@astrale-os/adapter-cloudflare 0.5.0-beta.178 → 0.5.0-beta.179

package/README.md

@@ -10,11 +10,10 @@ npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 
 Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
 
-One `cloudflare()` value configures one Project Environment, in one of two modes. With
-`namespace`, each release becomes one immutable deployment in a Workers for Platforms dispatch
-namespace, on your own Cloudflare account or on a platform's. Without it, the Environment is on the
-legacy direct mode: one stable Worker, replaced in place by each deploy. A deploy never installs:
-install the URL it prints with `astrale domain install <url> --direct -i <instance>`.
+One `cloudflare()` value configures one Project Environment in a Workers for Platforms dispatch
+namespace. Each release becomes one immutable deployment on your own Cloudflare account or on a
+platform's. A deploy never installs: install the URL it prints with
+`astrale domain install <url> -i <instance>`.
 
 Generated Worker modules are minified by default, including separately loaded runtime modules.
 The Environment's `wrangler` overlay cannot change minification: every Environment of one source
@@ -74,10 +73,10 @@ Every line is readable. Namespace mode is a thin layer over the hosting kit belo
   secrets and `ASTRALE_SIGNING_IDENTITY`, a key generated for that deployment and kept nowhere
   else. Its tags name its artifact (build digest), line and key; never `astrale-service`, which is
   Services'.
-- **Activation.** The deploy writes `record:<label>`, whose presence makes the dispatcher route the
-  label: the canonical `DeploymentRecordV1`, published through the kit's opaque record with its
-  media type, which the dispatcher serves at `/.well-known/astrale/deployment.json`. It never holds
-  a provider version or a secret digest. Readiness then waits, bounded, until the URL serves the
+- **Activation.** The deploy writes `record:<label>` with its media type metadata, whose presence
+  makes the dispatcher route the label: the canonical `DeploymentRecordV1`, published through the
+  kit's opaque record, which the dispatcher serves at `/.well-known/astrale/deployment.json`. It
+  never holds a provider version or a secret digest. Readiness then waits, bounded, until the URL serves the
   sealed release from the provider version the upload created.
 - **Reuse.** A redeploy of the same release finds the script under its label. It is reused only
   when its artifact and line tags and its record name this build and configuration (only the
@@ -120,9 +119,10 @@ Node and inside a Worker (`fetch` and WebCrypto only).
   record, opaque bytes with their media type in the value's metadata, `{"contentType":...}`, or
   `-` with `{"contentType":null}` for a deployment that publishes none; written once and kept only
   for the same bytes and media type), `retirement:<label>` (`withdrawn`), `current:<name>` (one of
-  the name's labels), `cron:<name>` (canonical UTC crons). A record written before records were
-  opaque has no metadata: it is a canonical `DeploymentRecordV1`, read and served as one. Every
-  write is read back before it counts.
+  the name's labels), `cron:<name>` (canonical UTC crons). The record's metadata is mandatory: a
+  `record:<label>` without it activates nothing at the dispatcher (every path of the label answers
+  as not active yet, and no cron fires on it) and the kit refuses it (`record-invalid`) instead of
+  reading it as any record. Every write is read back before it counts.
 - **Scripts.** `deploymentBindings`, `deploymentTags` (with a host's extra tags),
   `uploadDeploymentScript` (create-only, every module kind, assets in parallel),
   `observeScript`, `scriptSettings`, `scriptSecretNames`, `putScriptSecret`, `deleteScript`, and
@@ -137,53 +137,19 @@ Node and inside a Worker (`fetch` and WebCrypto only).
   to its script, a name to `current:<name>`, and firing `cron:<name>` on schedule. It serves a
   label's record at `/.well-known/astrale/deployment.json`, its bytes and media type as published
   (immutable, `405` but for `GET` and `HEAD`), and hands that path to a deployment that publishes
-  none. A host prepends
-  its own routing and schedule targets with `createDispatcher(extension)` in its own `index.mjs`,
-  without forking it. The public never reaches `/__scheduled`; nothing in the generated Worker
-  serves it yet.
+  none. `createDispatcher()` owns routing and schedule admission. The public never reaches
+  `/__scheduled`; cron targets serve that internal POST endpoint.
 - **Provisioning.** `planHosting` reads; `applyHosting` refuses any blocker before its first write;
   `provisionHosting` does both.
 - **Testing.** `@astrale-os/adapter-cloudflare/hosting/testing` exports `FakeCloudflare`, one fake
   account that serves public requests with the real dispatcher.
 
-## Legacy direct mode
-
-Deprecated: replaced by namespace mode, and deleted with the legacy deploy path (D10) once no
-configuration on any repository's main selects direct mode. Its consumers until they move: domains
-organization, whose `prod` binds an EU-jurisdiction R2 bucket that namespace mode does not admit
-yet, and the SDK's own e2e fixture (`__e2e__/flagship/fixtures/v1`).
-
-`astrale-domain deploy <environment>` builds locally and deploys the Worker and frontend
-remotely. Omitting `route` uses the observed stable `*.workers.dev` issuer.
-
-For an existing Worker, a deploy uploads a candidate, reconciles
-configured triggers, and stages the candidate at 0% while the previous version retains 100% of normal
-HTTP traffic. Exact-version probes verify Publication, Bundle, and serving identity before promotion;
-serving the Publication also initializes the Domain Runtime. After promotion, normal requests
-must prove that exact version again. A failed candidate remains at 0% and can be replaced on retry.
-Bundled View routes must also serve the prepared browser-file generation before readiness passes.
-This covers frontend-only changes without changing the Schema or reinstalling the Domain. HTML is
-revalidated on every use and transient asset misses are not cached; ordinary successful asset
-responses keep their cache policy. Frontend files are answered by the Worker's small startup module
-without loading the execution Service, which each such file starts loading in the background for the
-calls the View makes next.
-The first deployment uses ordinary Worker provisioning because no previous version exists to retain.
-An existing traffic-split rollout must be resolved before this single-version workflow can continue.
-
-A direct Cloudflare target shared across machines must still have one external writer, normally a
-CI/CD concurrency group. Live deployment checks detect competing changes but are not an atomic
-compare-and-swap or distributed lock. Use separate Worker targets for uncoordinated development.
-Routes, custom domains, schedules, and other non-versioned provider settings are reconciled through
-Wrangler before candidate probing; they can remain changed after a failed attempt. Candidate readiness
-protects the HTTP implementation, not an atomic rollback of external resources or trigger settings.
-
 ## Frontend files
 
 The Worker runs before Workers Static Assets on every request and owns frontend response headers
 and routing, for `cloudflare()` and `astrale()` deployments alike. Frontend preparation therefore
 refuses a built frontend whose root contains `_headers`, `_redirects`, or `.assetsignore`, in any
-letter case, as a file or a directory. Wrangler would apply them as asset configuration in a direct
-deployment, while a managed deployment would serve them as public files. The refusal happens while
+letter case, as a file or a directory. Wrangler and managed deployments would otherwise interpret these files differently. The refusal happens while
 the artifact is prepared, before any provider change. Vite copies its public directory (`public/`
 by default) to that root: remove them there, or stop the plugin that emits them. The same names
 below the root, such as `docs/_headers`, remain ordinary files.
@@ -205,26 +171,18 @@ same bytes. Each deployment binds its own values as plain Worker bindings:
 | --- | --- |
 | `WORKER_URL` | serving origin of the deployment |
 | `ASTRALE_SETTINGS` | canonical JSON of `{ invocationTimeoutMs, maximumRequestBytes, router, tokenExchange }`, defaults resolved, with optional `durableOptions` |
-| `ASTRALE_BUILD_DIGEST` | build digest the host recomputed from the uploaded bytes, bound only by hosts that deploy immutable Workers; never by a stable Worker |
-| `IDENTITY_ISS`, `ASTRALE_PROVIDER_ASSIGNED_WORKER` | **legacy direct mode only** (deprecated): a stable issuer behind another route, and the workers.dev claim |
+| `ASTRALE_BUILD_DIGEST` | required build digest the host recomputed from the uploaded bytes |
 
 These names are adapter-owned: preparation refuses an author var, or a `wrangler.vars` entry, that
 takes one, and deployment refuses a secret that does. A host that deploys the Worker itself encodes
 the settings with `encodeWorkerSettings` from `@astrale-os/adapter-cloudflare/worker`. A generated
 Worker refuses execution without `ASTRALE_SETTINGS`.
 
-`ASTRALE_BUILD_DIGEST` selects what the Worker serves. Bound, the Worker is an immutable deployment:
-it seals the `DomainRelease` v4 of its code at its `WORKER_URL`, which is its issuer, and serves it
-at `/.well-known/astrale/release.json` beside its frozen v3 projection at `domain.json`; it admits
-only routing that names that exact release or projection. Unbound, it is a stable Worker and serves
-exactly the v3 Publication of today, answering 404 at `release.json`. The Worker refuses execution,
-instead of falling back to v3, when the digest is malformed, when it is bound without `WORKER_URL`,
-or beside a direct-mode binding or a configured `identityIssuer`.
-
-The two direct-mode bindings are deprecated. Their replacement is an immutable deployment, whose
-host binds `WORKER_URL` to the deployment URL, which is also its issuer (namespace mode). They are
-deleted with direct mode, once the Shell, Services, Issues, domains and ui configurations deploy in
-namespace mode and no installation pins a direct Worker.
+Every Worker requires `WORKER_URL` and `ASTRALE_BUILD_DIGEST`. It seals the `DomainRelease` v4
+of its code at that serving URL, which is also its issuer, and serves it at
+`/.well-known/astrale/release.json`. Routing must name that exact Release. The Worker refuses
+execution when either binding is missing or invalid; a foreign request origin is refused before
+loading the Service. `domain.json` serves no compatibility projection.
 
 The `wrangler` overlay reaches the deployment configuration, never the bundle. Preparation refuses
 an overlay key the bundler reads (`alias`, `build`, `define`, `jsx_factory`, `jsx_fragment`,
@@ -240,14 +198,13 @@ digest, and `deploy` places that same Bundle. Two installed versions of this pac
 copies of the bundler: when their code differs, `build` prints one build digest per copy and warns
 until the adapter versions are aligned.
 
-Services receives the placed modules as they are, so there the digest names the bytes the
-deployment runs. Direct mode runs `wrangler deploy`, which bundles the placed modules again: there
-the digest names the portable Worker the deployment was made from, not the bytes Cloudflare runs.
-A host that receives a Worker upload recomputes the digest from the exact upload with
-`workerBuildDigest` (`@astrale-os/sdk/deployment/worker`), given the members of the Bundle's build
-manifest its deployer declares (`format`, `version`, `origin`, `schema`, `bundler`): modules keep
-their uploaded name and an asset `/<path>` is the file `assets/<path>`, so the digest is the
-Bundle's own. The bundler version names this layout, not a package release.
+Services and namespace deployments upload the placed modules unchanged, so the digest names the
+bytes the deployment runs. A host with its own Worker entrypoint describes its final upload with
+`workerBuildManifest` and `WorkerUpload` from `@astrale-os/adapter-cloudflare/build`, then computes
+its digest with `buildDigest` from `@astrale-os/sdk/deployment/build/manifest`. Modules retain
+their uploaded names and an asset `/<path>` becomes the file `assets/<path>`. The host binds that
+digest as `ASTRALE_BUILD_DIGEST` and uploads those exact bytes without bundling them again.
+The bundler version names this layout, not a package release.
 
 ## Material for a custom Worker entrypoint
 
@@ -264,8 +221,12 @@ await writeFile('src/build-material.gen.ts', generateBuildMaterialModule(build))
 
 The generated TypeScript module exports `loadBuildMaterial()`. Call it from the
 `load` callback of `generatedCloudflareWorkerEntry` alongside the Domain's Runtime.
+That callback loads deterministic local modules once per entrypoint. Concurrent execution and
+`prepare()` calls share the same result, including a rejection; subsequent calls do not retry it.
+A newly constructed entrypoint starts independently. Keep remote preparation that may recover
+from transient failures in its own lifecycle, rather than putting it in `load`.
 Such an entrypoint states its execution settings (`invocationTimeoutMs`, `maximumRequestBytes`,
-`tokenExchange`, `routeSubrequest`, `identityIssuer`) in its configuration, or reads them from its
+`tokenExchange`, `routeSubrequest`) in its configuration, or reads them from its
 deployment bindings with `settings: deploymentSettings`; one Worker never takes both.
 It constructs the same verified, deduplicated material as the adapter's generated Service;
 allocation is deferred until the factory is called and the SDK deep-freezes it before use.

package/dist/adapter.d.ts

@@ -1,25 +1,11 @@
 import type { Deployment } from '@astrale-os/sdk/deployment';
 import type { Adapter } from '@astrale-os/sdk/deployment/adapter';
-import type { CloudflareDeployDependencies } from './legacy/direct/index.js';
 import type { NamespaceDependencies } from './namespace/index.js';
 import type { CloudflareParams } from './params.js';
-import { artifact, signingIdentity } from './legacy/direct/index.js';
-export { waitForReadiness, type ReadinessCheck } from './legacy/direct/index.js';
 export type { NamespaceDependencies } from './namespace/index.js';
-export interface CloudflareDependencies extends CloudflareDeployDependencies {
-    readonly artifact: typeof artifact;
-    readonly signingIdentity: typeof signingIdentity;
-    /** The effects of namespace mode. Default: `fetch`, `process.env` and a new WebCrypto key. */
-    readonly namespace?: NamespaceDependencies;
+export interface CloudflareDependencies {
+    readonly namespace: NamespaceDependencies;
 }
-/**
- * Deploy one Project Environment through Cloudflare Workers.
- *
- * With `namespace`, each release becomes one immutable deployment in that dispatch namespace
- * (adapter interface v2), `astrale-domain list` lists them, and the adapter's commands
- * `astrale-domain cloudflare plan|init <environment>` provision the namespace on your own account.
- * Without it, the Environment stays on the legacy direct mode: one stable Worker replaced in place
- * by each deploy (CT33).
- */
-export declare function cloudflare(parameters?: CloudflareParams): Deployment<CloudflareParams, Adapter<CloudflareParams>>;
+/** Deploy each release as one immutable deployment in a Cloudflare dispatch namespace. */
+export declare function cloudflare(parameters: CloudflareParams): Deployment<CloudflareParams, Adapter<CloudflareParams>>;
 export declare function cloudflareWithDependencies(parameters: CloudflareParams, dependencies: CloudflareDependencies): Deployment<CloudflareParams, Adapter<CloudflareParams>>;

package/dist/adapter.js

@@ -1,33 +1,17 @@
 import { defineAdapter, defineDeployment } from '@astrale-os/sdk/deployment/adapter';
 import { createRequire } from 'node:module';
 import { cloudflareWorkerBundler } from './build/bundler.js';
+import { workerSettings } from './build/configuration.js';
 import { createSigningIdentity } from './hosting/identity.js';
-import { artifact, deployCloudflare, directReadiness, materialize, runWranglerDeploymentStatus, runWranglerRollout, signingIdentity, } from './legacy/direct/index.js';
-import { admitNamespace, configureNamespace, deployNamespaceRelease, listNamespaceDeployments, hostingCommands, placeNamespace, } from './namespace/index.js';
-export { waitForReadiness } from './legacy/direct/index.js';
+import { configureNamespace, deployNamespaceRelease, listNamespaceDeployments, hostingCommands, namespaceCoordinates, placeNamespace, } from './namespace/index.js';
 const packageVersion = createRequire(import.meta.url)('../package.json')
     .version;
-/**
- * Deploy one Project Environment through Cloudflare Workers.
- *
- * With `namespace`, each release becomes one immutable deployment in that dispatch namespace
- * (adapter interface v2), `astrale-domain list` lists them, and the adapter's commands
- * `astrale-domain cloudflare plan|init <environment>` provision the namespace on your own account.
- * Without it, the Environment stays on the legacy direct mode: one stable Worker replaced in place
- * by each deploy (CT33).
- */
-export function cloudflare(parameters = {}) {
-    return cloudflareWithDependencies(parameters, {
-        artifact,
-        materialize,
-        runWranglerRollout,
-        runWranglerDeploymentStatus,
-        signingIdentity,
-        waitForReadiness: directReadiness,
-    });
+/** Deploy each release as one immutable deployment in a Cloudflare dispatch namespace. */
+export function cloudflare(parameters) {
+    return cloudflareWithDependencies(parameters, { namespace: platformNamespaceDependencies() });
 }
 export function cloudflareWithDependencies(parameters, dependencies) {
-    const namespace = dependencies.namespace ?? platformNamespaceDependencies();
+    const namespace = dependencies.namespace;
     const adapter = defineAdapter({
         name: 'cloudflare',
         version: packageVersion,
@@ -38,17 +22,28 @@ export function cloudflareWithDependencies(parameters, dependencies) {
         deployRelease: (parameters, context) => deployNamespaceRelease(parameters, context, namespace),
         list: (parameters, context) => listNamespaceDeployments(parameters, context, namespace),
         commands: hostingCommands(namespace),
-        // Legacy direct mode (CT33 `legacy-direct`), deleted with it (D10).
-        prepare: dependencies.artifact,
-        deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
         secretsFile: (parameters) => parameters.secrets,
     });
     return defineDeployment(adapter, parameters);
 }
-/** Refuse a malformed `namespace` when the Project is defined, before any build. */
+/** Validate the deployment contract when the Project loads, before any build or provider effect. */
 function admitCloudflare(parameters) {
-    if (parameters.namespace !== undefined)
-        admitNamespace(parameters.namespace);
+    const allowed = [
+        'namespace',
+        'secrets',
+        'vars',
+        'maximumRequestBytes',
+        'invocationTimeoutMs',
+        'tokenExchange',
+        'durable',
+        'wrangler',
+        'router',
+    ];
+    if (Reflect.ownKeys(parameters).some((key) => !allowed.includes(key))) {
+        throw new TypeError('Cloudflare deployment parameters contain unknown fields.');
+    }
+    namespaceCoordinates(parameters);
+    workerSettings(parameters);
 }
 function platformNamespaceDependencies() {
     return Object.freeze({

package/dist/build/configuration/router.js

@@ -1,9 +1,15 @@
 export function resolveRouter(input) {
     if (input === false || input === undefined)
         return undefined;
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => !['service', 'hostSuffix', 'minLabels'].includes(String(key)))) {
+        throw new TypeError('Cloudflare router parameters contain unknown fields.');
+    }
     const value = input;
     return Object.freeze({
-        binding: value.binding ?? 'ROUTER',
+        binding: 'ROUTER',
         service: value.service ?? 'admin-router',
         hostSuffix: value.hostSuffix ?? '.astrale.ai',
         minLabels: value.minLabels ?? 4,

package/dist/build/configuration/settings.d.ts

@@ -3,4 +3,4 @@ import type { WorkerSettings } from '../../worker/settings.js';
 /** Whether a binding name is one the adapter owns, so no author var or secret may take it. */
 export declare function isAdapterVar(name: string): boolean;
 /** Resolve one Environment's execution settings, defaults included, as its deployment binds them. */
-export declare function workerSettings(parameters: CloudflareParams): WorkerSettings;
+export declare function workerSettings(parameters: Pick<CloudflareParams, 'durable' | 'maximumRequestBytes' | 'invocationTimeoutMs' | 'tokenExchange' | 'router'>): WorkerSettings;

package/dist/build/configuration/settings.js

@@ -6,14 +6,12 @@ import { workerRequestLimit } from './request-limit.js';
 import { resolveRouter } from './router.js';
 /**
  * Plain bindings the adapter owns on a deployment, bound or not; no author var or secret takes
- * these names. `IDENTITY_ISS` and `ASTRALE_PROVIDER_ASSIGNED_WORKER` belong to legacy direct mode.
+ * these names.
  */
 const ADAPTER_VARS = new Set([
     'WORKER_URL',
     BUILD_DIGEST_BINDING,
     SETTINGS_BINDING,
-    'IDENTITY_ISS',
-    'ASTRALE_PROVIDER_ASSIGNED_WORKER',
 ]);
 /** Whether a binding name is one the adapter owns, so no author var or secret may take it. */
 export function isAdapterVar(name) {

package/dist/build/frontend/readiness.d.ts

@@ -1,9 +1,15 @@
-import type { legacy } from '@astrale-os/sdk/deployment/release';
+import type { Release } from '@astrale-os/sdk/deployment/release';
 import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
-import type { WorkerArtifact } from '../worker/artifact.js';
 type ReadinessFetch = NonNullable<NonNullable<Parameters<typeof verifyReadiness>[1]>['fetch']>;
-/** Publication equality alone cannot prove a frontend-only deployment has propagated. */
-export declare function verifyWorkerFrontend(release: legacy.Release, worker: Pick<WorkerArtifact, 'assets'>, options?: {
+/** Release equality alone cannot prove a frontend-only deployment has propagated. */
+export declare function verifyWorkerFrontend(release: Release, worker: {
+    readonly assets?: {
+        readonly files: readonly {
+            readonly path: string;
+            bytes(): Uint8Array;
+        }[];
+    };
+}, options?: {
     readonly fetch?: ReadinessFetch;
     readonly signal?: AbortSignal;
 }): Promise<void>;

package/dist/build/frontend/readiness.js

@@ -1,5 +1,5 @@
 import { frontendRevision } from './revision.js';
-/** Publication equality alone cannot prove a frontend-only deployment has propagated. */
+/** Release equality alone cannot prove a frontend-only deployment has propagated. */
 export async function verifyWorkerFrontend(release, worker, options = {}) {
     const frontend = release.build.frontend;
     if (frontend === undefined || frontend.source.kind === 'external')
@@ -9,7 +9,7 @@ export async function verifyWorkerFrontend(release, worker, options = {}) {
     const expected = frontendRevision(worker.assets.files);
     const fetcher = options.fetch ?? globalThis.fetch;
     for (const route of frontend.routes) {
-        const response = await fetcher(new URL(route.path, release.addressing.publicUrl).href, {
+        const response = await fetcher(new URL(route.path, release.url).href, {
             redirect: 'error',
             ...(options.signal === undefined ? {} : { signal: options.signal }),
         });

package/dist/build/index.d.ts

@@ -1,8 +1,7 @@
 export { generateBuildMaterialModule } from './material.js';
 export { cloudflareWorkerBundler } from './bundler.js';
-export { loadWorkerArtifact } from './worker/index.js';
-export type { WorkerArtifact } from './worker/index.js';
-export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, type BundleUpload, } from './worker/upload.js';
+export { bundleUpload, type BundleUpload } from './worker/upload.js';
+export { workerBuildManifest, type WorkerUpload } from '../release/build.js';
 export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
 export { encodeWorkerSettings, SETTINGS_BINDING } from '../worker/settings.js';
 export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
@@ -11,9 +10,3 @@ export { verifyWorkerFrontend } from './frontend/readiness.js';
 export { qualifyWorkerBundle } from './qualification.js';
 export { assertSingletonRuntimeRoots } from './roots.js';
 export { runWranglerBundle, runWranglerTypes } from '../wrangler/index.js';
-/**
- * @deprecated Legacy direct mode only (`../legacy/direct/index.ts`): preparation of a stable
- * Worker, its Wrangler deployment and its name. Replacement: `cloudflare({ namespace })`, which
- * deploys one immutable deployment per release. Deleted with direct mode (D10).
- */
-export { artifact, materialize, prepareWorkerArtifact, runWranglerDeploy, runWranglerDeploymentStatus, workerName, } from '../legacy/direct/index.js';

package/dist/build/index.js

@@ -1,7 +1,7 @@
 export { generateBuildMaterialModule } from './material.js';
 export { cloudflareWorkerBundler } from './bundler.js';
-export { loadWorkerArtifact } from './worker/index.js';
-export { bundleUpload, uploadBuildDigest, uploadBuildEvidence, workerUpload, } from './worker/upload.js';
+export { bundleUpload } from './worker/upload.js';
+export { workerBuildManifest } from '../release/build.js';
 export { isAdapterVar, resolveRouter, workerSettings } from './configuration.js';
 export { encodeWorkerSettings, SETTINGS_BINDING } from '../worker/settings.js';
 export { GENERATED_WORKER_RUNTIME } from './codegen/wrangler.js';
@@ -10,9 +10,3 @@ export { verifyWorkerFrontend } from './frontend/readiness.js';
 export { qualifyWorkerBundle } from './qualification.js';
 export { assertSingletonRuntimeRoots } from './roots.js';
 export { runWranglerBundle, runWranglerTypes } from '../wrangler/index.js';
-/**
- * @deprecated Legacy direct mode only (`../legacy/direct/index.ts`): preparation of a stable
- * Worker, its Wrangler deployment and its name. Replacement: `cloudflare({ namespace })`, which
- * deploys one immutable deployment per release. Deleted with direct mode (D10).
- */
-export { artifact, materialize, prepareWorkerArtifact, runWranglerDeploy, runWranglerDeploymentStatus, workerName, } from '../legacy/direct/index.js';

package/dist/build/worker/codegen/service.js

@@ -10,8 +10,8 @@ export function generateExecutionService(options) {
     verifySharedLiteral(material, generated);
     const materialDeclarations = material.declarations.map((line) => `    ${line}\n`).join('');
     const durableImports = options.durable === true
-        ? `import { RESTATE_IDENTITY_KEYS_BINDING, restateServing } from ${JSON.stringify(workerSpecifier)}
-import { isCanonicalDurableRequest, isLegacyDurableRequest } from '@astrale-os/sdk/execution'
+        ? `import { restateServing } from ${JSON.stringify(workerSpecifier)}
+import { isCanonicalDurableRequest } from '@astrale-os/sdk/execution'
 // A variable specifier preserves the engine as a separate deployed module.
 const RESTATE_SPECIFIER = ${JSON.stringify(options.restateSpecifier ?? './restate.mjs')}
 `
@@ -22,14 +22,13 @@ const RESTATE_SPECIFIER = ${JSON.stringify(options.restateSpecifier ?? './restat
     return `// AUTO-GENERATED by @astrale-os/adapter-cloudflare — do not edit.
 // Domain origin: ${options.origin}
 import type { BuildMaterial, GeneratedBuildMaterial } from '@astrale-os/sdk/deployment/build'
-import type { CloudflareAdapterBindings${options.durable === true ? ', DurableBindings' : ''} } from ${JSON.stringify(workerSpecifier)}
+import type { CloudflareAdapterBindings } from ${JSON.stringify(workerSpecifier)}
 
 import { generatedCloudflareWorkerEntry } from ${JSON.stringify(workerSpecifier)}
 import { decodeSigningIdentity, deploymentSettings, runtimeBindings } from ${JSON.stringify(workerSpecifier)}
-import { withDirectIssuer } from ${JSON.stringify(workerSpecifier)}
 
 ${durableImports}
-type WorkerEnv = CloudflareEnv & CloudflareAdapterBindings${options.durable === true ? ' & DurableBindings' : ''} & {
+type WorkerEnv = CloudflareEnv & CloudflareAdapterBindings & {
   readonly ASTRALE_SIGNING_IDENTITY: string
 }
 type RuntimeEnv = Omit<WorkerEnv, 'ASTRALE_SIGNING_IDENTITY'>
@@ -43,14 +42,13 @@ ${materialDeclarations}    return {
   },
   privateKey: (env) => decodeSigningIdentity(env.ASTRALE_SIGNING_IDENTITY),
   resolveEnvironment: runtimeBindings,
-  // Legacy direct mode: a bound IDENTITY_ISS signs instead of the serving origin.
-  settings: withDirectIssuer(deploymentSettings),
+  settings: deploymentSettings,
   selfBinding: (env) => env.SELF,${options.durable === true
         ? `
   durable: async (env, request, options) => {
-    if (!isCanonicalDurableRequest(request) && !(isLegacyDurableRequest(request) && env[RESTATE_IDENTITY_KEYS_BINDING]?.trim())) return undefined
+    if (!isCanonicalDurableRequest(request)) return undefined
     const restate = await import(RESTATE_SPECIFIER)
-    return restateServing(restate, env, options, request)
+    return restateServing(restate, request, options)
   },`
         : ''}
 })

package/dist/build/worker/media-type.d.ts

@@ -0,0 +1 @@
+export declare function inferMediaType(path: string): string | undefined;

package/dist/build/worker/media-type.js

@@ -0,0 +1,20 @@
+export function inferMediaType(path) {
+    const extension = path.split('.').at(-1)?.toLowerCase();
+    return extension === undefined ? undefined : MEDIA_TYPES[extension];
+}
+const MEDIA_TYPES = Object.freeze({
+    html: 'text/html; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+    mjs: 'text/javascript; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    json: 'application/json; charset=utf-8',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    ico: 'image/x-icon',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    wasm: 'application/wasm',
+});

package/dist/build/worker/modules.d.ts

@@ -1,4 +1,4 @@
-import type { WorkerArtifact } from './artifact.js';
+import type { WorkerModuleKind } from '@astrale-os/sdk/deployment/worker';
 type WranglerModuleType = 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
 /**
  * Project one admitted Worker module inventory into Wrangler's relative module discovery. Rules
@@ -6,7 +6,10 @@ type WranglerModuleType = 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
  */
 export declare function workerModules(worker: {
     readonly entrypoint: string;
-    readonly modules: readonly Pick<WorkerArtifact['release']['modules'][number], 'path' | 'kind'>[];
+    readonly modules: readonly {
+        readonly path: string;
+        readonly kind: WorkerModuleKind;
+    }[];
 }): {
     readonly baseDir: string;
     readonly rules: readonly {

package/dist/build/worker/upload.d.ts

@@ -1,10 +1,5 @@
-import type { Bundle, PreparedArtifact } from '@astrale-os/sdk/deployment/adapter';
-import type { Build } from '@astrale-os/sdk/deployment/build';
-import type { BuildDigest } from '@astrale-os/sdk/deployment/build/manifest';
-import type { WorkerArtifact } from './artifact.js';
+import type { Bundle } from '@astrale-os/sdk/deployment/adapter';
 import { type WorkerUpload } from '../../release/build.js';
-/** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
-export declare function workerUpload(artifact: PreparedArtifact, worker: WorkerArtifact): WorkerUpload;
 /**
  * The portable upload of one Bundle of the Cloudflare Worker bundler, as an immutable deployment's
  * host receives it: the entry and the modules it loads (ES modules and their WASM), and the
@@ -26,14 +21,3 @@ export interface BundleUpload extends WorkerUpload {
         readonly contentType?: string;
     }[];
 }
-/** Build digest of the portable upload of one prepared Worker. */
-export declare function uploadBuildDigest(artifact: PreparedArtifact, worker: WorkerArtifact): BuildDigest;
-/** Record that preparation placed the CLI's Bundle for this Build. */
-export declare function recordPlacedBundle(build: Build): void;
-/**
- * The `build` field of one prepared Worker's provider evidence: the build digest of its portable
- * upload, present only when its preparation placed the CLI's Bundle.
- */
-export declare function uploadBuildEvidence(artifact: PreparedArtifact, worker: WorkerArtifact): {
-    readonly build?: BuildDigest;
-};

package/dist/build/worker/upload.js

@@ -1,25 +1,8 @@
 import { buildDigest } from '@astrale-os/sdk/deployment/build/manifest';
 import { workerBuildManifest } from '../../release/build.js';
 import { bundledWorker } from '../bundler.js';
-import { inferMediaType } from './artifact.manifest.js';
 import { RELEASE_ENTRY } from './execution.prepare.js';
-/** The portable upload of one prepared Worker: exactly the modules and assets Services receives. */
-export function workerUpload(artifact, worker) {
-    const root = artifact.build.schema.compiled.root;
-    if (worker.origin !== root.origin || worker.revision !== root.revision) {
-        throw new TypeError('Worker artifact differs from its prepared Build.');
-    }
-    return Object.freeze({
-        origin: root.origin,
-        revision: root.revision,
-        bundle: artifact.build.schema.bundle.ref.digest,
-        entry: worker.release.entrypoint,
-        modules: worker.release.modules.map((module) => ({ name: module.path, bytes: module.bytes() })),
-        ...(worker.assets === undefined
-            ? {}
-            : { assets: worker.assets.files.map((file) => ({ path: file.path, bytes: file.bytes() })) }),
-    });
-}
+import { inferMediaType } from './media-type.js';
 /**
  * The portable upload of one Bundle of the Cloudflare Worker bundler, as an immutable deployment's
  * host receives it: the entry and the modules it loads (ES modules and their WASM), and the
@@ -57,24 +40,3 @@ export function bundleUpload(bundle) {
     }
     return upload;
 }
-/** Build digest of the portable upload of one prepared Worker. */
-export function uploadBuildDigest(artifact, worker) {
-    return buildDigest(workerBuildManifest(workerUpload(artifact, worker)));
-}
-/**
- * Builds whose preparation placed the Bundle `astrale-domain deploy` passed (`PrepareContext.bundle`).
- * Only a CLI that passes a Bundle reads `ProviderDeploymentEvidence.build`: an older one refuses an
- * evidence field it does not know, after the provider has applied the upload.
- */
-const placedBuilds = new WeakSet();
-/** Record that preparation placed the CLI's Bundle for this Build. */
-export function recordPlacedBundle(build) {
-    placedBuilds.add(build);
-}
-/**
- * The `build` field of one prepared Worker's provider evidence: the build digest of its portable
- * upload, present only when its preparation placed the CLI's Bundle.
- */
-export function uploadBuildEvidence(artifact, worker) {
-    return placedBuilds.has(artifact.build) ? { build: uploadBuildDigest(artifact, worker) } : {};
-}

package/dist/hosting/activation.d.ts

@@ -11,8 +11,9 @@ import type { RoutingKv } from './kv.js';
 export declare function activateDeployment(kv: RoutingKv, label: string, record: WorkerRecord | null): Promise<WorkerRecord | null>;
 /**
  * The record a label was activated with: the record, `null` when the deployment publishes none,
- * or undefined when the label is not activated. A record written before records were opaque,
- * without metadata, is the `DeploymentRecordV1` it holds, with that media type.
+ * or undefined when the label is not activated. A value whose metadata is not exactly
+ * `{"contentType":<media type or null>}` (none at all included) is no record the kit writes, and
+ * is refused (`record-invalid`) rather than read as any record.
  */
 export declare function readRecord(kv: RoutingKv, label: string): Promise<WorkerRecord | null | undefined>;
 /** Whether two activations publish the same record (or both none). */