@astrale-os/adapter-cloudflare 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/index.js

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -17,4 +17,3 @@
  * `/build` toolkit and ships it through the Astrale platform.
  */
 export { cloudflare } from './cloudflare.js';
-//# sourceMappingURL=index.js.map

package/dist/params.d.ts

@@ -17,8 +17,22 @@ export interface CloudflareParams {
      * localhost) but still used as the placeholder base domain there.
      */
     readonly route?: string;
+    /**
+     * Exact public Addressing expected after deployment. Use this for an already
+     * known provider-assigned address such as `*.workers.dev`; `route` remains
+     * the field that asks Cloudflare to attach a custom hostname. When both are
+     * present they must identify the same HTTPS origin.
+     */
+    readonly addressing?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
+    /**
+     * Private Ed25519 JWK file retained outside source control. Remote deploys
+     * require this explicit source so a fresh runner cannot silently rotate an
+     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * once when this field is omitted.
+     */
+    readonly signingIdentity?: string;
     /** Local dev port for `wrangler dev`. Default 8787. */
     readonly port?: number;
     /**
@@ -60,10 +74,10 @@ export interface CloudflareParams {
      * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
      * hostname served by another Worker — Cloudflare 522s it — so without this the
      * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, the GUI's
-     * delegated calls, authed views) fails with `2002 Credential verification
-     * failed`. Point it at a router Worker that reaches those hosts internally
-     * (Astrale: `admin-router`).
+     * from that instance, and every cross-instance call (install hooks, delegated
+     * GUI calls, and traffic initiated from a Shell-handshaken View) fails with
+     * `2002 Credential verification failed`. Point it at a router Worker that
+     * reaches those hosts internally (Astrale: `admin-router`).
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
@@ -88,4 +102,3 @@ export interface CloudflareParams {
         readonly minLabels?: number;
     };
 }
-//# sourceMappingURL=params.d.ts.map

package/dist/params.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=params.js.map

package/dist/release/index.d.ts

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/namespace.d.ts

@@ -0,0 +1,2 @@
+/** One private dispatch namespace per stable public Worker. */
+export declare function releaseNamespace(worker: string): string;

package/dist/release/namespace.js

@@ -0,0 +1,6 @@
+import { createHash } from 'node:crypto';
+/** One private dispatch namespace per stable public Worker. */
+export function releaseNamespace(worker) {
+    const digest = createHash('sha256').update(worker).digest('hex');
+    return `astrale-${digest.slice(0, 24)}`;
+}

package/dist/release/target.d.ts

@@ -0,0 +1,2 @@
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export declare function releaseWorkerName(revision: string): string;

package/dist/release/target.js

@@ -0,0 +1,9 @@
+const REVISION = /^sha256:([0-9a-f]{64})$/u;
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export function releaseWorkerName(revision) {
+    const digest = REVISION.exec(revision)?.[1];
+    if (digest === undefined)
+        throw new TypeError('Cloudflare Release revision is invalid.');
+    const encoded = BigInt(`0x${digest}`).toString(36).padStart(50, '0');
+    return `r-${encoded}`;
+}

package/dist/worker/entry.d.ts

@@ -0,0 +1,34 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { ExecutionContext } from '@astrale-os/sdk/execution';
+import type { Runtime } from '@astrale-os/sdk/runtime';
+export interface Fetcher {
+    fetch(request: Request): Response | Promise<Response>;
+}
+export interface CloudflareAdapterBindings {
+    readonly ASTRALE_SIGNING_IDENTITY?: string;
+    readonly WORKER_URL?: string;
+    readonly IDENTITY_ISS?: string;
+    readonly ASSETS?: Fetcher;
+    readonly SELF?: Fetcher;
+    readonly FRONTEND_DEV_URL?: string;
+    readonly DISPATCHER?: {
+        get(name: string): Fetcher;
+    };
+}
+export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings extends CloudflareAdapterBindings, Environment> {
+    readonly runtime: RuntimeValue;
+    readonly material: BuildMaterial;
+    readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
+    readonly resolveEnvironment?: (bindings: Bindings) => Environment;
+    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly providerAssignedWorker?: string;
+    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+}
+export interface CloudflareWorker<Bindings> {
+    fetch(request: Request, environment: Bindings, executionContext?: ExecutionContext): Response | Promise<Response>;
+}
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment>) => CloudflareWorker<Bindings>;

package/dist/worker/entry.js

@@ -0,0 +1,157 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { restoreBuild } from '@astrale-os/sdk/deployment/build/material';
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { createIdentity, serve } from '@astrale-os/sdk/execution';
+import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export function cloudflareWorkerEntry() {
+    return function (config) {
+        let currentIssuer;
+        let realized;
+        const realize = () => {
+            if (realized !== undefined)
+                return realized;
+            const build = restoreBuild(config.material, config.runtime);
+            const application = serve({
+                runtime: config.runtime,
+                load(environment) {
+                    if (currentIssuer !== environment.issuer) {
+                        throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
+                    }
+                    return assemble(build, addressing(environment.issuer));
+                },
+                initialize: (environment) => config.resolveEnvironment === undefined
+                    ? environment.bindings
+                    : config.resolveEnvironment(environment.bindings),
+                identity(environment) {
+                    return createIdentity({
+                        issuer: issuer.accept(environment.issuer),
+                        subject: build.schema.compiled.root.origin,
+                        privateKey: typeof config.privateKey === 'function'
+                            ? config.privateKey(environment.bindings)
+                            : config.privateKey,
+                        fetch: routedFetch(application, environment, config),
+                        ...(new URL(environment.issuer).protocol === 'http:'
+                            ? { allowInsecureHttp: true }
+                            : {}),
+                    });
+                },
+                server: {
+                    health: { probe: { check: () => true } },
+                    limits: {
+                        maximumRequestBytes: 1024 * 1024,
+                        maximumPublicationBytes: 1024 * 1024,
+                        maximumBundleBytes: 8 * 1024 * 1024,
+                        maximumDeliveryBytes: 8 * 1024 * 1024,
+                        invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
+                    },
+                },
+            });
+            realized = Object.freeze({ build, application });
+            return realized;
+        };
+        return Object.freeze({
+            async fetch(request, bindings, context) {
+                const url = new URL(request.url);
+                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                    bindings.IDENTITY_ISS ??
+                    config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
+                    requestOrigin(url, request));
+                if (config.providerAssignedWorker !== undefined &&
+                    bindings.WORKER_URL === undefined &&
+                    bindings.IDENTITY_ISS === undefined &&
+                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    return new Response('Request origin differs from provider-assigned Addressing.', {
+                        status: 421,
+                    });
+                }
+                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                    return new Response('Request origin differs from the current Release.', { status: 421 });
+                }
+                currentIssuer = issuer;
+                const { application, build } = realize();
+                const frontend = await frontendAsset(build.frontend, bindings, url, request);
+                if (frontend !== undefined)
+                    return frontend;
+                return application.fetch(request, Object.freeze({ bindings, issuer }), context);
+            },
+        });
+    };
+}
+function routedFetch(application, environment, config) {
+    return async (input, init) => {
+        const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
+        const destination = new URL(request.url);
+        if (destination.origin === environment.issuer) {
+            const self = config.selfBinding?.(environment.bindings);
+            return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
+                ? application.fetch(selected, environment)
+                : self.fetch(selected));
+        }
+        const route = config.routeSubrequest?.(destination, environment.bindings);
+        return dispatchCloudflareRequest(request, rejectRedirect, (selected) => route === null || route === undefined ? fetch(selected) : route.fetch(selected));
+    };
+}
+async function frontendAsset(frontend, environment, url, request) {
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return undefined;
+    if (reserved(url.pathname) || (request.method !== 'GET' && request.method !== 'HEAD')) {
+        return undefined;
+    }
+    const development = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
+    if (development !== undefined && development.length > 0) {
+        return fetch(new Request(new URL(`${url.pathname}${url.search}`, `${development}/`), request));
+    }
+    const route = frontend.routes
+        .filter((candidate) => candidate.path === url.pathname ||
+        (frontend.source.kind === 'vite' &&
+            frontend.source.spa &&
+            (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
+        .sort((left, right) => right.path.length - left.path.length)[0];
+    if (route === undefined && !url.pathname.startsWith('/assets/'))
+        return undefined;
+    const assets = environment.ASSETS;
+    if (assets === undefined)
+        return undefined;
+    const response = await assets.fetch(request);
+    if (response.status !== 404 || route === undefined)
+        return response;
+    await response.body?.cancel();
+    return assets.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request));
+}
+function reserved(path) {
+    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function requestOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
+    return forwarded === 'https' ? `https://${url.host}` : url.origin;
+}
+function canonicalServingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/fetch.d.ts

@@ -0,0 +1,11 @@
+export type RequestDispatcher = (request: Request) => Response | Promise<Response>;
+export interface CloudflareRequest {
+    readonly request: Request;
+    readonly rejectRedirect: boolean;
+}
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export declare function prepareCloudflareRequest(input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): CloudflareRequest;
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export declare function dispatchCloudflareRequest(request: Request, rejectRedirect: boolean, dispatch: RequestDispatcher): Promise<Response>;
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export declare function adaptCloudflareResponse(request: Request, response: Response): Response;

package/dist/worker/fetch.js

@@ -0,0 +1,31 @@
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export function prepareCloudflareRequest(input, init) {
+    const rejectRedirect = init?.redirect === 'error' ||
+        (init?.redirect === undefined && input instanceof Request && input.redirect === 'error');
+    const request = new Request(input, rejectRedirect ? { ...init, redirect: 'manual' } : init);
+    return Object.freeze({ request, rejectRedirect });
+}
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export async function dispatchCloudflareRequest(request, rejectRedirect, dispatch) {
+    const response = adaptCloudflareResponse(request, await dispatch(request));
+    if (!rejectRedirect)
+        return response;
+    if (!response.redirected && !REDIRECT_STATUSES.has(response.status))
+        return response;
+    await response.body?.cancel();
+    throw new TypeError('Redirects are not allowed for this request.');
+}
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export function adaptCloudflareResponse(request, response) {
+    if (response.url !== '')
+        return response;
+    return new Proxy(response, {
+        get(target, property) {
+            if (property === 'url')
+                return request.url;
+            const value = Reflect.get(target, property, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/dist/worker/gateway.d.ts

@@ -0,0 +1,15 @@
+import type { Revision } from '@astrale-os/sdk/schema';
+export interface DispatchNamespace {
+    get(name: string): {
+        fetch(request: Request): Response | Promise<Response>;
+    };
+}
+export interface CloudflareGatewayBindings {
+    readonly RELEASES: DispatchNamespace;
+}
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export declare function cloudflareGatewayEntry(config: {
+    readonly current: Revision;
+}): {
+    fetch(request: Request, bindings: CloudflareGatewayBindings): Promise<Response>;
+};

package/dist/worker/gateway.js

@@ -0,0 +1,26 @@
+import { releaseUnavailable, requestedRevision } from '@astrale-os/sdk/deployment/release/runtime';
+import { releaseWorkerName } from '../release/target.js';
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export function cloudflareGatewayEntry(config) {
+    const current = releaseWorkerName(config.current);
+    return Object.freeze({
+        async fetch(request, bindings) {
+            const revision = requestedRevision(new URL(request.url).pathname);
+            const target = revision === undefined ? current : releaseWorkerName(revision);
+            let worker;
+            try {
+                worker = bindings.RELEASES.get(target);
+            }
+            catch (cause) {
+                if (isMissingWorker(cause))
+                    return releaseUnavailable();
+                throw cause;
+            }
+            return worker.fetch(request);
+        },
+    });
+}
+/** Admit only Cloudflare's documented missing-script failure at the provider boundary. */
+function isMissingWorker(cause) {
+    return cause instanceof Error && /^Worker not found(?:\b|:)/iu.test(cause.message);
+}

package/dist/worker/identity.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+/** Decode the secret representation at the Worker binding boundary. */
+export declare function decodeSigningIdentity(input: string): JsonWebKey;
+/** Remove adapter-owned signing material before Runtime initialization. */
+export declare function runtimeBindings<Bindings extends {
+    readonly ASTRALE_SIGNING_IDENTITY: string;
+}>(bindings: Bindings): Omit<Bindings, 'ASTRALE_SIGNING_IDENTITY'>;

package/dist/worker/identity.js

@@ -0,0 +1,23 @@
+/** Decode the secret representation at the Worker binding boundary. */
+export function decodeSigningIdentity(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid();
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare signing identity secret is invalid JSON.', { cause });
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded))
+        invalid();
+    return decoded;
+}
+/** Remove adapter-owned signing material before Runtime initialization. */
+export function runtimeBindings(bindings) {
+    const { ASTRALE_SIGNING_IDENTITY: _identity, ...runtime } = bindings;
+    return runtime;
+}
+function invalid() {
+    throw new TypeError('Cloudflare signing identity secret is invalid.');
+}

package/dist/worker/index.d.ts

@@ -1,48 +1,3 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { DomainDefinition } from '@astrale-os/sdk';
-import type { Application, RemoteDeploymentInput, RemoteIdentityInput } from '@astrale-os/sdk/server';
-import type { ExecutionContext } from 'hono';
-/** SDK-owned Publication manifest passed through without adapter interpretation. */
-export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>;
-export interface Fetcher {
-    fetch(request: Request): Response | Promise<Response>;
-}
-/** Adapter-owned bindings generated into every Cloudflare deployment. */
-export interface CloudflareAdapterBindings {
-    /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
-    readonly ASTRALE_VERSION_METADATA?: {
-        readonly id: string;
-        readonly tag: string;
-        readonly timestamp: string;
-    };
-    /** Content-derived generation supplied by providers without version metadata. */
-    readonly ASTRALE_DEPLOYMENT_VERSION?: string;
-    readonly WORKER_URL?: string;
-    readonly ASSETS?: Fetcher;
-    readonly SELF?: Fetcher;
-    readonly FRONTEND_DEV_URL?: string;
-    readonly DISPATCHER?: {
-        get(name: string): Fetcher;
-    };
-}
-export interface CloudflareWorkerConfig<S extends schema.DomainSchema, Bindings extends CloudflareAdapterBindings, Environment> {
-    readonly definition: DomainDefinition<S>;
-    readonly privateKey: RemoteIdentityInput['privateKey'] | ((bindings: Bindings) => RemoteIdentityInput['privateKey']);
-    /** Compose provider bindings into the exact Domain environment once per deployment generation. */
-    readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>;
-    readonly manifest?: CloudflareManifest;
-    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
-    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
-}
-export interface CloudflareWorker<Environment> {
-    fetch(request: Request, environment: Environment, executionContext?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <const S extends schema.DomainSchema>(config: CloudflareWorkerConfig<S, Bindings, Environment>) => CloudflareWorker<Bindings>;
-/** Close an evicted Application before its environment bindings leave the cache. */
-export declare function closeEvictedApplication(application: Pick<Application, 'close'>, now?: () => number): Promise<void>;
-//# sourceMappingURL=index.d.ts.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export * from './gateway.js';

package/dist/worker/index.js

@@ -1,186 +1,3 @@
-import { issuer } from '@astrale-os/kernel-core/auth';
-import { createRemoteApplication } from '@astrale-os/sdk/server';
-import { Hono as HonoApplication } from 'hono';
-const MAXIMUM_CACHED_APPLICATIONS = 4;
-const APPLICATION_CLOSE_TIMEOUT_MS = 5_000;
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export function cloudflareWorkerEntry() {
-    return function (config) {
-        const applications = new Map();
-        const applicationFor = async (url, bindings) => {
-            const version = deploymentVersion(bindings);
-            const key = `${url}\u0000${version}`;
-            const cached = applications.get(key);
-            if (cached !== undefined)
-                return cached;
-            const environment = config.resolveEnvironment === undefined
-                ? bindings
-                : await config.resolveEnvironment(bindings);
-            const routedFetch = async (input, init) => {
-                const request = new Request(input, init);
-                const destination = new URL(request.url);
-                if (destination.origin === new URL(url).origin) {
-                    const self = config.selfBinding?.(bindings);
-                    if (self !== null && self !== undefined)
-                        return self.fetch(request);
-                    return serving.app.fetch(request, environment);
-                }
-                const route = config.routeSubrequest?.(destination, bindings);
-                return route === null || route === undefined ? fetch(request) : route.fetch(request);
-            };
-            const deploymentQuery = `deployment=${encodeURIComponent(version)}`;
-            const issuerId = issuer.accept(url);
-            const host = new HonoApplication();
-            host.get('/meta', (context) => context.json({
-                origin: config.definition.schema.origin,
-                issuer: issuerId,
-                schemaRevision: config.definition.domain.$.revision,
-                deploymentVersion: version,
-            }));
-            const serving = createRemoteApplication({
-                definition: config.definition,
-                environment,
-                identity: {
-                    issuer: issuerId,
-                    subject: config.definition.schema.origin,
-                    privateKey: typeof config.privateKey === 'function'
-                        ? config.privateKey(bindings)
-                        : config.privateKey,
-                    fetch: routedFetch,
-                    ...(new URL(url).protocol === 'http:' ? { allowInsecureHttp: true } : {}),
-                },
-                deployment: {
-                    bundleHref: `${url}/.well-known/astrale/domain.bundle.json?${deploymentQuery}`,
-                    endpoint: { http: `${url}/invoke` },
-                    ...(config.definition.frontend === undefined
-                        ? {}
-                        : { frontendBaseHref: url, frontendCacheKey: version }),
-                    ...(config.manifest === undefined ? {} : { manifest: config.manifest }),
-                    installation: {
-                        href: `${url}/install`,
-                        method: 'POST',
-                        authentication: { kind: 'public' },
-                    },
-                },
-                app: host,
-                server: {
-                    path: '/invoke',
-                    health: { probe: { check: () => true } },
-                    limits: {
-                        maximumRequestBytes: 1024 * 1024,
-                        maximumPublicationBytes: 1024 * 1024,
-                        maximumBundleBytes: 8 * 1024 * 1024,
-                        maximumInstallationBytes: 8 * 1024 * 1024,
-                        invocationTimeoutMs: 30_000,
-                    },
-                },
-            });
-            const created = Object.freeze({
-                origin: new URL(url).origin,
-                application: serving,
-                environment,
-            });
-            if (applications.size >= MAXIMUM_CACHED_APPLICATIONS) {
-                const oldest = applications.keys().next().value;
-                if (oldest !== undefined) {
-                    const evicted = applications.get(oldest);
-                    applications.delete(oldest);
-                    if (evicted !== undefined) {
-                        try {
-                            await closeEvictedApplication(evicted.application);
-                        }
-                        catch (cause) {
-                            await serving
-                                .close({ deadline: Date.now() + APPLICATION_CLOSE_TIMEOUT_MS })
-                                .catch(() => undefined);
-                            throw cause;
-                        }
-                    }
-                }
-            }
-            applications.set(key, created);
-            return created;
-        };
-        return Object.freeze({
-            async fetch(request, bindings, executionContext) {
-                const requestUrl = new URL(request.url);
-                if (config.definition.frontend !== undefined) {
-                    const asset = await frontendAsset(config.definition, bindings, requestUrl, request);
-                    if (asset !== undefined)
-                        return asset;
-                }
-                const publicUrl = canonicalServingUrl(config.resolveUrl?.(bindings, requestOrigin(requestUrl, request)) ??
-                    bindings.WORKER_URL ??
-                    requestOrigin(requestUrl, request));
-                const serving = await applicationFor(publicUrl, bindings);
-                return serving.application.app.fetch(request, serving.environment, executionContext);
-            },
-        });
-    };
-}
-/** Close an evicted Application before its environment bindings leave the cache. */
-export function closeEvictedApplication(application, now = Date.now) {
-    return application.close({ deadline: now() + APPLICATION_CLOSE_TIMEOUT_MS });
-}
-async function frontendAsset(definition, environment, url, request) {
-    const frontend = definition.frontend;
-    if (frontend === undefined || frontend.source.kind === 'external')
-        return undefined;
-    const routes = frontend.routes;
-    const route = Object.values(routes).find((candidate) => candidate.path === url.pathname);
-    const staticAsset = url.pathname.startsWith('/assets/');
-    if (route === undefined && !staticAsset)
-        return undefined;
-    if (request.method !== 'GET' && request.method !== 'HEAD')
-        return undefined;
-    const binding = environment.ASSETS;
-    if (binding === undefined)
-        return undefined;
-    const dev = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
-    if (dev !== undefined && dev.length > 0) {
-        return fetch(new Request(`${dev}${url.pathname}${url.search}`, request));
-    }
-    const path = route === undefined ? `${url.pathname}${url.search}` : `/${route.document}${url.search}`;
-    return binding.fetch(new Request(new URL(path, url.origin), request));
-}
-function requestOrigin(url, request) {
-    if (url.protocol !== 'http:')
-        return url.origin;
-    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
-    return forwarded === 'https' ? `https://${url.host}` : url.origin;
-}
-function canonicalServingUrl(input) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch (cause) {
-        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
-    }
-    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
-        url.username !== '' ||
-        url.password !== '' ||
-        url.pathname !== '/' ||
-        url.search !== '' ||
-        url.hash !== '') {
-        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
-    }
-    return url.origin;
-}
-function deploymentVersion(environment) {
-    const input = environment.ASTRALE_VERSION_METADATA;
-    if (input !== null &&
-        typeof input === 'object' &&
-        typeof input.id === 'string' &&
-        input.id.length > 0) {
-        return input.id;
-    }
-    const fallback = environment.ASTRALE_DEPLOYMENT_VERSION;
-    if (typeof fallback === 'string' && fallback.length > 0)
-        return fallback;
-    throw new TypeError('Cloudflare Worker deployment version is unavailable.');
-}
-//# sourceMappingURL=index.js.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export * from './gateway.js';