@astrale-os/adapter-cloudflare 0.5.0-beta.13 → 0.5.0-beta.131

package/dist/worker/index.d.ts

@@ -1,61 +1,2 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { DomainDefinition } from '@astrale-os/sdk';
-import type { Application, RemoteDeploymentInput, RemoteIdentityInput } from '@astrale-os/sdk/server';
-import type { ExecutionContext } from 'hono';
-/** SDK-owned Publication manifest passed through without adapter interpretation. */
-export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>;
-export interface Fetcher {
-    fetch(request: Request): Response | Promise<Response>;
-}
-/** Adapter-owned bindings generated into every Cloudflare deployment. */
-export interface CloudflareAdapterBindings {
-    /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
-    readonly ASTRALE_VERSION_METADATA?: {
-        readonly id: string;
-        readonly tag: string;
-        readonly timestamp: string;
-    };
-    /** Content-derived generation supplied by providers without version metadata. */
-    readonly ASTRALE_DEPLOYMENT_VERSION?: string;
-    readonly WORKER_URL?: string;
-    readonly ASSETS?: Fetcher;
-    readonly SELF?: Fetcher;
-    readonly FRONTEND_DEV_URL?: string;
-    readonly DISPATCHER?: {
-        get(name: string): Fetcher;
-    };
-}
-interface CloudflareWorkerSharedConfig<Bindings extends CloudflareAdapterBindings, Environment> {
-    readonly privateKey: RemoteIdentityInput['privateKey'] | ((bindings: Bindings) => RemoteIdentityInput['privateKey']);
-    /** Compose provider bindings into the exact Domain environment once per deployment generation. */
-    readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>;
-    readonly manifest?: CloudflareManifest;
-    /** Maximum time allowed for one Domain invocation. Defaults to 30 seconds. */
-    readonly invocationTimeoutMs?: number;
-    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
-    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
-}
-/**
- * Resolve a Domain lazily when its module graph is too expensive for provider startup admission.
- * The adapter resolves at most once concurrently and retries after a rejected resolution.
- */
-export type CloudflareWorkerConfig<S extends schema.DomainSchema, Bindings extends CloudflareAdapterBindings, Environment> = CloudflareWorkerSharedConfig<Bindings, Environment> & ({
-    readonly definition: DomainDefinition<S>;
-    readonly resolveDefinition?: never;
-} | {
-    readonly definition?: never;
-    readonly resolveDefinition: (bindings: Bindings) => DomainDefinition<S> | Promise<DomainDefinition<S>>;
-});
-export interface CloudflareWorker<Environment> {
-    fetch(request: Request, environment: Environment, executionContext?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <const S extends schema.DomainSchema>(config: CloudflareWorkerConfig<S, Bindings, Environment>) => CloudflareWorker<Bindings>;
-/** Close an evicted Application before its environment bindings leave the cache. */
-export declare function closeEvictedApplication(application: Pick<Application, 'close'>, now?: () => number): Promise<void>;
-export {};
-//# sourceMappingURL=index.d.ts.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';

package/dist/worker/index.js

@@ -1,218 +1,2 @@
-import { issuer } from '@astrale-os/kernel-core/auth';
-import { createRemoteApplication } from '@astrale-os/sdk/server';
-import { Hono as HonoApplication } from 'hono';
-import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
-const MAXIMUM_CACHED_APPLICATIONS = 4;
-const APPLICATION_CLOSE_TIMEOUT_MS = 5_000;
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export function cloudflareWorkerEntry() {
-    return function (config) {
-        const applications = new Map();
-        let resolvedDefinition = config.definition;
-        let pendingDefinition;
-        const definitionFor = async (bindings) => {
-            if (resolvedDefinition !== undefined)
-                return resolvedDefinition;
-            if (pendingDefinition !== undefined)
-                return pendingDefinition;
-            const resolve = config.resolveDefinition;
-            if (resolve === undefined)
-                throw new TypeError('Cloudflare Worker Domain definition is unavailable.');
-            const current = Promise.resolve().then(() => resolve(bindings));
-            pendingDefinition = current;
-            try {
-                const definition = await current;
-                resolvedDefinition = definition;
-                return definition;
-            }
-            finally {
-                if (pendingDefinition === current)
-                    pendingDefinition = undefined;
-            }
-        };
-        const applicationFor = async (url, bindings, definition) => {
-            const version = deploymentVersion(bindings);
-            const key = `${url}\u0000${version}`;
-            const cached = applications.get(key);
-            if (cached !== undefined)
-                return cached;
-            const environment = config.resolveEnvironment === undefined
-                ? bindings
-                : await config.resolveEnvironment(bindings);
-            const routedFetch = async (input, init) => {
-                const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
-                const destination = new URL(request.url);
-                if (destination.origin === new URL(url).origin) {
-                    const self = config.selfBinding?.(bindings);
-                    return dispatchCloudflareRequest(request, rejectRedirect, (transportRequest) => self !== null && self !== undefined
-                        ? self.fetch(transportRequest)
-                        : serving.app.fetch(transportRequest, environment));
-                }
-                const route = config.routeSubrequest?.(destination, bindings);
-                return dispatchCloudflareRequest(request, rejectRedirect, (transportRequest) => route === null || route === undefined
-                    ? fetch(transportRequest)
-                    : route.fetch(transportRequest));
-            };
-            const deploymentQuery = `deployment=${encodeURIComponent(version)}`;
-            const issuerId = issuer.accept(url);
-            const host = new HonoApplication();
-            const serving = createRemoteApplication({
-                definition,
-                environment,
-                identity: {
-                    issuer: issuerId,
-                    subject: definition.schema.origin,
-                    privateKey: typeof config.privateKey === 'function'
-                        ? config.privateKey(bindings)
-                        : config.privateKey,
-                    fetch: routedFetch,
-                    ...(new URL(url).protocol === 'http:' ? { allowInsecureHttp: true } : {}),
-                },
-                deployment: {
-                    bundleHref: `${url}/.well-known/astrale/domain.bundle.json?${deploymentQuery}`,
-                    endpoint: { http: `${url}/invoke` },
-                    ...(definition.frontend === undefined
-                        ? {}
-                        : { frontendBaseHref: url, frontendCacheKey: version }),
-                    ...(config.manifest === undefined ? {} : { manifest: config.manifest }),
-                    delivery: {
-                        href: `${url}/install`,
-                        method: 'POST',
-                        authentication: { kind: 'public' },
-                    },
-                },
-                app: host,
-                server: {
-                    path: '/invoke',
-                    health: { probe: { check: () => true } },
-                    limits: {
-                        maximumRequestBytes: 1024 * 1024,
-                        maximumPublicationBytes: 1024 * 1024,
-                        maximumBundleBytes: 8 * 1024 * 1024,
-                        maximumDeliveryBytes: 8 * 1024 * 1024,
-                        invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
-                    },
-                },
-            });
-            const created = Object.freeze({
-                origin: new URL(url).origin,
-                application: serving,
-                environment,
-            });
-            if (applications.size >= MAXIMUM_CACHED_APPLICATIONS) {
-                const oldest = applications.keys().next().value;
-                if (oldest !== undefined) {
-                    const evicted = applications.get(oldest);
-                    applications.delete(oldest);
-                    if (evicted !== undefined) {
-                        try {
-                            await closeEvictedApplication(evicted.application);
-                        }
-                        catch (cause) {
-                            await serving
-                                .close({ deadline: Date.now() + APPLICATION_CLOSE_TIMEOUT_MS })
-                                .catch(() => undefined);
-                            throw cause;
-                        }
-                    }
-                }
-            }
-            applications.set(key, created);
-            return created;
-        };
-        return Object.freeze({
-            async fetch(request, bindings, executionContext) {
-                const requestUrl = new URL(request.url);
-                const definition = await definitionFor(bindings);
-                if (definition.frontend !== undefined) {
-                    const asset = await frontendAsset(definition, bindings, requestUrl, request);
-                    if (asset !== undefined)
-                        return asset;
-                }
-                const publicUrl = canonicalServingUrl(config.resolveUrl?.(bindings, requestOrigin(requestUrl, request)) ??
-                    bindings.WORKER_URL ??
-                    requestOrigin(requestUrl, request));
-                const serving = await applicationFor(publicUrl, bindings, definition);
-                return serving.application.app.fetch(request, serving.environment, executionContext);
-            },
-        });
-    };
-}
-/** Close an evicted Application before its environment bindings leave the cache. */
-export function closeEvictedApplication(application, now = Date.now) {
-    return application.close({ deadline: now() + APPLICATION_CLOSE_TIMEOUT_MS });
-}
-async function frontendAsset(definition, environment, url, request) {
-    const frontend = definition.frontend;
-    if (frontend === undefined || frontend.source.kind === 'external')
-        return undefined;
-    if (isReservedServicePath(url.pathname))
-        return undefined;
-    if (request.method !== 'GET' && request.method !== 'HEAD')
-        return undefined;
-    const dev = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
-    if (dev !== undefined && dev.length > 0) {
-        return fetch(new Request(new URL(`${url.pathname}${url.search}`, `${dev}/`), request));
-    }
-    const routes = frontend.routes;
-    const spa = frontend.source.kind === 'vite' && frontend.source.spa;
-    const route = Object.values(routes)
-        .filter((candidate) => candidate.path === url.pathname ||
-        (spa && (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
-        .sort((left, right) => right.path.length - left.path.length)[0];
-    const staticAsset = url.pathname.startsWith('/assets/');
-    if (route === undefined && !staticAsset)
-        return undefined;
-    const binding = environment.ASSETS;
-    if (binding === undefined)
-        return undefined;
-    const asset = await binding.fetch(request);
-    if (asset.status !== 404 || route === undefined)
-        return asset;
-    await asset.body?.cancel();
-    return binding.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request));
-}
-function isReservedServicePath(path) {
-    return ['/invoke', '/install', '/health', '/meta', '/.well-known'].some((reserved) => path === reserved || path.startsWith(`${reserved}/`));
-}
-function requestOrigin(url, request) {
-    if (url.protocol !== 'http:')
-        return url.origin;
-    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
-    return forwarded === 'https' ? `https://${url.host}` : url.origin;
-}
-function canonicalServingUrl(input) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch (cause) {
-        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
-    }
-    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
-        url.username !== '' ||
-        url.password !== '' ||
-        url.pathname !== '/' ||
-        url.search !== '' ||
-        url.hash !== '') {
-        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
-    }
-    return url.origin;
-}
-function deploymentVersion(environment) {
-    const input = environment.ASTRALE_VERSION_METADATA;
-    if (input !== null &&
-        typeof input === 'object' &&
-        typeof input.id === 'string' &&
-        input.id.length > 0) {
-        return input.id;
-    }
-    const fallback = environment.ASTRALE_DEPLOYMENT_VERSION;
-    if (typeof fallback === 'string' && fallback.length > 0)
-        return fallback;
-    throw new TypeError('Cloudflare Worker deployment version is unavailable.');
-}
-//# sourceMappingURL=index.js.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';

package/dist/wrangler/bundle.d.ts

@@ -0,0 +1,10 @@
+export declare function runWranglerBundle(args: {
+    projectDir: string;
+    configPath: string;
+    outDir: string;
+    onLog?: (line: string) => void;
+    signal?: AbortSignal;
+}): Promise<{
+    readonly bundlePath: string;
+    readonly metafilePath: string;
+}>;

package/dist/wrangler/bundle.js

@@ -0,0 +1,28 @@
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { runCapture, wranglerCommand } from './process.js';
+export async function runWranglerBundle(args) {
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const { code, out } = await runCapture(cmd, [
+        ...prefix,
+        'deploy',
+        '--dry-run',
+        '--minify',
+        '--outdir',
+        args.outDir,
+        '--metafile',
+        '--config',
+        args.configPath,
+    ], args.projectDir, args.onLog, args.signal);
+    if (code !== 0)
+        throw new Error(`wrangler bundle failed (exit ${code}): ${out.slice(-400)}`);
+    const javascript = readdirSync(args.outDir).filter((file) => file.endsWith('.js'));
+    if (javascript.length === 0) {
+        throw new Error(`wrangler bundle produced no .js in ${args.outDir}`);
+    }
+    const preferred = javascript.find((file) => file.startsWith('worker')) ?? javascript[0];
+    return Object.freeze({
+        bundlePath: join(args.outDir, preferred),
+        metafilePath: join(args.outDir, 'bundle-meta.json'),
+    });
+}

package/dist/wrangler/deploy.d.ts

@@ -0,0 +1,24 @@
+export interface DeployArgs {
+    configPath: string;
+    secrets?: Readonly<Record<string, string>>;
+    route?: string;
+    onLog?: (line: string) => void;
+    signal?: AbortSignal;
+}
+export declare class WranglerDeployError extends Error {
+    readonly applied?: {
+        readonly url?: string;
+        readonly deploymentVersion?: string;
+    };
+    constructor(message: string, applied?: {
+        readonly url?: string;
+        readonly deploymentVersion?: string;
+    });
+}
+export declare function runWranglerDeploy(args: DeployArgs & {
+    projectDir: string;
+}): Promise<{
+    url?: string;
+    raw: string;
+    deploymentVersion: string;
+}>;

package/dist/wrangler/deploy.js

@@ -0,0 +1,44 @@
+import { parseDeployUrl, parseDeployVersionId } from '../deploy/output.js';
+import { runCapture, wranglerCommand } from './process.js';
+import { secretRedactor, withSecretsFile } from './secrets.js';
+import { runWranglerTypes } from './type-generation.js';
+export class WranglerDeployError extends Error {
+    applied;
+    constructor(message, applied) {
+        super(message);
+        this.name = 'WranglerDeployError';
+        if (applied !== undefined)
+            this.applied = Object.freeze({ ...applied });
+    }
+}
+export async function runWranglerDeploy(args) {
+    await runWranglerTypes(args);
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const secrets = args.secrets ?? {};
+    const execute = (secretsFile) => runCapture(cmd, [
+        ...prefix,
+        'deploy',
+        '--config',
+        args.configPath,
+        ...(secretsFile === undefined ? [] : ['--secrets-file', secretsFile]),
+    ], args.projectDir, args.onLog, args.signal, secretRedactor(secrets));
+    const { code, out } = await withSecretsFile(secrets, execute);
+    const url = parseDeployUrl(out, args.route);
+    const deploymentVersion = parseDeployVersionId(out);
+    if (code !== 0) {
+        throw new WranglerDeployError(`wrangler deploy failed (code ${code}):\n${out.slice(-2000)}`, url === undefined && deploymentVersion === undefined
+            ? undefined
+            : {
+                ...(url === undefined ? {} : { url }),
+                ...(deploymentVersion === undefined ? {} : { deploymentVersion }),
+            });
+    }
+    if (deploymentVersion === undefined) {
+        throw new WranglerDeployError('wrangler deploy did not report its Version ID.', url === undefined ? undefined : { url });
+    }
+    return Object.freeze({
+        raw: out,
+        ...(url === undefined ? {} : { url }),
+        deploymentVersion,
+    });
+}

package/dist/wrangler/index.d.ts

@@ -0,0 +1,5 @@
+export { runWranglerBundle } from './bundle.js';
+export { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './deploy.js';
+export { wranglerProcessEnv } from './process.js';
+export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, type WranglerDeploymentStatus, } from './status.js';
+export { runWranglerTypes } from './type-generation.js';

package/dist/wrangler/index.js

@@ -0,0 +1,5 @@
+export { runWranglerBundle } from './bundle.js';
+export { runWranglerDeploy, WranglerDeployError } from './deploy.js';
+export { wranglerProcessEnv } from './process.js';
+export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, } from './status.js';
+export { runWranglerTypes } from './type-generation.js';

package/dist/wrangler/process.d.ts

@@ -0,0 +1,15 @@
+export declare function wranglerCommand(projectDir: string, runtime?: {
+    readonly executable: string;
+    readonly bun: boolean;
+}): {
+    cmd: string;
+    prefix: string[];
+};
+/** Keep Wrangler CLI diagnostic logs inside the generated project state. */
+export declare function wranglerProcessEnv(projectDir: string): NodeJS.ProcessEnv;
+export declare function runCapture(cmd: string, args: string[], cwd: string, onLog?: (line: string) => void, signal?: AbortSignal, redact?: (input: string) => string): Promise<{
+    code: number;
+    out: string;
+    stdout: string;
+    stderr: string;
+}>;

package/dist/wrangler/process.js

@@ -0,0 +1,102 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+export function wranglerCommand(projectDir, runtime = {
+    executable: process.execPath,
+    bun: process.versions.bun !== undefined,
+}) {
+    const local = join(projectDir, 'node_modules', '.bin', 'wrangler');
+    if (existsSync(local))
+        return { cmd: local, prefix: [] };
+    const require = createRequire(import.meta.url);
+    const packagePath = require.resolve('wrangler/package.json');
+    const manifest = JSON.parse(readFileSync(packagePath, 'utf8'));
+    const executable = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.wrangler;
+    if (!executable)
+        throw new TypeError('Installed Wrangler package has no wrangler executable.');
+    return {
+        cmd: runtime.bun ? 'node' : runtime.executable,
+        prefix: [resolve(dirname(packagePath), executable)],
+    };
+}
+/** Keep Wrangler CLI diagnostic logs inside the generated project state. */
+export function wranglerProcessEnv(projectDir) {
+    return {
+        ...process.env,
+        WRANGLER_SEND_METRICS: 'false',
+        WRANGLER_LOG_PATH: process.env.WRANGLER_LOG_PATH || resolve(projectDir, '.astrale', 'logs', 'wrangler'),
+    };
+}
+export function runCapture(cmd, args, cwd, onLog, signal, redact = (input) => input) {
+    if (signal?.aborted)
+        return Promise.reject(new Error('Wrangler process cancelled.'));
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: wranglerProcessEnv(cwd),
+        });
+        let out = '';
+        let stdout = '';
+        let stderr = '';
+        let outputBytes = 0;
+        let terminating;
+        const timeout = setTimeout(() => terminate(new Error('Wrangler process timed out.')), 300_000);
+        const abort = () => terminate(new Error('Wrangler process cancelled.'));
+        signal?.addEventListener('abort', abort, { once: true });
+        let escalation;
+        const cleanup = () => {
+            clearTimeout(timeout);
+            if (escalation !== undefined)
+                clearTimeout(escalation);
+            signal?.removeEventListener('abort', abort);
+        };
+        function terminate(cause) {
+            if (terminating !== undefined)
+                return;
+            terminating = cause;
+            child.kill('SIGTERM');
+            escalation = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+            }, 1_000);
+        }
+        const onData = (buffer, stream) => {
+            outputBytes += buffer.byteLength;
+            if (outputBytes > 1024 * 1024) {
+                terminate(new Error('Wrangler process exceeded its output limit.'));
+                return;
+            }
+            const chunk = buffer.toString();
+            out += chunk;
+            if (stream === 'stdout')
+                stdout += chunk;
+            else
+                stderr += chunk;
+        };
+        child.stdout?.on('data', (buffer) => onData(buffer, 'stdout'));
+        child.stderr?.on('data', (buffer) => onData(buffer, 'stderr'));
+        child.on('exit', (code) => {
+            cleanup();
+            if (terminating !== undefined)
+                reject(terminating);
+            else {
+                const safe = redact(out);
+                for (const line of safe.split('\n'))
+                    if (line.trim())
+                        onLog?.(line);
+                resolve({
+                    code: code ?? 1,
+                    out: safe,
+                    stdout: redact(stdout),
+                    stderr: redact(stderr),
+                });
+            }
+        });
+        child.on('error', (cause) => {
+            cleanup();
+            reject(terminating ?? cause);
+        });
+    });
+}

package/dist/wrangler/rollout.d.ts

@@ -0,0 +1,27 @@
+import { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './deploy.js';
+import { observeWranglerDeployment, runWranglerDeploymentStatus } from './status.js';
+import { deployWranglerTriggers } from './triggers.js';
+import { deployWranglerVersions, uploadWranglerVersion } from './versions.js';
+export interface WorkerCandidate {
+    readonly deploymentVersion: string;
+    readonly url?: string;
+}
+export declare class WranglerRolloutError extends WranglerDeployError {
+    readonly phase: 'provider' | 'readiness';
+    constructor(phase: 'provider' | 'readiness', cause: unknown, candidate?: WorkerCandidate);
+}
+declare const operations: {
+    observe: typeof observeWranglerDeployment;
+    status: typeof runWranglerDeploymentStatus;
+    initial: typeof runWranglerDeploy;
+    upload: typeof uploadWranglerVersion;
+    triggers: typeof deployWranglerTriggers;
+    traffic: typeof deployWranglerVersions;
+};
+/** HTTP candidates receive no normal traffic until the caller proves their exact readiness. */
+export declare function runWranglerRollout(args: DeployArgs & {
+    readonly projectDir: string;
+    readonly workerName: string;
+    readonly verifyCandidate: (candidate: WorkerCandidate) => Promise<void>;
+}, dependencies?: typeof operations): Promise<Awaited<ReturnType<typeof runWranglerDeploy>>>;
+export {};

package/dist/wrangler/rollout.js

@@ -0,0 +1,75 @@
+import { runWranglerDeploy, WranglerDeployError } from './deploy.js';
+import { observeWranglerDeployment, runWranglerDeploymentStatus, } from './status.js';
+import { deployWranglerTriggers } from './triggers.js';
+import { deployWranglerVersions, uploadWranglerVersion } from './versions.js';
+export class WranglerRolloutError extends WranglerDeployError {
+    phase;
+    constructor(phase, cause, candidate) {
+        super(`Cloudflare Worker rollout failed during ${phase}: ${cause instanceof Error ? cause.message : 'unexpected provider failure'}`, candidate);
+        this.phase = phase;
+        this.name = 'WranglerRolloutError';
+        this.cause = cause;
+    }
+}
+const operations = {
+    observe: observeWranglerDeployment,
+    status: runWranglerDeploymentStatus,
+    initial: runWranglerDeploy,
+    upload: uploadWranglerVersion,
+    triggers: deployWranglerTriggers,
+    traffic: deployWranglerVersions,
+};
+/** HTTP candidates receive no normal traffic until the caller proves their exact readiness. */
+export async function runWranglerRollout(args, dependencies = operations) {
+    const previous = await dependencies.observe(args);
+    if (previous === undefined)
+        return dependencies.initial(args);
+    const serving = previous.versions.find(({ percentage }) => percentage === 100);
+    if (serving === undefined) {
+        throw new Error('Cloudflare staging requires one serving version at 100%; coordinate an existing gradual rollout first.');
+    }
+    let candidate;
+    let phase = 'provider';
+    try {
+        const deploymentVersion = await dependencies.upload(args);
+        candidate = { deploymentVersion };
+        requireUnchanged(await dependencies.status(args), previous);
+        const url = await dependencies.triggers(args);
+        candidate = { deploymentVersion, ...(url === undefined ? {} : { url }) };
+        requireUnchanged(await dependencies.status(args), previous);
+        const versions = [
+            { version: serving.version, percentage: 100 },
+            { version: deploymentVersion, percentage: 0 },
+        ];
+        await dependencies.traffic({ ...args, versions });
+        const staged = await dependencies.status(args);
+        requireTraffic(staged, versions);
+        phase = 'readiness';
+        await args.verifyCandidate(candidate);
+        phase = 'provider';
+        requireUnchanged(await dependencies.status(args), staged);
+        await dependencies.traffic({
+            ...args,
+            versions: [{ version: deploymentVersion, percentage: 100 }],
+        });
+        return { ...candidate, raw: '' };
+    }
+    catch (cause) {
+        // A failed/cancelled probe leaves the previous version at 100%. Do not perform an unguarded
+        // rollback after an unknown provider outcome or overwrite another operator's deployment.
+        if (candidate === undefined && cause instanceof WranglerDeployError)
+            throw cause;
+        throw new WranglerRolloutError(phase, cause, candidate);
+    }
+}
+function requireUnchanged(actual, expected) {
+    if (actual.deployment !== expected.deployment)
+        throw new Error('Cloudflare deployment changed during staging; refusing to overwrite it.');
+    requireTraffic(actual, expected.versions);
+}
+function requireTraffic(actual, expected) {
+    if (actual.versions.length !== expected.length ||
+        expected.some((entry) => !actual.versions.some(({ version, percentage }) => version === entry.version && percentage === entry.percentage))) {
+        throw new Error('Cloudflare deployment differs from the expected staged traffic allocation.');
+    }
+}

package/dist/wrangler/secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function withSecretsFile<Result>(secrets: Readonly<Record<string, string>>, operation: (path?: string) => Promise<Result>): Promise<Result>;
+export declare function secretRedactor(secrets: Readonly<Record<string, string>>): (input: string) => string;

package/dist/wrangler/secrets.js

@@ -0,0 +1,24 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+export async function withSecretsFile(secrets, operation) {
+    if (Object.keys(secrets).length === 0)
+        return operation();
+    const directory = await mkdtemp(join(tmpdir(), 'astrale-secrets-'));
+    const path = join(directory, 'secrets.json');
+    try {
+        await writeFile(path, JSON.stringify(secrets), { mode: 0o600 });
+        return await operation(path);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+export function secretRedactor(secrets) {
+    const values = Object.values(secrets)
+        .filter((value) => value.length > 0)
+        .flatMap((value) => [value, JSON.stringify(value).slice(1, -1)])
+        .filter((value, index, all) => all.indexOf(value) === index)
+        .sort((left, right) => right.length - left.length);
+    return (input) => values.reduce((output, value) => output.replaceAll(value, '[REDACTED]'), input);
+}