@astrale-os/adapter-cloudflare 0.5.0-beta.167 → 0.5.0-beta.169

package/README.md

@@ -10,16 +10,81 @@ npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 
 Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
 
-One `cloudflare()` value configures one Project Environment. `astrale-domain dev <environment>`
-builds locally and deploys each admitted Worker and frontend update remotely through the same path
-as `deploy`; it starts no local Worker, Vite server, or tunnel. Omitting `route` uses the observed
-stable `*.workers.dev` issuer. Add `installation: { instance: '...' }` to the Project Environment
-when generic tooling should reconcile the ready Release onto an Astrale Kernel.
+One `cloudflare()` value configures one Project Environment, in one of two modes. With
+`namespace`, each release becomes one immutable deployment in a platform dispatch namespace. Without
+it, the Environment is on the legacy direct mode: one stable Worker, replaced in place by each
+deploy. A deploy never installs: install the URL it prints with
+`astrale domain install <url> --direct -i <instance>`.
 
 Generated Worker modules are minified by default, including separately loaded runtime modules.
 The Environment's `wrangler` overlay cannot change minification: every Environment of one source
 must emit the same JavaScript bytes. `cloudflare({ wrangler: { minify: false } })` is rejected.
 
+## Namespace mode
+
+```ts
+production: {
+  deployment: cloudflare({
+    namespace: { name: 'astrale-platform', routingDomain: 'platform.astrale.ai' },
+    secrets: '.env.production',
+  }),
+},
+```
+
+Only the platform deploys there (Shell, Services and the other platform Domains), so every line is
+readable. `astrale-domain deploy <environment>` uploads one script named by the deployment label,
+create-only (`If-None-Match: *`), which answers at `https://<label>.<routingDomain>` through the
+platform dispatcher. Nothing is ever replaced in place: another build or configuration is another
+label.
+
+- **Credentials.** `CLOUDFLARE_API_TOKEN` must edit the namespace's scripts and the values of its
+  routing KV; the account is `namespace.account`, else `CLOUDFLARE_ACCOUNT_ID`. Neither is ever
+  written to the configuration.
+- **Routing KV.** The deploy finds the namespace's routing KV by its title,
+  `astrale-deployment-routing-<first 16 bytes of sha256(name), in hexadecimal>`, which the platform
+  provisioning creates. A namespace without it is refused before any effect.
+- **Bindings.** Each new deployment binds `WORKER_URL`, `ASTRALE_BUILD_DIGEST`, `ASTRALE_SETTINGS`
+  (the router as `ROUTER`), the author's `vars`, the service bindings of `wrangler.services`, the
+  router, its version metadata, and as `secret_text` exactly the Environment's secrets and
+  `ASTRALE_SIGNING_IDENTITY`, a key generated for that deployment and kept nowhere else. Its tags
+  name its artifact (build digest), line and key; never `astrale-service`, which is Services'.
+- **Activation.** The deploy writes `summary:<label>` (owner `platform`, state `active`, retention
+  `preview`, the activation instant), then `record:<label>`, whose presence makes the dispatcher
+  route the label. Neither ever holds a provider version or a secret digest. Readiness then waits,
+  bounded, until the URL serves the sealed release from the provider version the upload created.
+- **Reuse.** A redeploy of the same release finds the script under its label. It is reused only
+  when its artifact and line tags and its record name this build and configuration (or, when an
+  interrupted deploy left it unactivated, when it binds exactly this configuration). Then only that
+  script's declared secrets are rewritten in place, and readiness waits for the version the
+  rewrite minted. Anything else is a `deployment-conflict`, refused with nothing written; no other
+  deployment is ever touched.
+- **Retention.** `retain` (called once a Publication commits) marks the summary `published`, which
+  the platform's preview expiry never retires. A label the platform withdrew (`retirement:<label>`)
+  answers `DEPLOYMENT_RETIRED` at the dispatcher and is refused by every later deploy.
+- **Refused.** A direct-mode parameter beside `namespace` (`route`, `workerName`, `identityIssuer`,
+  `addressing`, `signingIdentity`), a `router.binding` other than `ROUTER`, and any `wrangler` key
+  but `services`, `dispatch_namespaces` and `compatibility_flags`, `triggers` first: an immutable
+  deployment runs no cron of its own. A `dispatch_namespaces` entry is exactly
+  `{ binding, namespace }`; it is frozen into the configuration (`bindings.dispatchNamespaces`), so
+  into the label, bound at the create-only upload, and never names the platform namespace the
+  deployment lives in (AM-174). Which namespaces a deployment may bind is its host's to decide.
+  `durable` is frozen into the configuration (`settings.durableOptions`, AM-175), so into the
+  label, and bound in `ASTRALE_SETTINGS`: a durable run stays on the deployment that started it.
+  `astrale-domain dev` serves only direct-mode Environments.
+
+## Legacy direct mode
+
+Deprecated: replaced by namespace mode, and deleted with the legacy deploy path (D10) once no
+configuration on any repository's main selects direct mode. Its consumers until they move: the
+domains configurations of ai-gateway, closing, grc, integrations and issues; domains organization,
+whose `prod` binds an EU-jurisdiction R2 bucket that namespace mode does not admit yet; the Services
+`beta`, `prod` and `development` environments and its frozen `admin-beta`; the Shell and its frozen
+`legacy-v3`; and ui:domain.
+
+`astrale-domain dev <environment>` builds locally and deploys each admitted Worker and frontend
+update remotely through the same path as `deploy`; it starts no local Worker, Vite server, or
+tunnel. Omitting `route` uses the observed stable `*.workers.dev` issuer.
+
 One watcher serializes its own updates. For an existing Worker, it uploads a candidate, reconciles
 configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
 HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
@@ -41,12 +106,6 @@ Routes, custom domains, schedules, and other non-versioned provider settings are
 Wrangler before candidate probing; they can remain changed after a failed attempt. Candidate readiness
 protects the HTTP implementation, not an atomic rollback of external resources or trigger settings.
 
-When an Environment also declares `installation`, the SDK excludes another local checkout that
-targets the same resolved `Kernel issuer + Domain origin` (including bookmark aliases), reconciles
-exact installed Release evidence, and opens
-the default View when the Domain has a frontend. These are Project-tooling behaviors rather
-than Cloudflare adapter responsibilities.
-
 ## Frontend files
 
 The Worker runs before Workers Static Assets on every request and owns frontend response headers
@@ -89,7 +148,7 @@ same bytes. Each deployment binds its own values as plain Worker bindings:
 | --- | --- |
 | `WORKER_URL` | serving origin of the deployment |
 | `ASTRALE_SETTINGS` | canonical JSON of `{ invocationTimeoutMs, maximumRequestBytes, router, tokenExchange }`, defaults resolved, with optional `durableOptions` |
-| `ASTRALE_BUILD_DIGEST` | build digest, bound only by hosts that deploy immutable Workers; never by a stable Worker |
+| `ASTRALE_BUILD_DIGEST` | build digest the host recomputed from the uploaded bytes, bound only by hosts that deploy immutable Workers; never by a stable Worker |
 | `IDENTITY_ISS`, `ASTRALE_PROVIDER_ASSIGNED_WORKER` | **legacy direct mode only** (deprecated): a stable issuer behind another route, and the workers.dev claim |
 
 These names are adapter-owned: preparation refuses an author var, or a `wrangler.vars` entry, that
@@ -97,6 +156,14 @@ takes one, and deployment refuses a secret that does. A host that deploys the Wo
 the settings with `encodeWorkerSettings` from `@astrale-os/adapter-cloudflare/worker`. A generated
 Worker refuses execution without `ASTRALE_SETTINGS`.
 
+`ASTRALE_BUILD_DIGEST` selects what the Worker serves. Bound, the Worker is an immutable deployment:
+it seals the `DomainRelease` v4 of its code at its `WORKER_URL`, which is its issuer, and serves it
+at `/.well-known/astrale/release.json` beside its frozen v3 projection at `domain.json`; it admits
+only routing that names that exact release or projection. Unbound, it is a stable Worker and serves
+exactly the v3 Publication of today, answering 404 at `release.json`. The Worker refuses execution,
+instead of falling back to v3, when the digest is malformed, when it is bound without `WORKER_URL`,
+or beside a direct-mode binding or a configured `identityIssuer`.
+
 The two direct-mode bindings are deprecated. Their replacement is an immutable deployment, whose
 host binds `WORKER_URL` to the deployment URL, which is also its issuer (namespace mode). They are
 deleted with direct mode, once the Shell, Services, Issues, domains and ui configurations deploy in

package/dist/adapter.d.ts

@@ -1,15 +1,23 @@
 import type { Deployment } from '@astrale-os/sdk/deployment';
-import type { LegacyAdapter } from '@astrale-os/sdk/deployment/adapter';
-import type { legacy } from '@astrale-os/sdk/deployment/release';
-import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import type { Adapter } from '@astrale-os/sdk/deployment/adapter';
+import type { CloudflareDeployDependencies } from './legacy/direct/index.js';
+import type { NamespaceDependencies } from './namespace/index.js';
 import type { CloudflareParams } from './params.js';
-import { artifact } from './build/artifact.js';
-import { type CloudflareDeployDependencies } from './deploy/index.js';
-import { signingIdentity } from './identity/source.js';
+import { artifact, signingIdentity } from './legacy/direct/index.js';
+export { waitForReadiness, type ReadinessCheck } from './legacy/direct/index.js';
+export type { NamespaceDependencies } from './namespace/index.js';
 export interface CloudflareDependencies extends CloudflareDeployDependencies {
     readonly artifact: typeof artifact;
     readonly signingIdentity: typeof signingIdentity;
+    /** The effects of namespace mode. Default: `fetch`, `process.env`, a new key, the clock. */
+    readonly namespace?: NamespaceDependencies;
 }
-export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
-export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, LegacyAdapter<CloudflareParams>>;
-export declare function waitForReadiness(verify: typeof verifyReadiness, release: legacy.Release, signal?: AbortSignal): Promise<void>;
+/**
+ * Deploy one Project Environment through Cloudflare Workers.
+ *
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace (adapter interface v2). Without it, the Environment stays on the legacy direct mode:
+ * one stable Worker replaced in place by each deploy (CT33).
+ */
+export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, Adapter<CloudflareParams>>;
+export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, Adapter<CloudflareParams>>;

package/dist/adapter.js

@@ -1,16 +1,19 @@
 import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adapter';
-import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import { createRequire } from 'node:module';
-import { artifact, materialize } from './build/artifact.js';
 import { cloudflareWorkerBundler } from './build/bundler.js';
-import { verifyWorkerFrontend } from './build/frontend/readiness.js';
-import { deployCloudflare } from './deploy/index.js';
-import { versionReadinessFetch } from './deploy/readiness.js';
-import { signingIdentity } from './identity/source.js';
-import { runWranglerRollout } from './wrangler/rollout.js';
-import { runWranglerDeploymentStatus } from './wrangler/status.js';
+import { createSigningIdentity } from './identity/material.js';
+import { artifact, deployCloudflare, directReadiness, materialize, runWranglerDeploymentStatus, runWranglerRollout, signingIdentity, } from './legacy/direct/index.js';
+import { admitNamespace, configureNamespace, deployNamespaceRelease, placeNamespace, retainNamespaceDeployment, } from './namespace/index.js';
+export { waitForReadiness } from './legacy/direct/index.js';
 const packageVersion = createRequire(import.meta.url)('../package.json')
     .version;
+/**
+ * Deploy one Project Environment through Cloudflare Workers.
+ *
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace (adapter interface v2). Without it, the Environment stays on the legacy direct mode:
+ * one stable Worker replaced in place by each deploy (CT33).
+ */
 export function cloudflare(parameters = {}) {
     return cloudflareWithDependencies(parameters, {
         artifact,
@@ -18,67 +21,37 @@ export function cloudflare(parameters = {}) {
         runWranglerRollout,
         runWranglerDeploymentStatus,
         signingIdentity,
-        waitForReadiness: (release, signal, version, worker, workerName) => waitForReadiness(async (release, options) => {
-            const checks = {
-                ...options,
-                fetch: versionReadinessFetch(release.addressing.publicUrl, version, globalThis.fetch, workerName, release.addressing.issuer),
-            };
-            await verifyReadiness(release, checks);
-            await verifyWorkerFrontend(release, worker, checks);
-        }, release, signal),
+        waitForReadiness: directReadiness,
     });
 }
 export function cloudflareWithDependencies(parameters, dependencies) {
+    const namespace = dependencies.namespace ?? platformNamespaceDependencies();
     const adapter = defineAdapter({
         name: 'cloudflare',
         version: packageVersion,
         bundler: cloudflareWorkerBundler,
+        admit: admitCloudflare,
+        configure: configureNamespace,
+        placement: async (parameters) => placeNamespace(parameters),
+        deployRelease: (parameters, context) => deployNamespaceRelease(parameters, context, namespace),
+        retain: (parameters, context) => retainNamespaceDeployment(parameters, context, namespace),
+        // Legacy direct mode (CT33 `legacy-direct`), deleted with it (D10).
         prepare: dependencies.artifact,
         deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
         secretsFile: (parameters) => parameters.secrets,
     });
     return defineDeployment(adapter, parameters);
 }
-export async function waitForReadiness(verify, release, signal) {
-    const deadline = Date.now() + 90_000;
-    let last;
-    while (Date.now() < deadline) {
-        throwIfAborted(signal);
-        try {
-            await verify(release, {
-                signal: signal === undefined
-                    ? AbortSignal.timeout(5_000)
-                    : AbortSignal.any([signal, AbortSignal.timeout(5_000)]),
-            });
-            return;
-        }
-        catch (cause) {
-            throwIfAborted(signal);
-            last = cause;
-            await pause(signal);
-        }
-    }
-    throw last instanceof Error ? last : new Error('Cloudflare Release did not become ready.');
+/** Refuse a malformed `namespace` when the Project is defined, before any build. */
+function admitCloudflare(parameters) {
+    if (parameters.namespace !== undefined)
+        admitNamespace(parameters.namespace);
 }
-function pause(signal) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(done, 1_000);
-        const abort = () => done(abortError(signal));
-        signal?.addEventListener('abort', abort, { once: true });
-        function done(cause) {
-            clearTimeout(timer);
-            signal?.removeEventListener('abort', abort);
-            if (cause === undefined)
-                resolve();
-            else
-                reject(cause);
-        }
+function platformNamespaceDependencies() {
+    return Object.freeze({
+        fetch: (input, init) => fetch(input, init),
+        environment: process.env,
+        createSigningIdentity,
+        now: () => new Date(),
     });
 }
-function throwIfAborted(signal) {
-    if (signal?.aborted)
-        throw abortError(signal);
-}
-function abortError(signal) {
-    return signal?.reason instanceof Error ? signal.reason : new Error('Deployment interrupted.');
-}

package/dist/build/codegen/wrangler.d.ts

@@ -54,4 +54,20 @@ export interface WranglerCodegenOptions {
      */
     wrangler?: Record<string, unknown>;
 }
+/**
+ * The Workers runtime every generated Worker runs on, wherever it is deployed: its compatibility
+ * date, kept on the runtime baseline qualified with Wrangler 4.123.0, and its compatibility flags.
+ * Domain execution calls its Kernel through the invocation's public issuer, so Cloudflare must route
+ * same-zone callbacks through the public front door instead of bypassing Worker routes
+ * (`global_fetch_strictly_public`). An immutable deployment freezes it into its configuration.
+ */
+export declare const GENERATED_WORKER_RUNTIME: Readonly<{
+    compatibilityDate: "2026-08-11";
+    compatibilityFlags: readonly string[];
+}>;
 export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
+/**
+ * Whether a compatibility flag shapes the bundle (Wrangler's bundler reads it), so that no
+ * Environment may add it: bundling takes no Environment.
+ */
+export declare function isBundlingCompatibilityFlag(flag: string): boolean;

package/dist/build/codegen/wrangler.js

@@ -12,16 +12,23 @@
  * (extra bindings: KV, R2, D1, queues, …) — see `mergeUserConfig`.
  */
 import { deepMergeConfig } from './merge.js';
-// Keep the generated date on the runtime baseline qualified with Wrangler 4.123.0.
-const COMPATIBILITY_DATE = '2026-08-11';
+/**
+ * The Workers runtime every generated Worker runs on, wherever it is deployed: its compatibility
+ * date, kept on the runtime baseline qualified with Wrangler 4.123.0, and its compatibility flags.
+ * Domain execution calls its Kernel through the invocation's public issuer, so Cloudflare must route
+ * same-zone callbacks through the public front door instead of bypassing Worker routes
+ * (`global_fetch_strictly_public`). An immutable deployment freezes it into its configuration.
+ */
+export const GENERATED_WORKER_RUNTIME = Object.freeze({
+    compatibilityDate: '2026-08-11',
+    compatibilityFlags: Object.freeze(['nodejs_compat', 'global_fetch_strictly_public']),
+});
 export function generateWranglerConfig(opts) {
     const config = {
         name: opts.workerName,
         main: opts.main ?? './worker.gen.ts',
-        compatibility_date: COMPATIBILITY_DATE,
-        // Domain execution calls its Kernel through the invocation's public issuer. Cloudflare must
-        // route same-zone callbacks through the public front door instead of bypassing Worker routes.
-        compatibility_flags: ['nodejs_compat', 'global_fetch_strictly_public'],
+        compatibility_date: GENERATED_WORKER_RUNTIME.compatibilityDate,
+        compatibility_flags: [...GENERATED_WORKER_RUNTIME.compatibilityFlags],
         workers_dev: opts.route === undefined,
         version_metadata: { binding: 'ASTRALE_VERSION_METADATA' },
         observability: { enabled: true },
@@ -100,6 +107,13 @@ const BUNDLING_KEYS = [
 ];
 /** Compatibility flags Wrangler's bundler reads: Node.js polyfills, `navigator`, fetch typing, Python. */
 const BUNDLING_FLAG = /nodejs|navigator|fetch_iterable_type_support|python_workers/u;
+/**
+ * Whether a compatibility flag shapes the bundle (Wrangler's bundler reads it), so that no
+ * Environment may add it: bundling takes no Environment.
+ */
+export function isBundlingCompatibilityFlag(flag) {
+    return BUNDLING_FLAG.test(flag);
+}
 /**
  * Deep-merge the dev's raw wrangler overlay over the generated config, after
  * refusing any attempt to override an adapter-owned key or a bundler input. Throwing (rather than

package/dist/build/configuration/settings.d.ts

@@ -4,12 +4,3 @@ import type { WorkerSettings } from '../../worker/settings.js';
 export declare function isAdapterVar(name: string): boolean;
 /** Resolve one Environment's execution settings, defaults included, as its deployment binds them. */
 export declare function workerSettings(parameters: CloudflareParams): WorkerSettings;
-/**
- * The plain bindings one stable Worker deployment carries: the author's vars, its execution
- * settings and serving origin, and the legacy direct-mode bindings. Never `ASTRALE_BUILD_DIGEST`:
- * only an immutable deployment may answer for a build digest.
- */
-export declare function deploymentVars(parameters: CloudflareParams, deployment: {
-    readonly configuredIssuer?: string;
-    readonly providerAssignedWorker?: string;
-}): Readonly<Record<string, string>>;

package/dist/build/configuration/settings.js

@@ -1,7 +1,7 @@
 import { maximumExchangeTtl } from '@astrale-os/sdk/execution';
-import { captureDurableOptions, DEFAULT_INVOCATION_TIMEOUT_MS, DEFAULT_MAXIMUM_REQUEST_BYTES, encodeWorkerSettings, SETTINGS_BINDING, } from '../../worker/settings.js';
+import { BUILD_DIGEST_BINDING } from '../../worker/build-digest.js';
+import { captureDurableOptions, DEFAULT_INVOCATION_TIMEOUT_MS, DEFAULT_MAXIMUM_REQUEST_BYTES, SETTINGS_BINDING, } from '../../worker/settings.js';
 import { workerInvocationTimeout } from './invocation-timeout.js';
-import { directDeploymentVars } from './legacy/direct.js';
 import { workerRequestLimit } from './request-limit.js';
 import { resolveRouter } from './router.js';
 /**
@@ -10,7 +10,7 @@ import { resolveRouter } from './router.js';
  */
 const ADAPTER_VARS = new Set([
     'WORKER_URL',
-    'ASTRALE_BUILD_DIGEST',
+    BUILD_DIGEST_BINDING,
     SETTINGS_BINDING,
     'IDENTITY_ISS',
     'ASTRALE_PROVIDER_ASSIGNED_WORKER',
@@ -40,32 +40,3 @@ export function workerSettings(parameters) {
             }),
     });
 }
-/**
- * The plain bindings one stable Worker deployment carries: the author's vars, its execution
- * settings and serving origin, and the legacy direct-mode bindings. Never `ASTRALE_BUILD_DIGEST`:
- * only an immutable deployment may answer for a build digest.
- */
-export function deploymentVars(parameters, deployment) {
-    const authored = [
-        ...Object.keys(parameters.vars ?? {}),
-        ...Object.keys(wranglerVars(parameters.wrangler)),
-    ];
-    const owned = authored.filter(isAdapterVar);
-    if (owned.length > 0) {
-        throw new TypeError(`Cloudflare var(s) ${owned.join(', ')} are adapter-owned bindings.`);
-    }
-    return Object.freeze({
-        ...parameters.vars,
-        [SETTINGS_BINDING]: encodeWorkerSettings(workerSettings(parameters)),
-        ...(deployment.configuredIssuer === undefined
-            ? {}
-            : { WORKER_URL: deployment.configuredIssuer }),
-        ...directDeploymentVars(parameters, deployment),
-    });
-}
-function wranglerVars(wrangler) {
-    const vars = wrangler?.vars;
-    return vars !== null && typeof vars === 'object' && !Array.isArray(vars)
-        ? vars
-        : {};
-}

package/dist/build/configuration.d.ts

@@ -1,6 +1,4 @@
-export { deploymentAddressing } from './configuration/addressing.js';
 export { workerInvocationTimeout } from './configuration/invocation-timeout.js';
 export { workerRequestLimit } from './configuration/request-limit.js';
 export { resolveRouter } from './configuration/router.js';
-export { deploymentVars, isAdapterVar, workerSettings } from './configuration/settings.js';
-export { workerName } from './configuration/worker-name.js';
+export { isAdapterVar, workerSettings } from './configuration/settings.js';

package/dist/build/configuration.js

@@ -1,6 +1,4 @@
-export { deploymentAddressing } from './configuration/addressing.js';
 export { workerInvocationTimeout } from './configuration/invocation-timeout.js';
 export { workerRequestLimit } from './configuration/request-limit.js';
 export { resolveRouter } from './configuration/router.js';
-export { deploymentVars, isAdapterVar, workerSettings } from './configuration/settings.js';
-export { workerName } from './configuration/worker-name.js';
+export { isAdapterVar, workerSettings } from './configuration/settings.js';

package/dist/build/index.d.ts

@@ -1,12 +1,18 @@
 export { generateBuildMaterialModule } from './material.js';
-export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
 export { cloudflareWorkerBundler } from './bundler.js';
 export { loadWorkerArtifact } from './worker/index.js';
 export type { WorkerArtifact } from './worker/index.js';
-export { uploadBuildDigest, uploadBuildEvidence, workerUpload } from './worker/upload.js';
-export { isAdapterVar, resolveRouter, workerName } from './configuration.js';
+export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, type BundleUpload, } from './worker/upload.js';
+export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
+export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';
 export { qualifyWorkerBundle } from './qualification.js';
 export { assertSingletonRuntimeRoots } from './roots.js';
-export { runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerTypes, } from '../wrangler/index.js';
+export { runWranglerBundle, runWranglerTypes } from '../wrangler/index.js';
+/**
+ * @deprecated Legacy direct mode only (`../legacy/direct/index.ts`): preparation of a stable
+ * Worker, its Wrangler deployment and its name. Replacement: `cloudflare({ namespace })`, which
+ * deploys one immutable deployment per release. Deleted with direct mode (D10).
+ */
+export { artifact, materialize, prepareWorkerArtifact, runWranglerDeploy, runWranglerDeploymentStatus, workerName, } from '../legacy/direct/index.js';

package/dist/build/index.js

@@ -1,11 +1,17 @@
 export { generateBuildMaterialModule } from './material.js';
-export { artifact, materialize, prepareWorkerArtifact } from './artifact.js';
 export { cloudflareWorkerBundler } from './bundler.js';
 export { loadWorkerArtifact } from './worker/index.js';
-export { uploadBuildDigest, uploadBuildEvidence, workerUpload } from './worker/upload.js';
-export { isAdapterVar, resolveRouter, workerName } from './configuration.js';
+export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, } from './worker/upload.js';
+export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
+export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
 export { frontendFiles } from './frontend/files.js';
 export { verifyWorkerFrontend } from './frontend/readiness.js';
 export { qualifyWorkerBundle } from './qualification.js';
 export { assertSingletonRuntimeRoots } from './roots.js';
-export { runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerTypes, } from '../wrangler/index.js';
+export { runWranglerBundle, runWranglerTypes } from '../wrangler/index.js';
+/**
+ * @deprecated Legacy direct mode only (`../legacy/direct/index.ts`): preparation of a stable
+ * Worker, its Wrangler deployment and its name. Replacement: `cloudflare({ namespace })`, which
+ * deploys one immutable deployment per release. Deleted with direct mode (D10).
+ */
+export { artifact, materialize, prepareWorkerArtifact, runWranglerDeploy, runWranglerDeploymentStatus, workerName, } from '../legacy/direct/index.js';

package/dist/build/worker/upload.d.ts

@@ -1,10 +1,31 @@
-import type { PreparedArtifact } from '@astrale-os/sdk/deployment/adapter';
+import type { Bundle, PreparedArtifact } from '@astrale-os/sdk/deployment/adapter';
 import type { Build } from '@astrale-os/sdk/deployment/build';
 import type { BuildDigest } from '@astrale-os/sdk/deployment/build/manifest';
 import type { WorkerArtifact } from './artifact.js';
 import { type WorkerUpload } from '../../release/build.js';
 /** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
 export declare function workerUpload(artifact: PreparedArtifact, worker: WorkerArtifact): WorkerUpload;
+/**
+ * The portable upload of one Bundle of the Cloudflare Worker bundler, as an immutable deployment's
+ * host receives it: the entry and the modules it loads (ES modules and their WASM), and the
+ * frontend as Worker assets with the media type their extension names. Its build digest is the Bundle's own, so the host that
+ * recomputes it from these bytes finds exactly the build the release names; any other Bundle is
+ * refused.
+ */
+export declare function bundleUpload(bundle: Bundle): BundleUpload;
+/** The Worker upload of one Bundle, with each module's kind and each asset's media type. */
+export interface BundleUpload extends WorkerUpload {
+    readonly modules: readonly {
+        readonly name: string;
+        readonly kind: 'esm' | 'wasm';
+        readonly bytes: Uint8Array;
+    }[];
+    readonly assets?: readonly {
+        readonly path: string;
+        readonly bytes: Uint8Array;
+        readonly contentType?: string;
+    }[];
+}
 /** Build digest of the portable upload of one prepared Worker. */
 export declare function uploadBuildDigest(artifact: PreparedArtifact, worker: WorkerArtifact): BuildDigest;
 /** Record that preparation placed the CLI's Bundle for this Build. */

package/dist/build/worker/upload.js

@@ -1,5 +1,8 @@
 import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest';
 import { workerBuildManifest } from '../../release/build.js';
+import { bundledWorker } from '../bundler.js';
+import { inferMediaType } from './artifact.manifest.js';
+import { RELEASE_ENTRY } from './execution.prepare.js';
 /** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
 export function workerUpload(artifact, worker) {
     const root = artifact.build.schema.compiled.root;
@@ -17,6 +20,43 @@ export function workerUpload(artifact, worker) {
             : { assets: worker.assets.files.map((file) => ({ path: file.path, bytes: file.bytes() })) }),
     });
 }
+/**
+ * The portable upload of one Bundle of the Cloudflare Worker bundler, as an immutable deployment's
+ * host receives it: the entry and the modules it loads (ES modules and their WASM), and the
+ * frontend as Worker assets with the media type their extension names. Its build digest is the Bundle's own, so the host that
+ * recomputes it from these bytes finds exactly the build the release names; any other Bundle is
+ * refused.
+ */
+export function bundleUpload(bundle) {
+    const worker = bundledWorker(bundle, bundle.build);
+    const root = bundle.build.schema.compiled.root;
+    const upload = Object.freeze({
+        origin: root.origin,
+        revision: root.revision,
+        bundle: bundle.manifest.schema.bundle,
+        entry: RELEASE_ENTRY,
+        modules: Object.freeze([
+            Object.freeze({ name: RELEASE_ENTRY, kind: 'esm', bytes: worker.entry }),
+            ...worker.modules.map((module) => Object.freeze({ name: module.path, kind: module.kind, bytes: module.content })),
+        ]),
+        ...(worker.frontend.length === 0
+            ? {}
+            : {
+                assets: Object.freeze(worker.frontend.map((file) => {
+                    const contentType = inferMediaType(file.path);
+                    return Object.freeze({
+                        path: `/${file.path}`,
+                        bytes: file.bytes(),
+                        ...(contentType === undefined ? {} : { contentType }),
+                    });
+                })),
+            }),
+    });
+    if (buildDigest(workerBuildManifest(upload)) !== bundle.digest) {
+        throw new TypeError('Worker upload of the Bundle does not reproduce its build digest.');
+    }
+    return upload;
+}
 /** Build digest of the portable upload of one prepared Worker. */
 export function uploadBuildDigest(artifact, worker) {
     return buildDigest(workerBuildManifest(workerUpload(artifact, worker)));

package/dist/index.d.ts

@@ -1,22 +1,24 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through
- * Cloudflare Workers on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through Cloudflare Workers.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   environments: {
- *     development: { deployment: cloudflare({ secrets: '.env.dev' }) },
- *     production: { deployment: cloudflare({ route: 'crm.acme.dev' }) },
+ *     production: {
+ *       deployment: cloudflare({
+ *         namespace: { name: 'astrale-platform', routingDomain: 'platform.astrale.ai' },
+ *       }),
+ *     },
  *   }
  *
- * `astrale-domain dev <environment>` remotely deploys each admitted update;
- * an Environment with no `route` ships to
- * `*.workers.dev`; an env with a `route` ships to that custom domain.
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace, at `https://<label>.<routingDomain>`. Without it, the Environment is on the legacy
+ * direct mode (deprecated): one stable Worker on `route` or `*.workers.dev`, replaced in place by
+ * each deploy, which `astrale-domain dev <environment>` also serves.
  *
- * Prefer a managed deploy (no Cloudflare account)? Use
- * `@astrale-os/adapter-astrale`, which builds the same bundle via this package's
- * `/build` toolkit and ships it through the Astrale platform. Generic Project
- * tooling owns optional Kernel installation after provider readiness.
+ * Prefer a managed deploy (no Cloudflare account)? Use `@astrale-os/adapter-astrale`, which builds
+ * the same bundle via this package's `/build` toolkit and ships it through the Astrale platform. A
+ * deploy never installs: `astrale domain install <url>` installs the URL it prints.
  */
 export { cloudflare } from './cloudflare.js';
-export type { CloudflareParams, DurableWorkerOptions } from './params.js';
+export type { CloudflareNamespace, CloudflareParams, DurableWorkerOptions } from './params.js';

package/dist/index.js

@@ -1,21 +1,23 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through
- * Cloudflare Workers on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale Domain through Cloudflare Workers.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   environments: {
- *     development: { deployment: cloudflare({ secrets: '.env.dev' }) },
- *     production: { deployment: cloudflare({ route: 'crm.acme.dev' }) },
+ *     production: {
+ *       deployment: cloudflare({
+ *         namespace: { name: 'astrale-platform', routingDomain: 'platform.astrale.ai' },
+ *       }),
+ *     },
  *   }
  *
- * `astrale-domain dev <environment>` remotely deploys each admitted update;
- * an Environment with no `route` ships to
- * `*.workers.dev`; an env with a `route` ships to that custom domain.
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace, at `https://<label>.<routingDomain>`. Without it, the Environment is on the legacy
+ * direct mode (deprecated): one stable Worker on `route` or `*.workers.dev`, replaced in place by
+ * each deploy, which `astrale-domain dev <environment>` also serves.
  *
- * Prefer a managed deploy (no Cloudflare account)? Use
- * `@astrale-os/adapter-astrale`, which builds the same bundle via this package's
- * `/build` toolkit and ships it through the Astrale platform. Generic Project
- * tooling owns optional Kernel installation after provider readiness.
+ * Prefer a managed deploy (no Cloudflare account)? Use `@astrale-os/adapter-astrale`, which builds
+ * the same bundle via this package's `/build` toolkit and ships it through the Astrale platform. A
+ * deploy never installs: `astrale domain install <url>` installs the URL it prints.
  */
 export { cloudflare } from './cloudflare.js';