@astrale-os/adapter-cloudflare 0.5.0-beta.146 → 0.5.0-beta.147

package/dist/adapter.js

@@ -20,7 +20,7 @@ export function cloudflare(parameters = {}) {
         waitForReadiness: (release, signal, version, worker, workerName) => waitForReadiness(async (release, options) => {
             const checks = {
                 ...options,
-                fetch: versionReadinessFetch(release.addressing.issuer, version, globalThis.fetch, workerName),
+                fetch: versionReadinessFetch(release.addressing.publicUrl, version, globalThis.fetch, workerName, release.addressing.issuer),
             };
             await verifyReadiness(release, checks);
             await verifyWorkerFrontend(release, worker, checks);

package/dist/build/artifact.js

@@ -155,7 +155,9 @@ async function prepare(params, context, direct) {
                 ? Object.freeze({ kind: 'provider-assigned', claim: name })
                 : Object.freeze({
                     kind: 'configured',
-                    addressing: addressing(configuredIssuer),
+                    addressing: addressing(params.identityIssuer ?? configuredIssuer, {
+                        publicUrl: configuredIssuer,
+                    }),
                 }),
         });
     }

package/dist/build/configuration/addressing.js

@@ -1,5 +1,11 @@
 import { addressing } from '@astrale-os/sdk/deployment/release';
 export function deploymentAddressing(parameters) {
+    if (parameters.identityIssuer !== undefined) {
+        addressing(parameters.identityIssuer);
+        if (parameters.route === undefined && parameters.addressing === undefined) {
+            throw new TypeError('A stable Cloudflare identityIssuer requires explicit public addressing.');
+        }
+    }
     const routed = parameters.route === undefined ? undefined : addressing(`https://${parameters.route}`).issuer;
     if (parameters.addressing === undefined)
         return routed;

package/dist/build/frontend/readiness.js

@@ -9,7 +9,7 @@ export async function verifyWorkerFrontend(release, worker, options = {}) {
     const expected = frontendRevision(worker.assets.files);
     const fetcher = options.fetch ?? globalThis.fetch;
     for (const route of frontend.routes) {
-        const response = await fetcher(new URL(route.path, release.addressing.issuer).href, {
+        const response = await fetcher(new URL(route.path, release.addressing.publicUrl).href, {
             redirect: 'error',
             ...(options.signal === undefined ? {} : { signal: options.signal }),
         });

package/dist/build/worker/codegen/service.d.ts

@@ -8,6 +8,7 @@ export interface ExecutionCodegenOptions {
     readonly frontendRevision?: string;
     readonly maximumRequestBytes?: number;
     readonly invocationTimeoutMs?: number;
+    readonly identityIssuer?: string;
     readonly providerAssignedWorker?: string;
     readonly tokenExchange?: ExchangeOptions | false;
     readonly router?: {

package/dist/build/worker/codegen/service.js

@@ -45,6 +45,7 @@ ${frontend}${options.frontendRevision === undefined ? '' : `  frontendRevision:
   resolveUrl: (env, requestOrigin) => env.WORKER_URL ?? env.IDENTITY_ISS ?? requestOrigin,
   ${options.maximumRequestBytes === undefined ? '' : `maximumRequestBytes: ${options.maximumRequestBytes},`}
   ${options.invocationTimeoutMs === undefined ? '' : `invocationTimeoutMs: ${options.invocationTimeoutMs},`}
+  ${options.identityIssuer === undefined ? '' : `identityIssuer: ${JSON.stringify(options.identityIssuer)},`}
   ${options.providerAssignedWorker === undefined ? '' : `providerAssignedWorker: ${JSON.stringify(options.providerAssignedWorker)},`}
   ${options.tokenExchange === undefined ? '' : `tokenExchange: ${JSON.stringify(options.tokenExchange)} as const,`}
   selfBinding: (env) => env.SELF,${routeSubrequest}

package/dist/build/worker/execution.prepare.js

@@ -18,6 +18,9 @@ export async function prepareExecution(input) {
     const invocationTimeoutMs = workerInvocationTimeout(input.params.invocationTimeoutMs);
     const serviceSource = generateExecutionService({
         origin: input.context.build.schema.compiled.root.origin,
+        ...(input.params.identityIssuer === undefined
+            ? {}
+            : { identityIssuer: input.params.identityIssuer }),
         runtimeSpecifier,
         workerSpecifier,
         build: input.context.build,

package/dist/deploy/deploy.js

@@ -150,7 +150,15 @@ function partialProvider(cause, artifact) {
     let issuer;
     if (cause.applied.url !== undefined) {
         try {
-            issuer = addressing(cause.applied.url).issuer;
+            const observed = addressing(cause.applied.url);
+            if (artifact.addressing.kind === 'configured') {
+                if (observed.publicUrl === artifact.addressing.addressing.publicUrl) {
+                    issuer = artifact.addressing.addressing.issuer;
+                }
+            }
+            else {
+                issuer = observed.issuer;
+            }
         }
         catch {
             // The provider effect remains known when its printed URL is not Addressing.
@@ -178,10 +186,10 @@ function observeAddressing(artifact, deployedUrl, expectedWorker) {
         if (deployedUrl === undefined)
             return artifact.addressing.addressing;
         const observed = addressing(deployedUrl);
-        if (observed.issuer !== artifact.addressing.addressing.issuer) {
+        if (observed.publicUrl !== artifact.addressing.addressing.publicUrl) {
             throw new TypeError('Cloudflare deployed URL differs from configured Addressing.');
         }
-        return observed;
+        return artifact.addressing.addressing;
     }
     if (deployedUrl === undefined) {
         throw new TypeError('Cloudflare did not report provider-assigned Addressing.');

package/dist/deploy/readiness.d.ts

@@ -1,5 +1,5 @@
 import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 type ReadinessFetch = NonNullable<NonNullable<Parameters<typeof verifyReadiness>[1]>['fetch']>;
 /** Readiness is evidence for the provider version, not just a compatible Publication. */
-export declare function versionReadinessFetch(issuer: string, version: string, fetcher?: typeof fetch, workerName?: string): ReadinessFetch;
+export declare function versionReadinessFetch(issuer: string, version: string, fetcher?: typeof fetch, workerName?: string, identityIssuer?: string): ReadinessFetch;
 export {};

package/dist/deploy/readiness.js

@@ -1,7 +1,10 @@
 /** Readiness is evidence for the provider version, not just a compatible Publication. */
-export function versionReadinessFetch(issuer, version, fetcher = globalThis.fetch, workerName) {
+export function versionReadinessFetch(issuer, version, fetcher = globalThis.fetch, workerName, identityIssuer = issuer) {
     return async (input, init) => {
-        if (new URL(input).origin !== issuer) {
+        const origin = new URL(input).origin;
+        if (origin !== issuer && origin === identityIssuer)
+            return fetcher(input, init);
+        if (origin !== issuer) {
             throw new TypeError('Cloudflare readiness cannot leave the expected Worker origin.');
         }
         const headers = new Headers();

package/dist/params.d.ts

@@ -18,6 +18,9 @@ export interface CloudflareParams {
      * present they must identify the same HTTPS origin.
      */
     readonly addressing?: string;
+    /** Stable Domain issuer when this deployment serves at a different public origin.
+     * Requires explicit route or addressing and the existing issuer signing key. */
+    readonly identityIssuer?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
     /**

package/dist/worker/entry.d.ts

@@ -25,6 +25,7 @@ export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings e
     readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
     readonly resolveEnvironment?: (bindings: Bindings) => Environment;
     readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly identityIssuer?: string;
     readonly providerAssignedWorker?: string;
     readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
     readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;

package/dist/worker/entry.js

@@ -14,7 +14,7 @@ export function generatedCloudflareWorkerEntry() {
 }
 function createCloudflareWorkerEntry(restore) {
     return function (config) {
-        let currentIssuer;
+        let currentPublicUrl;
         let realized;
         const realize = () => {
             if (realized !== undefined)
@@ -26,23 +26,25 @@ function createCloudflareWorkerEntry(restore) {
                 const application = serve({
                     runtime: source.runtime,
                     load(environment) {
-                        if (currentIssuer !== environment.issuer) {
+                        if (currentPublicUrl !== environment.publicUrl) {
                             throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
                         }
-                        return assemble(build, addressing(environment.issuer));
+                        return assemble(build, addressing(config.identityIssuer ?? environment.publicUrl, {
+                            publicUrl: environment.publicUrl,
+                        }));
                     },
                     initialize: (environment) => config.resolveEnvironment === undefined
                         ? environment.bindings
                         : config.resolveEnvironment(environment.bindings),
                     identity(environment) {
                         return createIdentity({
-                            issuer: issuer.accept(environment.issuer),
+                            issuer: issuer.accept(config.identityIssuer ?? environment.publicUrl),
                             subject: build.schema.compiled.root.origin,
                             privateKey: typeof config.privateKey === 'function'
                                 ? config.privateKey(environment.bindings)
                                 : config.privateKey,
                             fetch: routedFetch(application, environment, config),
-                            ...(new URL(environment.issuer).protocol === 'http:'
+                            ...(new URL(environment.publicUrl).protocol === 'http:'
                                 ? { allowInsecureHttp: true }
                                 : {}),
                             ...(config.tokenExchange === undefined
@@ -68,22 +70,22 @@ function createCloudflareWorkerEntry(restore) {
         return Object.freeze({
             async fetch(request, bindings, context) {
                 const url = new URL(request.url);
-                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                const publicUrl = canonicalServingUrl(bindings.WORKER_URL ??
                     bindings.IDENTITY_ISS ??
                     config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
                     requestOrigin(url, request));
                 if (config.providerAssignedWorker !== undefined &&
                     bindings.WORKER_URL === undefined &&
                     bindings.IDENTITY_ISS === undefined &&
-                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    !matchesWorkersDevClaim(publicUrl, config.providerAssignedWorker)) {
                     return new Response('Request origin differs from provider-assigned Addressing.', {
                         status: 421,
                     });
                 }
-                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                if (currentPublicUrl !== undefined && currentPublicUrl !== publicUrl) {
                     return new Response('Request origin differs from the current Release.', { status: 421 });
                 }
-                currentIssuer = issuer;
+                currentPublicUrl = publicUrl;
                 if (config.frontend !== undefined) {
                     const frontend = await frontendAsset(config.frontend, bindings.ASSETS, url, request, config.frontendRevision);
                     if (frontend !== undefined)
@@ -95,7 +97,7 @@ function createCloudflareWorkerEntry(restore) {
                     if (frontend !== undefined)
                         return withProviderVersion(frontend, bindings);
                 }
-                const response = await application.fetch(request, Object.freeze({ bindings, issuer }), context);
+                const response = await application.fetch(request, Object.freeze({ bindings, publicUrl }), context);
                 return withProviderVersion(response, bindings);
             },
         });
@@ -112,7 +114,7 @@ function routedFetch(application, environment, config) {
     return async (input, init) => {
         const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
         const destination = new URL(request.url);
-        if (destination.origin === environment.issuer) {
+        if (destination.origin === environment.publicUrl) {
             const self = config.selfBinding?.(environment.bindings);
             return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
                 ? application.fetch(selected, environment)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.146",
+  "version": "0.5.0-beta.147",
   "description": "Deploy an Astrale application through Cloudflare Workers",
   "keywords": [
     "adapter",
@@ -53,7 +53,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.143",
+    "@astrale-os/sdk": "0.5.0-beta.144",
     "@noble/hashes": "2.3.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",