@astrale-os/adapter-cloudflare 0.5.0-beta.3 → 0.5.0-beta.30

package/dist/deploy/deploy.js

@@ -0,0 +1,234 @@
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { workerName } from '../build/configuration.js';
+import { admitDirectPlacement } from '../build/direct.js';
+import { loadWorkerArtifact } from '../build/worker/index.js';
+import { WranglerDeployError, WranglerDispatchNamespaceError } from '../build/wrangler-cli.js';
+import { signingIdentitySecrets } from '../identity/secret.js';
+import { releaseNamespace } from '../release/index.js';
+const NONE = Object.freeze({ kind: 'none' });
+/** Establish private placement and place one revision before advancing the public gateway. */
+export async function deployCloudflare(parameters, context, dependencies) {
+    let secrets;
+    try {
+        const identity = await dependencies.signingIdentity({
+            projectDir: context.projectDir,
+            source: parameters.signingIdentity,
+            origin: context.artifact.build.schema.compiled.root.origin,
+            mode: 'deploy',
+        });
+        secrets = signingIdentitySecrets(context.secrets, identity);
+    }
+    catch (cause) {
+        return failed('prerequisite', progress({}), cause);
+    }
+    let worker;
+    try {
+        worker = loadWorkerArtifact(context.artifact);
+        for (const name of worker.bindings.requiredSecrets) {
+            if (!Object.hasOwn(secrets, name)) {
+                throw new TypeError(`Cloudflare Worker requires secret ${name}.`);
+            }
+        }
+        admitDirectPlacement(context.artifact, worker, parameters);
+    }
+    catch (cause) {
+        return failed('prerequisite', progress({}), cause);
+    }
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'deploy-'));
+    try {
+        await dependencies.materialize(directory, context.artifact.files);
+        const name = workerName(parameters, context.artifact.build.schema.compiled.root.origin);
+        const releaseConfigPath = join(directory, 'wrangler.release.jsonc');
+        const gatewayConfigPath = join(directory, 'wrangler.gateway.jsonc');
+        const namespace = releaseNamespace(name);
+        try {
+            await dependencies.ensureWranglerDispatchNamespace({
+                projectDir: context.projectDir,
+                namespace,
+                signal: context.signal,
+            });
+        }
+        catch (cause) {
+            const provider = cause instanceof WranglerDispatchNamespaceError && cause.effect === 'none'
+                ? NONE
+                : Object.freeze({ kind: 'unknown' });
+            return failed('provider', progress({ provider }), cause);
+        }
+        let revision;
+        try {
+            revision = await dependencies.runWranglerReleaseDeploy({
+                projectDir: context.projectDir,
+                configPath: releaseConfigPath,
+                namespace,
+                secrets,
+                signal: context.signal,
+            });
+        }
+        catch (cause) {
+            const provider = partialProvider(cause, context.artifact);
+            const configuration = Object.freeze({ kind: 'unknown' });
+            return failed('provider', progress({ provider, configuration }), cause);
+        }
+        const configuration = Object.freeze({
+            kind: 'applied',
+            evidence: Object.freeze({ names: Object.keys(secrets).sort() }),
+        });
+        const retained = Object.freeze({
+            kind: 'partial',
+            evidence: Object.freeze({
+                provider: 'cloudflare',
+                deployment: revision.deploymentVersion,
+                artifact: context.artifact.digest,
+            }),
+        });
+        let gateway;
+        try {
+            gateway = await dependencies.runWranglerDeploy({
+                projectDir: context.projectDir,
+                configPath: gatewayConfigPath,
+                ...(parameters.route === undefined ? {} : { route: parameters.route }),
+                signal: context.signal,
+            });
+        }
+        catch (cause) {
+            return failed('provider', progress({ provider: retained, configuration }), cause);
+        }
+        let selected;
+        try {
+            selected = observeAddressing(context.artifact, gateway.url, name);
+        }
+        catch (cause) {
+            return failed('addressing', progress({
+                provider: retained,
+                configuration,
+            }), cause);
+        }
+        let observed;
+        try {
+            observed = await dependencies.runWranglerDeploymentStatus({
+                projectDir: context.projectDir,
+                configPath: gatewayConfigPath,
+                workerName: name,
+                signal: context.signal,
+            });
+            requireCurrentDeployment(observed, gateway.deploymentVersion);
+        }
+        catch (cause) {
+            return failed('readiness', progress({
+                provider: retained,
+                configuration,
+            }), cause);
+        }
+        let release;
+        try {
+            release = assemble(context.artifact.build, selected);
+        }
+        catch (cause) {
+            return failed('release', progress({ provider: retained, configuration }), cause);
+        }
+        try {
+            await dependencies.waitForReadiness(release, context.signal);
+        }
+        catch (cause) {
+            return failed('readiness', progress({ provider: retained, configuration }), cause, release);
+        }
+        const provider = Object.freeze({
+            kind: 'applied',
+            evidence: Object.freeze({
+                provider: 'cloudflare',
+                deployment: revision.deploymentVersion,
+                artifact: context.artifact.digest,
+                issuer: selected.issuer,
+            }),
+        });
+        return Object.freeze({
+            status: 'ready',
+            phase: 'complete',
+            progress: Object.freeze({ ...progress({ configuration }), provider }),
+            release,
+        });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+function partialProvider(cause, artifact) {
+    if (!(cause instanceof WranglerDeployError) || cause.applied?.deploymentVersion === undefined) {
+        return Object.freeze({ kind: 'unknown' });
+    }
+    let issuer;
+    if (cause.applied.url !== undefined) {
+        try {
+            issuer = addressing(cause.applied.url).issuer;
+        }
+        catch {
+            // The provider effect remains known when its printed URL is not Addressing.
+        }
+    }
+    return Object.freeze({
+        kind: 'partial',
+        evidence: Object.freeze({
+            provider: 'cloudflare',
+            deployment: cause.applied.deploymentVersion,
+            artifact: artifact.digest,
+            ...(issuer === undefined ? {} : { issuer }),
+        }),
+    });
+}
+function requireCurrentDeployment(observed, expectedVersion) {
+    if (observed.versions.length !== 1 ||
+        observed.versions[0].percentage !== 100 ||
+        observed.versions[0].version !== expectedVersion) {
+        throw new TypeError('Cloudflare gateway is not one exact Worker version at 100%.');
+    }
+}
+function observeAddressing(artifact, deployedUrl, expectedWorker) {
+    if (artifact.addressing.kind === 'configured') {
+        if (deployedUrl === undefined)
+            return artifact.addressing.addressing;
+        const observed = addressing(deployedUrl);
+        if (observed.issuer !== artifact.addressing.addressing.issuer) {
+            throw new TypeError('Cloudflare deployed URL differs from configured Addressing.');
+        }
+        return observed;
+    }
+    if (deployedUrl === undefined) {
+        throw new TypeError('Cloudflare did not report provider-assigned Addressing.');
+    }
+    const observed = addressing(deployedUrl);
+    if (artifact.addressing.claim !== expectedWorker) {
+        throw new TypeError('PreparedArtifact worker claim differs from the gateway target.');
+    }
+    const url = new URL(observed.issuer);
+    const labels = url.hostname.split('.');
+    if (url.protocol !== 'https:' ||
+        labels.length < 4 ||
+        labels[0] !== artifact.addressing.claim ||
+        labels.at(-2) !== 'workers' ||
+        labels.at(-1) !== 'dev') {
+        throw new TypeError('Cloudflare workers.dev URL does not satisfy its prepared worker claim.');
+    }
+    return observed;
+}
+function progress(input) {
+    return Object.freeze({
+        prerequisite: input.prerequisite ?? NONE,
+        provider: input.provider ?? NONE,
+        configuration: input.configuration ?? NONE,
+        installation: input.installation ?? NONE,
+    });
+}
+function failed(phase, progressValue, cause, release) {
+    const error = cause instanceof Error ? cause : new Error(String(cause));
+    return Object.freeze({
+        status: 'failed',
+        phase,
+        progress: progressValue,
+        error,
+        ...(release === undefined ? {} : { release }),
+    });
+}

package/dist/deploy/index.d.ts

@@ -0,0 +1 @@
+export { deployCloudflare, type CloudflareDeployDependencies } from './deploy.js';

package/dist/deploy/index.js

@@ -0,0 +1 @@
+export { deployCloudflare } from './deploy.js';

package/dist/identity/binding.d.ts

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the execution identity private JWK. */
+export declare const SIGNING_IDENTITY_BINDING = "ASTRALE_SIGNING_IDENTITY";

package/dist/identity/binding.js

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the execution identity private JWK. */
+export const SIGNING_IDENTITY_BINDING = 'ASTRALE_SIGNING_IDENTITY';

package/dist/identity/material.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+export type SigningIdentityMaterial = JsonWebKey & {
+    readonly kid: string;
+};
+export declare function createSigningIdentity(): Promise<SigningIdentityMaterial>;
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export declare function admitSigningIdentity(input: unknown, owner: string, legacyKeyId?: string): Promise<SigningIdentityMaterial>;

package/dist/identity/material.js

@@ -0,0 +1,42 @@
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from 'jose';
+export async function createSigningIdentity() {
+    const { privateKey } = await generateKeyPair('EdDSA', { extractable: true });
+    const exported = await exportJWK(privateKey);
+    return admitSigningIdentity({
+        ...exported,
+        alg: 'EdDSA',
+        kid: await calculateJwkThumbprint(exported),
+    }, 'generated identity');
+}
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export async function admitSigningIdentity(input, owner, legacyKeyId) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(owner);
+    const value = input;
+    if (value.kty !== 'OKP' ||
+        value.crv !== 'Ed25519' ||
+        value.alg !== 'EdDSA' ||
+        typeof value.x !== 'string' ||
+        value.x.length === 0 ||
+        typeof value.d !== 'string' ||
+        value.d.length === 0) {
+        invalid(owner);
+    }
+    const thumbprint = await calculateJwkThumbprint(value);
+    const admitted = legacyKeyId !== undefined && (value.kid === undefined || value.kid === legacyKeyId)
+        ? { ...value, kid: thumbprint }
+        : value;
+    if (admitted.kid !== thumbprint) {
+        throw new TypeError(`Cloudflare signing identity '${owner}' must use its JWK thumbprint as kid.`);
+    }
+    try {
+        await importJWK(admitted, 'EdDSA');
+    }
+    catch (cause) {
+        throw invalid(owner, cause);
+    }
+    return admitted;
+}
+function invalid(owner, cause) {
+    throw new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/identity/secret.d.ts

@@ -0,0 +1,3 @@
+import type { SigningIdentitySource } from './source.js';
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export declare function signingIdentitySecrets(secrets: Readonly<Record<string, string>>, identity: SigningIdentitySource): Readonly<Record<string, string>>;

package/dist/identity/secret.js

@@ -0,0 +1,7 @@
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export function signingIdentitySecrets(secrets, identity) {
+    if (Object.hasOwn(secrets, identity.binding)) {
+        throw new TypeError(`${identity.binding} is adapter-owned; configure 'signingIdentity' instead of declaring that secret.`);
+    }
+    return Object.freeze({ ...secrets, [identity.binding]: identity.secret });
+}

package/dist/identity/source.d.ts

@@ -0,0 +1,26 @@
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+export interface SigningIdentitySource {
+    readonly binding: typeof SIGNING_IDENTITY_BINDING;
+    readonly path: string;
+    readonly secret: string;
+    readonly keyId: string;
+}
+export interface SigningIdentityInput {
+    readonly projectDir: string;
+    readonly origin: string;
+    readonly source?: string;
+    readonly mode: 'local' | 'deploy';
+}
+/** Resolve one admitted execution identity for local or remote provider custody. */
+export declare function signingIdentity(input: SigningIdentityInput): Promise<SigningIdentitySource>;
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export declare function readSigningIdentity(projectDir: string, declaration: string | undefined): Promise<SigningIdentitySource>;
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export declare function localSigningIdentity(projectDir: string, declaration: string | undefined, origin: string): Promise<SigningIdentitySource>;

package/dist/identity/source.js

@@ -0,0 +1,98 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+import { admitSigningIdentity, createSigningIdentity } from './material.js';
+const DEFAULT_IDENTITY = join('.astrale', 'identity.json');
+/** Resolve one admitted execution identity for local or remote provider custody. */
+export function signingIdentity(input) {
+    return input.mode === 'local'
+        ? localSigningIdentity(input.projectDir, input.source, input.origin)
+        : readSigningIdentity(input.projectDir, input.source);
+}
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export async function readSigningIdentity(projectDir, declaration) {
+    if (declaration === undefined || declaration.length === 0) {
+        throw new TypeError("Cloudflare deployment requires 'signingIdentity: <private-jwk-file>'. " +
+            'Run local development once to create .astrale/identity.json, then retain that file in managed secret storage.');
+    }
+    return readSource(pathOf(projectDir, declaration), declaration);
+}
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export async function localSigningIdentity(projectDir, declaration, origin) {
+    if (declaration !== undefined)
+        return readSource(pathOf(projectDir, declaration), declaration);
+    const path = join(projectDir, DEFAULT_IDENTITY);
+    if (!existsSync(path)) {
+        const legacy = join(projectDir, '.astrale', 'identity.ts');
+        if (existsSync(legacy))
+            await migrateLegacyIdentity(legacy, path, origin);
+        else
+            await generateIdentity(path);
+    }
+    return readSource(path, DEFAULT_IDENTITY);
+}
+async function generateIdentity(path) {
+    const value = await createSigningIdentity();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
+        `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+}
+async function migrateLegacyIdentity(legacy, destination, origin) {
+    const source = await readFile(legacy, 'utf8');
+    const match = /export const PRIVATE_JWK = (\{[\s\S]*\}) as const\n?$/u.exec(source);
+    if (match?.[1] === undefined)
+        throw invalidIdentity(legacy);
+    let decoded;
+    try {
+        decoded = JSON.parse(match[1]);
+    }
+    catch (cause) {
+        throw invalidIdentity(legacy, cause);
+    }
+    const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
+    await mkdir(dirname(destination), { recursive: true });
+    await writeFile(destination, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+}
+async function readSource(path, declaration) {
+    let source;
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'ENOENT'))
+            throw cause;
+        throw new TypeError(`Cloudflare signing identity '${declaration}' is missing at ${path}.`, {
+            cause,
+        });
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(source);
+    }
+    catch (cause) {
+        throw invalidIdentity(declaration, cause);
+    }
+    const value = await admitSigningIdentity(decoded, declaration);
+    return Object.freeze({
+        binding: SIGNING_IDENTITY_BINDING,
+        path,
+        secret: JSON.stringify(value),
+        keyId: value.kid,
+    });
+}
+function pathOf(projectDir, declaration) {
+    return isAbsolute(declaration) ? declaration : resolve(projectDir, declaration);
+}
+function invalidIdentity(owner, cause) {
+    return new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -18,4 +18,3 @@
  */
 export { cloudflare } from './cloudflare.js';
 export type { CloudflareParams } from './params.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -17,4 +17,3 @@
  * `/build` toolkit and ships it through the Astrale platform.
  */
 export { cloudflare } from './cloudflare.js';
-//# sourceMappingURL=index.js.map

package/dist/params.d.ts

@@ -17,8 +17,22 @@ export interface CloudflareParams {
      * localhost) but still used as the placeholder base domain there.
      */
     readonly route?: string;
+    /**
+     * Exact public Addressing expected after deployment. Use this for an already
+     * known provider-assigned address such as `*.workers.dev`; `route` remains
+     * the field that asks Cloudflare to attach a custom hostname. When both are
+     * present they must identify the same HTTPS origin.
+     */
+    readonly addressing?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
+    /**
+     * Private Ed25519 JWK file retained outside source control. Remote deploys
+     * require this explicit source so a fresh runner cannot silently rotate an
+     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * once when this field is omitted.
+     */
+    readonly signingIdentity?: string;
     /** Local dev port for `wrangler dev`. Default 8787. */
     readonly port?: number;
     /**
@@ -60,10 +74,10 @@ export interface CloudflareParams {
      * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
      * hostname served by another Worker — Cloudflare 522s it — so without this the
      * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, the GUI's
-     * delegated calls, authed views) fails with `2002 Credential verification
-     * failed`. Point it at a router Worker that reaches those hosts internally
-     * (Astrale: `admin-router`).
+     * from that instance, and every cross-instance call (install hooks, delegated
+     * GUI calls, and traffic initiated from a Shell-handshaken View) fails with
+     * `2002 Credential verification failed`. Point it at a router Worker that
+     * reaches those hosts internally (Astrale: `admin-router`).
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
@@ -88,4 +102,3 @@ export interface CloudflareParams {
         readonly minLabels?: number;
     };
 }
-//# sourceMappingURL=params.d.ts.map

package/dist/params.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=params.js.map

package/dist/release/index.d.ts

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/namespace.d.ts

@@ -0,0 +1,2 @@
+/** One private dispatch namespace per stable public Worker. */
+export declare function releaseNamespace(worker: string): string;

package/dist/release/namespace.js

@@ -0,0 +1,6 @@
+import { createHash } from 'node:crypto';
+/** One private dispatch namespace per stable public Worker. */
+export function releaseNamespace(worker) {
+    const digest = createHash('sha256').update(worker).digest('hex');
+    return `astrale-${digest.slice(0, 24)}`;
+}

package/dist/release/target.d.ts

@@ -0,0 +1,2 @@
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export declare function releaseWorkerName(revision: string): string;

package/dist/release/target.js

@@ -0,0 +1,9 @@
+const REVISION = /^sha256:([0-9a-f]{64})$/u;
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export function releaseWorkerName(revision) {
+    const digest = REVISION.exec(revision)?.[1];
+    if (digest === undefined)
+        throw new TypeError('Cloudflare Release revision is invalid.');
+    const encoded = BigInt(`0x${digest}`).toString(36).padStart(50, '0');
+    return `r-${encoded}`;
+}

package/dist/worker/entry.d.ts

@@ -0,0 +1,38 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { ExecutionContext } from '@astrale-os/sdk/execution';
+import type { Runtime } from '@astrale-os/sdk/runtime';
+export interface Fetcher {
+    fetch(request: Request): Response | Promise<Response>;
+}
+export interface CloudflareAdapterBindings {
+    readonly ASTRALE_SIGNING_IDENTITY?: string;
+    readonly WORKER_URL?: string;
+    readonly IDENTITY_ISS?: string;
+    readonly ASSETS?: Fetcher;
+    readonly SELF?: Fetcher;
+    readonly FRONTEND_DEV_URL?: string;
+    readonly DISPATCHER?: {
+        get(name: string): Fetcher;
+    };
+}
+export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings extends CloudflareAdapterBindings, Environment> {
+    /** Load the exact Runtime and Build once, after the isolate has accepted a request. */
+    readonly load: () => CloudflareWorkerSource<RuntimeValue> | Promise<CloudflareWorkerSource<RuntimeValue>>;
+    readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
+    readonly resolveEnvironment?: (bindings: Bindings) => Environment;
+    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly providerAssignedWorker?: string;
+    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+}
+export interface CloudflareWorkerSource<RuntimeValue extends Runtime> {
+    readonly runtime: RuntimeValue;
+    readonly material: BuildMaterial;
+}
+export interface CloudflareWorker<Bindings> {
+    fetch(request: Request, environment: Bindings, executionContext?: ExecutionContext): Response | Promise<Response>;
+}
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment>) => CloudflareWorker<Bindings>;