@astrale-os/adapter-cloudflare 0.5.0-beta.164 → 0.5.0-beta.166

package/dist/worker/front.d.ts

@@ -2,13 +2,36 @@ import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
 export interface Fetcher {
     fetch(request: Request): Response | Promise<Response>;
 }
+/** Bindings the adapter owns; a deployment's host binds them beside the author's own. */
 export interface CloudflareAdapterBindings {
     readonly ASTRALE_SIGNING_IDENTITY?: string;
     readonly ASTRALE_VERSION_METADATA?: {
         readonly id: string;
     };
+    /** Serving origin of this deployment. */
     readonly WORKER_URL?: string;
+    /** Build digest an immutable-deployment host recomputed from the uploaded bytes. */
+    readonly ASTRALE_BUILD_DIGEST?: string;
+    /** Execution settings of this deployment, as canonical JSON (see `deploymentSettings`). */
+    readonly ASTRALE_SETTINGS?: string;
+    /**
+     * Stable issuer of a direct deployment served behind another origin; it is also the serving
+     * origin when no `WORKER_URL` is bound.
+     *
+     * @deprecated Legacy direct mode only. Replacement: an immutable deployment's `WORKER_URL`,
+     * which is its issuer (namespace mode). Deleted with direct mode, once the Shell, Services,
+     * Issues, domains and ui configurations deploy in namespace mode and no installation pins a
+     * direct Worker.
+     */
     readonly IDENTITY_ISS?: string;
+    /**
+     * Worker name whose workers.dev address a provider-assigned direct deployment must serve.
+     *
+     * @deprecated Legacy direct mode only. Replacement: an immutable deployment's `WORKER_URL`,
+     * bound by its host. Deleted with direct mode, once the Shell, Services, Issues, domains and ui
+     * configurations deploy in namespace mode and no installation pins a direct Worker.
+     */
+    readonly ASTRALE_PROVIDER_ASSIGNED_WORKER?: string;
     readonly ASSETS?: Fetcher;
     readonly SELF?: Fetcher;
 }
@@ -20,7 +43,6 @@ export interface CloudflareFrontDoorConfig<Bindings extends CloudflareAdapterBin
     /** Served frontend paths the bundler content-addressed; absent means none may be retained. */
     readonly frontendAddressed?: readonly string[];
     readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly providerAssignedWorker?: string;
 }
 export type CloudflareFrontDoorAdmission = 
 /** The request is not for this isolate's serving origin. */

package/dist/worker/front.js

@@ -1,4 +1,5 @@
 import { frontendAsset } from './frontend.js';
+import { directServingOrigin, refusesDirectOrigin } from './legacy/direct.js';
 /** Admit requests to one serving origin and answer public frontend files, per isolate. */
 export function cloudflareFrontDoor(config) {
     let currentPublicUrl;
@@ -6,13 +7,10 @@ export function cloudflareFrontDoor(config) {
         async admit(request, bindings) {
             const url = new URL(request.url);
             const publicUrl = canonicalServingUrl(bindings.WORKER_URL ??
-                bindings.IDENTITY_ISS ??
+                directServingOrigin(bindings) ??
                 config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
                 requestOrigin(url, request));
-            if (config.providerAssignedWorker !== undefined &&
-                bindings.WORKER_URL === undefined &&
-                bindings.IDENTITY_ISS === undefined &&
-                !matchesWorkersDevClaim(publicUrl, config.providerAssignedWorker)) {
+            if (refusesDirectOrigin(bindings, publicUrl)) {
                 return refused('Request origin differs from provider-assigned Addressing.');
             }
             if (currentPublicUrl !== undefined && currentPublicUrl !== publicUrl) {
@@ -64,12 +62,3 @@ function canonicalServingUrl(input) {
     }
     return url.origin;
 }
-function matchesWorkersDevClaim(issuer, expectedWorker) {
-    const url = new URL(issuer);
-    const labels = url.hostname.split('.');
-    return (url.protocol === 'https:' &&
-        labels.length >= 4 &&
-        labels[0] === expectedWorker &&
-        labels.at(-2) === 'workers' &&
-        labels.at(-1) === 'dev');
-}

package/dist/worker/frontend.d.ts

@@ -1,4 +1,4 @@
 import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
 import type { Fetcher } from './front.js';
-/** Serve public frontend files without realizing the Application's execution Runtime. */
+/** Serve public frontend files without realizing the Domain's execution Runtime. */
 export declare function frontendAsset(frontend: BuildMaterial['frontend'], assets: Fetcher | undefined, url: URL, request: Request, revision?: string, addressed?: readonly string[]): Promise<Response | undefined>;

package/dist/worker/frontend.js

@@ -1,4 +1,4 @@
-/** Serve public frontend files without realizing the Application's execution Runtime. */
+/** Serve public frontend files without realizing the Domain's execution Runtime. */
 export async function frontendAsset(frontend, assets, url, request, revision, addressed) {
     if (frontend === undefined || frontend.source.kind === 'external')
         return undefined;
@@ -79,5 +79,5 @@ function publicAsset(response, revision, addressed) {
     return readable;
 }
 function reserved(path) {
-    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+    return ['/releases', '/install', '/health', '/meta', '/.well-known', '/invoke'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }

package/dist/worker/index.d.ts

@@ -1,2 +1,5 @@
 export * from './entry.js';
 export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export { decodeWorkerSettings, deploymentSettings, encodeWorkerSettings, SETTINGS_BINDING, type CloudflareWorkerSettings, type WorkerSettings, } from './settings.js';
+export { withDirectIssuer } from './legacy/direct.js';
+export { RESTATE_IDENTITY_KEYS_BINDING, restateServing, type DurableBindings } from './durable.js';

package/dist/worker/index.js

@@ -1,2 +1,5 @@
 export * from './entry.js';
 export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export { decodeWorkerSettings, deploymentSettings, encodeWorkerSettings, SETTINGS_BINDING, } from './settings.js';
+export { withDirectIssuer } from './legacy/direct.js';
+export { RESTATE_IDENTITY_KEYS_BINDING, restateServing } from './durable.js';

package/dist/worker/legacy/direct.d.ts

@@ -0,0 +1,37 @@
+import type { CloudflareAdapterBindings } from '../front.js';
+import type { CloudflareWorkerSettings } from '../settings.js';
+/**
+ * Legacy direct mode: one stable Worker on a custom route or its provider-assigned workers.dev
+ * address. Its deployment binds `IDENTITY_ISS` (a stable issuer served behind another origin) or
+ * `ASTRALE_PROVIDER_ASSIGNED_WORKER` (the workers.dev name its origin must claim).
+ *
+ * Replacement: an immutable deployment, whose host binds `WORKER_URL` to the deployment URL, which
+ * is also its issuer (Cloudflare namespace mode).
+ *
+ * Deletion: with direct mode, once the Shell, Services, Issues, domains and ui configurations
+ * deploy in namespace mode and no installation pins a direct Worker.
+ *
+ * Like the startup front door, this module reaches no runtime SDK module.
+ */
+/**
+ * Sign as the stable issuer a direct deployment bound, on top of its bound execution settings.
+ *
+ * @deprecated Legacy direct mode only. Replacement: the immutable deployment's `WORKER_URL`, which
+ * is its issuer. Deleted with direct mode (see the module header).
+ */
+export declare function withDirectIssuer<Bindings extends CloudflareAdapterBindings>(settings: (bindings: Bindings) => CloudflareWorkerSettings<Bindings>): (bindings: Bindings) => CloudflareWorkerSettings<Bindings>;
+/**
+ * The stable issuer, when a deployment bound one without its serving origin.
+ *
+ * @deprecated Legacy direct mode only. Replacement: `WORKER_URL`. Deleted with direct mode (see
+ * the module header).
+ */
+export declare function directServingOrigin(bindings: CloudflareAdapterBindings): string | undefined;
+/**
+ * Whether a provider-assigned direct deployment refuses this serving origin: it serves only the
+ * workers.dev address of the Worker name it was bound.
+ *
+ * @deprecated Legacy direct mode only. Replacement: `WORKER_URL`, bound by the host to the
+ * deployment URL. Deleted with direct mode (see the module header).
+ */
+export declare function refusesDirectOrigin(bindings: CloudflareAdapterBindings, publicUrl: string): boolean;

package/dist/worker/legacy/direct.js

@@ -0,0 +1,58 @@
+/**
+ * Legacy direct mode: one stable Worker on a custom route or its provider-assigned workers.dev
+ * address. Its deployment binds `IDENTITY_ISS` (a stable issuer served behind another origin) or
+ * `ASTRALE_PROVIDER_ASSIGNED_WORKER` (the workers.dev name its origin must claim).
+ *
+ * Replacement: an immutable deployment, whose host binds `WORKER_URL` to the deployment URL, which
+ * is also its issuer (Cloudflare namespace mode).
+ *
+ * Deletion: with direct mode, once the Shell, Services, Issues, domains and ui configurations
+ * deploy in namespace mode and no installation pins a direct Worker.
+ *
+ * Like the startup front door, this module reaches no runtime SDK module.
+ */
+/**
+ * Sign as the stable issuer a direct deployment bound, on top of its bound execution settings.
+ *
+ * @deprecated Legacy direct mode only. Replacement: the immutable deployment's `WORKER_URL`, which
+ * is its issuer. Deleted with direct mode (see the module header).
+ */
+export function withDirectIssuer(settings) {
+    return (bindings) => {
+        const bound = settings(bindings);
+        return bindings.IDENTITY_ISS === undefined
+            ? bound
+            : Object.freeze({ ...bound, identityIssuer: bindings.IDENTITY_ISS });
+    };
+}
+/**
+ * The stable issuer, when a deployment bound one without its serving origin.
+ *
+ * @deprecated Legacy direct mode only. Replacement: `WORKER_URL`. Deleted with direct mode (see
+ * the module header).
+ */
+export function directServingOrigin(bindings) {
+    return bindings.IDENTITY_ISS;
+}
+/**
+ * Whether a provider-assigned direct deployment refuses this serving origin: it serves only the
+ * workers.dev address of the Worker name it was bound.
+ *
+ * @deprecated Legacy direct mode only. Replacement: `WORKER_URL`, bound by the host to the
+ * deployment URL. Deleted with direct mode (see the module header).
+ */
+export function refusesDirectOrigin(bindings, publicUrl) {
+    return (bindings.ASTRALE_PROVIDER_ASSIGNED_WORKER !== undefined &&
+        bindings.WORKER_URL === undefined &&
+        bindings.IDENTITY_ISS === undefined &&
+        !matchesWorkersDevClaim(publicUrl, bindings.ASTRALE_PROVIDER_ASSIGNED_WORKER));
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/restate.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The workflow engine's Workers build. Generated code imports it only for a Domain that declares
+ * durable callables and retains it as a separate module, imported on the first engine request.
+ * Ordinary requests never evaluate this module or instantiate its WebAssembly core.
+ */
+export * from '@restatedev/restate-sdk-cloudflare-workers/fetch';

package/dist/worker/restate.js

@@ -0,0 +1,6 @@
+/**
+ * The workflow engine's Workers build. Generated code imports it only for a Domain that declares
+ * durable callables and retains it as a separate module, imported on the first engine request.
+ * Ordinary requests never evaluate this module or instantiate its WebAssembly core.
+ */
+export * from '@restatedev/restate-sdk-cloudflare-workers/fetch';

package/dist/worker/settings.d.ts

@@ -0,0 +1,48 @@
+import type { ExchangeOptions } from '@astrale-os/sdk/execution';
+import type { DurableWorkerOptions } from '../params.js';
+import type { CloudflareAdapterBindings, Fetcher } from './front.js';
+/** Plain binding that carries one deployment's execution settings as canonical JSON. */
+export declare const SETTINGS_BINDING = "ASTRALE_SETTINGS";
+export declare const DEFAULT_MAXIMUM_REQUEST_BYTES: number;
+export declare const MAXIMUM_REQUEST_BYTES: number;
+export declare const DEFAULT_INVOCATION_TIMEOUT_MS = 30000;
+export declare const MAXIMUM_INVOCATION_TIMEOUT_MS = 2147483647;
+/** The execution settings one deployment binds as `ASTRALE_SETTINGS`, defaults resolved. */
+export interface WorkerSettings {
+    /** Durable policy bound by this deployment; semantic bounds are admitted lazily by SDK serving. */
+    readonly durableOptions?: DurableWorkerOptions;
+    readonly maximumRequestBytes: number;
+    readonly invocationTimeoutMs: number;
+    readonly tokenExchange: false | {
+        readonly maximumLifetimeSeconds: number;
+    };
+    readonly router: false | {
+        /**
+         * Service binding that reaches the instance router. Hosts that deploy immutable Workers
+         * bind `ROUTER`; legacy direct mode binds its configured `router.binding`.
+         */
+        readonly binding: string;
+        readonly hostSuffix: string;
+        readonly minLabels: number;
+    };
+}
+/** What one isolate executes under, given by a hand-composed Worker or read from its bindings. */
+export interface CloudflareWorkerSettings<Bindings> {
+    readonly durableOptions?: DurableWorkerOptions;
+    readonly identityIssuer?: string;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+    readonly maximumRequestBytes?: number;
+    readonly tokenExchange?: ExchangeOptions | false;
+}
+/**
+ * Read the execution settings a deployment bound as `ASTRALE_SETTINGS`. The serving origin, and
+ * so the issuer, is the deployment's `WORKER_URL`, which the front door reads.
+ */
+export declare function deploymentSettings<Bindings extends CloudflareAdapterBindings>(bindings: Bindings): CloudflareWorkerSettings<Bindings>;
+/** Encode settings as the canonical JSON (RFC 8785) text bound as `ASTRALE_SETTINGS`. */
+export declare function encodeWorkerSettings(settings: WorkerSettings): string;
+/** Admit the `ASTRALE_SETTINGS` text one deployment bound; absent or malformed fails closed. */
+export declare function decodeWorkerSettings(input: unknown): WorkerSettings;
+/** Capture the plain binding shape; SDK serving owns retention/retry/deadline semantics. */
+export declare function captureDurableOptions(input: unknown): DurableWorkerOptions;

package/dist/worker/settings.js

@@ -0,0 +1,161 @@
+// A generated Worker carries no environment value in its bytes: the host that deploys it binds
+// the execution settings of that deployment, so one build serves every environment unchanged.
+/** Plain binding that carries one deployment's execution settings as canonical JSON. */
+export const SETTINGS_BINDING = 'ASTRALE_SETTINGS';
+export const DEFAULT_MAXIMUM_REQUEST_BYTES = 1024 * 1024;
+export const MAXIMUM_REQUEST_BYTES = 16 * 1024 * 1024;
+export const DEFAULT_INVOCATION_TIMEOUT_MS = 30_000;
+export const MAXIMUM_INVOCATION_TIMEOUT_MS = 2_147_483_647;
+const BINDING_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,127}$/u;
+/**
+ * Read the execution settings a deployment bound as `ASTRALE_SETTINGS`. The serving origin, and
+ * so the issuer, is the deployment's `WORKER_URL`, which the front door reads.
+ */
+export function deploymentSettings(bindings) {
+    const settings = decodeWorkerSettings(bindings.ASTRALE_SETTINGS);
+    return Object.freeze({
+        ...(settings.durableOptions === undefined ? {} : { durableOptions: settings.durableOptions }),
+        maximumRequestBytes: settings.maximumRequestBytes,
+        invocationTimeoutMs: settings.invocationTimeoutMs,
+        tokenExchange: settings.tokenExchange === false
+            ? false
+            : Object.freeze({ maximumTtlSeconds: settings.tokenExchange.maximumLifetimeSeconds }),
+        ...(settings.router === false
+            ? {}
+            : { routeSubrequest: instanceRoute(settings.router) }),
+    });
+}
+/** Encode settings as the canonical JSON (RFC 8785) text bound as `ASTRALE_SETTINGS`. */
+export function encodeWorkerSettings(settings) {
+    const admitted = acceptWorkerSettings(settings);
+    return JSON.stringify({
+        ...(admitted.durableOptions === undefined ? {} : { durableOptions: admitted.durableOptions }),
+        invocationTimeoutMs: admitted.invocationTimeoutMs,
+        maximumRequestBytes: admitted.maximumRequestBytes,
+        router: admitted.router === false
+            ? false
+            : {
+                binding: admitted.router.binding,
+                hostSuffix: admitted.router.hostSuffix,
+                minLabels: admitted.router.minLabels,
+            },
+        tokenExchange: admitted.tokenExchange === false
+            ? false
+            : { maximumLifetimeSeconds: admitted.tokenExchange.maximumLifetimeSeconds },
+    });
+}
+/** Admit the `ASTRALE_SETTINGS` text one deployment bound; absent or malformed fails closed. */
+export function decodeWorkerSettings(input) {
+    if (input === undefined) {
+        throw new TypeError(`Cloudflare Worker requires the ${SETTINGS_BINDING} binding.`);
+    }
+    if (typeof input !== 'string')
+        invalid();
+    let value;
+    try {
+        value = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError(`Cloudflare Worker ${SETTINGS_BINDING} binding is invalid JSON.`, {
+            cause,
+        });
+    }
+    return acceptWorkerSettings(value);
+}
+function acceptWorkerSettings(input) {
+    const value = exact(input, ['invocationTimeoutMs', 'maximumRequestBytes', 'router', 'tokenExchange'], ['durableOptions']);
+    const durableOptions = value.durableOptions;
+    const maximumRequestBytes = integer(value.maximumRequestBytes, 1, MAXIMUM_REQUEST_BYTES);
+    const invocationTimeoutMs = integer(value.invocationTimeoutMs, 1, MAXIMUM_INVOCATION_TIMEOUT_MS);
+    return Object.freeze({
+        ...(durableOptions === undefined
+            ? {}
+            : { durableOptions: captureDurableOptions(durableOptions) }),
+        maximumRequestBytes,
+        invocationTimeoutMs,
+        tokenExchange: value.tokenExchange === false ? false : tokenExchange(value.tokenExchange),
+        router: value.router === false ? false : router(value.router),
+    });
+}
+function tokenExchange(input) {
+    const value = exact(input, ['maximumLifetimeSeconds']);
+    return Object.freeze({
+        maximumLifetimeSeconds: integer(value.maximumLifetimeSeconds, 1, Number.MAX_SAFE_INTEGER),
+    });
+}
+function router(input) {
+    const value = exact(input, ['binding', 'hostSuffix', 'minLabels']);
+    if (typeof value.binding !== 'string' || !BINDING_NAME.test(value.binding))
+        invalid();
+    if (typeof value.hostSuffix !== 'string')
+        invalid();
+    return Object.freeze({
+        binding: value.binding,
+        hostSuffix: value.hostSuffix,
+        minLabels: integer(value.minLabels, 0, Number.MAX_SAFE_INTEGER),
+    });
+}
+/** Send instance hosts under the router suffix through its binding; everything else is public. */
+function instanceRoute(router) {
+    return (url, bindings) => {
+        // Services own their public ingress, including retirement and private-route isolation.
+        if (url.hostname.split('.')[1] === 'svc')
+            return null;
+        const fetcher = Reflect.get(bindings, router.binding);
+        if (fetcher &&
+            url.hostname.endsWith(router.hostSuffix) &&
+            url.hostname.split('.').length >= router.minLabels) {
+            return fetcher;
+        }
+        return null;
+    };
+}
+function exact(input, keys, optional = []) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => typeof key !== 'string' || (!keys.includes(key) && !optional.includes(key))) ||
+        keys.some((key) => !Object.hasOwn(input, key))) {
+        invalid();
+    }
+    return input;
+}
+/** Capture the plain binding shape; SDK serving owns retention/retry/deadline semantics. */
+export function captureDurableOptions(input) {
+    const value = exact(input, [], ['retentionMs', 'retry', 'stepTimeoutMs']);
+    const retentionMs = optionalNumber(value.retentionMs);
+    const retry = value.retry;
+    const stepTimeoutMs = optionalNumber(value.stepTimeoutMs);
+    return Object.freeze({
+        ...(retentionMs === undefined ? {} : { retentionMs }),
+        ...(retry === undefined ? {} : { retry: captureRetry(retry) }),
+        ...(stepTimeoutMs === undefined ? {} : { stepTimeoutMs }),
+    });
+}
+function captureRetry(input) {
+    const value = exact(input, [], ['initialIntervalMs', 'maxAttempts', 'maxIntervalMs']);
+    const initialIntervalMs = optionalNumber(value.initialIntervalMs);
+    const maxAttempts = optionalNumber(value.maxAttempts);
+    const maxIntervalMs = optionalNumber(value.maxIntervalMs);
+    return Object.freeze({
+        ...(initialIntervalMs === undefined ? {} : { initialIntervalMs }),
+        ...(maxAttempts === undefined ? {} : { maxAttempts }),
+        ...(maxIntervalMs === undefined ? {} : { maxIntervalMs }),
+    });
+}
+function optionalNumber(input) {
+    if (input === undefined)
+        return undefined;
+    if (typeof input !== 'number' || !Number.isFinite(input))
+        invalid();
+    return input;
+}
+function integer(input, minimum, maximum) {
+    if (!Number.isSafeInteger(input) || input < minimum || input > maximum) {
+        invalid();
+    }
+    return input;
+}
+function invalid() {
+    throw new TypeError(`Cloudflare Worker ${SETTINGS_BINDING} binding is invalid.`);
+}

package/dist/wrangler/bundle.js

@@ -7,7 +7,6 @@ export async function runWranglerBundle(args) {
         ...prefix,
         'deploy',
         '--dry-run',
-        '--minify',
         '--outdir',
         args.outDir,
         '--metafile',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.164",
-  "description": "Deploy an Astrale application through Cloudflare Workers",
+  "version": "0.5.0-beta.166",
+  "description": "Deploy an Astrale Domain through Cloudflare Workers",
   "keywords": [
     "adapter",
     "astrale",
@@ -51,14 +51,19 @@
       "types": "./dist/release/index.d.ts",
       "import": "./dist/release/index.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./worker/restate": {
+      "types": "./dist/worker/restate.d.ts",
+      "import": "./dist/worker/restate.js"
+    }
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.6.0-beta.9",
+    "@astrale-os/sdk": "0.6.0-beta.11",
     "@noble/hashes": "2.3.0",
+    "@restatedev/restate-sdk-cloudflare-workers": "1.17.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",
     "wrangler": "4.123.0"

package/template/astrale.config.ts

@@ -9,10 +9,10 @@ import { cloudflare } from '@astrale-os/adapter-cloudflare'
 import { defineProject } from '@astrale-os/sdk/project'
 import { dataset, tests } from '@astrale-os/sdk/testing'
 
-import { application } from './application.js'
+import { domain } from './domain.js'
 
 export default defineProject({
-  application,
+  domain,
 
   environments: {
     development: {