@astrale-os/adapter-cloudflare 0.5.0-beta.165 → 0.5.0-beta.167

package/README.md

@@ -23,7 +23,7 @@ must emit the same JavaScript bytes. `cloudflare({ wrangler: { minify: false } }
 One watcher serializes its own updates. For an existing Worker, it uploads a candidate, reconciles
 configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
 HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
-serving the Publication also initializes the Application Runtime. After promotion, normal requests
+serving the Publication also initializes the Domain Runtime. After promotion, normal requests
 must prove that exact version again. A failed candidate remains at 0% and can be replaced on retry.
 Bundled View routes must also serve the prepared browser-file generation before readiness passes.
 This covers frontend-only changes without changing the Schema or reinstalling the Domain. HTML is
@@ -44,7 +44,7 @@ protects the HTTP implementation, not an atomic rollback of external resources o
 When an Environment also declares `installation`, the SDK excludes another local checkout that
 targets the same resolved `Kernel issuer + Domain origin` (including bookmark aliases), reconciles
 exact installed Release evidence, and opens
-the default View when the Application has a frontend. These are Project-tooling behaviors rather
+the default View when the Domain has a frontend. These are Project-tooling behaviors rather
 than Cloudflare adapter responsibilities.
 
 ## Frontend files
@@ -108,6 +108,30 @@ an overlay key the bundler reads (`alias`, `build`, `define`, `jsx_factory`, `js
 `upload_source_maps`) and a compatibility flag it reads (Node.js, `navigator`, fetch iterable
 typing, Python) beyond the adapter's own `nodejs_compat`.
 
+## Build digest
+
+`cloudflare()` and `astrale()` bundle through one bundler, `cloudflare-worker` version `1`, so
+every Environment of either adapter shares one build: `astrale-domain build` prints its build
+digest, and `deploy` places that same Bundle. Two installed versions of this package are two
+copies of the bundler: when their code differs, `build` prints one build digest per copy and warns
+until the adapter versions are aligned.
+
+Services receives the placed modules as they are, so there the digest names the bytes the
+deployment runs. Direct mode runs `wrangler deploy`, which bundles the placed modules again: there
+the digest names the portable Worker the deployment was made from, not the bytes Cloudflare runs.
+A host that receives a Worker upload recomputes the digest from the exact upload with the same
+function:
+
+```ts
+import { workerBuildManifest } from '@astrale-os/adapter-cloudflare/release'
+import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest'
+
+const digest = buildDigest(workerBuildManifest({ origin, revision, bundle, entry, modules, assets }))
+```
+
+Modules keep their uploaded name and an asset `/<path>` is the file `assets/<path>`. The bundler
+version names this layout, not a package release. Both subpaths are runtime-safe.
+
 ## Material for a custom Worker entrypoint
 
 Workers with provider-specific routes or environment initialization can reuse the adapter's
@@ -117,19 +141,19 @@ material emission without adopting the entire generated entrypoint:
 import { generateBuildMaterialModule } from '@astrale-os/adapter-cloudflare/build'
 import { writeFile } from 'node:fs/promises'
 
-// build is an admitted Build returned by compile(application).
+// build is an admitted Build returned by compile(domain).
 await writeFile('src/build-material.gen.ts', generateBuildMaterialModule(build))
 ```
 
 The generated TypeScript module exports `loadBuildMaterial()`. Call it from the
-`load` callback of `generatedCloudflareWorkerEntry` alongside the application's Runtime.
+`load` callback of `generatedCloudflareWorkerEntry` alongside the Domain's Runtime.
 Such an entrypoint states its execution settings (`invocationTimeoutMs`, `maximumRequestBytes`,
 `tokenExchange`, `routeSubrequest`, `identityIssuer`) in its configuration, or reads them from its
 deployment bindings with `settings: deploymentSettings`; one Worker never takes both.
 It constructs the same verified, deduplicated material as the adapter's generated Service;
 allocation is deferred until the factory is called and the SDK deep-freezes it before use.
 The generated file needs only a type import from the SDK. Keep its compiler and runtime SDK
-versions aligned, and regenerate it when either the Application or that SDK version changes.
+versions aligned, and regenerate it when either the Domain or that SDK version changes.
 
 Such an entrypoint can keep the same fast frontend path by answering from
 `cloudflareFrontDoor()` (`@astrale-os/adapter-cloudflare/worker/front`, which reaches no SDK

package/dist/adapter.d.ts

@@ -1,5 +1,6 @@
 import type { Deployment } from '@astrale-os/sdk/deployment';
-import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { LegacyAdapter } from '@astrale-os/sdk/deployment/adapter';
+import type { legacy } from '@astrale-os/sdk/deployment/release';
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import type { CloudflareParams } from './params.js';
 import { artifact } from './build/artifact.js';
@@ -9,6 +10,6 @@ export interface CloudflareDependencies extends CloudflareDeployDependencies {
     readonly artifact: typeof artifact;
     readonly signingIdentity: typeof signingIdentity;
 }
-export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams>;
-export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams>;
-export declare function waitForReadiness(verify: typeof verifyReadiness, release: Release, signal?: AbortSignal): Promise<void>;
+export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
+export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
+export declare function waitForReadiness(verify: typeof verifyReadiness, release: legacy.Release, signal?: AbortSignal): Promise<void>;

package/dist/adapter.js

@@ -2,6 +2,7 @@ import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adap
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import { createRequire } from 'node:module';
 import { artifact, materialize } from './build/artifact.js';
+import { cloudflareWorkerBundler } from './build/bundler.js';
 import { verifyWorkerFrontend } from './build/frontend/readiness.js';
 import { deployCloudflare } from './deploy/index.js';
 import { versionReadinessFetch } from './deploy/readiness.js';
@@ -31,6 +32,7 @@ export function cloudflareWithDependencies(parameters, dependencies) {
     const adapter = defineAdapter({
         name: 'cloudflare',
         version: packageVersion,
+        bundler: cloudflareWorkerBundler,
         prepare: dependencies.artifact,
         deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
         secretsFile: (parameters) => parameters.secrets,

package/dist/build/artifact.js

@@ -1,16 +1,14 @@
 import { addressing } from '@astrale-os/sdk/deployment/release';
-import { mkdir, mkdtemp, rm } from 'node:fs/promises';
-import { join } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
 import { workerDeployment } from '../release/index.js';
+import { bundledWorker, bundleWorker } from './bundler.js';
 import { generateWranglerConfig } from './codegen/wrangler.js';
 import { deploymentAddressing, deploymentVars, resolveRouter, workerName } from './configuration.js';
-import { frontendFiles } from './frontend/files.js';
-import { frontendRevision } from './frontend/revision.js';
 import { encodeWorkerArtifactManifest, inferMediaType, workerContentDigest, WORKER_MANIFEST_PATH, } from './worker/artifact.manifest.js';
-import { prepareExecution, RELEASE_ENTRY } from './worker/execution.prepare.js';
+import { RELEASE_ENTRY } from './worker/execution.prepare.js';
 import { workerModules } from './worker/modules.js';
 import { admitWorkerRuntimeConfiguration } from './worker/runtime.js';
+import { recordPlacedBundle } from './worker/upload.js';
 export { materialize } from './materialize.js';
 const encoder = new TextEncoder();
 /** Prepare one portable Worker whose public provider address remains stable across builds. */
@@ -22,151 +20,136 @@ export async function prepareWorkerArtifact(params, context) {
     return prepare(params, context, false);
 }
 async function prepare(params, context, direct) {
-    const stateDirectory = join(context.projectDir, '.astrale');
-    await mkdir(stateDirectory, { recursive: true });
-    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
-    try {
-        const router = resolveRouter(params.router);
-        const name = workerName(params, context.build.schema.compiled.root.origin, context.environment);
-        const revision = context.build.schema.compiled.root.revision;
-        const configuredIssuer = deploymentAddressing(params);
-        // The Environment enters only as the deployment's bindings, never the bundled bytes.
-        const vars = deploymentVars(params, {
-            ...(configuredIssuer === undefined ? {} : { configuredIssuer }),
-            ...(direct && configuredIssuer === undefined ? { providerAssignedWorker: name } : {}),
-        });
-        // `frontend` stays the served file list every branch below already reads; `addressed` rides
-        // alongside it into the Worker, where it decides which of those files a browser may retain.
-        const { files: frontend, addressed } = await frontendFiles({
-            frontend: context.build.frontend,
-            projectDir: context.projectDir,
-            output: join(directory, 'frontend'),
-            recordSource: context.recordSource,
-            signal: context.signal,
-        });
-        const modules = await prepareExecution({
-            context,
-            directory,
-            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
-            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
-        });
-        const release = {
-            entrypoint: RELEASE_ENTRY,
-            modules: [
-                { path: RELEASE_ENTRY, kind: 'esm', content: modules.entry },
-                ...modules.modules,
-            ],
-        };
-        const releaseConfig = generateWranglerConfig({
-            workerName: name,
-            main: `./${RELEASE_ENTRY}`,
-            ...(params.route === undefined ? {} : { route: params.route }),
-            vars,
-            secretBindings: [SIGNING_IDENTITY_BINDING],
-            modules: workerModules(release),
-            ...(context.build.frontend?.source.kind === 'vite'
-                ? {
-                    frontend: {
-                        directory: './frontend',
-                    },
-                }
-                : {}),
-            ...(router === undefined
-                ? {}
-                : { router: { binding: router.binding, service: router.service } }),
-            ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
-            selfBinding: false,
-        });
-        const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
-        const deployment = workerDeployment({
-            release,
-            runtime,
-            bindings: {
-                vars: runtime.vars,
-                services: runtime.services,
-                requiredSecrets: [SIGNING_IDENTITY_BINDING],
-            },
-            ...(frontend.length === 0
-                ? {}
-                : {
-                    assets: {
-                        files: frontend.map((file) => {
-                            const contentType = file.mediaType ?? inferMediaType(file.path);
-                            return {
-                                path: `/${file.path}`,
-                                content: file.bytes(),
-                                ...(contentType === undefined ? {} : { contentType }),
-                            };
-                        }),
-                        notFound: 'none',
-                        runWorkerFirst: true,
-                        htmlHandling: 'none',
-                    },
-                }),
-        });
-        const manifest = encodeWorkerArtifactManifest({
-            origin: context.build.schema.compiled.root.origin,
-            revision,
-            deployment,
-            release: {
-                entrypoint: release.entrypoint,
-                modules: release.modules.map(({ path, kind, content }) => ({
-                    path,
-                    kind,
-                    digest: workerContentDigest(content),
-                })),
-            },
-            runtime: {
-                compatibilityDate: runtime.compatibilityDate,
-                compatibilityFlags: runtime.compatibilityFlags,
-            },
-            bindings: {
-                vars: runtime.vars,
-                services: runtime.services,
-                requiredSecrets: [SIGNING_IDENTITY_BINDING],
-            },
-            ...(frontend.length === 0
-                ? {}
-                : {
-                    assets: {
-                        files: frontend.map((file) => {
-                            const contentType = file.mediaType ?? inferMediaType(file.path);
-                            return {
-                                path: `/${file.path}`,
-                                artifactPath: `frontend/${file.path}`,
-                                digest: workerContentDigest(file.bytes()),
-                                ...(contentType === undefined ? {} : { contentType }),
-                            };
-                        }),
-                        notFound: 'none',
-                        runWorkerFirst: true,
-                        htmlHandling: 'none',
-                    },
-                }),
-        });
-        const files = [
-            ...release.modules.map(({ path, content }) => ({ path, content })),
-            { path: WORKER_MANIFEST_PATH, content: manifest },
-            ...frontend.map((file) => ({
-                path: `frontend/${file.path}`,
-                content: file.bytes(),
+    const router = resolveRouter(params.router);
+    const name = workerName(params, context.build.schema.compiled.root.origin, context.environment);
+    const revision = context.build.schema.compiled.root.revision;
+    const configuredIssuer = deploymentAddressing(params);
+    // The Environment enters only as the deployment's bindings, never the bundled bytes.
+    const vars = deploymentVars(params, {
+        ...(configuredIssuer === undefined ? {} : { configuredIssuer }),
+        ...(direct && configuredIssuer === undefined ? { providerAssignedWorker: name } : {}),
+    });
+    // Preparation places the environment-free Worker bytes: the Bundle `deploy` already produced
+    // with this adapter's bundler, or the same bundling run here.
+    const worker = context.bundle === undefined
+        ? await bundleWorker(context)
+        : bundledWorker(context.bundle, context.build);
+    if (context.bundle !== undefined)
+        recordPlacedBundle(context.build);
+    const { frontend } = worker;
+    const release = {
+        entrypoint: RELEASE_ENTRY,
+        modules: [
+            { path: RELEASE_ENTRY, kind: 'esm', content: worker.entry },
+            ...worker.modules,
+        ],
+    };
+    const releaseConfig = generateWranglerConfig({
+        workerName: name,
+        main: `./${RELEASE_ENTRY}`,
+        ...(params.route === undefined ? {} : { route: params.route }),
+        vars,
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        modules: workerModules(release),
+        ...(context.build.frontend?.source.kind === 'vite'
+            ? {
+                frontend: {
+                    directory: './frontend',
+                },
+            }
+            : {}),
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+        selfBinding: false,
+    });
+    const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
+    const deployment = workerDeployment({
+        release,
+        runtime,
+        bindings: {
+            vars: runtime.vars,
+            services: runtime.services,
+            requiredSecrets: [SIGNING_IDENTITY_BINDING],
+        },
+        ...(frontend.length === 0
+            ? {}
+            : {
+                assets: {
+                    files: frontend.map((file) => {
+                        const contentType = file.mediaType ?? inferMediaType(file.path);
+                        return {
+                            path: `/${file.path}`,
+                            content: file.bytes(),
+                            ...(contentType === undefined ? {} : { contentType }),
+                        };
+                    }),
+                    notFound: 'none',
+                    runWorkerFirst: true,
+                    htmlHandling: 'none',
+                },
+            }),
+    });
+    const manifest = encodeWorkerArtifactManifest({
+        origin: context.build.schema.compiled.root.origin,
+        revision,
+        deployment,
+        release: {
+            entrypoint: release.entrypoint,
+            modules: release.modules.map(({ path, kind, content }) => ({
+                path,
+                kind,
+                digest: workerContentDigest(content),
             })),
-            ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
-        ];
-        return Object.freeze({
-            entrypoint: RELEASE_ENTRY,
-            files: Object.freeze(files),
-            addressing: configuredIssuer === undefined
-                ? Object.freeze({ kind: 'provider-assigned', claim: name })
-                : Object.freeze({
-                    kind: 'configured',
-                    addressing: addressing(params.identityIssuer ?? configuredIssuer, {
-                        publicUrl: configuredIssuer,
+        },
+        runtime: {
+            compatibilityDate: runtime.compatibilityDate,
+            compatibilityFlags: runtime.compatibilityFlags,
+        },
+        bindings: {
+            vars: runtime.vars,
+            services: runtime.services,
+            requiredSecrets: [SIGNING_IDENTITY_BINDING],
+        },
+        ...(frontend.length === 0
+            ? {}
+            : {
+                assets: {
+                    files: frontend.map((file) => {
+                        const contentType = file.mediaType ?? inferMediaType(file.path);
+                        return {
+                            path: `/${file.path}`,
+                            artifactPath: `frontend/${file.path}`,
+                            digest: workerContentDigest(file.bytes()),
+                            ...(contentType === undefined ? {} : { contentType }),
+                        };
                     }),
+                    notFound: 'none',
+                    runWorkerFirst: true,
+                    htmlHandling: 'none',
+                },
+            }),
+    });
+    const files = [
+        ...release.modules.map(({ path, content }) => ({ path, content })),
+        { path: WORKER_MANIFEST_PATH, content: manifest },
+        ...frontend.map((file) => ({
+            path: `frontend/${file.path}`,
+            content: file.bytes(),
+        })),
+        ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
+    ];
+    return Object.freeze({
+        entrypoint: RELEASE_ENTRY,
+        files: Object.freeze(files),
+        addressing: configuredIssuer === undefined
+            ? Object.freeze({ kind: 'provider-assigned', claim: name })
+            : Object.freeze({
+                kind: 'configured',
+                addressing: addressing(params.identityIssuer ?? configuredIssuer, {
+                    publicUrl: configuredIssuer,
                 }),
-        });
-    }
-    finally {
-        await rm(directory, { recursive: true, force: true });
-    }
+            }),
+    });
 }

package/dist/build/bundler.d.ts

@@ -0,0 +1,21 @@
+import type { Bundle, BundleContext, Bundler } from '@astrale-os/sdk/deployment/adapter';
+import type { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+import type { ReleaseModule } from './worker/execution.prepare.js';
+/**
+ * Environment-free bytes of one generated Worker: its entry, the modules it loads (the execution
+ * Service, the deferred workflow engine and their WASM) and its frontend.
+ */
+export interface WorkerBytes {
+    readonly entry: Uint8Array;
+    readonly modules: readonly ReleaseModule[];
+    readonly frontend: readonly frontendBuild.FrontendFile[];
+}
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export declare const cloudflareWorkerBundler: Bundler;
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export declare function bundleWorker(context: BundleContext): Promise<WorkerBytes>;
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export declare function bundledWorker(bundle: Bundle, build: Bundle['build']): WorkerBytes;

package/dist/build/bundler.js

@@ -0,0 +1,96 @@
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CLOUDFLARE_WORKER_BUNDLER, workerAssetFile } from '../release/build.js';
+import { frontendFiles } from './frontend/files.js';
+import { frontendRevision } from './frontend/revision.js';
+import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE } from './worker/execution.prepare.js';
+/** Worker modules live beside the entry; WASM is the only non-ESM kind preparation emits. */
+const MODULE_DIRECTORY = 'bundle/';
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export const cloudflareWorkerBundler = Object.freeze({
+    id: CLOUDFLARE_WORKER_BUNDLER.id,
+    version: CLOUDFLARE_WORKER_BUNDLER.version,
+    async bundle(context) {
+        const worker = await bundleWorker(context);
+        return Object.freeze({
+            entrypoint: RELEASE_ENTRY,
+            files: Object.freeze([
+                { path: RELEASE_ENTRY, content: worker.entry },
+                ...worker.modules.map(({ path, content }) => ({ path, content })),
+                ...worker.frontend.map((file) => ({
+                    path: workerAssetFile(`/${file.path}`),
+                    content: file.bytes(),
+                })),
+            ]),
+        });
+    },
+});
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export async function bundleWorker(context) {
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
+    try {
+        // `frontend` is the served file list; `addressed` rides alongside it into the Worker, where it
+        // decides which of those files a browser may retain.
+        const { files: frontend, addressed } = await frontendFiles({
+            frontend: context.build.frontend,
+            projectDir: context.projectDir,
+            output: join(directory, 'frontend'),
+            recordSource: context.recordSource,
+            signal: context.signal,
+        });
+        const modules = await prepareExecution({
+            context,
+            directory,
+            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
+            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
+        });
+        return Object.freeze({ entry: modules.entry, modules: modules.modules, frontend });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export function bundledWorker(bundle, build) {
+    const { id, version } = bundle.manifest.bundler;
+    if (bundle.build !== build ||
+        id !== CLOUDFLARE_WORKER_BUNDLER.id ||
+        version !== CLOUDFLARE_WORKER_BUNDLER.version ||
+        bundle.entrypoint !== RELEASE_ENTRY) {
+        throw new TypeError('Cloudflare preparation requires the Bundle of its Worker bundler.');
+    }
+    let entry;
+    const modules = [];
+    const frontend = [];
+    for (const file of bundle.files) {
+        if (file.path === RELEASE_ENTRY)
+            entry = file.bytes();
+        else if (file.path.startsWith(MODULE_DIRECTORY) && /\.(?:mjs|wasm)$/u.test(file.path)) {
+            modules.push(Object.freeze({
+                path: file.path,
+                kind: file.path.endsWith('.wasm') ? 'wasm' : 'esm',
+                content: file.bytes(),
+            }));
+        }
+        else if (file.path.startsWith('assets/')) {
+            const content = file.bytes();
+            frontend.push(Object.freeze({ path: file.path.slice('assets/'.length), bytes: () => content.slice() }));
+        }
+        else {
+            throw new TypeError(`Cloudflare Worker Bundle file ${file.path} is not a Worker file.`);
+        }
+    }
+    if (entry === undefined || !modules.some((module) => module.path === RELEASE_SERVICE)) {
+        throw new TypeError('Cloudflare Worker Bundle lacks its execution modules.');
+    }
+    return Object.freeze({
+        entry,
+        modules: Object.freeze(modules),
+        frontend: Object.freeze(frontend),
+    });
+}

package/dist/build/frontend/readiness.d.ts

@@ -1,9 +1,9 @@
-import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { legacy } from '@astrale-os/sdk/deployment/release';
 import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import type { WorkerArtifact } from '../worker/artifact.js';
 type ReadinessFetch = NonNullable<NonNullable<Parameters<typeof verifyReadiness>[1]>['fetch']>;
 /** Publication equality alone cannot prove a frontend-only deployment has propagated. */
-export declare function verifyWorkerFrontend(release: Release, worker: Pick<WorkerArtifact, 'assets'>, options?: {
+export declare function verifyWorkerFrontend(release: legacy.Release, worker: Pick<WorkerArtifact, 'assets'>, options?: {
     readonly fetch?: ReadinessFetch;
     readonly signal?: AbortSignal;
 }): Promise<void>;

package/dist/build/index.d.ts

@@ -1,7 +1,9 @@
 export { generateBuildMaterialModule } from './material.js';
 export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
+export { cloudflareWorkerBundler } from './bundler.js';
 export { loadWorkerArtifact } from './worker/index.js';
 export type { WorkerArtifact } from './worker/index.js';
+export { uploadBuildDigest, uploadBuildEvidence, workerUpload } from './worker/upload.js';
 export { isAdapterVar, resolveRouter, workerName } from './configuration.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';

package/dist/build/index.js

@@ -1,6 +1,8 @@
 export { generateBuildMaterialModule } from './material.js';
 export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
+export { cloudflareWorkerBundler } from './bundler.js';
 export { loadWorkerArtifact } from './worker/index.js';
+export { uploadBuildDigest, uploadBuildEvidence, workerUpload } from './worker/upload.js';
 export { isAdapterVar, resolveRouter, workerName } from './configuration.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';

package/dist/build/worker/execution.prepare.d.ts

@@ -1,4 +1,4 @@
-import type { PrepareContext } from '@astrale-os/sdk/deployment/adapter';
+import type { BundleContext } from '@astrale-os/sdk/deployment/adapter';
 export declare const RELEASE_ENTRY = "bundle/index.mjs";
 export declare const RELEASE_SERVICE = "bundle/service.mjs";
 export declare const RELEASE_RESTATE = "bundle/restate.mjs";
@@ -9,7 +9,7 @@ export interface ReleaseModule {
     readonly content: Uint8Array;
 }
 export declare function prepareExecution(input: {
-    readonly context: PrepareContext;
+    readonly context: BundleContext;
     readonly directory: string;
     readonly frontendRevision?: string;
     readonly frontendAddressed?: readonly string[];
@@ -17,4 +17,4 @@ export declare function prepareExecution(input: {
     readonly entry: Uint8Array;
     readonly modules: readonly ReleaseModule[];
 }>;
-export declare function declaresDurable(build: PrepareContext['build']): boolean;
+export declare function declaresDurable(build: BundleContext['build']): boolean;

package/dist/build/worker/upload.d.ts

@@ -0,0 +1,18 @@
+import type { PreparedArtifact } from '@astrale-os/sdk/deployment/adapter';
+import type { Build } from '@astrale-os/sdk/deployment/build';
+import type { BuildDigest } from '@astrale-os/sdk/deployment/build/manifest';
+import type { WorkerArtifact } from './artifact.js';
+import { type WorkerUpload } from '../../release/build.js';
+/** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
+export declare function workerUpload(artifact: PreparedArtifact, worker: WorkerArtifact): WorkerUpload;
+/** Build digest of the portable upload of one prepared Worker. */
+export declare function uploadBuildDigest(artifact: PreparedArtifact, worker: WorkerArtifact): BuildDigest;
+/** Record that preparation placed the CLI's Bundle for this Build. */
+export declare function recordPlacedBundle(build: Build): void;
+/**
+ * The `build` field of one prepared Worker's provider evidence: the build digest of its portable
+ * upload, present only when its preparation placed the CLI's Bundle.
+ */
+export declare function uploadBuildEvidence(artifact: PreparedArtifact, worker: WorkerArtifact): {
+    readonly build?: BuildDigest;
+};

package/dist/build/worker/upload.js

@@ -0,0 +1,40 @@
+import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest';
+import { workerBuildManifest } from '../../release/build.js';
+/** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
+export function workerUpload(artifact, worker) {
+    const root = artifact.build.schema.compiled.root;
+    if (worker.origin !== root.origin || worker.revision !== root.revision) {
+        throw new TypeError('Worker artifact differs from its prepared Build.');
+    }
+    return Object.freeze({
+        origin: root.origin,
+        revision: root.revision,
+        bundle: artifact.build.schema.bundle.ref.digest,
+        entry: worker.release.entrypoint,
+        modules: worker.release.modules.map((module) => ({ name: module.path, bytes: module.bytes() })),
+        ...(worker.assets === undefined
+            ? {}
+            : { assets: worker.assets.files.map((file) => ({ path: file.path, bytes: file.bytes() })) }),
+    });
+}
+/** Build digest of the portable upload of one prepared Worker. */
+export function uploadBuildDigest(artifact, worker) {
+    return buildDigest(workerBuildManifest(workerUpload(artifact, worker)));
+}
+/**
+ * Builds whose preparation placed the Bundle `astrale-domain deploy` passed (`PrepareContext.bundle`).
+ * Only a CLI that passes a Bundle reads `ProviderDeploymentEvidence.build`: an older one refuses an
+ * evidence field it does not know, after the provider has applied the upload.
+ */
+const placedBuilds = new WeakSet();
+/** Record that preparation placed the CLI's Bundle for this Build. */
+export function recordPlacedBundle(build) {
+    placedBuilds.add(build);
+}
+/**
+ * The `build` field of one prepared Worker's provider evidence: the build digest of its portable
+ * upload, present only when its preparation placed the CLI's Bundle.
+ */
+export function uploadBuildEvidence(artifact, worker) {
+    return placedBuilds.has(artifact.build) ? { build: uploadBuildDigest(artifact, worker) } : {};
+}

package/dist/deploy/deploy.d.ts

@@ -1,5 +1,5 @@
 import type { DeployContext, DeployResult } from '@astrale-os/sdk/deployment/adapter';
-import type { Release } from '@astrale-os/sdk/deployment/release';
+import { legacy } from '@astrale-os/sdk/deployment/release';
 import type { materialize } from '../build/artifact.js';
 import type { WorkerArtifact } from '../build/worker/artifact.js';
 import type { signingIdentity } from '../identity/source.js';
@@ -10,7 +10,7 @@ export interface CloudflareDeployDependencies {
     readonly materialize: typeof materialize;
     readonly runWranglerRollout: typeof runWranglerRollout;
     readonly runWranglerDeploymentStatus: typeof runWranglerDeploymentStatus;
-    readonly waitForReadiness: (release: Release, signal: AbortSignal, version: string, worker: WorkerArtifact, workerName?: string) => Promise<void>;
+    readonly waitForReadiness: (release: legacy.Release, signal: AbortSignal, version: string, worker: WorkerArtifact, workerName?: string) => Promise<void>;
     readonly signingIdentity: typeof signingIdentity;
 }
 /** Deploy one stable Worker target and verify its exact serving implementation. */

package/dist/deploy/deploy.js

@@ -1,9 +1,10 @@
-import { addressing, assemble } from '@astrale-os/sdk/deployment/release';
+import { addressing, legacy } from '@astrale-os/sdk/deployment/release';
 import { mkdir, mkdtemp, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isAdapterVar, workerName } from '../build/configuration.js';
 import { admitDirectPlacement } from '../build/direct.js';
 import { loadWorkerArtifact } from '../build/worker/index.js';
+import { uploadBuildEvidence } from '../build/worker/upload.js';
 import { signingIdentitySecrets } from '../identity/secret.js';
 import { WranglerDeployError } from '../wrangler/deploy.js';
 import { WranglerRolloutError } from '../wrangler/rollout.js';
@@ -24,8 +25,10 @@ export async function deployCloudflare(parameters, context, dependencies) {
         return failed('prerequisite', progress({}), cause);
     }
     let worker;
+    let build;
     try {
         worker = loadWorkerArtifact(context.artifact);
+        build = uploadBuildEvidence(context.artifact, worker);
         const occupied = new Set([
             ...Object.keys(worker.bindings.vars),
             ...worker.bindings.services.map((binding) => binding.name),
@@ -60,7 +63,7 @@ export async function deployCloudflare(parameters, context, dependencies) {
                 workerName: name,
                 verifyCandidate: async (candidate) => {
                     const selected = observeAddressing(context.artifact, candidate.url, name);
-                    const release = assemble(context.artifact.build, selected);
+                    const release = legacy.assemble(context.artifact.build, selected);
                     await dependencies.waitForReadiness(release, context.signal, candidate.deploymentVersion, worker, name);
                 },
                 secrets,
@@ -91,6 +94,7 @@ export async function deployCloudflare(parameters, context, dependencies) {
                 provider: 'cloudflare',
                 deployment: deployed.deploymentVersion,
                 artifact: context.artifact.digest,
+                ...build,
             }),
         });
         let selected;
@@ -121,7 +125,7 @@ export async function deployCloudflare(parameters, context, dependencies) {
         }
         let release;
         try {
-            release = assemble(context.artifact.build, selected);
+            release = legacy.assemble(context.artifact.build, selected);
         }
         catch (cause) {
             return failed('release', progress({ provider: retained, configuration }), cause);
@@ -138,6 +142,7 @@ export async function deployCloudflare(parameters, context, dependencies) {
                 provider: 'cloudflare',
                 deployment: deployed.deploymentVersion,
                 artifact: context.artifact.digest,
+                ...build,
                 issuer: selected.issuer,
             }),
         });

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through
  * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'

package/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through
  * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'

package/dist/release/build.d.ts

@@ -0,0 +1,35 @@
+import type { BuildManifestV1 } from '@astrale-os/sdk/deployment/build/manifest';
+/**
+ * The bundler of every generated Cloudflare Worker, whichever adapter deploys it. Its version names
+ * the upload layout below, not a package release: a Services host recomputes the same build digest
+ * from the same bytes whatever SDK it runs.
+ */
+export declare const CLOUDFLARE_WORKER_BUNDLER: Readonly<{
+    id: "cloudflare-worker";
+    version: "1";
+}>;
+/** Portable Worker upload: what Services receives, and what a dispatch namespace upload carries. */
+export interface WorkerUpload {
+    readonly origin: string;
+    readonly revision: BuildManifestV1['schema']['revision'];
+    /** Digest of the Domain Schema bundle. */
+    readonly bundle: BuildManifestV1['schema']['bundle'];
+    readonly entry: string;
+    readonly modules: readonly {
+        readonly name: string;
+        readonly bytes: Uint8Array;
+    }[];
+    /** Static assets by their absolute Worker asset path (`/index.html`). */
+    readonly assets?: readonly {
+        readonly path: string;
+        readonly bytes: Uint8Array;
+    }[];
+}
+/**
+ * The one build manifest of a Worker upload, computed on the exact upload the deploy sends; the
+ * SDK, Services and namespace mode all identify Worker code through it. Modules keep their uploaded
+ * name; a static asset `/<path>` is the file `assets/<path>`.
+ */
+export declare function workerBuildManifest(upload: WorkerUpload): BuildManifestV1;
+/** The build-manifest file of one Worker asset path. */
+export declare function workerAssetFile(path: string): string;

package/dist/release/build.js

@@ -0,0 +1,44 @@
+import { buildManifest } from '@astrale-os/sdk/deployment/build/manifest';
+/**
+ * The bundler of every generated Cloudflare Worker, whichever adapter deploys it. Its version names
+ * the upload layout below, not a package release: a Services host recomputes the same build digest
+ * from the same bytes whatever SDK it runs.
+ */
+export const CLOUDFLARE_WORKER_BUNDLER = Object.freeze({
+    id: 'cloudflare-worker',
+    version: '1',
+});
+/**
+ * The one build manifest of a Worker upload, computed on the exact upload the deploy sends; the
+ * SDK, Services and namespace mode all identify Worker code through it. Modules keep their uploaded
+ * name; a static asset `/<path>` is the file `assets/<path>`.
+ */
+export function workerBuildManifest(upload) {
+    if (upload === null || typeof upload !== 'object' || !Array.isArray(upload.modules)) {
+        throw new TypeError('Worker upload is invalid.');
+    }
+    if (upload.assets !== undefined && !Array.isArray(upload.assets)) {
+        throw new TypeError('Worker upload assets are invalid.');
+    }
+    return buildManifest({
+        origin: upload.origin,
+        revision: upload.revision,
+        bundle: upload.bundle,
+        bundler: CLOUDFLARE_WORKER_BUNDLER,
+        entrypoint: upload.entry,
+        files: [
+            ...upload.modules.map((module) => ({ path: module.name, content: module.bytes })),
+            ...(upload.assets ?? []).map((asset) => ({
+                path: workerAssetFile(asset.path),
+                content: asset.bytes,
+            })),
+        ],
+    });
+}
+/** The build-manifest file of one Worker asset path. */
+export function workerAssetFile(path) {
+    if (typeof path !== 'string' || !path.startsWith('/')) {
+        throw new TypeError('Worker asset path must be absolute.');
+    }
+    return `assets${path}`;
+}

package/dist/release/index.d.ts

@@ -1,2 +1,3 @@
+export { CLOUDFLARE_WORKER_BUNDLER, workerBuildManifest, type WorkerUpload } from './build.js';
 export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, type WorkerDeploymentId, type WorkerDeploymentInput, } from './deployment.js';
 export { stagedWorkerName } from './staged-worker-name.js';

package/dist/release/index.js

@@ -1,2 +1,3 @@
+export { CLOUDFLARE_WORKER_BUNDLER, workerBuildManifest } from './build.js';
 export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, } from './deployment.js';
 export { stagedWorkerName } from './staged-worker-name.js';

package/dist/worker/entry.js

@@ -1,6 +1,6 @@
 import { issuer } from '@astrale-os/sdk/auth';
 import { restoreBuild, restoreGeneratedBuild } from '@astrale-os/sdk/deployment/build/material';
-import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { addressing, legacy } from '@astrale-os/sdk/deployment/release/runtime';
 import { createIdentity, serve } from '@astrale-os/sdk/execution';
 import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
 import { cloudflareFrontDoor, withProviderVersion } from './front.js';
@@ -49,7 +49,7 @@ function createCloudflareWorkerEntry(restore) {
                     if (frontDoor.current() !== environment.publicUrl) {
                         throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
                     }
-                    return assemble(build, addressing(settings.identityIssuer ?? environment.publicUrl, {
+                    return legacy.assemble(build, addressing(settings.identityIssuer ?? environment.publicUrl, {
                         publicUrl: environment.publicUrl,
                     }));
                 },

package/dist/worker/frontend.d.ts

@@ -1,4 +1,4 @@
 import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
 import type { Fetcher } from './front.js';
-/** Serve public frontend files without realizing the Application's execution Runtime. */
+/** Serve public frontend files without realizing the Domain's execution Runtime. */
 export declare function frontendAsset(frontend: BuildMaterial['frontend'], assets: Fetcher | undefined, url: URL, request: Request, revision?: string, addressed?: readonly string[]): Promise<Response | undefined>;

package/dist/worker/frontend.js

@@ -1,4 +1,4 @@
-/** Serve public frontend files without realizing the Application's execution Runtime. */
+/** Serve public frontend files without realizing the Domain's execution Runtime. */
 export async function frontendAsset(frontend, assets, url, request, revision, addressed) {
     if (frontend === undefined || frontend.source.kind === 'external')
         return undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.165",
-  "description": "Deploy an Astrale application through Cloudflare Workers",
+  "version": "0.5.0-beta.167",
+  "description": "Deploy an Astrale Domain through Cloudflare Workers",
   "keywords": [
     "adapter",
     "astrale",
@@ -61,7 +61,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.6.0-beta.10",
+    "@astrale-os/sdk": "0.6.0-beta.12",
     "@noble/hashes": "2.3.0",
     "@restatedev/restate-sdk-cloudflare-workers": "1.17.0",
     "hono": "^4.6.20",

package/template/astrale.config.ts

@@ -9,10 +9,10 @@ import { cloudflare } from '@astrale-os/adapter-cloudflare'
 import { defineProject } from '@astrale-os/sdk/project'
 import { dataset, tests } from '@astrale-os/sdk/testing'
 
-import { application } from './application.js'
+import { domain } from './domain.js'
 
 export default defineProject({
-  application,
+  domain,
 
   environments: {
     development: {