@astrale-os/adapter-cloudflare 0.5.0-beta.4 → 0.5.0-beta.41

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -18,4 +18,3 @@
  */
 export { cloudflare } from './cloudflare.js';
 export type { CloudflareParams } from './params.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,12 +1,12 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
  * `dev` runs `wrangler dev` locally; an env with no `route` ships to
@@ -17,4 +17,3 @@
  * `/build` toolkit and ships it through the Astrale platform.
  */
 export { cloudflare } from './cloudflare.js';
-//# sourceMappingURL=index.js.map

package/dist/params.d.ts

@@ -17,8 +17,22 @@ export interface CloudflareParams {
      * localhost) but still used as the placeholder base domain there.
      */
     readonly route?: string;
+    /**
+     * Exact public Addressing expected after deployment. Use this for an already
+     * known provider-assigned address such as `*.workers.dev`; `route` remains
+     * the field that asks Cloudflare to attach a custom hostname. When both are
+     * present they must identify the same HTTPS origin.
+     */
+    readonly addressing?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
+    /**
+     * Private Ed25519 JWK file retained outside source control. Remote deploys
+     * require this explicit source so a fresh runner cannot silently rotate an
+     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * once when this field is omitted.
+     */
+    readonly signingIdentity?: string;
     /** Local dev port for `wrangler dev`. Default 8787. */
     readonly port?: number;
     /**
@@ -36,6 +50,12 @@ export interface CloudflareParams {
     readonly remote?: boolean;
     /** Extra plain (non-secret) vars to inject as Worker vars. */
     readonly vars?: Record<string, string>;
+    /**
+     * Maximum encoded invocation request bytes retained by the Worker Server.
+     * Defaults to 1 MiB and is capped at 16 MiB. Increase only from measured
+     * application traffic; Publication and Bundle delivery have separate limits.
+     */
+    readonly maximumRequestBytes?: number;
     /**
      * Escape hatch: raw wrangler config deep-merged over the generated base. Use
      * it to declare extra bindings the adapter has no typed field for — KV, R2,
@@ -60,10 +80,10 @@ export interface CloudflareParams {
      * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
      * hostname served by another Worker — Cloudflare 522s it — so without this the
      * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, the GUI's
-     * delegated calls, authed views) fails with `2002 Credential verification
-     * failed`. Point it at a router Worker that reaches those hosts internally
-     * (Astrale: `admin-router`).
+     * from that instance, and every cross-instance call (install hooks, delegated
+     * GUI calls, and traffic initiated from a Shell-handshaken View) fails with
+     * `2002 Credential verification failed`. Point it at a router Worker that
+     * reaches those hosts internally (Astrale: `admin-router`).
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
@@ -88,4 +108,3 @@ export interface CloudflareParams {
         readonly minLabels?: number;
     };
 }
-//# sourceMappingURL=params.d.ts.map

package/dist/params.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=params.js.map

package/dist/release/index.d.ts

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { releaseNamespace } from './namespace.js';
+export { releaseWorkerName } from './target.js';

package/dist/release/namespace.d.ts

@@ -0,0 +1,2 @@
+/** One private dispatch namespace per stable public Worker. */
+export declare function releaseNamespace(worker: string): string;

package/dist/release/namespace.js

@@ -0,0 +1,6 @@
+import { createHash } from 'node:crypto';
+/** One private dispatch namespace per stable public Worker. */
+export function releaseNamespace(worker) {
+    const digest = createHash('sha256').update(worker).digest('hex');
+    return `astrale-${digest.slice(0, 24)}`;
+}

package/dist/release/target.d.ts

@@ -0,0 +1,2 @@
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export declare function releaseWorkerName(revision: string): string;

package/dist/release/target.js

@@ -0,0 +1,9 @@
+const REVISION = /^sha256:([0-9a-f]{64})$/u;
+/** Exact Schema revisions select stable Workers inside the private namespace. */
+export function releaseWorkerName(revision) {
+    const digest = REVISION.exec(revision)?.[1];
+    if (digest === undefined)
+        throw new TypeError('Cloudflare Release revision is invalid.');
+    const encoded = BigInt(`0x${digest}`).toString(36).padStart(50, '0');
+    return `r-${encoded}`;
+}

package/dist/worker/entry.d.ts

@@ -0,0 +1,39 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+import type { BuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { ExecutionContext } from '@astrale-os/sdk/execution';
+import type { Runtime } from '@astrale-os/sdk/runtime';
+export interface Fetcher {
+    fetch(request: Request): Response | Promise<Response>;
+}
+export interface CloudflareAdapterBindings {
+    readonly ASTRALE_SIGNING_IDENTITY?: string;
+    readonly WORKER_URL?: string;
+    readonly IDENTITY_ISS?: string;
+    readonly ASSETS?: Fetcher;
+    readonly SELF?: Fetcher;
+    readonly FRONTEND_DEV_URL?: string;
+    readonly DISPATCHER?: {
+        get(name: string): Fetcher;
+    };
+}
+export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings extends CloudflareAdapterBindings, Environment> {
+    /** Load the exact Runtime and Build once, after the isolate has accepted a request. */
+    readonly load: () => CloudflareWorkerSource<RuntimeValue> | Promise<CloudflareWorkerSource<RuntimeValue>>;
+    readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
+    readonly resolveEnvironment?: (bindings: Bindings) => Environment;
+    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly providerAssignedWorker?: string;
+    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+    readonly maximumRequestBytes?: number;
+}
+export interface CloudflareWorkerSource<RuntimeValue extends Runtime> {
+    readonly runtime: RuntimeValue;
+    readonly material: BuildMaterial;
+}
+export interface CloudflareWorker<Bindings> {
+    fetch(request: Request, environment: Bindings, executionContext?: ExecutionContext): Response | Promise<Response>;
+}
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment>) => CloudflareWorker<Bindings>;

package/dist/worker/entry.js

@@ -0,0 +1,162 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { restoreBuild } from '@astrale-os/sdk/deployment/build/material';
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { createIdentity, serve } from '@astrale-os/sdk/execution';
+import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
+/** Compose one exact revision Service; the provider gateway owns revision selection. */
+export function cloudflareWorkerEntry() {
+    return function (config) {
+        let currentIssuer;
+        let realized;
+        const realize = () => {
+            if (realized !== undefined)
+                return realized;
+            realized = Promise.resolve()
+                .then(config.load)
+                .then((source) => {
+                const build = restoreBuild(source.material, source.runtime);
+                const application = serve({
+                    runtime: source.runtime,
+                    load(environment) {
+                        if (currentIssuer !== environment.issuer) {
+                            throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
+                        }
+                        return assemble(build, addressing(environment.issuer));
+                    },
+                    initialize: (environment) => config.resolveEnvironment === undefined
+                        ? environment.bindings
+                        : config.resolveEnvironment(environment.bindings),
+                    identity(environment) {
+                        return createIdentity({
+                            issuer: issuer.accept(environment.issuer),
+                            subject: build.schema.compiled.root.origin,
+                            privateKey: typeof config.privateKey === 'function'
+                                ? config.privateKey(environment.bindings)
+                                : config.privateKey,
+                            fetch: routedFetch(application, environment, config),
+                            ...(new URL(environment.issuer).protocol === 'http:'
+                                ? { allowInsecureHttp: true }
+                                : {}),
+                        });
+                    },
+                    server: {
+                        health: { probe: { check: () => true } },
+                        limits: {
+                            maximumRequestBytes: config.maximumRequestBytes ?? 1024 * 1024,
+                            maximumPublicationBytes: 1024 * 1024,
+                            maximumBundleBytes: 8 * 1024 * 1024,
+                            maximumDeliveryBytes: 8 * 1024 * 1024,
+                            invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
+                        },
+                    },
+                });
+                return Object.freeze({ build, application });
+            });
+            return realized;
+        };
+        return Object.freeze({
+            async fetch(request, bindings, context) {
+                const url = new URL(request.url);
+                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                    bindings.IDENTITY_ISS ??
+                    config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
+                    requestOrigin(url, request));
+                if (config.providerAssignedWorker !== undefined &&
+                    bindings.WORKER_URL === undefined &&
+                    bindings.IDENTITY_ISS === undefined &&
+                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    return new Response('Request origin differs from provider-assigned Addressing.', {
+                        status: 421,
+                    });
+                }
+                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                    return new Response('Request origin differs from the current Release.', { status: 421 });
+                }
+                currentIssuer = issuer;
+                const { application, build } = await realize();
+                const frontend = await frontendAsset(build.frontend, bindings, url, request);
+                if (frontend !== undefined)
+                    return frontend;
+                return application.fetch(request, Object.freeze({ bindings, issuer }), context);
+            },
+        });
+    };
+}
+function routedFetch(application, environment, config) {
+    return async (input, init) => {
+        const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
+        const destination = new URL(request.url);
+        if (destination.origin === environment.issuer) {
+            const self = config.selfBinding?.(environment.bindings);
+            return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
+                ? application.fetch(selected, environment)
+                : self.fetch(selected));
+        }
+        const route = config.routeSubrequest?.(destination, environment.bindings);
+        return dispatchCloudflareRequest(request, rejectRedirect, (selected) => route === null || route === undefined ? fetch(selected) : route.fetch(selected));
+    };
+}
+async function frontendAsset(frontend, environment, url, request) {
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return undefined;
+    if (reserved(url.pathname) || (request.method !== 'GET' && request.method !== 'HEAD')) {
+        return undefined;
+    }
+    const development = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
+    if (development !== undefined && development.length > 0) {
+        return fetch(new Request(new URL(`${url.pathname}${url.search}`, `${development}/`), request));
+    }
+    const assetPath = url.pathname.startsWith('/assets/');
+    const route = assetPath
+        ? undefined
+        : frontend.routes
+            .filter((candidate) => candidate.path === url.pathname ||
+            (frontend.source.kind === 'vite' &&
+                frontend.source.spa &&
+                (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
+            .sort((left, right) => right.path.length - left.path.length)[0];
+    if (route === undefined && !assetPath)
+        return undefined;
+    const assets = environment.ASSETS;
+    if (assets === undefined)
+        return undefined;
+    if (route === undefined)
+        return assets.fetch(request);
+    return assets.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request));
+}
+function reserved(path) {
+    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function requestOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
+    return forwarded === 'https' ? `https://${url.host}` : url.origin;
+}
+function canonicalServingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/fetch.d.ts

@@ -0,0 +1,11 @@
+export type RequestDispatcher = (request: Request) => Response | Promise<Response>;
+export interface CloudflareRequest {
+    readonly request: Request;
+    readonly rejectRedirect: boolean;
+}
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export declare function prepareCloudflareRequest(input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): CloudflareRequest;
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export declare function dispatchCloudflareRequest(request: Request, rejectRedirect: boolean, dispatch: RequestDispatcher): Promise<Response>;
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export declare function adaptCloudflareResponse(request: Request, response: Response): Response;

package/dist/worker/fetch.js

@@ -0,0 +1,31 @@
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Construct a Cloudflare-compatible transport request without weakening redirect:error. */
+export function prepareCloudflareRequest(input, init) {
+    const rejectRedirect = init?.redirect === 'error' ||
+        (init?.redirect === undefined && input instanceof Request && input.redirect === 'error');
+    const request = new Request(input, rejectRedirect ? { ...init, redirect: 'manual' } : init);
+    return Object.freeze({ request, rejectRedirect });
+}
+/** Preserve Fetch redirect:error semantics on Cloudflare, whose transport rejects that mode. */
+export async function dispatchCloudflareRequest(request, rejectRedirect, dispatch) {
+    const response = adaptCloudflareResponse(request, await dispatch(request));
+    if (!rejectRedirect)
+        return response;
+    if (!response.redirected && !REDIRECT_STATUSES.has(response.status))
+        return response;
+    await response.body?.cancel();
+    throw new TypeError('Redirects are not allowed for this request.');
+}
+/** Restore the requested URL omitted by Cloudflare service-binding Responses. */
+export function adaptCloudflareResponse(request, response) {
+    if (response.url !== '')
+        return response;
+    return new Proxy(response, {
+        get(target, property) {
+            if (property === 'url')
+                return request.url;
+            const value = Reflect.get(target, property, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/dist/worker/gateway.d.ts

@@ -0,0 +1,15 @@
+import type { Revision } from '@astrale-os/sdk/schema';
+export interface DispatchNamespace {
+    get(name: string): {
+        fetch(request: Request): Response | Promise<Response>;
+    };
+}
+export interface CloudflareGatewayBindings {
+    readonly RELEASES: DispatchNamespace;
+}
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export declare function cloudflareGatewayEntry(config: {
+    readonly current: Revision;
+}): {
+    fetch(request: Request, bindings: CloudflareGatewayBindings): Promise<Response>;
+};

package/dist/worker/gateway.js

@@ -0,0 +1,26 @@
+import { releaseUnavailable, requestedRevision } from '@astrale-os/sdk/deployment/release/runtime';
+import { releaseWorkerName } from '../release/target.js';
+/** Stable public Worker that selects one exact immutable Schema-revision Service. */
+export function cloudflareGatewayEntry(config) {
+    const current = releaseWorkerName(config.current);
+    return Object.freeze({
+        async fetch(request, bindings) {
+            const revision = requestedRevision(new URL(request.url).pathname);
+            const target = revision === undefined ? current : releaseWorkerName(revision);
+            let worker;
+            try {
+                worker = bindings.RELEASES.get(target);
+                return await worker.fetch(request);
+            }
+            catch (cause) {
+                if (isMissingWorker(cause))
+                    return releaseUnavailable();
+                throw cause;
+            }
+        },
+    });
+}
+/** Admit only Cloudflare's documented missing-script failure at the provider boundary. */
+function isMissingWorker(cause) {
+    return cause instanceof Error && /^Worker not found(?:: [^\r\n]+|\.)?$/u.test(cause.message);
+}

package/dist/worker/identity.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+/** Decode the secret representation at the Worker binding boundary. */
+export declare function decodeSigningIdentity(input: string): JsonWebKey;
+/** Remove adapter-owned signing material before Runtime initialization. */
+export declare function runtimeBindings<Bindings extends {
+    readonly ASTRALE_SIGNING_IDENTITY: string;
+}>(bindings: Bindings): Omit<Bindings, 'ASTRALE_SIGNING_IDENTITY'>;

package/dist/worker/identity.js

@@ -0,0 +1,23 @@
+/** Decode the secret representation at the Worker binding boundary. */
+export function decodeSigningIdentity(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid();
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare signing identity secret is invalid JSON.', { cause });
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded))
+        invalid();
+    return decoded;
+}
+/** Remove adapter-owned signing material before Runtime initialization. */
+export function runtimeBindings(bindings) {
+    const { ASTRALE_SIGNING_IDENTITY: _identity, ...runtime } = bindings;
+    return runtime;
+}
+function invalid() {
+    throw new TypeError('Cloudflare signing identity secret is invalid.');
+}

package/dist/worker/index.d.ts

@@ -1,59 +1,3 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { DomainDefinition } from '@astrale-os/sdk';
-import type { Application, RemoteDeploymentInput, RemoteIdentityInput } from '@astrale-os/sdk/server';
-import type { ExecutionContext } from 'hono';
-/** SDK-owned Publication manifest passed through without adapter interpretation. */
-export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>;
-export interface Fetcher {
-    fetch(request: Request): Response | Promise<Response>;
-}
-/** Adapter-owned bindings generated into every Cloudflare deployment. */
-export interface CloudflareAdapterBindings {
-    /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
-    readonly ASTRALE_VERSION_METADATA?: {
-        readonly id: string;
-        readonly tag: string;
-        readonly timestamp: string;
-    };
-    /** Content-derived generation supplied by providers without version metadata. */
-    readonly ASTRALE_DEPLOYMENT_VERSION?: string;
-    readonly WORKER_URL?: string;
-    readonly ASSETS?: Fetcher;
-    readonly SELF?: Fetcher;
-    readonly FRONTEND_DEV_URL?: string;
-    readonly DISPATCHER?: {
-        get(name: string): Fetcher;
-    };
-}
-interface CloudflareWorkerSharedConfig<Bindings extends CloudflareAdapterBindings, Environment> {
-    readonly privateKey: RemoteIdentityInput['privateKey'] | ((bindings: Bindings) => RemoteIdentityInput['privateKey']);
-    /** Compose provider bindings into the exact Domain environment once per deployment generation. */
-    readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>;
-    readonly manifest?: CloudflareManifest;
-    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
-    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
-}
-/**
- * Resolve a Domain lazily when its module graph is too expensive for provider startup admission.
- * The adapter resolves at most once concurrently and retries after a rejected resolution.
- */
-export type CloudflareWorkerConfig<S extends schema.DomainSchema, Bindings extends CloudflareAdapterBindings, Environment> = CloudflareWorkerSharedConfig<Bindings, Environment> & ({
-    readonly definition: DomainDefinition<S>;
-    readonly resolveDefinition?: never;
-} | {
-    readonly definition?: never;
-    readonly resolveDefinition: (bindings: Bindings) => DomainDefinition<S> | Promise<DomainDefinition<S>>;
-});
-export interface CloudflareWorker<Environment> {
-    fetch(request: Request, environment: Environment, executionContext?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <const S extends schema.DomainSchema>(config: CloudflareWorkerConfig<S, Bindings, Environment>) => CloudflareWorker<Bindings>;
-/** Close an evicted Application before its environment bindings leave the cache. */
-export declare function closeEvictedApplication(application: Pick<Application, 'close'>, now?: () => number): Promise<void>;
-export {};
-//# sourceMappingURL=index.d.ts.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';
+export * from './gateway.js';