@astrale-os/adapter-cloudflare 0.5.0-beta.170 → 0.5.0-beta.172

package/dist/identity/material.d.ts

@@ -4,4 +4,4 @@ export type SigningIdentityMaterial = JsonWebKey & {
 };
 export declare function createSigningIdentity(): Promise<SigningIdentityMaterial>;
 /** Admit private Ed25519 material and its collision-resistant public identity. */
-export declare function admitSigningIdentity(input: unknown, owner: string, legacyKeyId?: string): Promise<SigningIdentityMaterial>;
+export declare function admitSigningIdentity(input: unknown, owner: string): Promise<SigningIdentityMaterial>;

package/dist/identity/material.js

@@ -9,7 +9,7 @@ export async function createSigningIdentity() {
     }, 'generated identity');
 }
 /** Admit private Ed25519 material and its collision-resistant public identity. */
-export async function admitSigningIdentity(input, owner, legacyKeyId) {
+export async function admitSigningIdentity(input, owner) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid(owner);
     const value = input;
@@ -22,20 +22,16 @@ export async function admitSigningIdentity(input, owner, legacyKeyId) {
         value.d.length === 0) {
         invalid(owner);
     }
-    const thumbprint = await calculateJwkThumbprint(value);
-    const admitted = legacyKeyId !== undefined && (value.kid === undefined || value.kid === legacyKeyId)
-        ? { ...value, kid: thumbprint }
-        : value;
-    if (admitted.kid !== thumbprint) {
+    if (value.kid !== (await calculateJwkThumbprint(value))) {
         throw new TypeError(`Cloudflare signing identity '${owner}' must use its JWK thumbprint as kid.`);
     }
     try {
-        await importJWK(admitted, 'EdDSA');
+        await importJWK(value, 'EdDSA');
     }
     catch (cause) {
         throw invalid(owner, cause);
     }
-    return admitted;
+    return value;
 }
 function invalid(owner, cause) {
     throw new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });

package/dist/legacy/direct/deploy.js

@@ -17,8 +17,6 @@ export async function deployCloudflare(parameters, context, dependencies) {
         const identity = await dependencies.signingIdentity({
             projectDir: context.projectDir,
             source: parameters.signingIdentity,
-            origin: context.artifact.build.schema.compiled.root.origin,
-            mode: 'deploy',
         });
         secrets = signingIdentitySecrets(context.secrets, identity);
     }

package/dist/legacy/direct/identity/source.d.ts

@@ -1,4 +1,14 @@
 import { SIGNING_IDENTITY_BINDING } from '../../../identity/binding.js';
+/**
+ * The one stable signing key a direct-mode Worker binds, read from the `signingIdentity` file its
+ * Environment retains. Nothing generates such a file any more: each direct-mode consumer deploys
+ * with the key its stable Worker was installed under, and a new Environment deploys with adapter
+ * astrale, or in namespace mode for platform publishers, both of which generate a key for each
+ * deployment (Identité [.60832]).
+ *
+ * @deprecated Legacy direct mode only. Replacement: `cloudflare({ namespace })`. Deleted with direct
+ * mode (D10, see `../index.ts`).
+ */
 export interface SigningIdentitySource {
     readonly binding: typeof SIGNING_IDENTITY_BINDING;
     readonly path: string;
@@ -7,20 +17,13 @@ export interface SigningIdentitySource {
 }
 export interface SigningIdentityInput {
     readonly projectDir: string;
-    readonly origin: string;
+    /** The Environment's `signingIdentity` file, relative to the Project directory or absolute. */
     readonly source?: string;
-    readonly mode: 'local' | 'deploy';
 }
-/** Resolve one admitted Domain signing identity for local or remote provider custody. */
+/** Read the retained signing key of one direct-mode Environment. */
 export declare function signingIdentity(input: SigningIdentityInput): Promise<SigningIdentitySource>;
 /**
- * Read an explicitly retained deployment identity. Deployment never generates
- * one: a missing file is a pre-provider configuration failure, not an implicit
- * key rotation.
+ * Read an explicitly retained deployment identity. Deployment never generates one: a missing file
+ * is a pre-provider configuration failure, not an implicit key rotation.
  */
 export declare function readSigningIdentity(projectDir: string, declaration: string | undefined): Promise<SigningIdentitySource>;
-/**
- * Resolve local development identity. The default is generated once inside
- * `.astrale`; an explicit source is always read-only and must already exist.
- */
-export declare function localSigningIdentity(projectDir: string, declaration: string | undefined, origin: string): Promise<SigningIdentitySource>;

package/dist/legacy/direct/identity/source.js

@@ -1,97 +1,24 @@
-import { randomUUID } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from '../../../identity/binding.js';
-import { admitSigningIdentity, createSigningIdentity } from '../../../identity/material.js';
-const DEFAULT_IDENTITY = join('.astrale', 'identity.json');
-/** Resolve one admitted Domain signing identity for local or remote provider custody. */
+import { admitSigningIdentity } from '../../../identity/material.js';
+/** Read the retained signing key of one direct-mode Environment. */
 export function signingIdentity(input) {
-    return input.mode === 'local'
-        ? localSigningIdentity(input.projectDir, input.source, input.origin)
-        : readSigningIdentity(input.projectDir, input.source);
+    return readSigningIdentity(input.projectDir, input.source);
 }
 /**
- * Read an explicitly retained deployment identity. Deployment never generates
- * one: a missing file is a pre-provider configuration failure, not an implicit
- * key rotation.
+ * Read an explicitly retained deployment identity. Deployment never generates one: a missing file
+ * is a pre-provider configuration failure, not an implicit key rotation.
  */
 export async function readSigningIdentity(projectDir, declaration) {
     if (declaration === undefined || declaration.length === 0) {
-        throw new TypeError("Cloudflare deployment requires 'signingIdentity: <private-jwk-file>'. " +
-            'Run local development once to create .astrale/identity.json, then retain that file in managed secret storage.');
+        throw new TypeError("Cloudflare direct-mode deployment requires 'signingIdentity: <private-jwk-file>', the " +
+            'retained key of its stable Worker. A new Environment deploys with adapter astrale ' +
+            '(`astrale()`), or, for platform publishers, in namespace mode (`cloudflare({ namespace })`); ' +
+            'both generate a key for each deployment.');
     }
     return readSource(pathOf(projectDir, declaration), declaration);
 }
-/**
- * Resolve local development identity. The default is generated once inside
- * `.astrale`; an explicit source is always read-only and must already exist.
- */
-export async function localSigningIdentity(projectDir, declaration, origin) {
-    if (declaration !== undefined)
-        return readSource(pathOf(projectDir, declaration), declaration);
-    const path = join(projectDir, DEFAULT_IDENTITY);
-    if (!existsSync(path)) {
-        const legacy = join(projectDir, '.astrale', 'identity.ts');
-        if (existsSync(legacy))
-            await migrateLegacyIdentity(legacy, path, origin);
-        else
-            await generateIdentity(path);
-    }
-    return readSource(path, DEFAULT_IDENTITY);
-}
-async function generateIdentity(path) {
-    const value = await createSigningIdentity();
-    if (await installIdentity(path, value)) {
-        process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
-            `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
-    }
-}
-async function migrateLegacyIdentity(legacy, destination, origin) {
-    const source = await readFile(legacy, 'utf8');
-    const match = /export const PRIVATE_JWK = (\{[\s\S]*\}) as const\n?$/u.exec(source);
-    if (match?.[1] === undefined)
-        throw invalidIdentity(legacy);
-    let decoded;
-    try {
-        decoded = JSON.parse(match[1]);
-    }
-    catch (cause) {
-        throw invalidIdentity(legacy, cause);
-    }
-    const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
-    if (await installIdentity(destination, value)) {
-        process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
-    }
-}
-/** Publish a complete owner-only identity once; concurrent environments reuse the winner. */
-async function installIdentity(path, value) {
-    await mkdir(dirname(path), { recursive: true });
-    const staging = `${path}.${process.pid}.${randomUUID()}.next`;
-    const file = await open(staging, 'wx', 0o600);
-    try {
-        await file.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
-        await file.sync();
-    }
-    catch (cause) {
-        await file.close();
-        await unlink(staging).catch(() => undefined);
-        throw cause;
-    }
-    await file.close();
-    try {
-        await link(staging, path);
-        return true;
-    }
-    catch (cause) {
-        if (!(cause instanceof Error && 'code' in cause && cause.code === 'EEXIST'))
-            throw cause;
-        return false;
-    }
-    finally {
-        await unlink(staging).catch(() => undefined);
-    }
-}
 async function readSource(path, declaration) {
     let source;
     try {

package/dist/namespace/deploy-release.d.ts

@@ -46,7 +46,11 @@ export declare function placeNamespace(parameters: CloudflareParams): Placement;
 export declare function deployNamespaceRelease(parameters: CloudflareParams, context: ReleaseDeployContext, dependencies: NamespaceDependencies): Promise<ReleaseDeployResult>;
 /**
  * Keep one published deployment of the platform namespace: its summary's retention becomes
- * `published`, which the platform's preview expiry never retires. Nothing else changes.
+ * `published`, which the platform's preview expiry never retires. Nothing else changes. A label the
+ * namespace holds no active deployment of is a `RetainRefusal` (`absent`, or `retired` once
+ * withdrawn), which no rerun changes; a failed read or write rejects as it is, and a rerun keeps it.
+ * A tombstone withdraws the label whatever its summary still says, as the dispatcher reads it, so
+ * it is refused before the summary is read or written.
  */
 export declare function retainNamespaceDeployment(parameters: CloudflareParams, context: RetainContext, dependencies: NamespaceDependencies): Promise<void>;
 /**

package/dist/namespace/deploy-release.js

@@ -1,3 +1,4 @@
+import { RetainRefusal } from '@astrale-os/sdk/deployment/adapter';
 import { acceptDeploymentRecord, configurationDigest, deploymentContent, deploymentLabel, deploymentLine, deploymentUrl, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, PLATFORM_OWNER, } from '@astrale-os/sdk/deployment/address';
 import { bundleUpload } from '../build/worker/upload.js';
 import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
@@ -56,18 +57,25 @@ export async function deployNamespaceRelease(parameters, context, dependencies)
 }
 /**
  * Keep one published deployment of the platform namespace: its summary's retention becomes
- * `published`, which the platform's preview expiry never retires. Nothing else changes.
+ * `published`, which the platform's preview expiry never retires. Nothing else changes. A label the
+ * namespace holds no active deployment of is a `RetainRefusal` (`absent`, or `retired` once
+ * withdrawn), which no rerun changes; a failed read or write rejects as it is, and a rerun keeps it.
+ * A tombstone withdraws the label whatever its summary still says, as the dispatcher reads it, so
+ * it is refused before the summary is read or written.
  */
 export async function retainNamespaceDeployment(parameters, context, dependencies) {
     const coordinates = namespaceCoordinates(parameters);
     const api = cloudflareApi(coordinates, context.signal, dependencies);
     const routing = await PlatformRouting.open(api, coordinates.routingKvTitle);
+    if ((await routing.retirement(context.label)) !== undefined) {
+        throw new RetainRefusal('retired', `${context.label} was withdrawn and is never served again, so it can no longer be retained.`);
+    }
     const summary = await routing.summary(context.label);
     if (summary === undefined || (await routing.record(context.label)) === undefined) {
-        throw new NamespaceRefusal('deployment-conflict', `The platform namespace has no active deployment ${context.label} to retain.`);
+        throw new RetainRefusal('absent', `The platform namespace has no active deployment ${context.label} to retain.`);
     }
     if (summary.state !== 'active') {
-        throw new NamespaceRefusal('deployment-retired', `${context.label} is ${summary.state} and can no longer be retained.`);
+        throw new RetainRefusal('retired', `${context.label} is ${summary.state} and can no longer be retained.`);
     }
     if (summary.retention === 'published')
         return;
@@ -273,11 +281,13 @@ class NamespaceDeployment {
     }
     /**
      * Write the summary, then the record whose presence activates the label (AM-131), so an active
-     * label always has a summary. A summary already there is kept; so is a record of this release.
+     * label always has a summary. A record of this release already there is kept; so is a summary,
+     * except that it is made to name this script's URL and key when it names another script's.
      */
     async activate(keyId) {
         const { plan } = this;
-        if ((await this.routing.summary(plan.label)) === undefined) {
+        const summary = await this.routing.summary(plan.label);
+        if (summary === undefined) {
             await this.routing.writeSummary({
                 id: plan.label,
                 url: plan.url,
@@ -290,6 +300,12 @@ class NamespaceDeployment {
                 signingKeyId: keyId,
             });
         }
+        else if (summary.url !== plan.url || summary.signingKeyId !== keyId) {
+            // A script deleted outside any retirement leaves its summary naming a key no script holds,
+            // which a later deploy and the platform tooling refuse: it follows the script recreated
+            // under the label, and keeps the label's activation instant, retention and state.
+            await this.routing.writeSummary({ ...summary, url: plan.url, signingKeyId: keyId });
+        }
         const record = await this.routing.activate(plan.record);
         this.applied();
         return record;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.170",
+  "version": "0.5.0-beta.172",
   "description": "Deploy an Astrale Domain through Cloudflare Workers",
   "keywords": [
     "adapter",
@@ -35,10 +35,6 @@
       "types": "./dist/build/index.d.ts",
       "import": "./dist/build/index.js"
     },
-    "./identity": {
-      "types": "./dist/legacy/direct/identity/index.d.ts",
-      "import": "./dist/legacy/direct/identity/index.js"
-    },
     "./worker": {
       "types": "./dist/worker/index.d.ts",
       "import": "./dist/worker/index.js"
@@ -61,7 +57,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.6.0-beta.15",
+    "@astrale-os/sdk": "0.6.0-beta.17",
     "@noble/hashes": "2.3.0",
     "@restatedev/restate-sdk-cloudflare-workers": "1.17.0",
     "hono": "^4.6.20",

package/template/astrale.config.ts

@@ -1,9 +1,19 @@
 /**
  * One Project definition, with explicit software-factory Environments.
  *
- * `pnpm dev` watches and deploys the development Environment remotely. A deploy
- * never installs: install the URL it prints with
- * `astrale domain install <url> --direct -i <instance>`.
+ * Every Environment deploys into the platform's dispatch namespace (namespace
+ * mode), where only the platform deploys: Shell, Services and the other
+ * platform Domains. `astrale-domain deploy <environment>` makes one immutable
+ * deployment of this release, at its own URL under the namespace's routing
+ * domain, with a signing key generated for it, and prints that URL. A deploy
+ * never installs the Domain: install the URL it prints with
+ * `astrale domain install <url> --direct -i <instance>`. Redeploying the same
+ * release reuses its deployment; a changed secrets file is then rewritten in
+ * place on that deployment only.
+ *
+ * `CLOUDFLARE_API_TOKEN` must edit the namespace's scripts and its routing KV,
+ * and `CLOUDFLARE_ACCOUNT_ID` names the account that holds it unless
+ * `namespace.account` does. Neither token nor secret is written here.
  */
 import { cloudflare } from '@astrale-os/adapter-cloudflare'
 import { defineProject } from '@astrale-os/sdk/project'
@@ -11,22 +21,24 @@ import { dataset, tests } from '@astrale-os/sdk/testing'
 
 import { domain } from './domain.js'
 
+/**
+ * The platform dispatch namespace and the DNS name its dispatcher answers
+ * under, as the platform provisioning created them. Replace both placeholders
+ * with the platform's coordinates: a deploy finds the namespace's routing KV
+ * from its name and refuses, before any effect, a namespace without one.
+ */
+const namespace = { name: 'your-platform-namespace', routingDomain: 'deployments.example.dev' }
+
 export default defineProject({
   domain,
 
   environments: {
     development: {
-      deployment: cloudflare({
-        secrets: '.env.dev',
-        signingIdentity: '.astrale/identity.json',
-      }),
+      deployment: cloudflare({ namespace, secrets: '.env.dev' }),
     },
 
     production: {
-      deployment: cloudflare({
-        route: 'astrale-domain.example.dev',
-        signingIdentity: '.astrale/identity.json',
-      }),
+      deployment: cloudflare({ namespace }),
     },
   },
 

package/dist/legacy/direct/identity/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Custody of the one stable signing key a direct-mode Worker binds: the `signingIdentity` file
- * (`.astrale/identity.json`), generated once for local development and read by every remote deploy.
- *
- * @deprecated Legacy direct mode only. Replacement: namespace mode generates a key for each new
- * deployment and binds it once (`cloudflare({ namespace })`); there is no file to keep. Consumers:
- * create-astrale-domain's direct scaffold (until S11) and adapter-astrale's instance mode (until
- * S8). Deleted with direct mode (D10, see `../index.ts`).
- */
-export { signingIdentity } from './source.js';
-export { signingIdentitySecrets } from './secret.js';

package/dist/legacy/direct/identity/index.js

@@ -1,11 +0,0 @@
-/**
- * Custody of the one stable signing key a direct-mode Worker binds: the `signingIdentity` file
- * (`.astrale/identity.json`), generated once for local development and read by every remote deploy.
- *
- * @deprecated Legacy direct mode only. Replacement: namespace mode generates a key for each new
- * deployment and binds it once (`cloudflare({ namespace })`); there is no file to keep. Consumers:
- * create-astrale-domain's direct scaffold (until S11) and adapter-astrale's instance mode (until
- * S8). Deleted with direct mode (D10, see `../index.ts`).
- */
-export { signingIdentity } from './source.js';
-export { signingIdentitySecrets } from './secret.js';