export function stagedWorkerName(deployment) {
+    const digest = DEPLOYMENT.exec(acceptWorkerDeployment(deployment))?.[1];
+    if (digest === undefined)
+        throw new TypeError('Cloudflare Worker deployment identity is invalid.');
+    const encoded = BigInt(`0x${digest}`).toString(36).padStart(50, '0');
+    return `r-${encoded}`;
+}

package/dist/worker/entry.d.ts

@@ -0,0 +1,48 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+import type { BuildMaterial, GeneratedBuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { ExchangeOptions, ExecutionContext } from '@astrale-os/sdk/execution';
+import type { Runtime } from '@astrale-os/sdk/runtime';
+export interface Fetcher {
+    fetch(request: Request): Response | Promise<Response>;
+}
+export interface CloudflareAdapterBindings {
+    readonly ASTRALE_SIGNING_IDENTITY?: string;
+    readonly ASTRALE_VERSION_METADATA?: {
+        readonly id: string;
+    };
+    readonly WORKER_URL?: string;
+    readonly IDENTITY_ISS?: string;
+    readonly ASSETS?: Fetcher;
+    readonly SELF?: Fetcher;
+    readonly DISPATCHER?: {
+        get(name: string): Fetcher;
+    };
+}
+export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings extends CloudflareAdapterBindings, Environment, Material = BuildMaterial> {
+    /** Generated frontend evidence available without restoring the execution Build. */
+    readonly frontend?: BuildMaterial['frontend'];
+    /** Generated browser-file identity used only for deployment propagation checks. */
+    readonly frontendRevision?: string;
+    /** Load the exact Runtime and Build once, after the isolate has accepted a request. */
+    readonly load: () => CloudflareWorkerSource<RuntimeValue, Material> | Promise<CloudflareWorkerSource<RuntimeValue, Material>>;
+    readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
+    readonly resolveEnvironment?: (bindings: Bindings) => Environment;
+    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly providerAssignedWorker?: string;
+    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+    readonly maximumRequestBytes?: number;
+    readonly tokenExchange?: ExchangeOptions | false;
+}
+export interface CloudflareWorkerSource<RuntimeValue extends Runtime, Material = BuildMaterial> {
+    readonly runtime: RuntimeValue;
+    readonly material: Material;
+}
+export interface CloudflareWorker<Bindings> {
+    fetch(request: Request, environment: Bindings, executionContext?: ExecutionContext): Response | Promise<Response>;
+}
+/** Compose one Service implementation behind its provider-owned stable address. */
+export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment, BuildMaterial>) => CloudflareWorker<Bindings>;
+/** Compose generated execution code whose exact Build material carries build-owner evidence. */
+export declare function generatedCloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment, GeneratedBuildMaterial>) => CloudflareWorker<Bindings>;

package/dist/worker/entry.js

@@ -0,0 +1,157 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { restoreBuild, restoreGeneratedBuild } from '@astrale-os/sdk/deployment/build/material';
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { createIdentity, serve } from '@astrale-os/sdk/execution';
+import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
+import { frontendAsset } from './frontend.js';
+/** Compose one Service implementation behind its provider-owned stable address. */
+export function cloudflareWorkerEntry() {
+    return createCloudflareWorkerEntry(restoreBuild);
+}
+/** Compose generated execution code whose exact Build material carries build-owner evidence. */
+export function generatedCloudflareWorkerEntry() {
+    return createCloudflareWorkerEntry(restoreGeneratedBuild);
+}
+function createCloudflareWorkerEntry(restore) {
+    return function (config) {
+        let currentIssuer;
+        let realized;
+        const realize = () => {
+            if (realized !== undefined)
+                return realized;
+            realized = Promise.resolve()
+                .then(config.load)
+                .then((source) => {
+                const build = restore(source.material, source.runtime);
+                const application = serve({
+                    runtime: source.runtime,
+                    load(environment) {
+                        if (currentIssuer !== environment.issuer) {
+                            throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
+                        }
+                        return assemble(build, addressing(environment.issuer));
+                    },
+                    initialize: (environment) => config.resolveEnvironment === undefined
+                        ? environment.bindings
+                        : config.resolveEnvironment(environment.bindings),
+                    identity(environment) {
+                        return createIdentity({
+                            issuer: issuer.accept(environment.issuer),
+                            subject: build.schema.compiled.root.origin,
+                            privateKey: typeof config.privateKey === 'function'
+                                ? config.privateKey(environment.bindings)
+                                : config.privateKey,
+                            fetch: routedFetch(application, environment, config),
+                            ...(new URL(environment.issuer).protocol === 'http:'
+                                ? { allowInsecureHttp: true }
+                                : {}),
+                            ...(config.tokenExchange === undefined
+                                ? {}
+                                : { tokenExchange: config.tokenExchange }),
+                        });
+                    },
+                    server: {
+                        health: { probe: { check: () => true } },
+                        limits: {
+                            maximumRequestBytes: config.maximumRequestBytes ?? 1024 * 1024,
+                            maximumPublicationBytes: 1024 * 1024,
+                            maximumBundleBytes: 8 * 1024 * 1024,
+                            maximumDeliveryBytes: 8 * 1024 * 1024,
+                            invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
+                        },
+                    },
+                });
+                return Object.freeze({ build, application });
+            });
+            return realized;
+        };
+        return Object.freeze({
+            async fetch(request, bindings, context) {
+                const url = new URL(request.url);
+                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                    bindings.IDENTITY_ISS ??
+                    config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
+                    requestOrigin(url, request));
+                if (config.providerAssignedWorker !== undefined &&
+                    bindings.WORKER_URL === undefined &&
+                    bindings.IDENTITY_ISS === undefined &&
+                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    return new Response('Request origin differs from provider-assigned Addressing.', {
+                        status: 421,
+                    });
+                }
+                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                    return new Response('Request origin differs from the current Release.', { status: 421 });
+                }
+                currentIssuer = issuer;
+                if (config.frontend !== undefined) {
+                    const frontend = await frontendAsset(config.frontend, bindings.ASSETS, url, request, config.frontendRevision);
+                    if (frontend !== undefined)
+                        return withProviderVersion(frontend, bindings);
+                }
+                const { application, build } = await realize();
+                if (config.frontend === undefined) {
+                    const frontend = await frontendAsset(build.frontend, bindings.ASSETS, url, request, config.frontendRevision);
+                    if (frontend !== undefined)
+                        return withProviderVersion(frontend, bindings);
+                }
+                const response = await application.fetch(request, Object.freeze({ bindings, issuer }), context);
+                return withProviderVersion(response, bindings);
+            },
+        });
+    };
+}
+function withProviderVersion(response, bindings) {
+    if (bindings.ASTRALE_VERSION_METADATA === undefined)
+        return response;
+    const versioned = new Response(response.body, response);
+    versioned.headers.set('X-Astrale-Worker-Version', bindings.ASTRALE_VERSION_METADATA.id);
+    return versioned;
+}
+function routedFetch(application, environment, config) {
+    return async (input, init) => {
+        const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
+        const destination = new URL(request.url);
+        if (destination.origin === environment.issuer) {
+            const self = config.selfBinding?.(environment.bindings);
+            return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
+                ? application.fetch(selected, environment)
+                : self.fetch(selected));
+        }
+        const route = config.routeSubrequest?.(destination, environment.bindings);
+        return dispatchCloudflareRequest(request, rejectRedirect, (selected) => route === null || route === undefined ? fetch(selected) : route.fetch(selected));
+    };
+}
+function requestOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
+    return forwarded === 'https' ? `https://${url.host}` : url.origin;
+}
+function canonicalServingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/fetch.d.ts

@@ -9,4 +9,3 @@ export declare function prepareCloudflareRequest(input: Parameters<typeof fetch>
 export declare function dispatchCloudflareRequest(request: Request, rejectRedirect: boolean, dispatch: RequestDispatcher): Promise<Response>;
 /** Restore the requested URL omitted by Cloudflare service-binding Responses. */
 export declare function adaptCloudflareResponse(request: Request, response: Response): Response;
-//# sourceMappingURL=fetch.d.ts.map

package/dist/worker/fetch.js

@@ -29,4 +29,3 @@ export function adaptCloudflareResponse(request, response) {
         },
     });
 }
-//# sourceMappingURL=fetch.js.map

package/dist/worker/frontend.d.ts

@@ -0,0 +1,4 @@
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { Fetcher } from './entry.js';
+/** Serve public frontend files without realizing the Application's execution Runtime. */
+export declare function frontendAsset(frontend: BuildMaterial['frontend'], assets: Fetcher | undefined, url: URL, request: Request, revision?: string): Promise<Response | undefined>;

package/dist/worker/frontend.js

@@ -0,0 +1,46 @@
+/** Serve public frontend files without realizing the Application's execution Runtime. */
+export async function frontendAsset(frontend, assets, url, request, revision) {
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return undefined;
+    if (reserved(url.pathname) || (request.method !== 'GET' && request.method !== 'HEAD')) {
+        return undefined;
+    }
+    const assetPath = url.pathname.startsWith('/assets/');
+    const route = assetPath
+        ? undefined
+        : frontend.routes
+            .filter((candidate) => candidate.path === url.pathname ||
+            (frontend.source.kind === 'vite' &&
+                frontend.source.spa &&
+                (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
+            .sort((left, right) => right.path.length - left.path.length)[0];
+    if (assets === undefined)
+        return undefined;
+    if (route === undefined) {
+        const response = await assets.fetch(request);
+        return assetPath || response.status !== 404 ? publicAsset(response, revision) : undefined;
+    }
+    if (route.path !== url.pathname) {
+        const response = await assets.fetch(request);
+        if (response.status !== 404)
+            return publicAsset(response, revision);
+    }
+    return publicAsset(await assets.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request)), revision);
+}
+function publicAsset(response, revision) {
+    // Plain Views have an opaque sandbox origin. Their modules, CSS and fonts still need
+    // public reads; this neither enables credentials nor changes execution endpoint CORS.
+    const readable = new Response(response.body, response);
+    if (!readable.headers.has('Access-Control-Allow-Origin'))
+        readable.headers.set('Access-Control-Allow-Origin', '*');
+    if (revision !== undefined)
+        readable.headers.set('X-Astrale-Frontend', revision);
+    // Documents select hashed assets. Do not retain stale documents or transient asset misses.
+    if (!response.ok || response.headers.get('Content-Type')?.split(';')[0] === 'text/html') {
+        readable.headers.set('Cache-Control', 'no-store');
+    }
+    return readable;
+}
+function reserved(path) {
+    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}

package/dist/worker/identity.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+/** Decode the secret representation at the Worker binding boundary. */
+export declare function decodeSigningIdentity(input: string): JsonWebKey;
+/** Remove adapter-owned signing material before Runtime initialization. */
+export declare function runtimeBindings<Bindings extends {
+    readonly ASTRALE_SIGNING_IDENTITY: string;
+}>(bindings: Bindings): Omit<Bindings, 'ASTRALE_SIGNING_IDENTITY'>;

package/dist/worker/identity.js

@@ -0,0 +1,23 @@
+/** Decode the secret representation at the Worker binding boundary. */
+export function decodeSigningIdentity(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid();
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare signing identity secret is invalid JSON.', { cause });
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded))
+        invalid();
+    return decoded;
+}
+/** Remove adapter-owned signing material before Runtime initialization. */
+export function runtimeBindings(bindings) {
+    const { ASTRALE_SIGNING_IDENTITY: _identity, ...runtime } = bindings;
+    return runtime;
+}
+function invalid() {
+    throw new TypeError('Cloudflare signing identity secret is invalid.');
+}