@astrale-os/adapter-cloudflare 0.5.0-beta.16 → 0.5.0-beta.161

package/README.md

@@ -2,10 +2,101 @@
 
 Cloudflare Worker deployment adapter for Astrale Domains.
 
-During the SDK beta program, install the beta cohort explicitly:
+During the SDK beta program, install the beta package set explicitly:
 
 ```bash
 npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 ```
 
-Bare installs return to stable releases when the cohort is promoted and npm `latest` advances.
+Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
+
+One `cloudflare()` value configures one Project Environment. `astrale-domain dev <environment>`
+builds locally and deploys each admitted Worker and frontend update remotely through the same path
+as `deploy`; it starts no local Worker, Vite server, or tunnel. Omitting `route` uses the observed
+stable `*.workers.dev` issuer. Add `installation: { instance: '...' }` to the Project Environment
+when generic tooling should reconcile the ready Release onto an Astrale Kernel.
+
+One watcher serializes its own updates. For an existing Worker, it uploads a candidate, reconciles
+configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
+HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
+serving the Publication also initializes the Application Runtime. After promotion, normal requests
+must prove that exact version again. A failed candidate remains at 0% and can be replaced on retry.
+Bundled View routes must also serve the prepared browser-file generation before readiness passes.
+This covers frontend-only changes without changing the Schema or reinstalling the Domain. HTML is
+revalidated on every use and transient asset misses are not cached; ordinary successful asset
+responses keep their cache policy. Frontend files are answered by the Worker's small startup module
+without loading the execution Service, which each such file starts loading in the background for the
+calls the View makes next.
+The first deployment uses ordinary Worker provisioning because no previous version exists to retain.
+An existing traffic-split rollout must be resolved before this single-version workflow can continue.
+
+A direct Cloudflare target shared across machines must still have one external writer, normally a
+CI/CD concurrency group. Live deployment checks detect competing changes but are not an atomic
+compare-and-swap or distributed lock. Use separate Worker targets for uncoordinated development.
+Routes, custom domains, schedules, and other non-versioned provider settings are reconciled through
+Wrangler before candidate probing; they can remain changed after a failed attempt. Candidate readiness
+protects the HTTP implementation, not an atomic rollback of external resources or trigger settings.
+
+When an Environment also declares `installation`, the SDK excludes another local checkout that
+targets the same resolved `Kernel issuer + Domain origin` (including bookmark aliases), reconciles
+exact installed Release evidence, and opens
+the default View when the Application has a frontend. These are Project-tooling behaviors rather
+than Cloudflare adapter responsibilities.
+
+## Frontend files
+
+The Worker runs before Workers Static Assets on every request and owns frontend response headers
+and routing, for `cloudflare()` and `astrale()` deployments alike. Frontend preparation therefore
+refuses a built frontend whose root contains `_headers`, `_redirects`, or `.assetsignore`, in any
+letter case, as a file or a directory. Wrangler would apply them as asset configuration in a direct
+deployment, while a managed deployment would serve them as public files. The refusal happens while
+the artifact is prepared, before any provider change. Vite copies its public directory (`public/`
+by default) to that root: remove them there, or stop the plugin that emits them. The same names
+below the root, such as `docs/_headers`, remain ordinary files.
+
+The Worker is also the only server-side code, so preparation likewise refuses a root name starting
+with `_worker.js`, the name of a Cloudflare Pages worker script: a `_worker.js` file or directory,
+or a sibling such as `_worker.js.map`. Wrangler refuses to upload these as assets, since they may
+hold server-side code, so a direct deployment would fail at upload, while a managed deployment would
+publish them. Unlike the names above, the match is case-sensitive, as Wrangler's is: `_Worker.js`
+and a nested `docs/_worker.js` remain ordinary files. Remove such a file from the public directory,
+or rename it if it is a browser script.
+
+## Provider-local staging
+
+Managed Cloudflare providers may stage immutable implementation candidates without exposing their
+identity to Publications or installed Kernels:
+
+```ts
+import { stagedWorkerName } from '@astrale-os/adapter-cloudflare/release'
+```
+
+This subpath is runtime-safe. `stagedWorkerName(providerDeployment)` addresses one private staged
+candidate. The public Worker name and `/invoke` endpoint remain stable across compatible
+implementation and Schema updates. Provider staging identity never enters Release, Publication,
+Kernel routing, or graph identity.
+
+## Material for a custom Worker entrypoint
+
+Workers with provider-specific routes or environment initialization can reuse the adapter's
+material emission without adopting the entire generated entrypoint:
+
+```ts
+import { generateBuildMaterialModule } from '@astrale-os/adapter-cloudflare/build'
+import { writeFile } from 'node:fs/promises'
+
+// build is an admitted Build returned by compile(application).
+await writeFile('src/build-material.gen.ts', generateBuildMaterialModule(build))
+```
+
+The generated TypeScript module exports `loadBuildMaterial()`. Call it from the
+`load` callback of `generatedCloudflareWorkerEntry` alongside the application's Runtime.
+It constructs the same verified, deduplicated material as the adapter's generated Service;
+allocation is deferred until the factory is called and the SDK deep-freezes it before use.
+The generated file needs only a type import from the SDK. Keep its compiler and runtime SDK
+versions aligned, and regenerate it when either the Application or that SDK version changes.
+
+Such an entrypoint can keep the same fast frontend path by answering from
+`cloudflareFrontDoor()` (`@astrale-os/adapter-cloudflare/worker/front`, which reaches no SDK
+runtime module) before importing its Service, and calling that Service's `prepare()` through
+`waitUntil` when the front door served a frontend file.

package/dist/adapter.d.ts

@@ -0,0 +1,14 @@
+import type { Deployment } from '@astrale-os/sdk/deployment';
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import type { CloudflareParams } from './params.js';
+import { artifact } from './build/artifact.js';
+import { type CloudflareDeployDependencies } from './deploy/index.js';
+import { signingIdentity } from './identity/source.js';
+export interface CloudflareDependencies extends CloudflareDeployDependencies {
+    readonly artifact: typeof artifact;
+    readonly signingIdentity: typeof signingIdentity;
+}
+export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams>;
+export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams>;
+export declare function waitForReadiness(verify: typeof verifyReadiness, release: Release, signal?: AbortSignal): Promise<void>;

package/dist/adapter.js

@@ -0,0 +1,82 @@
+import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adapter';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { createRequire } from 'node:module';
+import { artifact, materialize } from './build/artifact.js';
+import { verifyWorkerFrontend } from './build/frontend/readiness.js';
+import { deployCloudflare } from './deploy/index.js';
+import { versionReadinessFetch } from './deploy/readiness.js';
+import { signingIdentity } from './identity/source.js';
+import { runWranglerRollout } from './wrangler/rollout.js';
+import { runWranglerDeploymentStatus } from './wrangler/status.js';
+const packageVersion = createRequire(import.meta.url)('../package.json')
+    .version;
+export function cloudflare(parameters = {}) {
+    return cloudflareWithDependencies(parameters, {
+        artifact,
+        materialize,
+        runWranglerRollout,
+        runWranglerDeploymentStatus,
+        signingIdentity,
+        waitForReadiness: (release, signal, version, worker, workerName) => waitForReadiness(async (release, options) => {
+            const checks = {
+                ...options,
+                fetch: versionReadinessFetch(release.addressing.publicUrl, version, globalThis.fetch, workerName, release.addressing.issuer),
+            };
+            await verifyReadiness(release, checks);
+            await verifyWorkerFrontend(release, worker, checks);
+        }, release, signal),
+    });
+}
+export function cloudflareWithDependencies(parameters, dependencies) {
+    const adapter = defineAdapter({
+        name: 'cloudflare',
+        version: packageVersion,
+        prepare: dependencies.artifact,
+        deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
+        secretsFile: (parameters) => parameters.secrets,
+    });
+    return defineDeployment(adapter, parameters);
+}
+export async function waitForReadiness(verify, release, signal) {
+    const deadline = Date.now() + 90_000;
+    let last;
+    while (Date.now() < deadline) {
+        throwIfAborted(signal);
+        try {
+            await verify(release, {
+                signal: signal === undefined
+                    ? AbortSignal.timeout(5_000)
+                    : AbortSignal.any([signal, AbortSignal.timeout(5_000)]),
+            });
+            return;
+        }
+        catch (cause) {
+            throwIfAborted(signal);
+            last = cause;
+            await pause(signal);
+        }
+    }
+    throw last instanceof Error ? last : new Error('Cloudflare Release did not become ready.');
+}
+function pause(signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(done, 1_000);
+        const abort = () => done(abortError(signal));
+        signal?.addEventListener('abort', abort, { once: true });
+        function done(cause) {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', abort);
+            if (cause === undefined)
+                resolve();
+            else
+                reject(cause);
+        }
+    });
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw abortError(signal);
+}
+function abortError(signal) {
+    return signal?.reason instanceof Error ? signal.reason : new Error('Deployment interrupted.');
+}

package/dist/build/artifact.d.ts

@@ -0,0 +1,7 @@
+import type { ArtifactSource, PrepareContext } from '@astrale-os/sdk/deployment/adapter';
+import type { CloudflareParams } from '../params.js';
+export { materialize } from './materialize.js';
+/** Prepare one portable Worker whose public provider address remains stable across builds. */
+export declare function artifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;
+/** Prepare the complete portable Cloudflare Worker without direct Wrangler placement files. */
+export declare function prepareWorkerArtifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;

package/dist/build/artifact.js

@@ -0,0 +1,170 @@
+import { addressing } from '@astrale-os/sdk/deployment/release';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
+import { workerDeployment } from '../release/index.js';
+import { generateWranglerConfig } from './codegen/wrangler.js';
+import { deploymentAddressing, resolveRouter, workerName } from './configuration.js';
+import { frontendFiles } from './frontend/files.js';
+import { frontendRevision } from './frontend/revision.js';
+import { encodeWorkerArtifactManifest, inferMediaType, workerContentDigest, WORKER_MANIFEST_PATH, } from './worker/artifact.manifest.js';
+import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE, runtimeVars, } from './worker/execution.prepare.js';
+import { admitWorkerRuntimeConfiguration } from './worker/runtime.js';
+export { materialize } from './materialize.js';
+const encoder = new TextEncoder();
+/** Prepare one portable Worker whose public provider address remains stable across builds. */
+export async function artifact(params, context) {
+    return prepare(params, context, true);
+}
+/** Prepare the complete portable Cloudflare Worker without direct Wrangler placement files. */
+export async function prepareWorkerArtifact(params, context) {
+    return prepare(params, context, false);
+}
+async function prepare(params, context, direct) {
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
+    try {
+        const router = resolveRouter(params.router);
+        const name = workerName(params, context.build.schema.compiled.root.origin, context.environment);
+        const revision = context.build.schema.compiled.root.revision;
+        const configuredIssuer = deploymentAddressing(params);
+        // `frontend` stays the served file list every branch below already reads; `addressed` rides
+        // alongside it into the Worker, where it decides which of those files a browser may retain.
+        const { files: frontend, addressed } = await frontendFiles({
+            frontend: context.build.frontend,
+            projectDir: context.projectDir,
+            output: join(directory, 'frontend'),
+            recordSource: context.recordSource,
+            signal: context.signal,
+        });
+        const modules = await prepareExecution({
+            params,
+            context,
+            directory,
+            name,
+            direct,
+            configuredIssuer,
+            router,
+            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
+            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
+        });
+        const releaseConfig = generateWranglerConfig({
+            workerName: name,
+            main: `./${RELEASE_ENTRY}`,
+            ...(params.route === undefined ? {} : { route: params.route }),
+            vars: runtimeVars(params, configuredIssuer),
+            secretBindings: [SIGNING_IDENTITY_BINDING],
+            modules: { baseDir: './bundle', rules: [{ type: 'ESModule', globs: ['service.mjs'] }] },
+            ...(context.build.frontend?.source.kind === 'vite'
+                ? {
+                    frontend: {
+                        directory: './frontend',
+                    },
+                }
+                : {}),
+            ...(router === undefined
+                ? {}
+                : { router: { binding: router.binding, service: router.service } }),
+            ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+            selfBinding: false,
+        });
+        const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
+        const deployment = workerDeployment({
+            release: {
+                entrypoint: RELEASE_ENTRY,
+                modules: [
+                    { path: RELEASE_ENTRY, kind: 'esm', content: modules.entry },
+                    { path: RELEASE_SERVICE, kind: 'esm', content: modules.service },
+                ],
+            },
+            runtime,
+            bindings: {
+                vars: runtime.vars,
+                services: runtime.services,
+                requiredSecrets: [SIGNING_IDENTITY_BINDING],
+            },
+            ...(frontend.length === 0
+                ? {}
+                : {
+                    assets: {
+                        files: frontend.map((file) => {
+                            const contentType = file.mediaType ?? inferMediaType(file.path);
+                            return {
+                                path: `/${file.path}`,
+                                content: file.bytes(),
+                                ...(contentType === undefined ? {} : { contentType }),
+                            };
+                        }),
+                        notFound: 'none',
+                        runWorkerFirst: true,
+                        htmlHandling: 'none',
+                    },
+                }),
+        });
+        const manifest = encodeWorkerArtifactManifest({
+            origin: context.build.schema.compiled.root.origin,
+            revision,
+            deployment,
+            release: {
+                entrypoint: RELEASE_ENTRY,
+                modules: [
+                    { path: RELEASE_ENTRY, kind: 'esm', digest: workerContentDigest(modules.entry) },
+                    { path: RELEASE_SERVICE, kind: 'esm', digest: workerContentDigest(modules.service) },
+                ],
+            },
+            runtime: {
+                compatibilityDate: runtime.compatibilityDate,
+                compatibilityFlags: runtime.compatibilityFlags,
+            },
+            bindings: {
+                vars: runtime.vars,
+                services: runtime.services,
+                requiredSecrets: [SIGNING_IDENTITY_BINDING],
+            },
+            ...(frontend.length === 0
+                ? {}
+                : {
+                    assets: {
+                        files: frontend.map((file) => {
+                            const contentType = file.mediaType ?? inferMediaType(file.path);
+                            return {
+                                path: `/${file.path}`,
+                                artifactPath: `frontend/${file.path}`,
+                                digest: workerContentDigest(file.bytes()),
+                                ...(contentType === undefined ? {} : { contentType }),
+                            };
+                        }),
+                        notFound: 'none',
+                        runWorkerFirst: true,
+                        htmlHandling: 'none',
+                    },
+                }),
+        });
+        const files = [
+            { path: RELEASE_ENTRY, content: modules.entry },
+            { path: RELEASE_SERVICE, content: modules.service },
+            { path: WORKER_MANIFEST_PATH, content: manifest },
+            ...frontend.map((file) => ({
+                path: `frontend/${file.path}`,
+                content: file.bytes(),
+            })),
+            ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
+        ];
+        return Object.freeze({
+            entrypoint: RELEASE_ENTRY,
+            files: Object.freeze(files),
+            addressing: configuredIssuer === undefined
+                ? Object.freeze({ kind: 'provider-assigned', claim: name })
+                : Object.freeze({
+                    kind: 'configured',
+                    addressing: addressing(params.identityIssuer ?? configuredIssuer, {
+                        publicUrl: configuredIssuer,
+                    }),
+                }),
+        });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}

package/dist/build/bundle/admit.d.ts

@@ -0,0 +1 @@
+export declare function admitWorkerBundle(path: string): Promise<void>;

package/dist/build/bundle/admit.js

@@ -0,0 +1,9 @@
+import { pathToFileURL } from 'node:url';
+export async function admitWorkerBundle(path) {
+    const loaded = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
+    if (loaded.default === null ||
+        typeof loaded.default !== 'object' ||
+        typeof Reflect.get(loaded.default, 'fetch') !== 'function') {
+        throw new TypeError('Generated Worker bundle does not export a Fetch handler.');
+    }
+}

package/dist/build/closure.d.ts

@@ -0,0 +1,2 @@
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export declare function assertRuntimeClosure(metafilePath: string): Promise<void>;

package/dist/build/closure.js

@@ -0,0 +1,22 @@
+import { readWranglerMetafile } from './metafile.js';
+const FORBIDDEN_RUNTIME_INPUTS = [
+    '/v1/builder/',
+    '/v1/compiled/compiler/',
+    '/node_modules/ajv/',
+    '/node_modules/re2js/',
+    '/kernel-core/domain/',
+    '/core/domain/',
+    '/kernel-core/schema/index.',
+    '/core/schema/index.',
+];
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export async function assertRuntimeClosure(metafilePath) {
+    const metafile = await readWranglerMetafile(metafilePath);
+    const forbidden = Object.keys(metafile.inputs).filter((input) => {
+        const normalized = `/${input.replaceAll('\\', '/')}`.replace(/(\/node_modules\/@astrale-os\/kernel-[^/]+)\/dist\//gu, '$1/');
+        return FORBIDDEN_RUNTIME_INPUTS.some((fragment) => normalized.includes(fragment));
+    });
+    if (forbidden.length > 0) {
+        throw new Error(`Cloudflare Worker reaches build-side modules: ${forbidden.sort().join(', ')}.`);
+    }
+}

package/dist/build/codegen/execution.d.ts

@@ -0,0 +1,3 @@
+export { generateExecutionEntry } from '../worker/codegen/entry.js';
+export { generateExecutionService } from '../worker/codegen/service.js';
+export type { ExecutionCodegenOptions } from '../worker/codegen/service.js';

package/dist/build/codegen/execution.js

@@ -0,0 +1,2 @@
+export { generateExecutionEntry } from '../worker/codegen/entry.js';
+export { generateExecutionService } from '../worker/codegen/service.js';

package/dist/build/codegen/merge.d.ts

@@ -17,4 +17,3 @@
  * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
  */
 export declare function deepMergeConfig(base: Record<string, unknown>, overlay: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=merge.d.ts.map

package/dist/build/codegen/merge.js

@@ -88,4 +88,3 @@ function isPlainObject(v) {
 function isPrimitive(v) {
     return v === null || (typeof v !== 'object' && typeof v !== 'function');
 }
-//# sourceMappingURL=merge.js.map

package/dist/build/codegen/wrangler.d.ts

@@ -13,16 +13,26 @@
  */
 export interface WranglerCodegenOptions {
     workerName: string;
+    /** Provider-ready entrypoint relative to the generated config. */
+    main?: string;
     /** Full custom hostname for a routed deploy (e.g. 'crm.acme.dev'). */
     route?: string;
     /** Exact materialized local frontend; absence means no ASSETS binding. */
     frontend?: {
         readonly directory: string;
-        readonly routes: readonly string[];
-        readonly dev: boolean;
     };
     /** Plain (non-secret) vars to bake in. */
     vars?: Record<string, string>;
+    /** Secret binding names required by generated Worker code. */
+    secretBindings?: readonly string[];
+    /** Modules retained outside the startup entry and loaded on demand. */
+    modules?: {
+        readonly baseDir: string;
+        readonly rules: readonly {
+            readonly type: 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
+            readonly globs: readonly string[];
+        }[];
+    };
     /** Add the SELF service binding (autobinding). */
     selfBinding: boolean;
     /**
@@ -44,4 +54,3 @@ export interface WranglerCodegenOptions {
     wrangler?: Record<string, unknown>;
 }
 export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
-//# sourceMappingURL=wrangler.d.ts.map

package/dist/build/codegen/wrangler.js

@@ -12,15 +12,17 @@
  * (extra bindings: KV, R2, D1, queues, …) — see `mergeUserConfig`.
  */
 import { deepMergeConfig } from './merge.js';
-// Wrangler 4.121.0's pinned workerd accepts dates through 2026-08-11.
+// Keep the generated date on the runtime baseline qualified with Wrangler 4.123.0.
 const COMPATIBILITY_DATE = '2026-08-11';
 export function generateWranglerConfig(opts) {
     const config = {
         name: opts.workerName,
-        main: './worker.gen.ts',
+        main: opts.main ?? './worker.gen.ts',
         compatibility_date: COMPATIBILITY_DATE,
-        compatibility_flags: ['nodejs_compat'],
-        workers_dev: true,
+        // Domain execution calls its Kernel through the invocation's public issuer. Cloudflare must
+        // route same-zone callbacks through the public front door instead of bypassing Worker routes.
+        compatibility_flags: ['nodejs_compat', 'global_fetch_strictly_public'],
+        workers_dev: opts.route === undefined,
         version_metadata: { binding: 'ASTRALE_VERSION_METADATA' },
         observability: { enabled: true },
     };
@@ -31,19 +33,10 @@ export function generateWranglerConfig(opts) {
         config.assets = {
             directory: opts.frontend.directory,
             binding: 'ASSETS',
-            run_worker_first: opts.frontend.dev
-                ? true
-                : [
-                    '/invoke',
-                    '/invoke/*',
-                    '/install',
-                    '/install/*',
-                    '/health',
-                    '/health/*',
-                    '/.well-known',
-                    '/.well-known/*',
-                    ...opts.frontend.routes,
-                ],
+            html_handling: 'none',
+            // Match the portable Worker artifact: frontend routing and sandbox-safe asset
+            // response headers are owned by the Worker for both deployment adapters.
+            run_worker_first: true,
         };
     }
     const services = [];
@@ -57,6 +50,18 @@ export function generateWranglerConfig(opts) {
     if (opts.vars && Object.keys(opts.vars).length > 0) {
         config.vars = opts.vars;
     }
+    if (opts.secretBindings && opts.secretBindings.length > 0) {
+        config.secrets = { required: [...opts.secretBindings] };
+    }
+    if (opts.modules !== undefined) {
+        config.find_additional_modules = true;
+        config.base_dir = opts.modules.baseDir;
+        config.rules = opts.modules.rules.map((rule) => ({
+            type: rule.type,
+            globs: [...rule.globs],
+            fallthrough: true,
+        }));
+    }
     const merged = opts.wrangler ? mergeUserConfig(config, opts.wrangler) : config;
     return JSON.stringify(merged, null, 2) + '\n';
 }
@@ -67,7 +72,11 @@ const ADAPTER_OWNED_KEYS = [
     'assets',
     'routes',
     'compatibility_date',
+    'workers_dev',
     'version_metadata',
+    'secrets',
+    'find_additional_modules',
+    'base_dir',
 ];
 /**
  * Deep-merge the dev's raw wrangler overlay over the generated config, after
@@ -83,4 +92,3 @@ function mergeUserConfig(base, user) {
     }
     return deepMergeConfig(base, user);
 }
-//# sourceMappingURL=wrangler.js.map

package/dist/build/configuration/addressing.d.ts

@@ -0,0 +1,2 @@
+import type { CloudflareParams } from '../../params.js';
+export declare function deploymentAddressing(parameters: CloudflareParams): string | undefined;

package/dist/build/configuration/addressing.js

@@ -0,0 +1,17 @@
+import { addressing } from '@astrale-os/sdk/deployment/release';
+export function deploymentAddressing(parameters) {
+    if (parameters.identityIssuer !== undefined) {
+        addressing(parameters.identityIssuer);
+        if (parameters.route === undefined && parameters.addressing === undefined) {
+            throw new TypeError('A stable Cloudflare identityIssuer requires explicit public addressing.');
+        }
+    }
+    const routed = parameters.route === undefined ? undefined : addressing(`https://${parameters.route}`).issuer;
+    if (parameters.addressing === undefined)
+        return routed;
+    const configured = addressing(parameters.addressing).issuer;
+    if (routed !== undefined && configured !== routed) {
+        throw new TypeError('Cloudflare route and addressing identify different origins.');
+    }
+    return configured;
+}

package/dist/build/configuration/invocation-timeout.d.ts

@@ -0,0 +1,2 @@
+import type { CloudflareParams } from '../../params.js';
+export declare function workerInvocationTimeout(value: CloudflareParams['invocationTimeoutMs']): number | undefined;

package/dist/build/configuration/invocation-timeout.js

@@ -0,0 +1,9 @@
+const MAXIMUM_TIMER_MS = 2_147_483_647;
+export function workerInvocationTimeout(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > MAXIMUM_TIMER_MS) {
+        throw new TypeError('Cloudflare invocationTimeoutMs must be a positive integer within the platform timer range.');
+    }
+    return value;
+}

package/dist/build/configuration/request-limit.d.ts

@@ -0,0 +1,2 @@
+import type { CloudflareParams } from '../../params.js';
+export declare function workerRequestLimit(value: CloudflareParams['maximumRequestBytes']): number | undefined;

package/dist/build/configuration/request-limit.js

@@ -0,0 +1,9 @@
+const MAXIMUM_REQUEST_BYTES = 16 * 1024 * 1024;
+export function workerRequestLimit(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > MAXIMUM_REQUEST_BYTES) {
+        throw new TypeError('Cloudflare maximumRequestBytes must be a positive integer at most 16 MiB.');
+    }
+    return value;
+}

package/dist/build/configuration/router.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareParams } from '../../params.js';
+export declare function resolveRouter(input: CloudflareParams['router']): {
+    readonly binding: string;
+    readonly service: string;
+    readonly hostSuffix: string;
+    readonly minLabels: number;
+} | undefined;

package/dist/build/configuration/router.js

@@ -0,0 +1,11 @@
+export function resolveRouter(input) {
+    if (input === false || input === undefined)
+        return undefined;
+    const value = input;
+    return Object.freeze({
+        binding: value.binding ?? 'ROUTER',
+        service: value.service ?? 'admin-router',
+        hostSuffix: value.hostSuffix ?? '.astrale.ai',
+        minLabels: value.minLabels ?? 4,
+    });
+}

package/dist/build/configuration/worker-name.d.ts

@@ -0,0 +1,2 @@
+import type { CloudflareParams } from '../../params.js';
+export declare function workerName(parameters: CloudflareParams, origin: string, environment?: string): string;