@astrale-os/adapter-cloudflare 0.5.0-beta.2 → 0.5.0-beta.20

package/README.md

@@ -0,0 +1,11 @@
+# `@astrale-os/adapter-cloudflare`
+
+Cloudflare Worker deployment adapter for Astrale Domains.
+
+During the SDK beta program, install the beta package set explicitly:
+
+```bash
+npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
+```
+
+Bare installs return to stable releases when the package set is promoted and npm `latest` advances.

package/dist/adapter.d.ts

@@ -0,0 +1,17 @@
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import type { CloudflareParams } from './params.js';
+import { artifact } from './build/artifact.js';
+import { startFrontend } from './build/frontend-v1.js';
+import { runWranglerDev } from './build/wrangler-cli.js';
+import { type CloudflareDeployDependencies } from './deploy/index.js';
+import { signingIdentity } from './identity/source.js';
+export interface CloudflareDependencies extends CloudflareDeployDependencies {
+    readonly artifact: typeof artifact;
+    readonly runWranglerDev: typeof runWranglerDev;
+    readonly startFrontend: typeof startFrontend;
+    readonly signingIdentity: typeof signingIdentity;
+}
+export declare function cloudflare(environments: Readonly<Record<string, CloudflareParams>>): import("@astrale-os/sdk/deployment/adapter").Adapter<CloudflareParams>;
+export declare function cloudflareWithDependencies(environments: Readonly<Record<string, CloudflareParams>>, dependencies: CloudflareDependencies): import("@astrale-os/sdk/deployment/adapter").Adapter<CloudflareParams>;
+export declare function waitForReadiness(verify: typeof verifyReadiness, release: Release): Promise<void>;

package/dist/adapter.js

@@ -0,0 +1,140 @@
+import { defineAdapter } from '@astrale-os/sdk/deployment/adapter';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { artifact, materialize } from './build/artifact.js';
+import { generateWranglerConfig } from './build/codegen/wrangler.js';
+import { resolveRouter, workerName } from './build/configuration.js';
+import { startFrontend } from './build/frontend-v1.js';
+import { ensureWranglerDispatchNamespace, runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev, runWranglerReleaseDeploy, } from './build/wrangler-cli.js';
+import { deployCloudflare } from './deploy/index.js';
+import { signingIdentitySecrets } from './identity/secret.js';
+import { signingIdentity } from './identity/source.js';
+const packageVersion = createRequire(import.meta.url)('../package.json')
+    .version;
+export function cloudflare(environments) {
+    return cloudflareWithDependencies(environments, {
+        artifact,
+        materialize,
+        ensureWranglerDispatchNamespace,
+        runWranglerDeploy,
+        runWranglerReleaseDeploy,
+        runWranglerDeploymentStatus,
+        runWranglerDev,
+        startFrontend,
+        signingIdentity,
+        waitForReadiness: (release) => waitForReadiness(verifyReadiness, release),
+    });
+}
+export function cloudflareWithDependencies(environments, dependencies) {
+    return defineAdapter({
+        name: 'cloudflare',
+        version: packageVersion,
+        environments,
+        prepare: dependencies.artifact,
+        async watch(parameters, context) {
+            const identity = await dependencies.signingIdentity({
+                projectDir: context.projectDir,
+                source: parameters.signingIdentity,
+                origin: context.artifact.build.schema.compiled.root.origin,
+                mode: 'local',
+            });
+            const secrets = signingIdentitySecrets(context.secrets, identity);
+            const directory = join(context.projectDir, '.astrale', 'runtime');
+            await dependencies.materialize(directory, context.artifact.files);
+            const frontend = await dependencies.startFrontend({
+                frontend: context.artifact.build.frontend,
+                projectDir: context.projectDir,
+            });
+            const name = workerName(parameters, context.artifact.build.schema.compiled.root.origin);
+            const router = resolveRouter(parameters.router);
+            const configPath = join(directory, 'wrangler.watch.jsonc');
+            await writeFile(configPath, generateWranglerConfig({
+                workerName: name,
+                vars: {
+                    ...parameters.vars,
+                    ...(parameters.host === undefined ? {} : { WORKER_URL: parameters.host }),
+                    ...(frontend === undefined ? {} : { FRONTEND_DEV_URL: frontend.url }),
+                },
+                secretBindings: Object.keys(secrets).sort(),
+                ...(context.artifact.build.frontend?.source.kind === 'vite'
+                    ? {
+                        frontend: {
+                            directory: './frontend',
+                            routes: frontendRoutes(context.artifact),
+                            dev: true,
+                        },
+                    }
+                    : {}),
+                ...(router === undefined
+                    ? {}
+                    : { router: { binding: router.binding, service: router.service } }),
+                ...(parameters.wrangler === undefined ? {} : { wrangler: parameters.wrangler }),
+                selfBinding: true,
+            }));
+            let worker;
+            try {
+                worker = await dependencies.runWranglerDev({
+                    projectDir: context.projectDir,
+                    configPath,
+                    port: parameters.port ?? 8787,
+                    remote: parameters.remote ?? false,
+                    secrets,
+                    autoPickPort: parameters.port === undefined,
+                    ...(parameters.host === undefined ? {} : { ip: '0.0.0.0' }),
+                    onReload: context.onReload,
+                });
+            }
+            catch (cause) {
+                await frontend?.stop().catch(() => undefined);
+                throw cause;
+            }
+            return Object.freeze({
+                url: parameters.host ?? worker.url,
+                localUrl: worker.url,
+                async stop() {
+                    const results = await Promise.allSettled([
+                        worker.stop(),
+                        frontend?.stop() ?? Promise.resolve(),
+                    ]);
+                    const failures = results.filter((result) => result.status === 'rejected');
+                    if (failures.length === 1)
+                        throw failures[0].reason;
+                    if (failures.length > 1) {
+                        throw new AggregateError(failures.map((failure) => failure.reason), 'Cloudflare development cleanup failed.');
+                    }
+                },
+            });
+        },
+        deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
+        secretsFile: (parameters) => parameters.secrets,
+    });
+}
+function frontendRoutes(artifact) {
+    const frontend = artifact.build.frontend;
+    if (frontend === undefined || frontend.source.kind !== 'vite')
+        return [];
+    return Object.freeze(frontend.routes
+        .flatMap((route) => frontend.source.kind === 'vite' && frontend.source.spa && route.path !== '/'
+        ? [route.path, `${route.path}/*`]
+        : route.path === '/'
+            ? ['/*']
+            : [route.path])
+        .sort());
+}
+export async function waitForReadiness(verify, release) {
+    const deadline = Date.now() + 90_000;
+    let last;
+    while (Date.now() < deadline) {
+        try {
+            await verify(release, { signal: AbortSignal.timeout(5_000) });
+            return;
+        }
+        catch (cause) {
+            last = cause;
+            await new Promise((resolve) => setTimeout(resolve, 1_000));
+        }
+    }
+    throw last instanceof Error ? last : new Error('Cloudflare Release did not become ready.');
+}

package/dist/build/artifact.d.ts

@@ -0,0 +1,8 @@
+import type { ArtifactSource, PrepareContext } from '@astrale-os/sdk/deployment/adapter';
+import type { CloudflareParams } from '../params.js';
+/** Prepare one revision Service and its stateless gateway without provider mutation. */
+export declare function artifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;
+export declare function materialize(root: string, files: readonly {
+    readonly path: string;
+    bytes(): Uint8Array;
+}[]): Promise<void>;

package/dist/build/artifact.js

@@ -0,0 +1,179 @@
+import { material } from '@astrale-os/sdk/deployment/build';
+import { addressing } from '@astrale-os/sdk/deployment/release';
+import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
+import { releaseNamespace, releaseWorkerName } from '../release/index.js';
+import { generateExecutionEntry } from './codegen/execution.js';
+import { generateGatewayEntry } from './codegen/gateway.js';
+import { generateWranglerConfig } from './codegen/wrangler.js';
+import { deploymentAddressing, resolveRouter, workerName } from './configuration.js';
+import { frontendFiles } from './frontend-v1.js';
+import { qualifyWorkerBundle } from './qualification.js';
+import { runWranglerBundle } from './wrangler-cli.js';
+const encoder = new TextEncoder();
+/** Prepare one revision Service and its stateless gateway without provider mutation. */
+export async function artifact(params, context) {
+    const stateDirectory = join(context.projectDir, '.astrale');
+    const directory = join(stateDirectory, 'runtime');
+    await mkdir(directory, { recursive: true });
+    const runtimePath = resolve(context.projectDir, context.runtime.reference.path);
+    const runtimeSpecifier = moduleSpecifier(relative(directory, runtimePath));
+    const router = resolveRouter(params.router);
+    const name = workerName(params, context.build.schema.compiled.root.origin);
+    const revision = context.build.schema.compiled.root.revision;
+    const namespace = releaseNamespace(name);
+    const target = releaseWorkerName(revision);
+    const configuredIssuer = deploymentAddressing(params);
+    const source = generateExecutionEntry({
+        origin: context.build.schema.compiled.root.origin,
+        runtimeSpecifier,
+        material: material(context.build),
+        ...(configuredIssuer === undefined ? { providerAssignedWorker: name } : {}),
+        ...(router === undefined
+            ? {}
+            : {
+                router: {
+                    binding: router.binding,
+                    hostSuffix: router.hostSuffix,
+                    minLabels: router.minLabels,
+                },
+            }),
+    });
+    const sourcePath = join(directory, 'worker.gen.ts');
+    await writeFile(sourcePath, source);
+    const configPath = join(directory, 'wrangler.prepare.jsonc');
+    await writeFile(configPath, generateWranglerConfig({
+        workerName: name,
+        ...(params.route === undefined ? {} : { route: params.route }),
+        vars: {
+            ...params.vars,
+            ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
+        },
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+        selfBinding: false,
+    }));
+    const output = join(directory, 'dist-prepare');
+    await rm(output, { recursive: true, force: true });
+    const emitted = await runWranglerBundle({
+        projectDir: context.projectDir,
+        configPath,
+        outDir: output,
+    });
+    const frontend = await frontendFiles({
+        frontend: context.build.frontend,
+        projectDir: context.projectDir,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: emitted.metafilePath,
+        inputRoot: dirname(configPath),
+    });
+    await admitBundle(emitted.bundlePath);
+    const bundle = await readFile(emitted.bundlePath);
+    const gatewaySource = join(directory, 'gateway.gen.ts');
+    await writeFile(gatewaySource, generateGatewayEntry(revision));
+    const gatewayPrepareConfig = join(directory, 'wrangler.gateway.prepare.jsonc');
+    await writeFile(gatewayPrepareConfig, generateWranglerConfig({
+        workerName: name,
+        main: './gateway.gen.ts',
+        ...(params.route === undefined ? {} : { route: params.route }),
+        releases: { binding: 'RELEASES', namespace },
+        selfBinding: false,
+    }));
+    const gatewayOutput = join(directory, 'dist-gateway');
+    await rm(gatewayOutput, { recursive: true, force: true });
+    const gateway = await runWranglerBundle({
+        projectDir: context.projectDir,
+        configPath: gatewayPrepareConfig,
+        outDir: gatewayOutput,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: gateway.metafilePath,
+        inputRoot: dirname(gatewayPrepareConfig),
+    });
+    await admitBundle(gateway.bundlePath);
+    const gatewayBundle = await readFile(gateway.bundlePath);
+    const releaseConfig = generateWranglerConfig({
+        workerName: target,
+        main: './bundle/index.mjs',
+        vars: {
+            ...params.vars,
+            ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
+        },
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        ...(context.build.frontend?.source.kind === 'vite'
+            ? {
+                frontend: {
+                    directory: './frontend',
+                    routes: frontendRoutes(context.build.frontend),
+                    dev: false,
+                },
+            }
+            : {}),
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+        selfBinding: false,
+    });
+    const gatewayConfig = generateWranglerConfig({
+        workerName: name,
+        main: './gateway/index.mjs',
+        ...(params.route === undefined ? {} : { route: params.route }),
+        releases: { binding: 'RELEASES', namespace },
+        selfBinding: false,
+    });
+    const files = [
+        { path: 'wrangler.release.jsonc', content: encoder.encode(releaseConfig) },
+        { path: 'wrangler.gateway.jsonc', content: encoder.encode(gatewayConfig) },
+        { path: 'bundle/index.mjs', content: new Uint8Array(bundle) },
+        { path: 'gateway/index.mjs', content: new Uint8Array(gatewayBundle) },
+        ...frontend.map((file) => ({
+            path: `frontend/${file.path}`,
+            content: file.bytes(),
+        })),
+    ];
+    return Object.freeze({
+        entrypoint: 'bundle/index.mjs',
+        files: Object.freeze(files),
+        addressing: configuredIssuer === undefined
+            ? Object.freeze({ kind: 'provider-assigned', claim: name })
+            : Object.freeze({ kind: 'configured', addressing: addressing(configuredIssuer) }),
+    });
+}
+async function admitBundle(path) {
+    const loaded = (await import(`${pathToFileURL(path).href}?admit=${Date.now()}`));
+    if (loaded.default === null ||
+        typeof loaded.default !== 'object' ||
+        typeof Reflect.get(loaded.default, 'fetch') !== 'function') {
+        throw new TypeError('Generated Worker bundle does not export a Fetch handler.');
+    }
+}
+function frontendRoutes(frontend) {
+    if (frontend.source.kind !== 'vite')
+        return [];
+    return Object.freeze(frontend.routes
+        .flatMap((route) => frontend.source.kind === 'vite' && frontend.source.spa && route.path !== '/'
+        ? [route.path, `${route.path}/*`]
+        : route.path === '/'
+            ? ['/*']
+            : [route.path])
+        .sort());
+}
+export async function materialize(root, files) {
+    await rm(root, { recursive: true, force: true });
+    for (const file of files) {
+        const path = join(root, file.path);
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, file.bytes());
+    }
+}
+function moduleSpecifier(input) {
+    const normalized = input.split('\\').join('/');
+    return normalized.startsWith('.') ? normalized : `./${normalized}`;
+}

package/dist/build/closure.d.ts

@@ -0,0 +1,2 @@
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export declare function assertRuntimeClosure(metafilePath: string): Promise<void>;

package/dist/build/closure.js

@@ -0,0 +1,22 @@
+import { readWranglerMetafile } from './metafile.js';
+const FORBIDDEN_RUNTIME_INPUTS = [
+    '/v1/builder/',
+    '/v1/compiled/compiler/',
+    '/node_modules/ajv/',
+    '/node_modules/re2js/',
+    '/kernel-core/domain/',
+    '/core/domain/',
+    '/kernel-core/schema/index.',
+    '/core/schema/index.',
+];
+/** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
+export async function assertRuntimeClosure(metafilePath) {
+    const metafile = await readWranglerMetafile(metafilePath);
+    const forbidden = Object.keys(metafile.inputs).filter((input) => {
+        const normalized = `/${input.replaceAll('\\', '/')}`.replace(/(\/node_modules\/@astrale-os\/kernel-[^/]+)\/dist\//gu, '$1/');
+        return FORBIDDEN_RUNTIME_INPUTS.some((fragment) => normalized.includes(fragment));
+    });
+    if (forbidden.length > 0) {
+        throw new Error(`Cloudflare Worker reaches build-side modules: ${forbidden.sort().join(', ')}.`);
+    }
+}

package/dist/build/codegen/execution.d.ts

@@ -0,0 +1,13 @@
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build';
+export interface ExecutionCodegenOptions {
+    readonly origin: string;
+    readonly runtimeSpecifier: string;
+    readonly material: BuildMaterial;
+    readonly providerAssignedWorker?: string;
+    readonly router?: {
+        readonly binding: string;
+        readonly hostSuffix: string;
+        readonly minLabels: number;
+    };
+}
+export declare function generateExecutionEntry(options: ExecutionCodegenOptions): string;

package/dist/build/codegen/execution.js

@@ -0,0 +1,44 @@
+export function generateExecutionEntry(options) {
+    const router = options.router;
+    const routerPredicate = router === undefined
+        ? ''
+        : `
+function isInstanceHost(host: string): boolean {
+  return host.endsWith(${JSON.stringify(router.hostSuffix)}) && host.split('.').length >= ${router.minLabels}
+}
+`;
+    const routeSubrequest = router === undefined
+        ? ''
+        : `
+  routeSubrequest: (url, env) => {
+    const labels = url.hostname.split('.')
+    if (env.DISPATCHER && labels[1] === 'svc') return env.DISPATCHER.get(labels[0]!)
+    if (env.${router.binding} && isInstanceHost(url.hostname)) return env.${router.binding}
+    return null
+  },`;
+    return `// AUTO-GENERATED by @astrale-os/adapter-cloudflare — do not edit.
+// Domain origin: ${options.origin}
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build'
+import type { CloudflareAdapterBindings } from '@astrale-os/adapter-cloudflare/worker'
+
+import { cloudflareWorkerEntry } from '@astrale-os/adapter-cloudflare/worker'
+import runtime from ${JSON.stringify(options.runtimeSpecifier)}
+import { decodeSigningIdentity, runtimeBindings } from '@astrale-os/adapter-cloudflare/worker'
+
+type WorkerEnv = CloudflareEnv & CloudflareAdapterBindings & {
+  readonly ASTRALE_SIGNING_IDENTITY: string
+}
+type RuntimeEnv = Omit<WorkerEnv, 'ASTRALE_SIGNING_IDENTITY'>
+const MATERIAL = ${JSON.stringify(options.material)} as const satisfies BuildMaterial
+${routerPredicate}
+export default cloudflareWorkerEntry<WorkerEnv, RuntimeEnv>()({
+  runtime,
+  material: MATERIAL,
+  privateKey: (env) => decodeSigningIdentity(env.ASTRALE_SIGNING_IDENTITY),
+  resolveEnvironment: runtimeBindings,
+  resolveUrl: (env, requestOrigin) => env.WORKER_URL ?? env.IDENTITY_ISS ?? requestOrigin,
+  ${options.providerAssignedWorker === undefined ? '' : `providerAssignedWorker: ${JSON.stringify(options.providerAssignedWorker)},`}
+  selfBinding: (env) => env.SELF,${routeSubrequest}
+})
+`;
+}

package/dist/build/codegen/gateway.d.ts

@@ -0,0 +1 @@
+export declare function generateGatewayEntry(revision: string): string;

package/dist/build/codegen/gateway.js

@@ -0,0 +1,7 @@
+export function generateGatewayEntry(revision) {
+    return `// AUTO-GENERATED by @astrale-os/adapter-cloudflare — do not edit.
+import { cloudflareGatewayEntry } from '@astrale-os/adapter-cloudflare/worker'
+
+export default cloudflareGatewayEntry({ current: ${JSON.stringify(revision)} })
+`;
+}

package/dist/build/codegen/merge.d.ts

@@ -17,4 +17,3 @@
  * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
  */
 export declare function deepMergeConfig(base: Record<string, unknown>, overlay: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=merge.d.ts.map

package/dist/build/codegen/merge.js

@@ -88,4 +88,3 @@ function isPlainObject(v) {
 function isPrimitive(v) {
     return v === null || (typeof v !== 'object' && typeof v !== 'function');
 }
-//# sourceMappingURL=merge.js.map

package/dist/build/codegen/wrangler.d.ts

@@ -13,17 +13,27 @@
  */
 export interface WranglerCodegenOptions {
     workerName: string;
+    /** Provider-ready entrypoint relative to the generated config. */
+    main?: string;
     /** Full custom hostname for a routed deploy (e.g. 'crm.acme.dev'). */
     route?: string;
     /** Exact materialized local frontend; absence means no ASSETS binding. */
     frontend?: {
         readonly directory: string;
         readonly routes: readonly string[];
+        readonly dev: boolean;
     };
     /** Plain (non-secret) vars to bake in. */
     vars?: Record<string, string>;
+    /** Secret binding names required by generated Worker code. */
+    secretBindings?: readonly string[];
     /** Add the SELF service binding (autobinding). */
     selfBinding: boolean;
+    /** Bind the stable gateway to its private revision namespace. */
+    releases?: {
+        readonly binding: string;
+        readonly namespace: string;
+    };
     /**
      * Add a service binding to a router Worker for instance-host subrequest
      * routing (see `CloudflareParams.router`). Pairs with the worker
@@ -43,4 +53,3 @@ export interface WranglerCodegenOptions {
     wrangler?: Record<string, unknown>;
 }
 export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
-//# sourceMappingURL=wrangler.d.ts.map

package/dist/build/codegen/wrangler.js

@@ -12,12 +12,12 @@
  * (extra bindings: KV, R2, D1, queues, …) — see `mergeUserConfig`.
  */
 import { deepMergeConfig } from './merge.js';
-// Wrangler 4.121.0's pinned workerd accepts dates through 2026-08-11.
+// Keep the generated date on the runtime baseline qualified with Wrangler 4.123.0.
 const COMPATIBILITY_DATE = '2026-08-11';
 export function generateWranglerConfig(opts) {
     const config = {
         name: opts.workerName,
-        main: './worker.gen.ts',
+        main: opts.main ?? './worker.gen.ts',
         compatibility_date: COMPATIBILITY_DATE,
         compatibility_flags: ['nodejs_compat'],
         workers_dev: true,
@@ -31,19 +31,19 @@ export function generateWranglerConfig(opts) {
         config.assets = {
             directory: opts.frontend.directory,
             binding: 'ASSETS',
-            run_worker_first: [
-                '/invoke',
-                '/invoke/*',
-                '/install',
-                '/install/*',
-                '/health',
-                '/health/*',
-                '/meta',
-                '/meta/*',
-                '/.well-known',
-                '/.well-known/*',
-                ...opts.frontend.routes,
-            ],
+            run_worker_first: opts.frontend.dev
+                ? true
+                : [
+                    '/releases',
+                    '/releases/*',
+                    '/install',
+                    '/install/*',
+                    '/health',
+                    '/health/*',
+                    '/.well-known',
+                    '/.well-known/*',
+                    ...opts.frontend.routes,
+                ],
         };
     }
     const services = [];
@@ -57,6 +57,12 @@ export function generateWranglerConfig(opts) {
     if (opts.vars && Object.keys(opts.vars).length > 0) {
         config.vars = opts.vars;
     }
+    if (opts.secretBindings && opts.secretBindings.length > 0) {
+        config.secrets = { required: [...opts.secretBindings] };
+    }
+    if (opts.releases !== undefined) {
+        config.dispatch_namespaces = [opts.releases];
+    }
     const merged = opts.wrangler ? mergeUserConfig(config, opts.wrangler) : config;
     return JSON.stringify(merged, null, 2) + '\n';
 }
@@ -68,6 +74,7 @@ const ADAPTER_OWNED_KEYS = [
     'routes',
     'compatibility_date',
     'version_metadata',
+    'secrets',
 ];
 /**
  * Deep-merge the dev's raw wrangler overlay over the generated config, after
@@ -83,4 +90,3 @@ function mergeUserConfig(base, user) {
     }
     return deepMergeConfig(base, user);
 }
-//# sourceMappingURL=wrangler.js.map

package/dist/build/configuration.d.ts

@@ -0,0 +1,9 @@
+import type { CloudflareParams } from '../params.js';
+export declare function deploymentAddressing(parameters: CloudflareParams): string | undefined;
+export declare function workerName(parameters: CloudflareParams, origin: string): string;
+export declare function resolveRouter(input: CloudflareParams['router']): {
+    readonly binding: string;
+    readonly service: string;
+    readonly hostSuffix: string;
+    readonly minLabels: number;
+} | undefined;

package/dist/build/configuration.js

@@ -0,0 +1,40 @@
+import { addressing } from '@astrale-os/sdk/deployment/release';
+import { createHash } from 'node:crypto';
+const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u;
+export function deploymentAddressing(parameters) {
+    const routed = parameters.route === undefined ? undefined : addressing(`https://${parameters.route}`).issuer;
+    if (parameters.addressing === undefined)
+        return routed;
+    const configured = addressing(parameters.addressing).issuer;
+    if (routed !== undefined && configured !== routed) {
+        throw new TypeError('Cloudflare route and addressing identify different origins.');
+    }
+    return configured;
+}
+export function workerName(parameters, origin) {
+    if (parameters.workerName !== undefined) {
+        if (!WORKER_NAME.test(parameters.workerName) || parameters.workerName.length > 63) {
+            throw new TypeError('Cloudflare workerName is invalid.');
+        }
+        return parameters.workerName;
+    }
+    const readable = origin
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '-')
+        .slice(0, 12)
+        .replace(/^-+|-+$/gu, '') || 'domain';
+    const hexadecimal = createHash('sha256').update(origin).digest('hex');
+    const identity = BigInt(`0x${hexadecimal}`).toString(36).padStart(50, '0');
+    return `${readable}-${identity}`;
+}
+export function resolveRouter(input) {
+    if (input === false)
+        return undefined;
+    const value = input ?? {};
+    return Object.freeze({
+        binding: value.binding ?? 'ROUTER',
+        service: value.service ?? 'admin-router',
+        hostSuffix: value.hostSuffix ?? '.astrale.ai',
+        minLabels: value.minLabels ?? 4,
+    });
+}

package/dist/build/frontend-v1.d.ts

@@ -0,0 +1,16 @@
+import type { Build } from '@astrale-os/sdk/deployment/build';
+import { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
+export interface FrontendDevHandle {
+    readonly url: string;
+    stop(): Promise<void>;
+}
+export declare function frontendFiles(input: {
+    readonly frontend: Build['frontend'];
+    readonly projectDir: string;
+    readonly onLog?: (line: string) => void;
+}): Promise<readonly frontendBuild.FrontendFile[]>;
+export declare function startFrontend(input: {
+    readonly frontend: Build['frontend'];
+    readonly projectDir: string;
+    readonly onLog?: (line: string) => void;
+}): Promise<FrontendDevHandle | undefined>;