@astrale-os/adapter-cloudflare 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/cloudflare.js

@@ -1,205 +1 @@
-/**
- * `cloudflare(envs)` — the Cloudflare deployment adapter.
- *
- * Owns everything target-specific: it codegens the Worker entry + wrangler
- * config (the dev never sees a `wrangler.jsonc`), materializes the optional frontend
- * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
- * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
- * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the CLI
- * prints and `astrale domain install <url>` consumes.
- */
-import { defineAdapter } from '@astrale-os/sdk';
-import { bulkPutSecrets, buildCloudflareWorker, buildFrontend, logTo, prepare, runWranglerDeploy, runWranglerDev, runWranglerTypes, watchFrontend, } from './build/index.js';
-export function cloudflare(envs) {
-    return cloudflareWithDependencies(envs, {
-        bulkPutSecrets,
-        buildCloudflareWorker,
-        buildFrontend,
-        logTo,
-        prepare,
-        runWranglerDeploy,
-        runWranglerDev,
-        runWranglerTypes,
-        watchFrontend,
-        waitUntilLive,
-    });
-}
-/** Exact orchestration seam used by adapter-level deployment qualification. */
-export function cloudflareWithDependencies(envs, dependencies) {
-    return defineAdapter({
-        name: 'cloudflare',
-        envs,
-        async build(params, ctx) {
-            await dependencies.buildCloudflareWorker({
-                params,
-                context: ctx,
-                onLog: dependencies.logTo(),
-            });
-        },
-        async watch(params, ctx) {
-            const onLog = dependencies.logTo();
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog,
-            });
-            const { configPath, port } = await dependencies.prepare(params, ctx, 'dev', frontend);
-            const handle = await dependencies.runWranglerDev({
-                projectDir: ctx.projectDir,
-                configPath,
-                port,
-                remote: Boolean(params.remote),
-                autoPickPort: params.port === undefined,
-                ...(params.host ? { ip: '0.0.0.0' } : {}),
-                onReload: ctx.onReload,
-                onLog,
-            });
-            let frontendWatch;
-            try {
-                frontendWatch = dependencies.watchFrontend({
-                    definition: ctx.definition,
-                    projectDir: ctx.projectDir,
-                    onLog,
-                    // Routes and source recipes are immutable for this watch generation.
-                    // Wrangler already observes the atomically swapped asset stage, so a
-                    // source rebuild needs no config regeneration.
-                    onRebuild: ctx.onReload,
-                });
-            }
-            catch (error) {
-                try {
-                    await handle.stop();
-                }
-                catch (cleanupError) {
-                    throw new AggregateError([error, cleanupError], 'cloudflare frontend watcher startup failed and Wrangler cleanup also failed');
-                }
-                throw error;
-            }
-            // With --host the actionable URL is the PUBLIC one (the tunnel/proxy
-            // front), not the local bind — print and spec-stamp that.
-            return {
-                url: params.host ?? handle.url,
-                async stop() {
-                    const errors = [];
-                    try {
-                        await frontendWatch?.stop();
-                    }
-                    catch (error) {
-                        errors.push(error);
-                    }
-                    try {
-                        await handle.stop();
-                    }
-                    catch (error) {
-                        errors.push(error);
-                    }
-                    if (errors.length === 1)
-                        throw errors[0];
-                    if (errors.length > 1) {
-                        throw new AggregateError(errors, 'cloudflare development cleanup failed');
-                    }
-                },
-            };
-        },
-        // Config hot-regen: rewrite the generated files only — the running
-        // `wrangler dev` watches its `--config` (and the worker entry) and reloads
-        // them itself, so a `astrale.config.ts` edit lands without a restart.
-        // Mirrors `watch`'s prep exactly (codegen + frontend build), minus the spawn.
-        async regenerate(params, ctx) {
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog: dependencies.logTo(),
-            });
-            const { configPath } = await dependencies.prepare(params, ctx, 'dev', frontend);
-            await dependencies.runWranglerTypes({
-                projectDir: ctx.projectDir,
-                configPath,
-                onLog: dependencies.logTo(),
-            });
-        },
-        async deploy(params, ctx) {
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog: dependencies.logTo(),
-            });
-            const { configPath, fallbackConfigPath, workerName: name, } = await dependencies.prepare(params, ctx, 'deploy', frontend);
-            const { url, deploymentVersion } = await dependencies.runWranglerDeploy({
-                projectDir: ctx.projectDir,
-                configPath,
-                workerName: name,
-                ...(fallbackConfigPath ? { fallbackConfigPath } : {}),
-                ...(params.route ? { route: params.route } : {}),
-                onLog: dependencies.logTo(),
-            });
-            if (Object.keys(ctx.secrets).length > 0) {
-                await dependencies.bulkPutSecrets({
-                    projectDir: ctx.projectDir,
-                    configPath,
-                    secrets: ctx.secrets,
-                    onLog: dependencies.logTo(),
-                });
-            }
-            // A first deploy on a fresh `*.workers.dev` host can take ~30-60s to
-            // propagate; an `astrale domain install <url>` issued right away would
-            // 404 (Cloudflare 1042). Block until the URL actually serves so the
-            // install line we print is immediately actionable.
-            await dependencies.waitUntilLive(url, dependencies.logTo(), deploymentVersion);
-            return { url };
-        },
-        secretsFile(params) {
-            return params.secrets;
-        },
-    });
-}
-/**
- * Poll until the deployed Worker health endpoint returns exactly 200.
- */
-async function waitUntilLive(url, onLog, expectedDeploymentVersion, timeoutMs = 90_000) {
-    const probe = new URL('/health', url);
-    const metadata = new URL('/meta', url);
-    const deadline = Date.now() + timeoutMs;
-    let waited = false;
-    let lastStatus;
-    let lastDeploymentVersion;
-    for (;;) {
-        try {
-            const res = await fetch(probe, { redirect: 'manual' });
-            lastStatus = res.status;
-            await res.body?.cancel();
-            if (res.status === 200) {
-                if (expectedDeploymentVersion === undefined)
-                    return;
-                const meta = await fetch(metadata, { redirect: 'manual' });
-                if (meta.status === 200) {
-                    const body = (await meta.json());
-                    lastDeploymentVersion =
-                        typeof body.deploymentVersion === 'string' ? body.deploymentVersion : undefined;
-                    if (lastDeploymentVersion === expectedDeploymentVersion)
-                        return;
-                }
-                else {
-                    await meta.body?.cancel();
-                }
-            }
-        }
-        catch {
-            // Network hiccup — treat like "not live yet" and keep polling.
-        }
-        if (Date.now() >= deadline) {
-            throw new Error(`deployed Worker health did not reach HTTP 200 within ${Math.round(timeoutMs / 1000)}s` +
-                (lastStatus === undefined ? '' : ` (last status ${lastStatus})`) +
-                (expectedDeploymentVersion === undefined
-                    ? ''
-                    : `; deployment version ${JSON.stringify(lastDeploymentVersion)} ` +
-                        `did not reach ${JSON.stringify(expectedDeploymentVersion)}`));
-        }
-        if (!waited) {
-            waited = true;
-            onLog('waiting for the URL to go live (first deploys can take ~30-60s)…');
-        }
-        await new Promise((r) => setTimeout(r, 3000));
-    }
-}
-//# sourceMappingURL=cloudflare.js.map
+export { cloudflare } from './adapter.js';

package/dist/deploy/deploy.d.ts

@@ -0,0 +1,17 @@
+import type { DeployContext, DeployResult } from '@astrale-os/sdk/deployment/adapter';
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { materialize } from '../build/artifact.js';
+import type { ensureWranglerDispatchNamespace, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerReleaseDeploy } from '../build/wrangler-cli.js';
+import type { signingIdentity } from '../identity/source.js';
+import type { CloudflareParams } from '../params.js';
+export interface CloudflareDeployDependencies {
+    readonly materialize: typeof materialize;
+    readonly ensureWranglerDispatchNamespace: typeof ensureWranglerDispatchNamespace;
+    readonly runWranglerDeploy: typeof runWranglerDeploy;
+    readonly runWranglerReleaseDeploy: typeof runWranglerReleaseDeploy;
+    readonly runWranglerDeploymentStatus: typeof runWranglerDeploymentStatus;
+    readonly waitForReadiness: (release: Release) => Promise<void>;
+    readonly signingIdentity: typeof signingIdentity;
+}
+/** Establish private placement and place one revision before advancing the public gateway. */
+export declare function deployCloudflare(parameters: CloudflareParams, context: DeployContext, dependencies: CloudflareDeployDependencies): Promise<DeployResult>;

package/dist/deploy/deploy.js

@@ -0,0 +1,207 @@
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release';
+import { join } from 'node:path';
+import { workerName } from '../build/configuration.js';
+import { WranglerDeployError, WranglerDispatchNamespaceError } from '../build/wrangler-cli.js';
+import { signingIdentitySecrets } from '../identity/secret.js';
+import { releaseNamespace } from '../release/index.js';
+const NONE = Object.freeze({ kind: 'none' });
+/** Establish private placement and place one revision before advancing the public gateway. */
+export async function deployCloudflare(parameters, context, dependencies) {
+    let secrets;
+    try {
+        const identity = await dependencies.signingIdentity({
+            projectDir: context.projectDir,
+            source: parameters.signingIdentity,
+            origin: context.artifact.build.schema.compiled.root.origin,
+            mode: 'deploy',
+        });
+        secrets = signingIdentitySecrets(context.secrets, identity);
+    }
+    catch (cause) {
+        return failed('prerequisite', progress({}), cause);
+    }
+    const directory = join(context.projectDir, '.astrale', 'deploy');
+    await dependencies.materialize(directory, context.artifact.files);
+    const name = workerName(parameters, context.artifact.build.schema.compiled.root.origin);
+    const releaseConfigPath = join(directory, 'wrangler.release.jsonc');
+    const gatewayConfigPath = join(directory, 'wrangler.gateway.jsonc');
+    const namespace = releaseNamespace(name);
+    try {
+        await dependencies.ensureWranglerDispatchNamespace({
+            projectDir: context.projectDir,
+            namespace,
+        });
+    }
+    catch (cause) {
+        const provider = cause instanceof WranglerDispatchNamespaceError && cause.effect === 'none'
+            ? NONE
+            : Object.freeze({ kind: 'unknown' });
+        return failed('provider', progress({ provider }), cause);
+    }
+    let revision;
+    try {
+        revision = await dependencies.runWranglerReleaseDeploy({
+            projectDir: context.projectDir,
+            configPath: releaseConfigPath,
+            namespace,
+            secrets,
+        });
+    }
+    catch (cause) {
+        const provider = partialProvider(cause, context.artifact);
+        const configuration = Object.freeze({ kind: 'unknown' });
+        return failed('provider', progress({ provider, configuration }), cause);
+    }
+    const configuration = Object.freeze({
+        kind: 'applied',
+        evidence: Object.freeze({ names: Object.keys(secrets).sort() }),
+    });
+    const retained = Object.freeze({
+        kind: 'partial',
+        evidence: Object.freeze({
+            provider: 'cloudflare',
+            deployment: revision.deploymentVersion,
+            artifact: context.artifact.digest,
+        }),
+    });
+    let gateway;
+    try {
+        gateway = await dependencies.runWranglerDeploy({
+            projectDir: context.projectDir,
+            configPath: gatewayConfigPath,
+            ...(parameters.route === undefined ? {} : { route: parameters.route }),
+        });
+    }
+    catch (cause) {
+        return failed('provider', progress({ provider: retained, configuration }), cause);
+    }
+    let selected;
+    try {
+        selected = observeAddressing(context.artifact, gateway.url, name);
+    }
+    catch (cause) {
+        return failed('addressing', progress({
+            provider: retained,
+            configuration,
+        }), cause);
+    }
+    let observed;
+    try {
+        observed = await dependencies.runWranglerDeploymentStatus({
+            projectDir: context.projectDir,
+            configPath: gatewayConfigPath,
+            workerName: name,
+        });
+        requireCurrentDeployment(observed, gateway.deploymentVersion);
+    }
+    catch (cause) {
+        return failed('readiness', progress({
+            provider: retained,
+            configuration,
+        }), cause);
+    }
+    let release;
+    try {
+        release = assemble(context.artifact.build, selected);
+    }
+    catch (cause) {
+        return failed('release', progress({ provider: retained, configuration }), cause);
+    }
+    try {
+        await dependencies.waitForReadiness(release);
+    }
+    catch (cause) {
+        return failed('readiness', progress({ provider: retained, configuration }), cause, release);
+    }
+    const provider = Object.freeze({
+        kind: 'applied',
+        evidence: Object.freeze({
+            provider: 'cloudflare',
+            deployment: revision.deploymentVersion,
+            artifact: context.artifact.digest,
+            issuer: selected.issuer,
+        }),
+    });
+    return Object.freeze({
+        status: 'ready',
+        phase: 'complete',
+        progress: Object.freeze({ ...progress({ configuration }), provider }),
+        release,
+    });
+}
+function partialProvider(cause, artifact) {
+    if (!(cause instanceof WranglerDeployError) || cause.applied?.deploymentVersion === undefined) {
+        return Object.freeze({ kind: 'unknown' });
+    }
+    let issuer;
+    if (cause.applied.url !== undefined) {
+        try {
+            issuer = addressing(cause.applied.url).issuer;
+        }
+        catch {
+            // The provider effect remains known when its printed URL is not Addressing.
+        }
+    }
+    return Object.freeze({
+        kind: 'partial',
+        evidence: Object.freeze({
+            provider: 'cloudflare',
+            deployment: cause.applied.deploymentVersion,
+            artifact: artifact.digest,
+            ...(issuer === undefined ? {} : { issuer }),
+        }),
+    });
+}
+function requireCurrentDeployment(observed, expectedVersion) {
+    if (observed.versions.length !== 1 ||
+        observed.versions[0].percentage !== 100 ||
+        observed.versions[0].version !== expectedVersion) {
+        throw new TypeError('Cloudflare gateway is not one exact Worker version at 100%.');
+    }
+}
+function observeAddressing(artifact, deployedUrl, expectedWorker) {
+    if (artifact.addressing.kind === 'configured') {
+        if (deployedUrl === undefined)
+            return artifact.addressing.addressing;
+        const observed = addressing(deployedUrl);
+        if (observed.issuer !== artifact.addressing.addressing.issuer) {
+            throw new TypeError('Cloudflare deployed URL differs from configured Addressing.');
+        }
+        return observed;
+    }
+    if (deployedUrl === undefined) {
+        throw new TypeError('Cloudflare did not report provider-assigned Addressing.');
+    }
+    const observed = addressing(deployedUrl);
+    if (artifact.addressing.claim !== expectedWorker) {
+        throw new TypeError('PreparedArtifact worker claim differs from the gateway target.');
+    }
+    const url = new URL(observed.issuer);
+    const labels = url.hostname.split('.');
+    if (url.protocol !== 'https:' ||
+        labels.length < 4 ||
+        labels[0] !== artifact.addressing.claim ||
+        labels.at(-2) !== 'workers' ||
+        labels.at(-1) !== 'dev') {
+        throw new TypeError('Cloudflare workers.dev URL does not satisfy its prepared worker claim.');
+    }
+    return observed;
+}
+function progress(input) {
+    return Object.freeze({
+        prerequisite: input.prerequisite ?? NONE,
+        provider: input.provider ?? NONE,
+        configuration: input.configuration ?? NONE,
+        installation: input.installation ?? NONE,
+    });
+}
+function failed(phase, progressValue, cause, release) {
+    const error = cause instanceof Error ? cause : new Error(String(cause));
+    return Object.freeze({
+        status: 'failed',
+        phase,
+        progress: progressValue,
+        error,
+        ...(release === undefined ? {} : { release }),
+    });
+}

package/dist/deploy/index.d.ts

@@ -0,0 +1 @@
+export { deployCloudflare, type CloudflareDeployDependencies } from './deploy.js';

package/dist/deploy/index.js

@@ -0,0 +1 @@
+export { deployCloudflare } from './deploy.js';

package/dist/identity/binding.d.ts

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the execution identity private JWK. */
+export declare const SIGNING_IDENTITY_BINDING = "ASTRALE_SIGNING_IDENTITY";

package/dist/identity/binding.js

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the execution identity private JWK. */
+export const SIGNING_IDENTITY_BINDING = 'ASTRALE_SIGNING_IDENTITY';

package/dist/identity/material.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+export type SigningIdentityMaterial = JsonWebKey & {
+    readonly kid: string;
+};
+export declare function createSigningIdentity(): Promise<SigningIdentityMaterial>;
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export declare function admitSigningIdentity(input: unknown, owner: string, legacyKeyId?: string): Promise<SigningIdentityMaterial>;

package/dist/identity/material.js

@@ -0,0 +1,42 @@
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from 'jose';
+export async function createSigningIdentity() {
+    const { privateKey } = await generateKeyPair('EdDSA', { extractable: true });
+    const exported = await exportJWK(privateKey);
+    return admitSigningIdentity({
+        ...exported,
+        alg: 'EdDSA',
+        kid: await calculateJwkThumbprint(exported),
+    }, 'generated identity');
+}
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export async function admitSigningIdentity(input, owner, legacyKeyId) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(owner);
+    const value = input;
+    if (value.kty !== 'OKP' ||
+        value.crv !== 'Ed25519' ||
+        value.alg !== 'EdDSA' ||
+        typeof value.x !== 'string' ||
+        value.x.length === 0 ||
+        typeof value.d !== 'string' ||
+        value.d.length === 0) {
+        invalid(owner);
+    }
+    const thumbprint = await calculateJwkThumbprint(value);
+    const admitted = legacyKeyId !== undefined && (value.kid === undefined || value.kid === legacyKeyId)
+        ? { ...value, kid: thumbprint }
+        : value;
+    if (admitted.kid !== thumbprint) {
+        throw new TypeError(`Cloudflare signing identity '${owner}' must use its JWK thumbprint as kid.`);
+    }
+    try {
+        await importJWK(admitted, 'EdDSA');
+    }
+    catch (cause) {
+        throw invalid(owner, cause);
+    }
+    return admitted;
+}
+function invalid(owner, cause) {
+    throw new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/identity/secret.d.ts

@@ -0,0 +1,3 @@
+import type { SigningIdentitySource } from './source.js';
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export declare function signingIdentitySecrets(secrets: Readonly<Record<string, string>>, identity: SigningIdentitySource): Readonly<Record<string, string>>;

package/dist/identity/secret.js

@@ -0,0 +1,7 @@
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export function signingIdentitySecrets(secrets, identity) {
+    if (Object.hasOwn(secrets, identity.binding)) {
+        throw new TypeError(`${identity.binding} is adapter-owned; configure 'signingIdentity' instead of declaring that secret.`);
+    }
+    return Object.freeze({ ...secrets, [identity.binding]: identity.secret });
+}

package/dist/identity/source.d.ts

@@ -0,0 +1,26 @@
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+export interface SigningIdentitySource {
+    readonly binding: typeof SIGNING_IDENTITY_BINDING;
+    readonly path: string;
+    readonly secret: string;
+    readonly keyId: string;
+}
+export interface SigningIdentityInput {
+    readonly projectDir: string;
+    readonly origin: string;
+    readonly source?: string;
+    readonly mode: 'local' | 'deploy';
+}
+/** Resolve one admitted execution identity for local or remote provider custody. */
+export declare function signingIdentity(input: SigningIdentityInput): Promise<SigningIdentitySource>;
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export declare function readSigningIdentity(projectDir: string, declaration: string | undefined): Promise<SigningIdentitySource>;
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export declare function localSigningIdentity(projectDir: string, declaration: string | undefined, origin: string): Promise<SigningIdentitySource>;

package/dist/identity/source.js

@@ -0,0 +1,98 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+import { admitSigningIdentity, createSigningIdentity } from './material.js';
+const DEFAULT_IDENTITY = join('.astrale', 'identity.json');
+/** Resolve one admitted execution identity for local or remote provider custody. */
+export function signingIdentity(input) {
+    return input.mode === 'local'
+        ? localSigningIdentity(input.projectDir, input.source, input.origin)
+        : readSigningIdentity(input.projectDir, input.source);
+}
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export async function readSigningIdentity(projectDir, declaration) {
+    if (declaration === undefined || declaration.length === 0) {
+        throw new TypeError("Cloudflare deployment requires 'signingIdentity: <private-jwk-file>'. " +
+            'Run local development once to create .astrale/identity.json, then retain that file in managed secret storage.');
+    }
+    return readSource(pathOf(projectDir, declaration), declaration);
+}
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export async function localSigningIdentity(projectDir, declaration, origin) {
+    if (declaration !== undefined)
+        return readSource(pathOf(projectDir, declaration), declaration);
+    const path = join(projectDir, DEFAULT_IDENTITY);
+    if (!existsSync(path)) {
+        const legacy = join(projectDir, '.astrale', 'identity.ts');
+        if (existsSync(legacy))
+            await migrateLegacyIdentity(legacy, path, origin);
+        else
+            await generateIdentity(path);
+    }
+    return readSource(path, DEFAULT_IDENTITY);
+}
+async function generateIdentity(path) {
+    const value = await createSigningIdentity();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
+        `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+}
+async function migrateLegacyIdentity(legacy, destination, origin) {
+    const source = await readFile(legacy, 'utf8');
+    const match = /export const PRIVATE_JWK = (\{[\s\S]*\}) as const\n?$/u.exec(source);
+    if (match?.[1] === undefined)
+        throw invalidIdentity(legacy);
+    let decoded;
+    try {
+        decoded = JSON.parse(match[1]);
+    }
+    catch (cause) {
+        throw invalidIdentity(legacy, cause);
+    }
+    const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
+    await mkdir(dirname(destination), { recursive: true });
+    await writeFile(destination, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+}
+async function readSource(path, declaration) {
+    let source;
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'ENOENT'))
+            throw cause;
+        throw new TypeError(`Cloudflare signing identity '${declaration}' is missing at ${path}.`, {
+            cause,
+        });
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(source);
+    }
+    catch (cause) {
+        throw invalidIdentity(declaration, cause);
+    }
+    const value = await admitSigningIdentity(decoded, declaration);
+    return Object.freeze({
+        binding: SIGNING_IDENTITY_BINDING,
+        path,
+        secret: JSON.stringify(value),
+        keyId: value.kid,
+    });
+}
+function pathOf(projectDir, declaration) {
+    return isAbsolute(declaration) ? declaration : resolve(projectDir, declaration);
+}
+function invalidIdentity(owner, cause) {
+    return new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -18,4 +18,3 @@
  */
 export { cloudflare } from './cloudflare.js';
 export type { CloudflareParams } from './params.js';
-//# sourceMappingURL=index.d.ts.map