@astrale-os/adapter-cloudflare 0.5.0-beta.164 → 0.5.0-beta.166

package/README.md

@@ -16,10 +16,14 @@ as `deploy`; it starts no local Worker, Vite server, or tunnel. Omitting `route`
 stable `*.workers.dev` issuer. Add `installation: { instance: '...' }` to the Project Environment
 when generic tooling should reconcile the ready Release onto an Astrale Kernel.
 
+Generated Worker modules are minified by default, including separately loaded runtime modules.
+The Environment's `wrangler` overlay cannot change minification: every Environment of one source
+must emit the same JavaScript bytes. `cloudflare({ wrangler: { minify: false } })` is rejected.
+
 One watcher serializes its own updates. For an existing Worker, it uploads a candidate, reconciles
 configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
 HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
-serving the Publication also initializes the Application Runtime. After promotion, normal requests
+serving the Publication also initializes the Domain Runtime. After promotion, normal requests
 must prove that exact version again. A failed candidate remains at 0% and can be replaced on retry.
 Bundled View routes must also serve the prepared browser-file generation before readiness passes.
 This covers frontend-only changes without changing the Schema or reinstalling the Domain. HTML is
@@ -40,7 +44,7 @@ protects the HTTP implementation, not an atomic rollback of external resources o
 When an Environment also declares `installation`, the SDK excludes another local checkout that
 targets the same resolved `Kernel issuer + Domain origin` (including bookmark aliases), reconciles
 exact installed Release evidence, and opens
-the default View when the Application has a frontend. These are Project-tooling behaviors rather
+the default View when the Domain has a frontend. These are Project-tooling behaviors rather
 than Cloudflare adapter responsibilities.
 
 ## Frontend files
@@ -76,6 +80,58 @@ candidate. The public Worker name and `/invoke` endpoint remain stable across co
 implementation and Schema updates. Provider staging identity never enters Release, Publication,
 Kernel routing, or graph identity.
 
+## Deployment bindings
+
+The bundled Worker carries no Environment value, so every Environment of one source bundles the
+same bytes. Each deployment binds its own values as plain Worker bindings:
+
+| Binding | Value |
+| --- | --- |
+| `WORKER_URL` | serving origin of the deployment |
+| `ASTRALE_SETTINGS` | canonical JSON of `{ invocationTimeoutMs, maximumRequestBytes, router, tokenExchange }`, defaults resolved, with optional `durableOptions` |
+| `ASTRALE_BUILD_DIGEST` | build digest, bound only by hosts that deploy immutable Workers; never by a stable Worker |
+| `IDENTITY_ISS`, `ASTRALE_PROVIDER_ASSIGNED_WORKER` | **legacy direct mode only** (deprecated): a stable issuer behind another route, and the workers.dev claim |
+
+These names are adapter-owned: preparation refuses an author var, or a `wrangler.vars` entry, that
+takes one, and deployment refuses a secret that does. A host that deploys the Worker itself encodes
+the settings with `encodeWorkerSettings` from `@astrale-os/adapter-cloudflare/worker`. A generated
+Worker refuses execution without `ASTRALE_SETTINGS`.
+
+The two direct-mode bindings are deprecated. Their replacement is an immutable deployment, whose
+host binds `WORKER_URL` to the deployment URL, which is also its issuer (namespace mode). They are
+deleted with direct mode, once the Shell, Services, Issues, domains and ui configurations deploy in
+namespace mode and no installation pins a direct Worker.
+
+The `wrangler` overlay reaches the deployment configuration, never the bundle. Preparation refuses
+an overlay key the bundler reads (`alias`, `build`, `define`, `jsx_factory`, `jsx_fragment`,
+`keep_names`, `minify`, `no_bundle`, `node_compat`, `preserve_file_names`, `rules`, `tsconfig`,
+`upload_source_maps`) and a compatibility flag it reads (Node.js, `navigator`, fetch iterable
+typing, Python) beyond the adapter's own `nodejs_compat`.
+
+## Build digest
+
+`cloudflare()` and `astrale()` bundle through one bundler, `cloudflare-worker` version `1`, so
+every Environment of either adapter shares one build: `astrale-domain build` prints its build
+digest, and `deploy` places that same Bundle. Two installed versions of this package are two
+copies of the bundler: when their code differs, `build` prints one build digest per copy and warns
+until the adapter versions are aligned.
+
+Services receives the placed modules as they are, so there the digest names the bytes the
+deployment runs. Direct mode runs `wrangler deploy`, which bundles the placed modules again: there
+the digest names the portable Worker the deployment was made from, not the bytes Cloudflare runs.
+A host that receives a Worker upload recomputes the digest from the exact upload with the same
+function:
+
+```ts
+import { workerBuildManifest } from '@astrale-os/adapter-cloudflare/release'
+import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest'
+
+const digest = buildDigest(workerBuildManifest({ origin, revision, bundle, entry, modules, assets }))
+```
+
+Modules keep their uploaded name and an asset `/<path>` is the file `assets/<path>`. The bundler
+version names this layout, not a package release. Both subpaths are runtime-safe.
+
 ## Material for a custom Worker entrypoint
 
 Workers with provider-specific routes or environment initialization can reuse the adapter's
@@ -85,16 +141,19 @@ material emission without adopting the entire generated entrypoint:
 import { generateBuildMaterialModule } from '@astrale-os/adapter-cloudflare/build'
 import { writeFile } from 'node:fs/promises'
 
-// build is an admitted Build returned by compile(application).
+// build is an admitted Build returned by compile(domain).
 await writeFile('src/build-material.gen.ts', generateBuildMaterialModule(build))
 ```
 
 The generated TypeScript module exports `loadBuildMaterial()`. Call it from the
-`load` callback of `generatedCloudflareWorkerEntry` alongside the application's Runtime.
+`load` callback of `generatedCloudflareWorkerEntry` alongside the Domain's Runtime.
+Such an entrypoint states its execution settings (`invocationTimeoutMs`, `maximumRequestBytes`,
+`tokenExchange`, `routeSubrequest`, `identityIssuer`) in its configuration, or reads them from its
+deployment bindings with `settings: deploymentSettings`; one Worker never takes both.
 It constructs the same verified, deduplicated material as the adapter's generated Service;
 allocation is deferred until the factory is called and the SDK deep-freezes it before use.
 The generated file needs only a type import from the SDK. Keep its compiler and runtime SDK
-versions aligned, and regenerate it when either the Application or that SDK version changes.
+versions aligned, and regenerate it when either the Domain or that SDK version changes.
 
 Such an entrypoint can keep the same fast frontend path by answering from
 `cloudflareFrontDoor()` (`@astrale-os/adapter-cloudflare/worker/front`, which reaches no SDK

package/dist/adapter.d.ts

@@ -1,5 +1,6 @@
 import type { Deployment } from '@astrale-os/sdk/deployment';
-import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { LegacyAdapter } from '@astrale-os/sdk/deployment/adapter';
+import type { legacy } from '@astrale-os/sdk/deployment/release';
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import type { CloudflareParams } from './params.js';
 import { artifact } from './build/artifact.js';
@@ -9,6 +10,6 @@ export interface CloudflareDependencies extends CloudflareDeployDependencies {
     readonly artifact: typeof artifact;
     readonly signingIdentity: typeof signingIdentity;
 }
-export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams>;
-export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams>;
-export declare function waitForReadiness(verify: typeof verifyReadiness, release: Release, signal?: AbortSignal): Promise<void>;
+export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
+export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
+export declare function waitForReadiness(verify: typeof verifyReadiness, release: legacy.Release, signal?: AbortSignal): Promise<void>;

package/dist/adapter.js

@@ -2,6 +2,7 @@ import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adap
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import { createRequire } from 'node:module';
 import { artifact, materialize } from './build/artifact.js';
+import { cloudflareWorkerBundler } from './build/bundler.js';
 import { verifyWorkerFrontend } from './build/frontend/readiness.js';
 import { deployCloudflare } from './deploy/index.js';
 import { versionReadinessFetch } from './deploy/readiness.js';
@@ -31,6 +32,7 @@ export function cloudflareWithDependencies(parameters, dependencies) {
     const adapter = defineAdapter({
         name: 'cloudflare',
         version: packageVersion,
+        bundler: cloudflareWorkerBundler,
         prepare: dependencies.artifact,
         deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
         secretsFile: (parameters) => parameters.secrets,

package/dist/build/artifact.js

@@ -1,15 +1,14 @@
 import { addressing } from '@astrale-os/sdk/deployment/release';
-import { mkdir, mkdtemp, rm } from 'node:fs/promises';
-import { join } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
 import { workerDeployment } from '../release/index.js';
+import { bundledWorker, bundleWorker } from './bundler.js';
 import { generateWranglerConfig } from './codegen/wrangler.js';
-import { deploymentAddressing, resolveRouter, workerName } from './configuration.js';
-import { frontendFiles } from './frontend/files.js';
-import { frontendRevision } from './frontend/revision.js';
+import { deploymentAddressing, deploymentVars, resolveRouter, workerName } from './configuration.js';
 import { encodeWorkerArtifactManifest, inferMediaType, workerContentDigest, WORKER_MANIFEST_PATH, } from './worker/artifact.manifest.js';
-import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE, runtimeVars, } from './worker/execution.prepare.js';
+import { RELEASE_ENTRY } from './worker/execution.prepare.js';
+import { workerModules } from './worker/modules.js';
 import { admitWorkerRuntimeConfiguration } from './worker/runtime.js';
+import { recordPlacedBundle } from './worker/upload.js';
 export { materialize } from './materialize.js';
 const encoder = new TextEncoder();
 /** Prepare one portable Worker whose public provider address remains stable across builds. */
@@ -21,150 +20,136 @@ export async function prepareWorkerArtifact(params, context) {
     return prepare(params, context, false);
 }
 async function prepare(params, context, direct) {
-    const stateDirectory = join(context.projectDir, '.astrale');
-    await mkdir(stateDirectory, { recursive: true });
-    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
-    try {
-        const router = resolveRouter(params.router);
-        const name = workerName(params, context.build.schema.compiled.root.origin, context.environment);
-        const revision = context.build.schema.compiled.root.revision;
-        const configuredIssuer = deploymentAddressing(params);
-        // `frontend` stays the served file list every branch below already reads; `addressed` rides
-        // alongside it into the Worker, where it decides which of those files a browser may retain.
-        const { files: frontend, addressed } = await frontendFiles({
-            frontend: context.build.frontend,
-            projectDir: context.projectDir,
-            output: join(directory, 'frontend'),
-            recordSource: context.recordSource,
-            signal: context.signal,
-        });
-        const modules = await prepareExecution({
-            params,
-            context,
-            directory,
-            name,
-            direct,
-            configuredIssuer,
-            router,
-            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
-            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
-        });
-        const releaseConfig = generateWranglerConfig({
-            workerName: name,
-            main: `./${RELEASE_ENTRY}`,
-            ...(params.route === undefined ? {} : { route: params.route }),
-            vars: runtimeVars(params, configuredIssuer),
-            secretBindings: [SIGNING_IDENTITY_BINDING],
-            modules: { baseDir: './bundle', rules: [{ type: 'ESModule', globs: ['service.mjs'] }] },
-            ...(context.build.frontend?.source.kind === 'vite'
-                ? {
-                    frontend: {
-                        directory: './frontend',
-                    },
-                }
-                : {}),
-            ...(router === undefined
-                ? {}
-                : { router: { binding: router.binding, service: router.service } }),
-            ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
-            selfBinding: false,
-        });
-        const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
-        const deployment = workerDeployment({
-            release: {
-                entrypoint: RELEASE_ENTRY,
-                modules: [
-                    { path: RELEASE_ENTRY, kind: 'esm', content: modules.entry },
-                    { path: RELEASE_SERVICE, kind: 'esm', content: modules.service },
-                ],
-            },
-            runtime,
-            bindings: {
-                vars: runtime.vars,
-                services: runtime.services,
-                requiredSecrets: [SIGNING_IDENTITY_BINDING],
-            },
-            ...(frontend.length === 0
-                ? {}
-                : {
-                    assets: {
-                        files: frontend.map((file) => {
-                            const contentType = file.mediaType ?? inferMediaType(file.path);
-                            return {
-                                path: `/${file.path}`,
-                                content: file.bytes(),
-                                ...(contentType === undefined ? {} : { contentType }),
-                            };
-                        }),
-                        notFound: 'none',
-                        runWorkerFirst: true,
-                        htmlHandling: 'none',
-                    },
-                }),
-        });
-        const manifest = encodeWorkerArtifactManifest({
-            origin: context.build.schema.compiled.root.origin,
-            revision,
-            deployment,
-            release: {
-                entrypoint: RELEASE_ENTRY,
-                modules: [
-                    { path: RELEASE_ENTRY, kind: 'esm', digest: workerContentDigest(modules.entry) },
-                    { path: RELEASE_SERVICE, kind: 'esm', digest: workerContentDigest(modules.service) },
-                ],
-            },
-            runtime: {
-                compatibilityDate: runtime.compatibilityDate,
-                compatibilityFlags: runtime.compatibilityFlags,
-            },
-            bindings: {
-                vars: runtime.vars,
-                services: runtime.services,
-                requiredSecrets: [SIGNING_IDENTITY_BINDING],
-            },
-            ...(frontend.length === 0
-                ? {}
-                : {
-                    assets: {
-                        files: frontend.map((file) => {
-                            const contentType = file.mediaType ?? inferMediaType(file.path);
-                            return {
-                                path: `/${file.path}`,
-                                artifactPath: `frontend/${file.path}`,
-                                digest: workerContentDigest(file.bytes()),
-                                ...(contentType === undefined ? {} : { contentType }),
-                            };
-                        }),
-                        notFound: 'none',
-                        runWorkerFirst: true,
-                        htmlHandling: 'none',
-                    },
-                }),
-        });
-        const files = [
-            { path: RELEASE_ENTRY, content: modules.entry },
-            { path: RELEASE_SERVICE, content: modules.service },
-            { path: WORKER_MANIFEST_PATH, content: manifest },
-            ...frontend.map((file) => ({
-                path: `frontend/${file.path}`,
-                content: file.bytes(),
+    const router = resolveRouter(params.router);
+    const name = workerName(params, context.build.schema.compiled.root.origin, context.environment);
+    const revision = context.build.schema.compiled.root.revision;
+    const configuredIssuer = deploymentAddressing(params);
+    // The Environment enters only as the deployment's bindings, never the bundled bytes.
+    const vars = deploymentVars(params, {
+        ...(configuredIssuer === undefined ? {} : { configuredIssuer }),
+        ...(direct && configuredIssuer === undefined ? { providerAssignedWorker: name } : {}),
+    });
+    // Preparation places the environment-free Worker bytes: the Bundle `deploy` already produced
+    // with this adapter's bundler, or the same bundling run here.
+    const worker = context.bundle === undefined
+        ? await bundleWorker(context)
+        : bundledWorker(context.bundle, context.build);
+    if (context.bundle !== undefined)
+        recordPlacedBundle(context.build);
+    const { frontend } = worker;
+    const release = {
+        entrypoint: RELEASE_ENTRY,
+        modules: [
+            { path: RELEASE_ENTRY, kind: 'esm', content: worker.entry },
+            ...worker.modules,
+        ],
+    };
+    const releaseConfig = generateWranglerConfig({
+        workerName: name,
+        main: `./${RELEASE_ENTRY}`,
+        ...(params.route === undefined ? {} : { route: params.route }),
+        vars,
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        modules: workerModules(release),
+        ...(context.build.frontend?.source.kind === 'vite'
+            ? {
+                frontend: {
+                    directory: './frontend',
+                },
+            }
+            : {}),
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+        selfBinding: false,
+    });
+    const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
+    const deployment = workerDeployment({
+        release,
+        runtime,
+        bindings: {
+            vars: runtime.vars,
+            services: runtime.services,
+            requiredSecrets: [SIGNING_IDENTITY_BINDING],
+        },
+        ...(frontend.length === 0
+            ? {}
+            : {
+                assets: {
+                    files: frontend.map((file) => {
+                        const contentType = file.mediaType ?? inferMediaType(file.path);
+                        return {
+                            path: `/${file.path}`,
+                            content: file.bytes(),
+                            ...(contentType === undefined ? {} : { contentType }),
+                        };
+                    }),
+                    notFound: 'none',
+                    runWorkerFirst: true,
+                    htmlHandling: 'none',
+                },
+            }),
+    });
+    const manifest = encodeWorkerArtifactManifest({
+        origin: context.build.schema.compiled.root.origin,
+        revision,
+        deployment,
+        release: {
+            entrypoint: release.entrypoint,
+            modules: release.modules.map(({ path, kind, content }) => ({
+                path,
+                kind,
+                digest: workerContentDigest(content),
             })),
-            ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
-        ];
-        return Object.freeze({
-            entrypoint: RELEASE_ENTRY,
-            files: Object.freeze(files),
-            addressing: configuredIssuer === undefined
-                ? Object.freeze({ kind: 'provider-assigned', claim: name })
-                : Object.freeze({
-                    kind: 'configured',
-                    addressing: addressing(params.identityIssuer ?? configuredIssuer, {
-                        publicUrl: configuredIssuer,
+        },
+        runtime: {
+            compatibilityDate: runtime.compatibilityDate,
+            compatibilityFlags: runtime.compatibilityFlags,
+        },
+        bindings: {
+            vars: runtime.vars,
+            services: runtime.services,
+            requiredSecrets: [SIGNING_IDENTITY_BINDING],
+        },
+        ...(frontend.length === 0
+            ? {}
+            : {
+                assets: {
+                    files: frontend.map((file) => {
+                        const contentType = file.mediaType ?? inferMediaType(file.path);
+                        return {
+                            path: `/${file.path}`,
+                            artifactPath: `frontend/${file.path}`,
+                            digest: workerContentDigest(file.bytes()),
+                            ...(contentType === undefined ? {} : { contentType }),
+                        };
                     }),
+                    notFound: 'none',
+                    runWorkerFirst: true,
+                    htmlHandling: 'none',
+                },
+            }),
+    });
+    const files = [
+        ...release.modules.map(({ path, content }) => ({ path, content })),
+        { path: WORKER_MANIFEST_PATH, content: manifest },
+        ...frontend.map((file) => ({
+            path: `frontend/${file.path}`,
+            content: file.bytes(),
+        })),
+        ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
+    ];
+    return Object.freeze({
+        entrypoint: RELEASE_ENTRY,
+        files: Object.freeze(files),
+        addressing: configuredIssuer === undefined
+            ? Object.freeze({ kind: 'provider-assigned', claim: name })
+            : Object.freeze({
+                kind: 'configured',
+                addressing: addressing(params.identityIssuer ?? configuredIssuer, {
+                    publicUrl: configuredIssuer,
                 }),
-        });
-    }
-    finally {
-        await rm(directory, { recursive: true, force: true });
-    }
+            }),
+    });
 }

package/dist/build/bundle/admit.d.ts

@@ -1 +1,3 @@
 export declare function admitWorkerBundle(path: string): Promise<void>;
+/** Admit the separately emitted engine's actual platform exports, including its compiled WASM. */
+export declare function admitDurableEngineBundle(path: string): Promise<void>;

package/dist/build/bundle/admit.js

@@ -1,5 +1,34 @@
+import * as nodeModule from 'node:module';
 import { pathToFileURL } from 'node:url';
+import { compiledWasmLoader, compiledWasmSource } from './compiled-wasm-loader.js';
+let compiledWasm = false;
+/**
+ * Import a WebAssembly module as Workers do for `CompiledWasm`: its default export is the compiled
+ * `WebAssembly.Module`, instantiated by the importing code. The CLI admits bundles under Bun; Node
+ * serves programmatic builds.
+ */
+function admitCompiledWasm() {
+    if (compiledWasm)
+        return;
+    if (process.versions.bun !== undefined) {
+        ;
+        Reflect.get(globalThis, 'Bun').plugin({
+            name: 'astrale-compiled-wasm',
+            setup(build) {
+                build.onLoad({ filter: /\.wasm$/ }, ({ path }) => ({
+                    loader: 'js',
+                    contents: compiledWasmSource(JSON.stringify(path)),
+                }));
+            },
+        });
+        compiledWasm = true;
+        return;
+    }
+    nodeModule.register(compiledWasmLoader);
+    compiledWasm = true;
+}
 export async function admitWorkerBundle(path) {
+    admitCompiledWasm();
     const loaded = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
     if (loaded.default === null ||
         typeof loaded.default !== 'object' ||
@@ -7,3 +36,11 @@ export async function admitWorkerBundle(path) {
         throw new TypeError('Generated Worker bundle does not export a Fetch handler.');
     }
 }
+/** Admit the separately emitted engine's actual platform exports, including its compiled WASM. */
+export async function admitDurableEngineBundle(path) {
+    admitCompiledWasm();
+    const engine = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
+    if (['createEndpointHandler', 'workflow', 'TerminalError', 'CancelledError'].some((key) => typeof engine[key] !== 'function')) {
+        throw new TypeError('Generated durable engine bundle does not export the platform Fetch entrypoint.');
+    }
+}

package/dist/build/bundle/compiled-wasm-loader.d.ts

@@ -0,0 +1,8 @@
+/** Workers expose CompiledWasm imports as modules, rather than instantiated exports. */
+export declare function compiledWasmSource(file: string): string;
+/**
+ * Async hooks run in a separate Node thread. A self-contained ESM hook admits both emitted JS and
+ * source builds under tsx without requiring that thread to resolve or transpile our source files.
+ * The emitted import source is shared with Bun.
+ */
+export declare const compiledWasmLoader: string;

package/dist/build/bundle/compiled-wasm-loader.js

@@ -0,0 +1,21 @@
+const SOURCE_PREFIX = "import { readFileSync } from 'node:fs'\nexport default new WebAssembly.Module(readFileSync(";
+const SOURCE_SUFFIX = '))\n';
+/** Workers expose CompiledWasm imports as modules, rather than instantiated exports. */
+export function compiledWasmSource(file) {
+    return `${SOURCE_PREFIX}${file}${SOURCE_SUFFIX}`;
+}
+/**
+ * Async hooks run in a separate Node thread. A self-contained ESM hook admits both emitted JS and
+ * source builds under tsx without requiring that thread to resolve or transpile our source files.
+ * The emitted import source is shared with Bun.
+ */
+export const compiledWasmLoader = `data:text/javascript,${encodeURIComponent(`
+export function load(url, context, nextLoad) {
+  if (!url.startsWith('file:') || !url.endsWith('.wasm')) return nextLoad(url, context);
+  return {
+    format: 'module',
+    shortCircuit: true,
+    source: ${JSON.stringify(SOURCE_PREFIX)} + 'new URL(' + JSON.stringify(url) + ')' + ${JSON.stringify(SOURCE_SUFFIX)},
+  };
+}
+`)}`;

package/dist/build/bundler.d.ts

@@ -0,0 +1,21 @@
+import type { Bundle, BundleContext, Bundler } from '@astrale-os/sdk/deployment/adapter';
+import type { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+import type { ReleaseModule } from './worker/execution.prepare.js';
+/**
+ * Environment-free bytes of one generated Worker: its entry, the modules it loads (the execution
+ * Service, the deferred workflow engine and their WASM) and its frontend.
+ */
+export interface WorkerBytes {
+    readonly entry: Uint8Array;
+    readonly modules: readonly ReleaseModule[];
+    readonly frontend: readonly frontendBuild.FrontendFile[];
+}
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export declare const cloudflareWorkerBundler: Bundler;
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export declare function bundleWorker(context: BundleContext): Promise<WorkerBytes>;
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export declare function bundledWorker(bundle: Bundle, build: Bundle['build']): WorkerBytes;

package/dist/build/bundler.js

@@ -0,0 +1,96 @@
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CLOUDFLARE_WORKER_BUNDLER, workerAssetFile } from '../release/build.js';
+import { frontendFiles } from './frontend/files.js';
+import { frontendRevision } from './frontend/revision.js';
+import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE } from './worker/execution.prepare.js';
+/** Worker modules live beside the entry; WASM is the only non-ESM kind preparation emits. */
+const MODULE_DIRECTORY = 'bundle/';
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export const cloudflareWorkerBundler = Object.freeze({
+    id: CLOUDFLARE_WORKER_BUNDLER.id,
+    version: CLOUDFLARE_WORKER_BUNDLER.version,
+    async bundle(context) {
+        const worker = await bundleWorker(context);
+        return Object.freeze({
+            entrypoint: RELEASE_ENTRY,
+            files: Object.freeze([
+                { path: RELEASE_ENTRY, content: worker.entry },
+                ...worker.modules.map(({ path, content }) => ({ path, content })),
+                ...worker.frontend.map((file) => ({
+                    path: workerAssetFile(`/${file.path}`),
+                    content: file.bytes(),
+                })),
+            ]),
+        });
+    },
+});
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export async function bundleWorker(context) {
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
+    try {
+        // `frontend` is the served file list; `addressed` rides alongside it into the Worker, where it
+        // decides which of those files a browser may retain.
+        const { files: frontend, addressed } = await frontendFiles({
+            frontend: context.build.frontend,
+            projectDir: context.projectDir,
+            output: join(directory, 'frontend'),
+            recordSource: context.recordSource,
+            signal: context.signal,
+        });
+        const modules = await prepareExecution({
+            context,
+            directory,
+            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
+            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
+        });
+        return Object.freeze({ entry: modules.entry, modules: modules.modules, frontend });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export function bundledWorker(bundle, build) {
+    const { id, version } = bundle.manifest.bundler;
+    if (bundle.build !== build ||
+        id !== CLOUDFLARE_WORKER_BUNDLER.id ||
+        version !== CLOUDFLARE_WORKER_BUNDLER.version ||
+        bundle.entrypoint !== RELEASE_ENTRY) {
+        throw new TypeError('Cloudflare preparation requires the Bundle of its Worker bundler.');
+    }
+    let entry;
+    const modules = [];
+    const frontend = [];
+    for (const file of bundle.files) {
+        if (file.path === RELEASE_ENTRY)
+            entry = file.bytes();
+        else if (file.path.startsWith(MODULE_DIRECTORY) && /\.(?:mjs|wasm)$/u.test(file.path)) {
+            modules.push(Object.freeze({
+                path: file.path,
+                kind: file.path.endsWith('.wasm') ? 'wasm' : 'esm',
+                content: file.bytes(),
+            }));
+        }
+        else if (file.path.startsWith('assets/')) {
+            const content = file.bytes();
+            frontend.push(Object.freeze({ path: file.path.slice('assets/'.length), bytes: () => content.slice() }));
+        }
+        else {
+            throw new TypeError(`Cloudflare Worker Bundle file ${file.path} is not a Worker file.`);
+        }
+    }
+    if (entry === undefined || !modules.some((module) => module.path === RELEASE_SERVICE)) {
+        throw new TypeError('Cloudflare Worker Bundle lacks its execution modules.');
+    }
+    return Object.freeze({
+        entry,
+        modules: Object.freeze(modules),
+        frontend: Object.freeze(frontend),
+    });
+}