@astrale-os/adapter-cloudflare 0.5.0-beta.15 → 0.5.0-beta.151

package/dist/build/direct.js

@@ -0,0 +1,90 @@
+import { isDeepStrictEqual } from 'node:util';
+import { generateWranglerConfig } from './codegen/wrangler.js';
+import { resolveRouter, workerName } from './configuration.js';
+import { workerModules } from './worker/modules.js';
+export function admitDirectPlacement(artifact, worker, parameters, environment = '') {
+    const name = workerName(parameters, worker.origin, environment);
+    const release = config(artifact, 'wrangler.jsonc');
+    const router = resolveRouter(parameters.router);
+    const frontend = artifact.build.frontend;
+    const hasViteFrontend = frontend?.source.kind === 'vite';
+    equal(worker.assets !== undefined, hasViteFrontend);
+    if (worker.assets !== undefined) {
+        equal(worker.assets.notFound, 'none');
+        equal(worker.assets.runWorkerFirst, true);
+    }
+    equal(release, generated({
+        workerName: name,
+        main: `./${worker.release.entrypoint}`,
+        ...(parameters.route === undefined ? {} : { route: parameters.route }),
+        vars: worker.bindings.vars,
+        secretBindings: worker.bindings.requiredSecrets,
+        modules: directModules(worker.release),
+        ...(hasViteFrontend
+            ? {
+                frontend: {
+                    directory: './frontend',
+                },
+            }
+            : {}),
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(parameters.wrangler === undefined ? {} : { wrangler: parameters.wrangler }),
+        selfBinding: false,
+    }));
+    equal(release.compatibility_date, worker.runtime.compatibilityDate);
+    equalStringCollection(release.compatibility_flags, worker.runtime.compatibilityFlags);
+    equal(release.services ?? [], worker.bindings.services.map(serviceBinding));
+    equal(record(release.assets).html_handling, worker.assets?.htmlHandling);
+}
+function directModules(worker) {
+    try {
+        return workerModules(worker);
+    }
+    catch {
+        mismatch();
+    }
+}
+function generated(input) {
+    return JSON.parse(generateWranglerConfig(input));
+}
+function config(artifact, path) {
+    const file = artifact.files.find((candidate) => candidate.path === path);
+    if (file === undefined)
+        throw new TypeError(`Direct Cloudflare artifact is missing ${path}.`);
+    try {
+        const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(file.bytes()));
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch (cause) {
+        throw new TypeError(`Direct Cloudflare artifact ${path} is invalid.`, { cause });
+    }
+}
+function serviceBinding(binding) {
+    return { binding: binding.name, service: binding.service };
+}
+function record(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input)
+        ? input
+        : {};
+}
+function equal(actual, expected) {
+    if (!isDeepStrictEqual(actual, expected)) {
+        throw new TypeError('Direct Cloudflare placement differs from its admitted Worker artifact.', {
+            cause: { actual, expected },
+        });
+    }
+}
+function equalStringCollection(actual, expected) {
+    if (!Array.isArray(actual) ||
+        actual.some((value) => typeof value !== 'string') ||
+        !isDeepStrictEqual([...actual].sort(), [...expected].sort())) {
+        mismatch();
+    }
+}
+function mismatch() {
+    throw new TypeError('Direct Cloudflare placement differs from its admitted Worker artifact.');
+}

package/dist/build/frontend/files.d.ts

@@ -0,0 +1,19 @@
+import type { Build } from '@astrale-os/sdk/deployment/build';
+import { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+/** The served frontend, and which of its files a browser may keep without revalidating. */
+export interface FrontendOutput {
+    readonly files: readonly frontendBuild.FrontendFile[];
+    /**
+     * Served paths the bundler content-addressed, so their bytes can never change under a given name.
+     * A frontend Astrale does not build leaves this empty, which is what keeps the absence of evidence
+     * indistinguishable from evidence of mutability.
+     */
+    readonly addressed: readonly string[];
+}
+export declare function frontendFiles(input: {
+    readonly frontend: Build['frontend'];
+    readonly projectDir: string;
+    readonly output: string;
+    readonly recordSource?: (path: string) => void;
+    readonly signal: AbortSignal;
+}): Promise<FrontendOutput>;

package/dist/build/frontend/files.js

@@ -0,0 +1,38 @@
+import { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+import { readFile, readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { buildViteFrontend } from './vite.js';
+export async function frontendFiles(input) {
+    const frontend = input.frontend;
+    if (frontend === undefined)
+        return { files: [], addressed: [] };
+    if (frontend.source.kind === 'external') {
+        return { files: frontendBuild.files(frontend, []), addressed: [] };
+    }
+    await rm(input.output, { recursive: true, force: true });
+    const built = await buildViteFrontend({
+        projectDir: input.projectDir,
+        output: input.output,
+        ...(frontend.source.config === undefined ? {} : { config: frontend.source.config }),
+        recordSource: input.recordSource,
+        signal: input.signal,
+    });
+    const files = frontendBuild.files(frontend, await readFiles(input.output));
+    // A name the bundler reported but that never reached disk is not a served path; keeping only the
+    // intersection means the evidence describes exactly what this deployment will answer with.
+    const served = new Set(files.map((file) => file.path));
+    return { files, addressed: built.addressed.filter((path) => served.has(path)) };
+}
+async function readFiles(root, current = '') {
+    const entries = await readdir(join(root, current), { withFileTypes: true });
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const path = current === '' ? entry.name : `${current}/${entry.name}`;
+        if (entry.isDirectory())
+            files.push(...(await readFiles(root, path)));
+        else if (entry.isFile()) {
+            files.push({ path, content: new Uint8Array(await readFile(join(root, path))) });
+        }
+    }
+    return files;
+}

package/dist/build/frontend/readiness.d.ts

@@ -0,0 +1,10 @@
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import type { WorkerArtifact } from '../worker/artifact.js';
+type ReadinessFetch = NonNullable<NonNullable<Parameters<typeof verifyReadiness>[1]>['fetch']>;
+/** Publication equality alone cannot prove a frontend-only deployment has propagated. */
+export declare function verifyWorkerFrontend(release: Release, worker: Pick<WorkerArtifact, 'assets'>, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<void>;
+export {};

package/dist/build/frontend/readiness.js

@@ -0,0 +1,21 @@
+import { frontendRevision } from './revision.js';
+/** Publication equality alone cannot prove a frontend-only deployment has propagated. */
+export async function verifyWorkerFrontend(release, worker, options = {}) {
+    const frontend = release.build.frontend;
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return;
+    if (worker.assets === undefined)
+        throw new Error('Prepared Worker frontend assets are missing.');
+    const expected = frontendRevision(worker.assets.files);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    for (const route of frontend.routes) {
+        const response = await fetcher(new URL(route.path, release.addressing.publicUrl).href, {
+            redirect: 'error',
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        const matches = response.status === 200 && response.headers.get('X-Astrale-Frontend') === expected;
+        await response.body?.cancel();
+        if (!matches)
+            throw new Error(`Frontend ${route.path} is not serving the prepared browser build yet.`);
+    }
+}

package/dist/build/frontend/revision.d.ts

@@ -0,0 +1,5 @@
+/** Bind the generated Worker to its exact browser files, independently of Schema revision. */
+export declare function frontendRevision(files: readonly {
+    readonly path: string;
+    bytes(): Uint8Array;
+}[]): string;

package/dist/build/frontend/revision.js

@@ -0,0 +1,14 @@
+import { createHash } from 'node:crypto';
+/** Bind the generated Worker to its exact browser files, independently of Schema revision. */
+export function frontendRevision(files) {
+    const hash = createHash('sha256');
+    const ordered = files
+        .map((file) => ({ path: file.path.replace(/^\//u, ''), bytes: file.bytes }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    for (const file of ordered) {
+        const bytes = file.bytes();
+        hash.update(JSON.stringify([file.path, bytes.byteLength]));
+        hash.update(bytes);
+    }
+    return `sha256:${hash.digest('hex')}`;
+}

package/dist/build/frontend/vite.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Build a Vite frontend in an isolated process and report its authored inputs, along with the
+ * outputs the bundler content-addressed. Those are the files a browser may keep forever, and only
+ * the build that named them can say which they are.
+ */
+export declare function buildViteFrontend(input: {
+    readonly projectDir: string;
+    readonly output: string;
+    readonly config?: string;
+    readonly recordSource?: (path: string) => void;
+    readonly signal: AbortSignal;
+}): Promise<{
+    readonly addressed: readonly string[];
+}>;

package/dist/build/frontend/vite.js

@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runViteProcess } from './vite.process.js';
+/**
+ * Build a Vite frontend in an isolated process and report its authored inputs, along with the
+ * outputs the bundler content-addressed. Those are the files a browser may keep forever, and only
+ * the build that named them can say which they are.
+ */
+export async function buildViteFrontend(input) {
+    const parent = dirname(input.output);
+    await mkdir(parent, { recursive: true });
+    const scratch = await mkdtemp(join(parent, 'vite-run-'));
+    const evidence = join(scratch, 'sources.json');
+    const addressed = join(scratch, 'addressed.json');
+    try {
+        await runViteProcess({
+            cwd: input.projectDir,
+            arguments: [runnerPath(), input.output, evidence, input.config ?? '', addressed],
+            signal: input.signal,
+        });
+        const sources = JSON.parse(await readFile(evidence, 'utf8'));
+        if (!Array.isArray(sources) || sources.some((path) => typeof path !== 'string')) {
+            throw new TypeError('Vite preparation source evidence is invalid.');
+        }
+        for (const path of sources)
+            input.recordSource?.(path);
+        const named = JSON.parse(await readFile(addressed, 'utf8'));
+        if (!Array.isArray(named) || named.some((path) => typeof path !== 'string')) {
+            throw new TypeError('Vite preparation output evidence is invalid.');
+        }
+        return { addressed: Object.freeze([...named]) };
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+function runnerPath() {
+    const built = fileURLToPath(new URL('./vite.runner.js', import.meta.url));
+    return existsSync(built) ? built : fileURLToPath(new URL('./vite.runner.ts', import.meta.url));
+}

package/dist/build/frontend/vite.process.d.ts

@@ -0,0 +1,7 @@
+/** Run one bounded, cancellable Vite subprocess. */
+export declare function runViteProcess(input: {
+    readonly cwd: string;
+    readonly arguments: readonly string[];
+    readonly signal: AbortSignal;
+    readonly timeoutMs?: number;
+}): Promise<void>;

package/dist/build/frontend/vite.process.js

@@ -0,0 +1,65 @@
+import { spawn } from 'node:child_process';
+const MAXIMUM_OUTPUT_BYTES = 1024 * 1024;
+const TERMINATION_GRACE_MS = 1_000;
+const VITE_TIMEOUT_MS = 300_000;
+/** Run one bounded, cancellable Vite subprocess. */
+export function runViteProcess(input) {
+    if (input.signal.aborted)
+        return Promise.reject(abortReason(input.signal));
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, input.arguments, {
+            cwd: input.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        let output = '';
+        let outputBytes = 0;
+        let terminating;
+        let escalation;
+        const timeout = setTimeout(() => terminate(new Error('Vite process timed out.')), input.timeoutMs ?? VITE_TIMEOUT_MS);
+        const abort = () => terminate(abortReason(input.signal));
+        input.signal.addEventListener('abort', abort, { once: true });
+        const cleanup = () => {
+            clearTimeout(timeout);
+            if (escalation !== undefined)
+                clearTimeout(escalation);
+            input.signal.removeEventListener('abort', abort);
+        };
+        function terminate(cause) {
+            if (terminating !== undefined)
+                return;
+            terminating = cause;
+            child.kill('SIGTERM');
+            escalation = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+            }, TERMINATION_GRACE_MS);
+        }
+        const collect = (buffer) => {
+            outputBytes += buffer.byteLength;
+            if (outputBytes > MAXIMUM_OUTPUT_BYTES) {
+                terminate(new Error('Vite process exceeded its output limit.'));
+                return;
+            }
+            output += buffer.toString();
+        };
+        child.stdout.on('data', collect);
+        child.stderr.on('data', collect);
+        child.once('error', (cause) => {
+            cleanup();
+            reject(terminating ?? cause);
+        });
+        child.once('close', (code) => {
+            cleanup();
+            if (terminating !== undefined)
+                reject(terminating);
+            else if (code === 0)
+                resolve();
+            else
+                reject(new Error(`Vite failed (code ${code ?? 1}):\n${output.slice(-1500)}`));
+        });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error('Vite process cancelled.');
+}

package/dist/build/frontend/vite.runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/build/frontend/vite.runner.js

@@ -0,0 +1,155 @@
+import { readdir, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+const CONFIG_FILES = Object.freeze([
+    'vite.config.js',
+    'vite.config.mjs',
+    'vite.config.ts',
+    'vite.config.cjs',
+    'vite.config.mts',
+    'vite.config.cts',
+]);
+await main();
+async function main() {
+    const [output, evidence, configured, addressed] = process.argv.slice(2);
+    if (output === undefined || evidence === undefined) {
+        throw new TypeError('Vite preparation runner arguments are invalid.');
+    }
+    const projectDir = process.cwd();
+    const vite = await projectVite(projectDir);
+    const sources = new Set();
+    const named = new Set();
+    let publicDir = false;
+    let environment = {
+        directory: false,
+        mode: 'production',
+    };
+    const config = configured === '' || configured === undefined ? undefined : configured;
+    await vite.build({
+        logLevel: 'silent',
+        ...(config === undefined
+            ? {}
+            : { configFile: isAbsolute(config) ? config : resolve(projectDir, config) }),
+        build: { outDir: output, emptyOutDir: true },
+        plugins: [
+            {
+                name: 'astrale:preparation-sources',
+                configResolved(value) {
+                    publicDir = value.publicDir;
+                    environment = { directory: value.envDir, mode: value.mode };
+                    for (const path of value.configFileDependencies)
+                        sources.add(path);
+                },
+                transform(_source, id) {
+                    const path = physicalModulePath(id);
+                    if (path !== undefined)
+                        sources.add(path);
+                },
+                // The bundler is the only party that knows which outputs it content-addressed: a served path
+                // is safe to retain exactly when its name changes with its bytes. Reading that here, from
+                // the build that produced them, is what keeps the answer a fact rather than a guess about
+                // directory layout or file naming.
+                generateBundle(options, bundle) {
+                    for (const [fileName, entry] of Object.entries(bundle)) {
+                        if (addressedName(options, entry))
+                            named.add(fileName);
+                    }
+                },
+            },
+        ],
+    });
+    for (const path of configCandidates(projectDir, config))
+        sources.add(path);
+    for (const path of environmentCandidates(environment))
+        sources.add(path);
+    if (publicDir !== false)
+        await collectTree(publicDir, sources);
+    await writeFile(evidence, JSON.stringify([...sources]));
+    if (addressed !== undefined)
+        await writeFile(addressed, JSON.stringify([...named].sort()));
+}
+/**
+ * Whether this output's name carries a content hash.
+ *
+ * Two facts are required, and each is necessary. The output must carry a `name`, which the bundler
+ * sets only for the outputs it named itself: a plugin emitting an explicit `fileName` bypasses the
+ * template entirely, and such a file can sit anywhere, including beside the bundle's own output. And
+ * the template that was applied must embed `[hash]`, since a project is free to strip it.
+ *
+ * Anything else leaves the answer unknown, and unknown must read as "not content-addressed": losing
+ * the optimization costs a revalidation, while claiming it wrongly serves a stale file for as long
+ * as the header says, with no way to recall it.
+ */
+function addressedName(options, entry) {
+    if (typeof entry.name !== 'string')
+        return false;
+    const template = entry.type === 'asset'
+        ? options.assetFileNames
+        : entry.isEntry === true
+            ? options.entryFileNames
+            : options.chunkFileNames;
+    return typeof template === 'string' && template.includes('[hash]');
+}
+function environmentCandidates(input) {
+    const directory = input.directory;
+    if (directory === false)
+        return [];
+    return ['.env', '.env.local', `.env.${input.mode}`, `.env.${input.mode}.local`].map((name) => join(directory, name));
+}
+function physicalModulePath(id) {
+    if (id.startsWith('\0'))
+        return undefined;
+    const path = id.replace(/[?#].*$/u, '');
+    if (path.length === 0)
+        return undefined;
+    if (path.startsWith('file:')) {
+        try {
+            return fileURLToPath(path);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return isAbsolute(path) ? path : undefined;
+}
+async function projectVite(projectDir) {
+    try {
+        const manifest = createRequire(join(projectDir, 'package.json')).resolve('vite/package.json');
+        const entry = createRequire(manifest).resolve('vite');
+        return (await import(pathToFileURL(entry).href));
+    }
+    catch (cause) {
+        throw new TypeError('Vite frontend requires a project-local Vite package.', { cause });
+    }
+}
+function configCandidates(projectDir, configured) {
+    if (configured !== undefined) {
+        return [isAbsolute(configured) ? configured : resolve(projectDir, configured)];
+    }
+    return CONFIG_FILES.map((name) => join(projectDir, name));
+}
+async function collectTree(path, output) {
+    output.add(path);
+    let entries;
+    try {
+        entries = await readdir(path, { withFileTypes: true });
+    }
+    catch (cause) {
+        if (errorCode(cause) === 'ENOENT')
+            return;
+        throw cause;
+    }
+    for (const entry of entries) {
+        const child = join(path, entry.name);
+        if (entry.isDirectory())
+            await collectTree(child, output);
+        else if (entry.isFile())
+            output.add(child);
+    }
+}
+function errorCode(input) {
+    return input !== null && typeof input === 'object' && 'code' in input
+        ? String(Reflect.get(input, 'code'))
+        : undefined;
+}

package/dist/build/index.d.ts

@@ -1,16 +1,9 @@
-/**
- * `@astrale-os/adapter-cloudflare/build` — the shared Cloudflare-Workers build
- * toolkit, exposed for sibling deploy adapters (e.g.
- * `@astrale-os/adapter-astrale`).
- *
- * This is the "compile a `defineDomain` into a Cloudflare Workers bundle + run
- * local dev" surface that every Cloudflare-Workers deploy strategy shares,
- * regardless of WHERE the bundle ultimately ships. It is NOT part of the public
- * adapter API (`@astrale-os/adapter-cloudflare`) — it's the seam two adapters
- * build on so the codegen/bundling/dev logic lives in exactly one place.
- */
-export { buildFrontend, FRONTEND_STAGE_DIR, startFrontendDev, type FrontendDevHandle, type ViteBuild, type ViteBuildInput, } from './frontend.js';
-export { logTo, prepare } from './prepare.js';
-export { buildCloudflareWorker, type CloudflareWorkerBuild } from './worker.js';
-export { bulkPutSecrets, runWranglerBundle, runWranglerDeploy, runWranglerDev, runWranglerTypes, } from './wrangler-cli.js';
-//# sourceMappingURL=index.d.ts.map
+export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
+export { loadWorkerArtifact } from './worker/index.js';
+export type { WorkerArtifact } from './worker/index.js';
+export { resolveRouter, workerName } from './configuration.js';
+export { frontendFiles } from './frontend/files.js';
+export { verifyWorkerFrontend } from './frontend/readiness.js';
+export { qualifyWorkerBundle } from './qualification.js';
+export { assertSingletonRuntimeRoots } from './roots.js';
+export { runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerTypes, } from '../wrangler/index.js';

package/dist/build/index.js

@@ -1,16 +1,8 @@
-/**
- * `@astrale-os/adapter-cloudflare/build` — the shared Cloudflare-Workers build
- * toolkit, exposed for sibling deploy adapters (e.g.
- * `@astrale-os/adapter-astrale`).
- *
- * This is the "compile a `defineDomain` into a Cloudflare Workers bundle + run
- * local dev" surface that every Cloudflare-Workers deploy strategy shares,
- * regardless of WHERE the bundle ultimately ships. It is NOT part of the public
- * adapter API (`@astrale-os/adapter-cloudflare`) — it's the seam two adapters
- * build on so the codegen/bundling/dev logic lives in exactly one place.
- */
-export { buildFrontend, FRONTEND_STAGE_DIR, startFrontendDev, } from './frontend.js';
-export { logTo, prepare } from './prepare.js';
-export { buildCloudflareWorker } from './worker.js';
-export { bulkPutSecrets, runWranglerBundle, runWranglerDeploy, runWranglerDev, runWranglerTypes, } from './wrangler-cli.js';
-//# sourceMappingURL=index.js.map
+export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
+export { loadWorkerArtifact } from './worker/index.js';
+export { resolveRouter, workerName } from './configuration.js';
+export { frontendFiles } from './frontend/files.js';
+export { verifyWorkerFrontend } from './frontend/readiness.js';
+export { qualifyWorkerBundle } from './qualification.js';
+export { assertSingletonRuntimeRoots } from './roots.js';
+export { runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerTypes, } from '../wrangler/index.js';

package/dist/build/materialize.d.ts

@@ -0,0 +1,4 @@
+export declare function materialize(root: string, files: readonly {
+    readonly path: string;
+    bytes(): Uint8Array;
+}[]): Promise<void>;

package/dist/build/materialize.js

@@ -0,0 +1,10 @@
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export async function materialize(root, files) {
+    await rm(root, { recursive: true, force: true });
+    for (const file of files) {
+        const path = join(root, file.path);
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, file.bytes());
+    }
+}

package/dist/build/metafile.d.ts

@@ -0,0 +1,5 @@
+export interface WranglerMetafile {
+    readonly inputs: Readonly<Record<string, unknown>>;
+}
+/** Decode Wrangler's emitted esbuild graph at the provider-tooling boundary. */
+export declare function readWranglerMetafile(path: string): Promise<WranglerMetafile>;

package/dist/build/metafile.js

@@ -0,0 +1,14 @@
+import { readFile } from 'node:fs/promises';
+/** Decode Wrangler's emitted esbuild graph at the provider-tooling boundary. */
+export async function readWranglerMetafile(path) {
+    const source = await readFile(path, 'utf8');
+    const value = JSON.parse(source);
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new TypeError('Wrangler metafile is not an object.');
+    }
+    const inputs = Reflect.get(value, 'inputs');
+    if (inputs === null || typeof inputs !== 'object' || Array.isArray(inputs)) {
+        throw new TypeError('Wrangler metafile has no input graph.');
+    }
+    return Object.freeze({ inputs: inputs });
+}

package/dist/build/qualification.d.ts

@@ -0,0 +1,5 @@
+/** Qualify Wrangler's emitted module, not generated source or an inferred graph. */
+export declare function qualifyWorkerBundle(evidence: {
+    readonly metafilePath: string;
+    readonly inputRoot: string;
+}): Promise<void>;

package/dist/build/qualification.js

@@ -0,0 +1,7 @@
+import { assertRuntimeClosure } from './closure.js';
+import { assertSingletonRuntimeRoots } from './roots.js';
+/** Qualify Wrangler's emitted module, not generated source or an inferred graph. */
+export async function qualifyWorkerBundle(evidence) {
+    await assertRuntimeClosure(evidence.metafilePath);
+    await assertSingletonRuntimeRoots(evidence.metafilePath, evidence.inputRoot);
+}

package/dist/build/roots.d.ts

@@ -0,0 +1,2 @@
+/** Prove that Wrangler emitted at most one physical root per runtime package. */
+export declare function assertSingletonRuntimeRoots(metafilePath: string, inputRoot: string): Promise<void>;

package/dist/build/roots.js

@@ -0,0 +1,34 @@
+import { realpath } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { readWranglerMetafile } from './metafile.js';
+const RUNTIME_PACKAGES = [
+    '@astrale-os/adapter-cloudflare',
+    '@astrale-os/sdk',
+    '@astrale-os/kernel-core',
+    '@astrale-os/kernel-dsl',
+    '@astrale-os/kernel-ports',
+    '@astrale-os/kernel-protocol',
+    '@astrale-os/kernel-server',
+    '@astrale-os/kernel-client',
+];
+/** Prove that Wrangler emitted at most one physical root per runtime package. */
+export async function assertSingletonRuntimeRoots(metafilePath, inputRoot) {
+    const metafile = await readWranglerMetafile(metafilePath);
+    for (const name of RUNTIME_PACKAGES) {
+        const roots = new Set();
+        for (const input of Object.keys(metafile.inputs)) {
+            const root = packageRoot(input, name);
+            if (root !== undefined)
+                roots.add(await realpath(resolve(inputRoot, root)));
+        }
+        if (roots.size > 1) {
+            throw new Error(`Cloudflare Worker contains duplicate physical ${name} roots: ${[...roots].join(', ')}.`);
+        }
+    }
+}
+function packageRoot(input, name) {
+    const normalized = input.replaceAll('\\', '/');
+    const marker = `node_modules/${name}/`;
+    const index = normalized.lastIndexOf(marker);
+    return index < 0 ? undefined : normalized.slice(0, index + marker.length - 1);
+}