@astrale-os/adapter-cloudflare 0.5.0-beta.176 → 0.5.0-beta.177

package/README.md

@@ -11,85 +11,136 @@ npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
 
 One `cloudflare()` value configures one Project Environment, in one of two modes. With
-`namespace`, each release becomes one immutable deployment in a platform dispatch namespace. Without
-it, the Environment is on the legacy direct mode: one stable Worker, replaced in place by each
-deploy. A deploy never installs: install the URL it prints with
-`astrale domain install <url> --direct -i <instance>`.
+`namespace`, each release becomes one immutable deployment in a Workers for Platforms dispatch
+namespace, on your own Cloudflare account or on a platform's. Without it, the Environment is on the
+legacy direct mode: one stable Worker, replaced in place by each deploy. A deploy never installs:
+install the URL it prints with `astrale domain install <url> --direct -i <instance>`.
 
 Generated Worker modules are minified by default, including separately loaded runtime modules.
 The Environment's `wrangler` overlay cannot change minification: every Environment of one source
 must emit the same JavaScript bytes. `cloudflare({ wrangler: { minify: false } })` is rejected.
 
-## Namespace mode
+## Host it yourself
+
+Anyone with a Cloudflare account, Workers for Platforms and a domain of their own can host
+immutable deployments, with no Astrale infrastructure:
+
+1. **A domain.** Add a zone to Cloudflare and pick a routing domain under it dedicated to the
+   deployments, such as `deploy.example.dev`: every deployment answers at
+   `https://<label>.deploy.example.dev`. Nothing else may serve a host at, under or above it, and
+   its wildcard name needs an edge certificate (Advanced Certificate Manager, or Total TLS).
+2. **A token.** Create an API token with Workers Scripts Edit, Workers KV Storage Edit, Workers
+   Routes Edit and Zone DNS Edit on that zone. Export it as `CLOUDFLARE_API_TOKEN`, with
+   `CLOUDFLARE_ACCOUNT_ID` (and `CLOUDFLARE_ZONE_ID` when the zone cannot be found from the domain).
+3. **The Environment.**
+
+   ```ts
+   production: {
+     deployment: cloudflare({
+       namespace: { name: 'my-deployments', routingDomain: 'deploy.example.dev' },
+       secrets: '.env.production',
+     }),
+   },
+   ```
+
+4. **Provision once.** `astrale-domain cloudflare plan production` reads the account and prints
+   what provisioning does and what blocks it; `astrale-domain cloudflare init production`
+   provisions it (both are commands this adapter declares; `--json` prints the result):
+   the dispatch namespace, its routing KV, the dispatcher Worker (`<name>-dispatcher`, or
+   `--dispatcher <worker>`), a proxied `AAAA 100::` record `*.<domain>` and the route
+   `*.<domain>/*` to the dispatcher, then checks that a never-deployed host reaches it over HTTPS.
+   It is idempotent: a rerun adopts what exists and uploads the dispatcher again.
+5. **Deploy.** `astrale-domain deploy production` prints the deployment URL, which
+   `astrale domain install` takes.
 
-```ts
-production: {
-  deployment: cloudflare({
-    namespace: { name: 'astrale-platform', routingDomain: 'platform.astrale.ai' },
-    secrets: '.env.production',
-  }),
-},
-```
+## Namespace mode
 
-Only the platform deploys there (Shell, Services and the other platform Domains), so every line is
-readable. `astrale-domain deploy <environment>` uploads one script named by the deployment label,
-create-only (`If-None-Match: *`), which answers at `https://<label>.<routingDomain>` through the
-platform dispatcher. Nothing is ever replaced in place: another build or configuration is another
-label.
+`astrale-domain deploy <environment>` uploads one script named by the deployment label, create-only
+(`If-None-Match: *`), which answers at `https://<label>.<routingDomain>` through the namespace's
+dispatcher. Nothing is ever replaced in place: another build or configuration is another label.
+Every line is readable. Namespace mode is a thin layer over the hosting kit below.
 
 - **Credentials.** `CLOUDFLARE_API_TOKEN` must edit the namespace's scripts and the values of its
   routing KV; the account is `namespace.account`, else `CLOUDFLARE_ACCOUNT_ID`. Neither is ever
   written to the configuration.
 - **Routing KV.** The deploy finds the namespace's routing KV by its title,
-  `astrale-deployment-routing-<first 16 bytes of sha256(name), in hexadecimal>`, which the platform
-  provisioning creates. A namespace without it is refused before any effect.
+  `astrale-deployment-routing-<first 16 bytes of sha256(name), in hexadecimal>`, which
+  provisioning creates. A namespace without it is refused before any effect. The names of
+  Services' deployments namespaces (`astrale-deployments-<hex>`) are refused: Services manages
+  their scripts.
 - **Bindings.** Each new deployment binds `WORKER_URL`, `ASTRALE_BUILD_DIGEST`, `ASTRALE_SETTINGS`
-  (the router as `ROUTER`), the author's `vars`, the service bindings of `wrangler.services`, the
-  router, its version metadata, and as `secret_text` exactly the Environment's secrets and
-  `ASTRALE_SIGNING_IDENTITY`, a key generated for that deployment and kept nowhere else. Its tags
-  name its artifact (build digest), line and key; never `astrale-service`, which is Services'.
-- **Activation.** The deploy writes `summary:<label>` (owner `platform`, state `active`, retention
-  `preview`, the activation instant), then `record:<label>`, whose presence makes the dispatcher
-  route the label. Neither ever holds a provider version or a secret digest. Readiness then waits,
-  bounded, until the URL serves the sealed release from the provider version the upload created.
+  (the router as `ROUTER`), the author's `vars`, the service and dispatch namespace bindings of
+  `wrangler`, the router, its version metadata, and as `secret_text` exactly the Environment's
+  secrets and `ASTRALE_SIGNING_IDENTITY`, a key generated for that deployment and kept nowhere
+  else. Its tags name its artifact (build digest), line and key; never `astrale-service`, which is
+  Services'.
+- **Activation.** The deploy writes `record:<label>`, whose presence makes the dispatcher route the
+  label; it never holds a provider version or a secret digest. Readiness then waits, bounded,
+  until the URL serves the sealed release from the provider version the upload created.
 - **Reuse.** A redeploy of the same release finds the script under its label. It is reused only
   when its artifact and line tags and its record name this build and configuration (or, when an
   interrupted deploy left it unactivated, when it binds exactly this configuration). Then only that
   script's declared secrets are rewritten in place, and readiness waits for the version the
   rewrite minted. Anything else is a `deployment-conflict`, refused with nothing written; no other
-  deployment is ever touched.
-- **Retention.** `retain` (called once a Publication commits) marks the summary `published`, which
-  the platform's preview expiry never retires. A label the platform withdrew (`retirement:<label>`)
-  answers `DEPLOYMENT_RETIRED` at the dispatcher and is refused by every later deploy.
-- **Listing.** `astrale-domain list` lists the Environment's deployments from the routing KV, and
-  writes nothing: one row per `summary:<label>` of the Environment's line, with its record as
-  `record:<label>` stores it (a record the SDK refuses is listed with `record: null` and the
-  refusal), and the call target `{ kind: 'namespace', namespace, script }` that the platform's
-  per-script tooling takes, such as its in-place secret rotation. A summary without its record is
-  `deploying` (not activated), and an active one whose label carries the tombstone is `retiring`.
-  Nothing on the namespace records last calls: they come from its calls dataset,
-  `astrale_deployment_calls_<the same hexadecimal>`, through the Analytics Engine SQL API, and an
-  active preview expires 30 days after the later of its activation and its last call. The token
-  then also needs Account Analytics Read; without it, the deployments are listed without last calls
-  or expiries.
+  deployment is ever touched. A `summary:<label>` an older adapter wrote is ignored.
+- **Retirement.** A label whose `retirement:<label>` the kit's `markRetired` wrote answers
+  `DEPLOYMENT_RETIRED` at the dispatcher and is refused by every later deploy. The namespace keeps
+  every deployment until then: there is no retention, preview expiry or `retain`.
+- **Listing.** `astrale-domain list` lists the Environment's deployments from the routing KV and
+  the namespace, and writes nothing: one row per label of the Environment's line that
+  `record:<label>` activated or `retirement:<label>` withdrew, with its record as stored (a record
+  the SDK refuses is listed with `record: null` and the refusal), its script's creation instant and
+  key while the script exists, and the call target `{ kind: 'namespace', namespace, script }`. Its
+  state is `active`, `retiring` (tombstoned, script not deleted yet), `retired` (script deleted) or
+  `failed` (activated, script gone).
 - **Refused.** A direct-mode parameter beside `namespace` (`route`, `workerName`, `identityIssuer`,
   `addressing`, `signingIdentity`), a `router.binding` other than `ROUTER`, and any `wrangler` key
   but `services`, `dispatch_namespaces` and `compatibility_flags`, `triggers` first: an immutable
   deployment runs no cron of its own. A `dispatch_namespaces` entry is exactly
   `{ binding, namespace }`; it is frozen into the configuration (`bindings.dispatchNamespaces`), so
-  into the label, bound at the create-only upload, and never names the platform namespace the
-  deployment lives in (AM-174). Which namespaces a deployment may bind is its host's to decide.
+  into the label, bound at the create-only upload, and never names the namespace the deployment
+  lives in (AM-174). Which namespaces a deployment may bind is its host's to decide.
   `durable` is frozen into the configuration (`settings.durableOptions`, AM-175), so into the
   label, and bound in `ASTRALE_SETTINGS`: a durable run stays on the deployment that started it.
 
+## Hosting kit
+
+`@astrale-os/adapter-cloudflare/hosting` is the one implementation of this hosting, for namespace
+mode and for any other host that keeps its own routing beside it. Everything but provisioning runs in
+Node and inside a Worker (`fetch` and WebCrypto only).
+
+- **Client.** `CloudflareClient`: bounded bodies, `Retry-After`/429 waits by policy
+  (`DEFAULT_RATE_LIMIT`, `OPERATOR_RATE_LIMIT` or none), timeouts and a deadline, typed
+  `CloudflareApiError`s (`kind`, `status`, `codes`), cursor and numbered pagination, multipart
+  forms and raw KV text.
+- **Routing KV.** `RoutingKv` (by title or id) and the contract: `record:<label>` (canonical
+  `DeploymentRecordV1`, written once; re-publication only for the same release, `sameRelease`),
+  `retirement:<label>` (`withdrawn`), `current:<name>` (one of the name's labels), `cron:<name>`
+  (canonical UTC crons). Every write is read back before it counts.
+- **Scripts.** `deploymentBindings`, `deploymentTags` (with a host's extra tags),
+  `uploadDeploymentScript` (create-only, every module kind, assets in parallel),
+  `observeScript`, `scriptSettings`, `scriptSecretNames`, `putScriptSecret`, `deleteScript`, and
+  `createSigningIdentity` (WebCrypto Ed25519).
+- **Lifecycle.** `activateDeployment`, `promoteDeployment`, `replaceSchedules`, two-phase retirement
+  (`markRetired`, then `completeRetirement` once `retirementVisible` sees the dispatcher answer
+  `DEPLOYMENT_RETIRED`), `waitForReadiness` through the public URL or a dispatch binding, and
+  `listLineDeployments`.
+- **Dispatcher.** Plain ES modules shipped with the package (`dispatcherModules()`), routing a label
+  to its script, a name to `current:<name>`, and firing `cron:<name>` on schedule. A host prepends
+  its own routing and schedule targets with `createDispatcher(extension)` in its own `index.mjs`,
+  without forking it. The public never reaches `/__scheduled`; nothing in the generated Worker
+  serves it yet.
+- **Provisioning.** `planHosting` reads; `applyHosting` refuses any blocker before its first write;
+  `provisionHosting` does both.
+- **Testing.** `@astrale-os/adapter-cloudflare/hosting/testing` exports `FakeCloudflare`, one fake
+  account that serves public requests with the real dispatcher.
+
 ## Legacy direct mode
 
 Deprecated: replaced by namespace mode, and deleted with the legacy deploy path (D10) once no
-configuration on any repository's main selects direct mode. Its consumers until they move: the
-domains configurations of ai-gateway, closing, grc, integrations and issues; domains organization,
-whose `prod` binds an EU-jurisdiction R2 bucket that namespace mode does not admit yet; the Services
-`beta`, `prod` and `development` environments and its frozen `admin-beta`; the Shell and its frozen
-`legacy-v3`; and ui:domain.
+configuration on any repository's main selects direct mode. Its consumers until they move: domains
+organization, whose `prod` binds an EU-jurisdiction R2 bucket that namespace mode does not admit
+yet, and the SDK's own e2e fixture (`__e2e__/flagship/fixtures/v1`).
 
 `astrale-domain deploy <environment>` builds locally and deploys the Worker and frontend
 remotely. Omitting `route` uses the observed stable `*.workers.dev` issuer.
@@ -134,20 +185,6 @@ publish them. Unlike the names above, the match is case-sensitive, as Wrangler's
 and a nested `docs/_worker.js` remain ordinary files. Remove such a file from the public directory,
 or rename it if it is a browser script.
 
-## Provider-local staging
-
-Managed Cloudflare providers may stage immutable implementation candidates without exposing their
-identity to Publications or installed Kernels:
-
-```ts
-import { stagedWorkerName } from '@astrale-os/adapter-cloudflare/release'
-```
-
-This subpath is runtime-safe. `stagedWorkerName(providerDeployment)` addresses one private staged
-candidate. The public Worker name and `/invoke` endpoint remain stable across compatible
-implementation and Schema updates. Provider staging identity never enters Release, Publication,
-Kernel routing, or graph identity.
-
 ## Deployment bindings
 
 The bundled Worker carries no Environment value, so every Environment of one source bundles the

package/dist/adapter.d.ts

@@ -9,16 +9,17 @@ export type { NamespaceDependencies } from './namespace/index.js';
 export interface CloudflareDependencies extends CloudflareDeployDependencies {
     readonly artifact: typeof artifact;
     readonly signingIdentity: typeof signingIdentity;
-    /** The effects of namespace mode. Default: `fetch`, `process.env`, a new key, the clock. */
+    /** The effects of namespace mode. Default: `fetch`, `process.env` and a new WebCrypto key. */
     readonly namespace?: NamespaceDependencies;
 }
 /**
  * Deploy one Project Environment through Cloudflare Workers.
  *
- * With `namespace`, each release becomes one immutable deployment in that platform dispatch
- * namespace (adapter interface v2), and `astrale-domain list` lists them. Without it, the
- * Environment stays on the legacy direct mode: one stable Worker replaced in place by each deploy
- * (CT33).
+ * With `namespace`, each release becomes one immutable deployment in that dispatch namespace
+ * (adapter interface v2), `astrale-domain list` lists them, and the adapter's commands
+ * `astrale-domain cloudflare plan|init <environment>` provision the namespace on your own account.
+ * Without it, the Environment stays on the legacy direct mode: one stable Worker replaced in place
+ * by each deploy (CT33).
  */
 export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, Adapter<CloudflareParams>>;
 export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, Adapter<CloudflareParams>>;

package/dist/adapter.js

@@ -1,19 +1,20 @@
 import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adapter';
 import { createRequire } from 'node:module';
 import { cloudflareWorkerBundler } from './build/bundler.js';
-import { createSigningIdentity } from './identity/material.js';
+import { createSigningIdentity } from './hosting/identity.js';
 import { artifact, deployCloudflare, directReadiness, materialize, runWranglerDeploymentStatus, runWranglerRollout, signingIdentity, } from './legacy/direct/index.js';
-import { admitNamespace, configureNamespace, deployNamespaceRelease, listNamespaceDeployments, placeNamespace, retainNamespaceDeployment, } from './namespace/index.js';
+import { admitNamespace, configureNamespace, deployNamespaceRelease, listNamespaceDeployments, hostingCommands, placeNamespace, } from './namespace/index.js';
 export { waitForReadiness } from './legacy/direct/index.js';
 const packageVersion = createRequire(import.meta.url)('../package.json')
     .version;
 /**
  * Deploy one Project Environment through Cloudflare Workers.
  *
- * With `namespace`, each release becomes one immutable deployment in that platform dispatch
- * namespace (adapter interface v2), and `astrale-domain list` lists them. Without it, the
- * Environment stays on the legacy direct mode: one stable Worker replaced in place by each deploy
- * (CT33).
+ * With `namespace`, each release becomes one immutable deployment in that dispatch namespace
+ * (adapter interface v2), `astrale-domain list` lists them, and the adapter's commands
+ * `astrale-domain cloudflare plan|init <environment>` provision the namespace on your own account.
+ * Without it, the Environment stays on the legacy direct mode: one stable Worker replaced in place
+ * by each deploy (CT33).
  */
 export function cloudflare(parameters = {}) {
     return cloudflareWithDependencies(parameters, {
@@ -36,7 +37,7 @@ export function cloudflareWithDependencies(parameters, dependencies) {
         placement: async (parameters) => placeNamespace(parameters),
         deployRelease: (parameters, context) => deployNamespaceRelease(parameters, context, namespace),
         list: (parameters, context) => listNamespaceDeployments(parameters, context, namespace),
-        retain: (parameters, context) => retainNamespaceDeployment(parameters, context, namespace),
+        commands: hostingCommands(namespace),
         // Legacy direct mode (CT33 `legacy-direct`), deleted with it (D10).
         prepare: dependencies.artifact,
         deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
@@ -54,6 +55,5 @@ function platformNamespaceDependencies() {
         fetch: (input, init) => fetch(input, init),
         environment: process.env,
         createSigningIdentity,
-        now: () => new Date(),
     });
 }

package/dist/hosting/activation.d.ts

@@ -0,0 +1,30 @@
+import type { DeploymentRecordV1 } from '@astrale-os/sdk/deployment/address';
+import type { RoutingKv } from './kv.js';
+/**
+ * Activate one deployment: publish its record at `record:<label>`, which the dispatcher reads to
+ * route the label and serves at `/.well-known/astrale/deployment.json`. A record never changes once
+ * published: a record already there is kept and answered when it declares the same release
+ * (`sameRelease`, so only its commit may differ), and refused (`deployment-conflict`) otherwise,
+ * without any write.
+ */
+export declare function activateDeployment(kv: RoutingKv, record: DeploymentRecordV1): Promise<DeploymentRecordV1>;
+/** The record a label was activated with, admitted, or undefined when it is not activated. */
+export declare function readRecord(kv: RoutingKv, label: string): Promise<DeploymentRecordV1 | undefined>;
+/**
+ * Point a name (a deployment line) at the deployment its URL `https://<name>.<routing domain>`
+ * serves: `current:<name>` = `label`, or no deployment when `label` is null (the key is deleted).
+ * The label must be one of the name's own. Writing the same value again writes nothing, so a rerun
+ * converges.
+ */
+export declare function promoteDeployment(kv: RoutingKv, name: string, label: string | null): Promise<void>;
+/** The deployment a name serves now, or null. */
+export declare function readCurrent(kv: RoutingKv, name: string): Promise<string | null>;
+/**
+ * Replace a name's crons with canonical UTC crons (`cron:<name>`), or delete them when the set is
+ * empty. A set that is not canonical is refused (`schedules-invalid`) before anything is written.
+ * The dispatcher fires a due cron on the name's current deployment, once its upload bound a
+ * `cron` trigger.
+ */
+export declare function replaceSchedules(kv: RoutingKv, name: string, crons: readonly string[]): Promise<readonly string[]>;
+/** A name's crons: empty when it has none; a stored set that is not canonical is refused. */
+export declare function readSchedules(kv: RoutingKv, name: string): Promise<readonly string[]>;

package/dist/hosting/activation.js

@@ -0,0 +1,71 @@
+import { cronKey, currentKey, decodeCurrent, decodeRecord, decodeSchedules, encodeRecord, encodeSchedules, isLabelOf, recordKey, sameRelease, } from './kv.js';
+import { HostingRefusal } from './refusal.js';
+/**
+ * Activate one deployment: publish its record at `record:<label>`, which the dispatcher reads to
+ * route the label and serves at `/.well-known/astrale/deployment.json`. A record never changes once
+ * published: a record already there is kept and answered when it declares the same release
+ * (`sameRelease`, so only its commit may differ), and refused (`deployment-conflict`) otherwise,
+ * without any write.
+ */
+export async function activateDeployment(kv, record) {
+    const label = record.providerScript;
+    const text = encodeRecord(record);
+    const stored = await readRecord(kv, label);
+    if (stored !== undefined) {
+        if (!sameRelease(stored, record)) {
+            throw new HostingRefusal('deployment-conflict', `Another record is already published for ${label}; nothing was written.`);
+        }
+        return stored;
+    }
+    await kv.put(recordKey(label), text, 'application/json');
+    return record;
+}
+/** The record a label was activated with, admitted, or undefined when it is not activated. */
+export async function readRecord(kv, label) {
+    const text = await kv.get(recordKey(label));
+    return text === undefined ? undefined : decodeRecord(text, label);
+}
+/**
+ * Point a name (a deployment line) at the deployment its URL `https://<name>.<routing domain>`
+ * serves: `current:<name>` = `label`, or no deployment when `label` is null (the key is deleted).
+ * The label must be one of the name's own. Writing the same value again writes nothing, so a rerun
+ * converges.
+ */
+export async function promoteDeployment(kv, name, label) {
+    if (label !== null && !isLabelOf(label, name)) {
+        throw new HostingRefusal('route-invalid', `${label} is not a deployment of ${name}.`);
+    }
+    if ((await kv.get(currentKey(name))) === (label ?? undefined))
+        return;
+    if (label === null)
+        await kv.delete(currentKey(name));
+    else
+        await kv.put(currentKey(name), label, 'text/plain');
+}
+/** The deployment a name serves now, or null. */
+export async function readCurrent(kv, name) {
+    const text = await kv.get(currentKey(name));
+    return text === undefined ? null : decodeCurrent(text, name);
+}
+/**
+ * Replace a name's crons with canonical UTC crons (`cron:<name>`), or delete them when the set is
+ * empty. A set that is not canonical is refused (`schedules-invalid`) before anything is written.
+ * The dispatcher fires a due cron on the name's current deployment, once its upload bound a
+ * `cron` trigger.
+ */
+export async function replaceSchedules(kv, name, crons) {
+    const encoded = encodeSchedules(crons);
+    if (encoded.text === undefined) {
+        if ((await kv.get(cronKey(name))) !== undefined)
+            await kv.delete(cronKey(name));
+    }
+    else {
+        await kv.put(cronKey(name), encoded.text, 'application/json');
+    }
+    return encoded.crons;
+}
+/** A name's crons: empty when it has none; a stored set that is not canonical is refused. */
+export async function readSchedules(kv, name) {
+    const text = await kv.get(cronKey(name));
+    return text === undefined ? Object.freeze([]) : decodeSchedules(text, name);
+}

package/dist/hosting/assets.d.ts

@@ -0,0 +1,14 @@
+import type { CloudflareClient } from './client.js';
+/** One static asset of a deployment, served by its Worker through the `ASSETS` binding. */
+export interface ScriptAsset {
+    /** The URL path it is served at, `/`-prefixed. */
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    readonly contentType?: string;
+}
+/**
+ * Upload one script's static assets through its namespace's asset upload session, the buckets
+ * Cloudflare asks for in parallel (at most `CLOUDFLARE_FAN_OUT` at once), and answer the completion
+ * token the script upload binds them with.
+ */
+export declare function uploadAssets(client: CloudflareClient, namespace: string, script: string, assets: readonly ScriptAsset[]): Promise<string>;

package/dist/hosting/assets.js

@@ -0,0 +1,53 @@
+import { CLOUDFLARE_FAN_OUT, mapBounded } from './bounded.js';
+import { base64, sha256Hex } from './bytes.js';
+import { CloudflareApiError } from './client.js';
+/**
+ * Upload one script's static assets through its namespace's asset upload session, the buckets
+ * Cloudflare asks for in parallel (at most `CLOUDFLARE_FAN_OUT` at once), and answer the completion
+ * token the script upload binds them with.
+ */
+export async function uploadAssets(client, namespace, script, assets) {
+    const byHash = new Map();
+    const manifest = {};
+    for (const asset of assets) {
+        const hash = (await sha256Hex(asset.bytes)).slice(0, 32);
+        byHash.set(hash, asset);
+        manifest[asset.path] = { hash, size: asset.bytes.byteLength };
+    }
+    const session = decodeSession(await client.json('POST', client.account(`/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(script)}/assets-upload-session`), { manifest }));
+    if (session.buckets.length === 0)
+        return session.jwt;
+    const tokens = await mapBounded(session.buckets, CLOUDFLARE_FAN_OUT, async (bucket) => {
+        const form = new FormData();
+        for (const hash of bucket) {
+            const asset = byHash.get(hash);
+            if (asset === undefined)
+                invalid('Cloudflare asked for an unknown asset.');
+            form.append(hash, new File([base64(asset.bytes)], hash, {
+                type: asset.contentType ?? 'application/octet-stream',
+            }));
+        }
+        const result = (await client.form('POST', client.account('/workers/assets/upload?base64=true'), form, { bearer: session.jwt }));
+        return typeof result?.jwt === 'string' && result.jwt.length > 0 ? result.jwt : undefined;
+    });
+    const completion = tokens.find((token) => token !== undefined);
+    if (completion === undefined)
+        invalid('Cloudflare returned no asset completion token.');
+    return completion;
+}
+function decodeSession(value) {
+    const session = value;
+    if (typeof session?.jwt !== 'string' || session.jwt.length === 0) {
+        invalid('Cloudflare returned an invalid asset upload session.');
+    }
+    const buckets = session.buckets ?? [];
+    if (!Array.isArray(buckets) ||
+        buckets.some((bucket) => !Array.isArray(bucket) ||
+            bucket.some((hash) => typeof hash !== 'string' || hash.length === 0))) {
+        invalid('Cloudflare returned invalid asset upload buckets.');
+    }
+    return { jwt: session.jwt, buckets: buckets };
+}
+function invalid(message) {
+    throw new CloudflareApiError('upstream', message);
+}

package/dist/hosting/bounded.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Cloudflare API requests one fan-out keeps in flight. A Worker invocation holds at most six
+ * simultaneous connections, and Cloudflare's API rate limit is per user (the token owner).
+ */
+export declare const CLOUDFLARE_FAN_OUT = 6;
+/**
+ * Map items through a sliding window of at most `limit` operations, preserving item order. The
+ * first failure stops new work and rejects once the work already in flight settles.
+ */
+export declare function mapBounded<Item, Result>(items: readonly Item[], limit: number, operation: (item: Item) => Promise<Result>): Promise<Result[]>;

package/dist/hosting/bounded.js

@@ -0,0 +1,32 @@
+/**
+ * Cloudflare API requests one fan-out keeps in flight. A Worker invocation holds at most six
+ * simultaneous connections, and Cloudflare's API rate limit is per user (the token owner).
+ */
+export const CLOUDFLARE_FAN_OUT = 6;
+/**
+ * Map items through a sliding window of at most `limit` operations, preserving item order. The
+ * first failure stops new work and rejects once the work already in flight settles.
+ */
+export async function mapBounded(items, limit, operation) {
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+        throw new RangeError('Fan-out limit must be a positive safe integer.');
+    }
+    const results = [];
+    let failure;
+    let next = 0;
+    const worker = async () => {
+        while (failure === undefined && next < items.length) {
+            const index = next++;
+            try {
+                results[index] = await operation(items[index]);
+            }
+            catch (cause) {
+                failure ??= { cause };
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    if (failure !== undefined)
+        throw failure.cause;
+    return results;
+}

package/dist/hosting/bytes.d.ts

@@ -0,0 +1,6 @@
+/** The lower-case hexadecimal SHA-256 of text (UTF-8) or bytes, with WebCrypto. */
+export declare function sha256Hex(input: string | Uint8Array): Promise<string>;
+/** Bytes as base64, in chunks small enough for `String.fromCharCode`. */
+export declare function base64(bytes: Uint8Array): string;
+/** Bytes as unpadded base64url. */
+export declare function base64url(bytes: Uint8Array): string;

package/dist/hosting/bytes.js

@@ -0,0 +1,25 @@
+const encoder = new TextEncoder();
+/** The lower-case hexadecimal SHA-256 of text (UTF-8) or bytes, with WebCrypto. */
+export async function sha256Hex(input) {
+    const bytes = typeof input === 'string' ? encoder.encode(input) : input;
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return hex(new Uint8Array(digest));
+}
+/** Bytes as base64, in chunks small enough for `String.fromCharCode`. */
+export function base64(bytes) {
+    let binary = '';
+    for (let offset = 0; offset < bytes.byteLength; offset += 32_768) {
+        binary += String.fromCharCode(...bytes.subarray(offset, offset + 32_768));
+    }
+    return btoa(binary);
+}
+/** Bytes as unpadded base64url. */
+export function base64url(bytes) {
+    return base64(bytes).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/u, '');
+}
+function hex(bytes) {
+    let text = '';
+    for (const byte of bytes)
+        text += byte.toString(16).padStart(2, '0');
+    return text;
+}