@astrale-os/adapter-cloudflare 0.5.0-beta.17 → 0.5.0-beta.171

package/README.md

@@ -2,10 +2,238 @@
 
 Cloudflare Worker deployment adapter for Astrale Domains.
 
-During the SDK beta program, install the beta cohort explicitly:
+During the SDK beta program, install the beta package set explicitly:
 
 ```bash
 npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 ```
 
-Bare installs return to stable releases when the cohort is promoted and npm `latest` advances.
+Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
+
+One `cloudflare()` value configures one Project Environment, in one of two modes. With
+`namespace`, each release becomes one immutable deployment in a platform dispatch namespace. Without
+it, the Environment is on the legacy direct mode: one stable Worker, replaced in place by each
+deploy. A deploy never installs: install the URL it prints with
+`astrale domain install <url> --direct -i <instance>`.
+
+Generated Worker modules are minified by default, including separately loaded runtime modules.
+The Environment's `wrangler` overlay cannot change minification: every Environment of one source
+must emit the same JavaScript bytes. `cloudflare({ wrangler: { minify: false } })` is rejected.
+
+## Namespace mode
+
+```ts
+production: {
+  deployment: cloudflare({
+    namespace: { name: 'astrale-platform', routingDomain: 'platform.astrale.ai' },
+    secrets: '.env.production',
+  }),
+},
+```
+
+Only the platform deploys there (Shell, Services and the other platform Domains), so every line is
+readable. `astrale-domain deploy <environment>` uploads one script named by the deployment label,
+create-only (`If-None-Match: *`), which answers at `https://<label>.<routingDomain>` through the
+platform dispatcher. Nothing is ever replaced in place: another build or configuration is another
+label.
+
+- **Credentials.** `CLOUDFLARE_API_TOKEN` must edit the namespace's scripts and the values of its
+  routing KV; the account is `namespace.account`, else `CLOUDFLARE_ACCOUNT_ID`. Neither is ever
+  written to the configuration.
+- **Routing KV.** The deploy finds the namespace's routing KV by its title,
+  `astrale-deployment-routing-<first 16 bytes of sha256(name), in hexadecimal>`, which the platform
+  provisioning creates. A namespace without it is refused before any effect.
+- **Bindings.** Each new deployment binds `WORKER_URL`, `ASTRALE_BUILD_DIGEST`, `ASTRALE_SETTINGS`
+  (the router as `ROUTER`), the author's `vars`, the service bindings of `wrangler.services`, the
+  router, its version metadata, and as `secret_text` exactly the Environment's secrets and
+  `ASTRALE_SIGNING_IDENTITY`, a key generated for that deployment and kept nowhere else. Its tags
+  name its artifact (build digest), line and key; never `astrale-service`, which is Services'.
+- **Activation.** The deploy writes `summary:<label>` (owner `platform`, state `active`, retention
+  `preview`, the activation instant), then `record:<label>`, whose presence makes the dispatcher
+  route the label. Neither ever holds a provider version or a secret digest. Readiness then waits,
+  bounded, until the URL serves the sealed release from the provider version the upload created.
+- **Reuse.** A redeploy of the same release finds the script under its label. It is reused only
+  when its artifact and line tags and its record name this build and configuration (or, when an
+  interrupted deploy left it unactivated, when it binds exactly this configuration). Then only that
+  script's declared secrets are rewritten in place, and readiness waits for the version the
+  rewrite minted. Anything else is a `deployment-conflict`, refused with nothing written; no other
+  deployment is ever touched.
+- **Retention.** `retain` (called once a Publication commits) marks the summary `published`, which
+  the platform's preview expiry never retires. A label the platform withdrew (`retirement:<label>`)
+  answers `DEPLOYMENT_RETIRED` at the dispatcher and is refused by every later deploy.
+- **Listing.** `astrale-domain list` lists the Environment's deployments from the routing KV, and
+  writes nothing: one row per `summary:<label>` of the Environment's line, with its record as
+  `record:<label>` stores it (a record the SDK refuses is listed with `record: null` and the
+  refusal), and the call target `{ kind: 'namespace', namespace, script }` that the platform's
+  per-script tooling takes, such as its in-place secret rotation. A summary without its record is
+  `deploying` (not activated), and an active one whose label carries the tombstone is `retiring`.
+  Nothing on the namespace records last calls: they come from its calls dataset,
+  `astrale_deployment_calls_<the same hexadecimal>`, through the Analytics Engine SQL API, and an
+  active preview expires 30 days after the later of its activation and its last call. The token
+  then also needs Account Analytics Read; without it, the deployments are listed without last calls
+  or expiries.
+- **Refused.** A direct-mode parameter beside `namespace` (`route`, `workerName`, `identityIssuer`,
+  `addressing`, `signingIdentity`), a `router.binding` other than `ROUTER`, and any `wrangler` key
+  but `services`, `dispatch_namespaces` and `compatibility_flags`, `triggers` first: an immutable
+  deployment runs no cron of its own. A `dispatch_namespaces` entry is exactly
+  `{ binding, namespace }`; it is frozen into the configuration (`bindings.dispatchNamespaces`), so
+  into the label, bound at the create-only upload, and never names the platform namespace the
+  deployment lives in (AM-174). Which namespaces a deployment may bind is its host's to decide.
+  `durable` is frozen into the configuration (`settings.durableOptions`, AM-175), so into the
+  label, and bound in `ASTRALE_SETTINGS`: a durable run stays on the deployment that started it.
+  `astrale-domain dev` serves only direct-mode Environments.
+
+## Legacy direct mode
+
+Deprecated: replaced by namespace mode, and deleted with the legacy deploy path (D10) once no
+configuration on any repository's main selects direct mode. Its consumers until they move: the
+domains configurations of ai-gateway, closing, grc, integrations and issues; domains organization,
+whose `prod` binds an EU-jurisdiction R2 bucket that namespace mode does not admit yet; the Services
+`beta`, `prod` and `development` environments and its frozen `admin-beta`; the Shell and its frozen
+`legacy-v3`; and ui:domain.
+
+`astrale-domain dev <environment>` builds locally and deploys each admitted Worker and frontend
+update remotely through the same path as `deploy`; it starts no local Worker, Vite server, or
+tunnel. Omitting `route` uses the observed stable `*.workers.dev` issuer.
+
+One watcher serializes its own updates. For an existing Worker, it uploads a candidate, reconciles
+configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
+HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
+serving the Publication also initializes the Domain Runtime. After promotion, normal requests
+must prove that exact version again. A failed candidate remains at 0% and can be replaced on retry.
+Bundled View routes must also serve the prepared browser-file generation before readiness passes.
+This covers frontend-only changes without changing the Schema or reinstalling the Domain. HTML is
+revalidated on every use and transient asset misses are not cached; ordinary successful asset
+responses keep their cache policy. Frontend files are answered by the Worker's small startup module
+without loading the execution Service, which each such file starts loading in the background for the
+calls the View makes next.
+The first deployment uses ordinary Worker provisioning because no previous version exists to retain.
+An existing traffic-split rollout must be resolved before this single-version workflow can continue.
+
+A direct Cloudflare target shared across machines must still have one external writer, normally a
+CI/CD concurrency group. Live deployment checks detect competing changes but are not an atomic
+compare-and-swap or distributed lock. Use separate Worker targets for uncoordinated development.
+Routes, custom domains, schedules, and other non-versioned provider settings are reconciled through
+Wrangler before candidate probing; they can remain changed after a failed attempt. Candidate readiness
+protects the HTTP implementation, not an atomic rollback of external resources or trigger settings.
+
+## Frontend files
+
+The Worker runs before Workers Static Assets on every request and owns frontend response headers
+and routing, for `cloudflare()` and `astrale()` deployments alike. Frontend preparation therefore
+refuses a built frontend whose root contains `_headers`, `_redirects`, or `.assetsignore`, in any
+letter case, as a file or a directory. Wrangler would apply them as asset configuration in a direct
+deployment, while a managed deployment would serve them as public files. The refusal happens while
+the artifact is prepared, before any provider change. Vite copies its public directory (`public/`
+by default) to that root: remove them there, or stop the plugin that emits them. The same names
+below the root, such as `docs/_headers`, remain ordinary files.
+
+The Worker is also the only server-side code, so preparation likewise refuses a root name starting
+with `_worker.js`, the name of a Cloudflare Pages worker script: a `_worker.js` file or directory,
+or a sibling such as `_worker.js.map`. Wrangler refuses to upload these as assets, since they may
+hold server-side code, so a direct deployment would fail at upload, while a managed deployment would
+publish them. Unlike the names above, the match is case-sensitive, as Wrangler's is: `_Worker.js`
+and a nested `docs/_worker.js` remain ordinary files. Remove such a file from the public directory,
+or rename it if it is a browser script.
+
+## Provider-local staging
+
+Managed Cloudflare providers may stage immutable implementation candidates without exposing their
+identity to Publications or installed Kernels:
+
+```ts
+import { stagedWorkerName } from '@astrale-os/adapter-cloudflare/release'
+```
+
+This subpath is runtime-safe. `stagedWorkerName(providerDeployment)` addresses one private staged
+candidate. The public Worker name and `/invoke` endpoint remain stable across compatible
+implementation and Schema updates. Provider staging identity never enters Release, Publication,
+Kernel routing, or graph identity.
+
+## Deployment bindings
+
+The bundled Worker carries no Environment value, so every Environment of one source bundles the
+same bytes. Each deployment binds its own values as plain Worker bindings:
+
+| Binding | Value |
+| --- | --- |
+| `WORKER_URL` | serving origin of the deployment |
+| `ASTRALE_SETTINGS` | canonical JSON of `{ invocationTimeoutMs, maximumRequestBytes, router, tokenExchange }`, defaults resolved, with optional `durableOptions` |
+| `ASTRALE_BUILD_DIGEST` | build digest the host recomputed from the uploaded bytes, bound only by hosts that deploy immutable Workers; never by a stable Worker |
+| `IDENTITY_ISS`, `ASTRALE_PROVIDER_ASSIGNED_WORKER` | **legacy direct mode only** (deprecated): a stable issuer behind another route, and the workers.dev claim |
+
+These names are adapter-owned: preparation refuses an author var, or a `wrangler.vars` entry, that
+takes one, and deployment refuses a secret that does. A host that deploys the Worker itself encodes
+the settings with `encodeWorkerSettings` from `@astrale-os/adapter-cloudflare/worker`. A generated
+Worker refuses execution without `ASTRALE_SETTINGS`.
+
+`ASTRALE_BUILD_DIGEST` selects what the Worker serves. Bound, the Worker is an immutable deployment:
+it seals the `DomainRelease` v4 of its code at its `WORKER_URL`, which is its issuer, and serves it
+at `/.well-known/astrale/release.json` beside its frozen v3 projection at `domain.json`; it admits
+only routing that names that exact release or projection. Unbound, it is a stable Worker and serves
+exactly the v3 Publication of today, answering 404 at `release.json`. The Worker refuses execution,
+instead of falling back to v3, when the digest is malformed, when it is bound without `WORKER_URL`,
+or beside a direct-mode binding or a configured `identityIssuer`.
+
+The two direct-mode bindings are deprecated. Their replacement is an immutable deployment, whose
+host binds `WORKER_URL` to the deployment URL, which is also its issuer (namespace mode). They are
+deleted with direct mode, once the Shell, Services, Issues, domains and ui configurations deploy in
+namespace mode and no installation pins a direct Worker.
+
+The `wrangler` overlay reaches the deployment configuration, never the bundle. Preparation refuses
+an overlay key the bundler reads (`alias`, `build`, `define`, `jsx_factory`, `jsx_fragment`,
+`keep_names`, `minify`, `no_bundle`, `node_compat`, `preserve_file_names`, `rules`, `tsconfig`,
+`upload_source_maps`) and a compatibility flag it reads (Node.js, `navigator`, fetch iterable
+typing, Python) beyond the adapter's own `nodejs_compat`.
+
+## Build digest
+
+`cloudflare()` and `astrale()` bundle through one bundler, `cloudflare-worker` version `1`, so
+every Environment of either adapter shares one build: `astrale-domain build` prints its build
+digest, and `deploy` places that same Bundle. Two installed versions of this package are two
+copies of the bundler: when their code differs, `build` prints one build digest per copy and warns
+until the adapter versions are aligned.
+
+Services receives the placed modules as they are, so there the digest names the bytes the
+deployment runs. Direct mode runs `wrangler deploy`, which bundles the placed modules again: there
+the digest names the portable Worker the deployment was made from, not the bytes Cloudflare runs.
+A host that receives a Worker upload recomputes the digest from the exact upload with the same
+function:
+
+```ts
+import { workerBuildManifest } from '@astrale-os/adapter-cloudflare/release'
+import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest'
+
+const digest = buildDigest(workerBuildManifest({ origin, revision, bundle, entry, modules, assets }))
+```
+
+Modules keep their uploaded name and an asset `/<path>` is the file `assets/<path>`. The bundler
+version names this layout, not a package release. Both subpaths are runtime-safe.
+
+## Material for a custom Worker entrypoint
+
+Workers with provider-specific routes or environment initialization can reuse the adapter's
+material emission without adopting the entire generated entrypoint:
+
+```ts
+import { generateBuildMaterialModule } from '@astrale-os/adapter-cloudflare/build'
+import { writeFile } from 'node:fs/promises'
+
+// build is an admitted Build returned by compile(domain).
+await writeFile('src/build-material.gen.ts', generateBuildMaterialModule(build))
+```
+
+The generated TypeScript module exports `loadBuildMaterial()`. Call it from the
+`load` callback of `generatedCloudflareWorkerEntry` alongside the Domain's Runtime.
+Such an entrypoint states its execution settings (`invocationTimeoutMs`, `maximumRequestBytes`,
+`tokenExchange`, `routeSubrequest`, `identityIssuer`) in its configuration, or reads them from its
+deployment bindings with `settings: deploymentSettings`; one Worker never takes both.
+It constructs the same verified, deduplicated material as the adapter's generated Service;
+allocation is deferred until the factory is called and the SDK deep-freezes it before use.
+The generated file needs only a type import from the SDK. Keep its compiler and runtime SDK
+versions aligned, and regenerate it when either the Domain or that SDK version changes.
+
+Such an entrypoint can keep the same fast frontend path by answering from
+`cloudflareFrontDoor()` (`@astrale-os/adapter-cloudflare/worker/front`, which reaches no SDK
+runtime module) before importing its Service, and calling that Service's `prepare()` through
+`waitUntil` when the front door served a frontend file.

package/dist/adapter.d.ts

@@ -0,0 +1,24 @@
+import type { Deployment } from '@astrale-os/sdk/deployment';
+import type { Adapter } from '@astrale-os/sdk/deployment/adapter';
+import type { CloudflareDeployDependencies } from './legacy/direct/index.js';
+import type { NamespaceDependencies } from './namespace/index.js';
+import type { CloudflareParams } from './params.js';
+import { artifact, signingIdentity } from './legacy/direct/index.js';
+export { waitForReadiness, type ReadinessCheck } from './legacy/direct/index.js';
+export type { NamespaceDependencies } from './namespace/index.js';
+export interface CloudflareDependencies extends CloudflareDeployDependencies {
+    readonly artifact: typeof artifact;
+    readonly signingIdentity: typeof signingIdentity;
+    /** The effects of namespace mode. Default: `fetch`, `process.env`, a new key, the clock. */
+    readonly namespace?: NamespaceDependencies;
+}
+/**
+ * Deploy one Project Environment through Cloudflare Workers.
+ *
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace (adapter interface v2), and `astrale-domain list` lists them. Without it, the
+ * Environment stays on the legacy direct mode: one stable Worker replaced in place by each deploy
+ * (CT33).
+ */
+export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, Adapter<CloudflareParams>>;
+export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, Adapter<CloudflareParams>>;

package/dist/adapter.js

@@ -0,0 +1,59 @@
+import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adapter';
+import { createRequire } from 'node:module';
+import { cloudflareWorkerBundler } from './build/bundler.js';
+import { createSigningIdentity } from './identity/material.js';
+import { artifact, deployCloudflare, directReadiness, materialize, runWranglerDeploymentStatus, runWranglerRollout, signingIdentity, } from './legacy/direct/index.js';
+import { admitNamespace, configureNamespace, deployNamespaceRelease, listNamespaceDeployments, placeNamespace, retainNamespaceDeployment, } from './namespace/index.js';
+export { waitForReadiness } from './legacy/direct/index.js';
+const packageVersion = createRequire(import.meta.url)('../package.json')
+    .version;
+/**
+ * Deploy one Project Environment through Cloudflare Workers.
+ *
+ * With `namespace`, each release becomes one immutable deployment in that platform dispatch
+ * namespace (adapter interface v2), and `astrale-domain list` lists them. Without it, the
+ * Environment stays on the legacy direct mode: one stable Worker replaced in place by each deploy
+ * (CT33).
+ */
+export function cloudflare(parameters = {}) {
+    return cloudflareWithDependencies(parameters, {
+        artifact,
+        materialize,
+        runWranglerRollout,
+        runWranglerDeploymentStatus,
+        signingIdentity,
+        waitForReadiness: directReadiness,
+    });
+}
+export function cloudflareWithDependencies(parameters, dependencies) {
+    const namespace = dependencies.namespace ?? platformNamespaceDependencies();
+    const adapter = defineAdapter({
+        name: 'cloudflare',
+        version: packageVersion,
+        bundler: cloudflareWorkerBundler,
+        admit: admitCloudflare,
+        configure: configureNamespace,
+        placement: async (parameters) => placeNamespace(parameters),
+        deployRelease: (parameters, context) => deployNamespaceRelease(parameters, context, namespace),
+        list: (parameters, context) => listNamespaceDeployments(parameters, context, namespace),
+        retain: (parameters, context) => retainNamespaceDeployment(parameters, context, namespace),
+        // Legacy direct mode (CT33 `legacy-direct`), deleted with it (D10).
+        prepare: dependencies.artifact,
+        deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
+        secretsFile: (parameters) => parameters.secrets,
+    });
+    return defineDeployment(adapter, parameters);
+}
+/** Refuse a malformed `namespace` when the Project is defined, before any build. */
+function admitCloudflare(parameters) {
+    if (parameters.namespace !== undefined)
+        admitNamespace(parameters.namespace);
+}
+function platformNamespaceDependencies() {
+    return Object.freeze({
+        fetch: (input, init) => fetch(input, init),
+        environment: process.env,
+        createSigningIdentity,
+        now: () => new Date(),
+    });
+}

package/dist/build/bundle/admit.d.ts

@@ -0,0 +1,3 @@
+export declare function admitWorkerBundle(path: string): Promise<void>;
+/** Admit the separately emitted engine's actual platform exports, including its compiled WASM. */
+export declare function admitDurableEngineBundle(path: string): Promise<void>;

package/dist/build/bundle/admit.js

@@ -0,0 +1,46 @@
+import * as nodeModule from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { compiledWasmLoader, compiledWasmSource } from './compiled-wasm-loader.js';
+let compiledWasm = false;
+/**
+ * Import a WebAssembly module as Workers do for `CompiledWasm`: its default export is the compiled
+ * `WebAssembly.Module`, instantiated by the importing code. The CLI admits bundles under Bun; Node
+ * serves programmatic builds.
+ */
+function admitCompiledWasm() {
+    if (compiledWasm)
+        return;
+    if (process.versions.bun !== undefined) {
+        ;
+        Reflect.get(globalThis, 'Bun').plugin({
+            name: 'astrale-compiled-wasm',
+            setup(build) {
+                build.onLoad({ filter: /\.wasm$/ }, ({ path }) => ({
+                    loader: 'js',
+                    contents: compiledWasmSource(JSON.stringify(path)),
+                }));
+            },
+        });
+        compiledWasm = true;
+        return;
+    }
+    nodeModule.register(compiledWasmLoader);
+    compiledWasm = true;
+}
+export async function admitWorkerBundle(path) {
+    admitCompiledWasm();
+    const loaded = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
+    if (loaded.default === null ||
+        typeof loaded.default !== 'object' ||
+        typeof Reflect.get(loaded.default, 'fetch') !== 'function') {
+        throw new TypeError('Generated Worker bundle does not export a Fetch handler.');
+    }
+}
+/** Admit the separately emitted engine's actual platform exports, including its compiled WASM. */
+export async function admitDurableEngineBundle(path) {
+    admitCompiledWasm();
+    const engine = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
+    if (['createEndpointHandler', 'workflow', 'TerminalError', 'CancelledError'].some((key) => typeof engine[key] !== 'function')) {
+        throw new TypeError('Generated durable engine bundle does not export the platform Fetch entrypoint.');
+    }
+}

package/dist/build/bundle/compiled-wasm-loader.d.ts

@@ -0,0 +1,8 @@
+/** Workers expose CompiledWasm imports as modules, rather than instantiated exports. */
+export declare function compiledWasmSource(file: string): string;
+/**
+ * Async hooks run in a separate Node thread. A self-contained ESM hook admits both emitted JS and
+ * source builds under tsx without requiring that thread to resolve or transpile our source files.
+ * The emitted import source is shared with Bun.
+ */
+export declare const compiledWasmLoader: string;

package/dist/build/bundle/compiled-wasm-loader.js

@@ -0,0 +1,21 @@
+const SOURCE_PREFIX = "import { readFileSync } from 'node:fs'\nexport default new WebAssembly.Module(readFileSync(";
+const SOURCE_SUFFIX = '))\n';
+/** Workers expose CompiledWasm imports as modules, rather than instantiated exports. */
+export function compiledWasmSource(file) {
+    return `${SOURCE_PREFIX}${file}${SOURCE_SUFFIX}`;
+}
+/**
+ * Async hooks run in a separate Node thread. A self-contained ESM hook admits both emitted JS and
+ * source builds under tsx without requiring that thread to resolve or transpile our source files.
+ * The emitted import source is shared with Bun.
+ */
+export const compiledWasmLoader = `data:text/javascript,${encodeURIComponent(`
+export function load(url, context, nextLoad) {
+  if (!url.startsWith('file:') || !url.endsWith('.wasm')) return nextLoad(url, context);
+  return {
+    format: 'module',
+    shortCircuit: true,
+    source: ${JSON.stringify(SOURCE_PREFIX)} + 'new URL(' + JSON.stringify(url) + ')' + ${JSON.stringify(SOURCE_SUFFIX)},
+  };
+}
+`)}`;

package/dist/build/bundler.d.ts

@@ -0,0 +1,21 @@
+import type { Bundle, BundleContext, Bundler } from '@astrale-os/sdk/deployment/adapter';
+import type { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+import type { ReleaseModule } from './worker/execution.prepare.js';
+/**
+ * Environment-free bytes of one generated Worker: its entry, the modules it loads (the execution
+ * Service, the deferred workflow engine and their WASM) and its frontend.
+ */
+export interface WorkerBytes {
+    readonly entry: Uint8Array;
+    readonly modules: readonly ReleaseModule[];
+    readonly frontend: readonly frontendBuild.FrontendFile[];
+}
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export declare const cloudflareWorkerBundler: Bundler;
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export declare function bundleWorker(context: BundleContext): Promise<WorkerBytes>;
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export declare function bundledWorker(bundle: Bundle, build: Bundle['build']): WorkerBytes;

package/dist/build/bundler.js

@@ -0,0 +1,96 @@
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CLOUDFLARE_WORKER_BUNDLER, workerAssetFile } from '../release/build.js';
+import { frontendFiles } from './frontend/files.js';
+import { frontendRevision } from './frontend/revision.js';
+import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE } from './worker/execution.prepare.js';
+/** Worker modules live beside the entry; WASM is the only non-ESM kind preparation emits. */
+const MODULE_DIRECTORY = 'bundle/';
+/**
+ * Bundles every generated Cloudflare Worker, for adapter-cloudflare and adapter-astrale alike. It
+ * reads no Environment: settings, address, issuer and key are bound at deploy.
+ */
+export const cloudflareWorkerBundler = Object.freeze({
+    id: CLOUDFLARE_WORKER_BUNDLER.id,
+    version: CLOUDFLARE_WORKER_BUNDLER.version,
+    async bundle(context) {
+        const worker = await bundleWorker(context);
+        return Object.freeze({
+            entrypoint: RELEASE_ENTRY,
+            files: Object.freeze([
+                { path: RELEASE_ENTRY, content: worker.entry },
+                ...worker.modules.map(({ path, content }) => ({ path, content })),
+                ...worker.frontend.map((file) => ({
+                    path: workerAssetFile(`/${file.path}`),
+                    content: file.bytes(),
+                })),
+            ]),
+        });
+    },
+});
+/** Bundle the Worker modules and build the frontend they serve, in one scratch directory. */
+export async function bundleWorker(context) {
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
+    try {
+        // `frontend` is the served file list; `addressed` rides alongside it into the Worker, where it
+        // decides which of those files a browser may retain.
+        const { files: frontend, addressed } = await frontendFiles({
+            frontend: context.build.frontend,
+            projectDir: context.projectDir,
+            output: join(directory, 'frontend'),
+            recordSource: context.recordSource,
+            signal: context.signal,
+        });
+        const modules = await prepareExecution({
+            context,
+            directory,
+            ...(frontend.length === 0 ? {} : { frontendRevision: frontendRevision(frontend) }),
+            ...(addressed.length === 0 ? {} : { frontendAddressed: addressed }),
+        });
+        return Object.freeze({ entry: modules.entry, modules: modules.modules, frontend });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+/** Read back the Worker bytes of a Bundle this bundler produced for the same Build. */
+export function bundledWorker(bundle, build) {
+    const { id, version } = bundle.manifest.bundler;
+    if (bundle.build !== build ||
+        id !== CLOUDFLARE_WORKER_BUNDLER.id ||
+        version !== CLOUDFLARE_WORKER_BUNDLER.version ||
+        bundle.entrypoint !== RELEASE_ENTRY) {
+        throw new TypeError('Cloudflare preparation requires the Bundle of its Worker bundler.');
+    }
+    let entry;
+    const modules = [];
+    const frontend = [];
+    for (const file of bundle.files) {
+        if (file.path === RELEASE_ENTRY)
+            entry = file.bytes();
+        else if (file.path.startsWith(MODULE_DIRECTORY) && /\.(?:mjs|wasm)$/u.test(file.path)) {
+            modules.push(Object.freeze({
+                path: file.path,
+                kind: file.path.endsWith('.wasm') ? 'wasm' : 'esm',
+                content: file.bytes(),
+            }));
+        }
+        else if (file.path.startsWith('assets/')) {
+            const content = file.bytes();
+            frontend.push(Object.freeze({ path: file.path.slice('assets/'.length), bytes: () => content.slice() }));
+        }
+        else {
+            throw new TypeError(`Cloudflare Worker Bundle file ${file.path} is not a Worker file.`);
+        }
+    }
+    if (entry === undefined || !modules.some((module) => module.path === RELEASE_SERVICE)) {
+        throw new TypeError('Cloudflare Worker Bundle lacks its execution modules.');
+    }
+    return Object.freeze({
+        entry,
+        modules: Object.freeze(modules),
+        frontend: Object.freeze(frontend),
+    });
+}

package/dist/build/closure.d.ts

@@ -0,0 +1,2 @@
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export declare function assertRuntimeClosure(metafilePath: string): Promise<void>;

package/dist/build/closure.js

@@ -0,0 +1,22 @@
+import { readWranglerMetafile } from './metafile.js';
+const FORBIDDEN_RUNTIME_INPUTS = [
+    '/v1/builder/',
+    '/v1/compiled/compiler/',
+    '/node_modules/ajv/',
+    '/node_modules/re2js/',
+    '/kernel-core/domain/',
+    '/core/domain/',
+    '/kernel-core/schema/index.',
+    '/core/schema/index.',
+];
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export async function assertRuntimeClosure(metafilePath) {
+    const metafile = await readWranglerMetafile(metafilePath);
+    const forbidden = Object.keys(metafile.inputs).filter((input) => {
+        const normalized = `/${input.replaceAll('\\', '/')}`.replace(/(\/node_modules\/@astrale-os\/kernel-[^/]+)\/dist\//gu, '$1/');
+        return FORBIDDEN_RUNTIME_INPUTS.some((fragment) => normalized.includes(fragment));
+    });
+    if (forbidden.length > 0) {
+        throw new Error(`Cloudflare Worker reaches build-side modules: ${forbidden.sort().join(', ')}.`);
+    }
+}

package/dist/build/codegen/execution.d.ts

@@ -0,0 +1,3 @@
+export { generateExecutionEntry } from '../worker/codegen/entry.js';
+export { generateExecutionService } from '../worker/codegen/service.js';
+export type { ExecutionCodegenOptions } from '../worker/codegen/service.js';

package/dist/build/codegen/execution.js

@@ -0,0 +1,2 @@
+export { generateExecutionEntry } from '../worker/codegen/entry.js';
+export { generateExecutionService } from '../worker/codegen/service.js';

package/dist/build/codegen/merge.d.ts

@@ -17,4 +17,3 @@
  * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
  */
 export declare function deepMergeConfig(base: Record<string, unknown>, overlay: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=merge.d.ts.map

package/dist/build/codegen/merge.js

@@ -88,4 +88,3 @@ function isPlainObject(v) {
 function isPrimitive(v) {
     return v === null || (typeof v !== 'object' && typeof v !== 'function');
 }
-//# sourceMappingURL=merge.js.map

package/dist/build/codegen/wrangler.d.ts

@@ -13,22 +13,32 @@
  */
 export interface WranglerCodegenOptions {
     workerName: string;
+    /** Provider-ready entrypoint relative to the generated config. */
+    main?: string;
     /** Full custom hostname for a routed deploy (e.g. 'crm.acme.dev'). */
     route?: string;
     /** Exact materialized local frontend; absence means no ASSETS binding. */
     frontend?: {
         readonly directory: string;
-        readonly routes: readonly string[];
-        readonly dev: boolean;
     };
     /** Plain (non-secret) vars to bake in. */
     vars?: Record<string, string>;
+    /** Secret binding names required by generated Worker code. */
+    secretBindings?: readonly string[];
+    /** Modules retained outside the startup entry and loaded on demand. */
+    modules?: {
+        readonly baseDir: string;
+        readonly rules: readonly {
+            readonly type: 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
+            readonly globs: readonly string[];
+        }[];
+    };
     /** Add the SELF service binding (autobinding). */
     selfBinding: boolean;
     /**
      * Add a service binding to a router Worker for instance-host subrequest
-     * routing (see `CloudflareParams.router`). Pairs with the worker
-     * entry's `routeSubrequest`.
+     * routing (see `CloudflareParams.router`). Pairs with the router rule bound
+     * in `ASTRALE_SETTINGS`.
      */
     router?: {
         binding: string;
@@ -39,9 +49,25 @@ export interface WranglerCodegenOptions {
      * hatch for extra bindings (KV, R2, D1, queues, service bindings, extra
      * `compatibility_flags`, cron `triggers`, …). Arrays concat; new keys are
      * added as-is. The adapter-owned keys `name`, `main`, `assets`, `routes` are
-     * rejected (throws) — use `workerName` / `route` instead.
+     * rejected (throws) — use `workerName` / `route` instead — and so are the keys
+     * and compatibility flags Wrangler's bundler reads.
      */
     wrangler?: Record<string, unknown>;
 }
+/**
+ * The Workers runtime every generated Worker runs on, wherever it is deployed: its compatibility
+ * date, kept on the runtime baseline qualified with Wrangler 4.123.0, and its compatibility flags.
+ * Domain execution calls its Kernel through the invocation's public issuer, so Cloudflare must route
+ * same-zone callbacks through the public front door instead of bypassing Worker routes
+ * (`global_fetch_strictly_public`). An immutable deployment freezes it into its configuration.
+ */
+export declare const GENERATED_WORKER_RUNTIME: Readonly<{
+    compatibilityDate: "2026-08-11";
+    compatibilityFlags: readonly string[];
+}>;
 export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
-//# sourceMappingURL=wrangler.d.ts.map
+/**
+ * Whether a compatibility flag shapes the bundle (Wrangler's bundler reads it), so that no
+ * Environment may add it: bundling takes no Environment.
+ */
+export declare function isBundlingCompatibilityFlag(flag: string): boolean;