@astrale-os/adapter-cloudflare 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/params.d.ts

@@ -17,8 +17,22 @@ export interface CloudflareParams {
      * localhost) but still used as the placeholder base domain there.
      */
     readonly route?: string;
+    /**
+     * Exact public Addressing expected after deployment. Use this for an already
+     * known provider-assigned address such as `*.workers.dev`; `route` remains
+     * the field that asks Cloudflare to attach a custom hostname. When both are
+     * present they must identify the same HTTPS origin.
+     */
+    readonly addressing?: string;
     /** Gitignored secrets file (whole contents = secrets), e.g. `'.env.dev'`. */
     readonly secrets?: string;
+    /**
+     * Private Ed25519 JWK file retained outside source control. Remote deploys
+     * require this explicit source so a fresh runner cannot silently rotate an
+     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * once when this field is omitted.
+     */
+    readonly signingIdentity?: string;
     /** Local dev port for `wrangler dev`. Default 8787. */
     readonly port?: number;
     /**
@@ -36,6 +50,18 @@ export interface CloudflareParams {
     readonly remote?: boolean;
     /** Extra plain (non-secret) vars to inject as Worker vars. */
     readonly vars?: Record<string, string>;
+    /**
+     * Maximum encoded invocation request bytes retained by the Worker Server.
+     * Defaults to 1 MiB and is capped at 16 MiB. Increase only from measured
+     * application traffic; Publication and Bundle delivery have separate limits.
+     */
+    readonly maximumRequestBytes?: number;
+    /**
+     * Maximum wall-clock lifetime of one invocation, including Workflow steps and
+     * returned streams. Defaults to 30 seconds. Increase this for intentionally
+     * long provider orchestration while retaining a finite application budget.
+     */
+    readonly invocationTimeoutMs?: number;
     /**
      * Escape hatch: raw wrangler config deep-merged over the generated base. Use
      * it to declare extra bindings the adapter has no typed field for — KV, R2,
@@ -60,10 +86,10 @@ export interface CloudflareParams {
      * instead of the public edge. A Cloudflare Worker can't fetch a same-zone
      * hostname served by another Worker — Cloudflare 522s it — so without this the
      * worker can't fetch an instance kernel's JWKS to verify an inbound credential
-     * from that instance, and every cross-instance call (install hooks, the GUI's
-     * delegated calls, authed views) fails with `2002 Credential verification
-     * failed`. Point it at a router Worker that reaches those hosts internally
-     * (Astrale: `admin-router`).
+     * from that instance, and every cross-instance call (install hooks, delegated
+     * GUI calls, and traffic initiated from a Shell-handshaken View) fails with
+     * `2002 Credential verification failed`. Point it at a router Worker that
+     * reaches those hosts internally (Astrale: `admin-router`).
      *
      * Wires BOTH halves the SDK needs: the `<binding>` service binding in the
      * generated wrangler config, and a `routeSubrequest` predicate in the worker
@@ -88,4 +114,3 @@ export interface CloudflareParams {
         readonly minLabels?: number;
     };
 }
-//# sourceMappingURL=params.d.ts.map

package/dist/params.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=params.js.map

package/dist/release/deployment.d.ts

@@ -0,0 +1,44 @@
+declare const WORKER_DEPLOYMENT_ID: unique symbol;
+/** Provider-local identity for one immutable staged Cloudflare implementation. */
+export type WorkerDeploymentId = `sha256:${string}` & {
+    readonly [WORKER_DEPLOYMENT_ID]: true;
+};
+export interface WorkerDeploymentInput {
+    readonly release: {
+        readonly entrypoint: string;
+        readonly modules: readonly {
+            readonly path: string;
+            readonly kind: 'esm' | 'wasm' | 'text' | 'data';
+            readonly content: Uint8Array;
+        }[];
+    };
+    readonly runtime: {
+        readonly compatibilityDate: string;
+        readonly compatibilityFlags: readonly string[];
+    };
+    readonly bindings: {
+        readonly vars: Readonly<Record<string, string>>;
+        readonly services: readonly {
+            readonly name: string;
+            readonly service: string;
+        }[];
+        readonly requiredSecrets: readonly string[];
+    };
+    readonly assets?: {
+        readonly files: readonly {
+            readonly path: string;
+            readonly content: Uint8Array;
+            readonly contentType?: string;
+        }[];
+        readonly notFound: 'none' | '404-page' | 'single-page-application';
+        readonly runWorkerFirst: boolean;
+        readonly htmlHandling?: 'none';
+    };
+}
+/** Canonical provider material used only for staging, promotion, rollback, and cleanup. */
+export declare function workerDeploymentMaterial(input: WorkerDeploymentInput): Uint8Array;
+/** Identify one immutable Cloudflare implementation without changing SDK or Publication identity. */
+export declare function workerDeployment(input: WorkerDeploymentInput): WorkerDeploymentId;
+/** Admit a serialized provider deployment identity at a Cloudflare boundary. */
+export declare function acceptWorkerDeployment(input: unknown): WorkerDeploymentId;
+export {};

package/dist/release/deployment.js

@@ -0,0 +1,141 @@
+import { sha256 } from '@noble/hashes/sha2.js';
+const DEPLOYMENT = /^sha256:[0-9a-f]{64}$/u;
+/** Canonical provider material used only for staging, promotion, rollback, and cleanup. */
+export function workerDeploymentMaterial(input) {
+    const release = executable(input.release);
+    const compatibilityFlags = uniqueStrings(input.runtime.compatibilityFlags, 'compatibility flag');
+    const vars = Object.fromEntries(Object.entries(input.bindings.vars)
+        .map(([name, value]) => {
+        stable(name, 'Variable binding name');
+        if (typeof value !== 'string')
+            invalid();
+        return [name, value];
+    })
+        .sort(([left], [right]) => compare(left, right)));
+    const services = [...input.bindings.services]
+        .map((binding) => ({
+        name: stable(binding.name, 'Service binding name'),
+        service: stable(binding.service, 'Service binding target'),
+    }))
+        .sort((left, right) => compare(left.name, right.name));
+    unique(services.map((binding) => binding.name), 'Service binding name');
+    const requiredSecrets = uniqueStrings(input.bindings.requiredSecrets, 'required secret');
+    unique([...Object.keys(vars), ...services.map((binding) => binding.name), ...requiredSecrets], 'Worker binding name');
+    const assets = input.assets === undefined ? undefined : canonicalAssets(input.assets);
+    return new TextEncoder().encode(`${JSON.stringify({
+        format: 'astrale.cloudflare.deployment',
+        version: 1,
+        release,
+        runtime: {
+            compatibilityDate: stable(input.runtime.compatibilityDate, 'compatibility date'),
+            compatibilityFlags,
+        },
+        bindings: { vars, services, requiredSecrets },
+        ...(assets === undefined ? {} : { assets }),
+    })}\n`);
+}
+/** Identify one immutable Cloudflare implementation without changing SDK or Publication identity. */
+export function workerDeployment(input) {
+    let hexadecimal = '';
+    for (const byte of sha256(workerDeploymentMaterial(input))) {
+        hexadecimal += byte.toString(16).padStart(2, '0');
+    }
+    return `sha256:${hexadecimal}`;
+}
+/** Admit a serialized provider deployment identity at a Cloudflare boundary. */
+export function acceptWorkerDeployment(input) {
+    if (typeof input !== 'string' || !DEPLOYMENT.test(input)) {
+        throw new TypeError('Cloudflare Worker deployment identity is invalid.');
+    }
+    return input;
+}
+function executable(input) {
+    const entrypoint = stablePath(input.entrypoint, 'Worker release entrypoint');
+    const modules = input.modules
+        .map((module) => ({
+        path: stablePath(module.path, 'Worker release module path'),
+        kind: module.kind,
+        digest: content(module.content),
+    }))
+        .sort((left, right) => compare(left.path, right.path));
+    unique(modules.map((module) => module.path), 'Worker release module path');
+    if (!modules.some((module) => module.path === entrypoint && module.kind === 'esm')) {
+        throw new TypeError('Worker release entrypoint must be an ES module in its module set.');
+    }
+    return { entrypoint, modules };
+}
+function canonicalAssets(input) {
+    const files = input.files
+        .map((file) => ({
+        path: stableAssetPath(file.path),
+        digest: content(file.content),
+        ...(file.contentType === undefined
+            ? {}
+            : { contentType: stable(file.contentType, 'Worker asset content type') }),
+    }))
+        .sort((left, right) => compare(left.path, right.path));
+    unique(files.map((file) => file.path), 'Worker asset path');
+    if (!['none', '404-page', 'single-page-application'].includes(input.notFound))
+        invalid();
+    if (input.htmlHandling !== undefined && input.htmlHandling !== 'none')
+        invalid();
+    return {
+        files,
+        notFound: input.notFound,
+        runWorkerFirst: input.runWorkerFirst,
+        htmlHandling: input.htmlHandling ?? 'none',
+    };
+}
+function uniqueStrings(input, label) {
+    const values = input.map((value) => stable(value, label)).sort(compare);
+    unique(values, label);
+    return values;
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length) {
+        throw new TypeError(`${label} must be unique.`);
+    }
+}
+function content(value) {
+    if (!(value instanceof Uint8Array))
+        invalid();
+    let hexadecimal = '';
+    for (const byte of sha256(value))
+        hexadecimal += byte.toString(16).padStart(2, '0');
+    return `sha256:${hexadecimal}`;
+}
+function stablePath(value, label) {
+    const admitted = stable(value, label);
+    if (admitted.startsWith('/') ||
+        admitted.includes('\\') ||
+        admitted.split('/').some((part) => part.length === 0 || part === '.' || part === '..')) {
+        invalid();
+    }
+    return admitted;
+}
+function stableAssetPath(value) {
+    const admitted = stable(value, 'Worker asset path');
+    if (!admitted.startsWith('/') ||
+        admitted.includes('\\') ||
+        admitted.includes('?') ||
+        admitted.includes('#') ||
+        admitted
+            .slice(1)
+            .split('/')
+            .some((part) => part.length === 0 || part === '.' || part === '..')) {
+        invalid();
+    }
+    return admitted;
+}
+function stable(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.trim() !== value) {
+        throw new TypeError(`${label} must be stable non-empty text.`);
+    }
+    return value;
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid() {
+    throw new TypeError('Cloudflare Worker deployment material is invalid.');
+}

package/dist/release/index.d.ts

@@ -0,0 +1,2 @@
+export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, type WorkerDeploymentId, type WorkerDeploymentInput, } from './deployment.js';
+export { stagedWorkerName } from './staged-worker-name.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { acceptWorkerDeployment, workerDeployment, workerDeploymentMaterial, } from './deployment.js';
+export { stagedWorkerName } from './staged-worker-name.js';

package/dist/release/staged-worker-name.d.ts

@@ -0,0 +1,3 @@
+import type { WorkerDeploymentId } from './deployment.js';
+/** Provider deployment identities select immutable Workers inside the private namespace. */
+export declare function stagedWorkerName(deployment: WorkerDeploymentId): string;

package/dist/release/staged-worker-name.js

@@ -0,0 +1,10 @@
+import { acceptWorkerDeployment } from './deployment.js';
+const DEPLOYMENT = /^sha256:([0-9a-f]{64})$/u;
+/** Provider deployment identities select immutable Workers inside the private namespace. */
+export function stagedWorkerName(deployment) {
+    const digest = DEPLOYMENT.exec(acceptWorkerDeployment(deployment))?.[1];
+    if (digest === undefined)
+        throw new TypeError('Cloudflare Worker deployment identity is invalid.');
+    const encoded = BigInt(`0x${digest}`).toString(36).padStart(50, '0');
+    return `r-${encoded}`;
+}

package/dist/worker/entry.d.ts

@@ -0,0 +1,43 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+import type { BuildMaterial, GeneratedBuildMaterial } from '@astrale-os/sdk/deployment/build/material';
+import type { ExecutionContext } from '@astrale-os/sdk/execution';
+import type { Runtime } from '@astrale-os/sdk/runtime';
+export interface Fetcher {
+    fetch(request: Request): Response | Promise<Response>;
+}
+export interface CloudflareAdapterBindings {
+    readonly ASTRALE_SIGNING_IDENTITY?: string;
+    readonly WORKER_URL?: string;
+    readonly IDENTITY_ISS?: string;
+    readonly ASSETS?: Fetcher;
+    readonly SELF?: Fetcher;
+    readonly FRONTEND_DEV_URL?: string;
+    readonly DISPATCHER?: {
+        get(name: string): Fetcher;
+    };
+}
+export interface CloudflareWorkerConfig<RuntimeValue extends Runtime, Bindings extends CloudflareAdapterBindings, Environment, Material = BuildMaterial> {
+    /** Generated frontend evidence available without restoring the execution Build. */
+    readonly frontend?: BuildMaterial['frontend'];
+    /** Load the exact Runtime and Build once, after the isolate has accepted a request. */
+    readonly load: () => CloudflareWorkerSource<RuntimeValue, Material> | Promise<CloudflareWorkerSource<RuntimeValue, Material>>;
+    readonly privateKey: JsonWebKey | ((bindings: Bindings) => JsonWebKey);
+    readonly resolveEnvironment?: (bindings: Bindings) => Environment;
+    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
+    readonly providerAssignedWorker?: string;
+    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
+    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
+    readonly invocationTimeoutMs?: number;
+    readonly maximumRequestBytes?: number;
+}
+export interface CloudflareWorkerSource<RuntimeValue extends Runtime, Material = BuildMaterial> {
+    readonly runtime: RuntimeValue;
+    readonly material: Material;
+}
+export interface CloudflareWorker<Bindings> {
+    fetch(request: Request, environment: Bindings, executionContext?: ExecutionContext): Response | Promise<Response>;
+}
+/** Compose one Service implementation behind its provider-owned stable address. */
+export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment, BuildMaterial>) => CloudflareWorker<Bindings>;
+/** Compose generated execution code whose exact Build material carries build-owner evidence. */
+export declare function generatedCloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <RuntimeValue extends Runtime>(config: CloudflareWorkerConfig<RuntimeValue, Bindings, Environment, GeneratedBuildMaterial>) => CloudflareWorker<Bindings>;

package/dist/worker/entry.js

@@ -0,0 +1,181 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { restoreBuild, restoreGeneratedBuild } from '@astrale-os/sdk/deployment/build/material';
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release/runtime';
+import { createIdentity, serve } from '@astrale-os/sdk/execution';
+import { dispatchCloudflareRequest, prepareCloudflareRequest } from './fetch.js';
+/** Compose one Service implementation behind its provider-owned stable address. */
+export function cloudflareWorkerEntry() {
+    return createCloudflareWorkerEntry(restoreBuild);
+}
+/** Compose generated execution code whose exact Build material carries build-owner evidence. */
+export function generatedCloudflareWorkerEntry() {
+    return createCloudflareWorkerEntry(restoreGeneratedBuild);
+}
+function createCloudflareWorkerEntry(restore) {
+    return function (config) {
+        let currentIssuer;
+        let realized;
+        const realize = () => {
+            if (realized !== undefined)
+                return realized;
+            realized = Promise.resolve()
+                .then(config.load)
+                .then((source) => {
+                const build = restore(source.material, source.runtime);
+                const application = serve({
+                    runtime: source.runtime,
+                    load(environment) {
+                        if (currentIssuer !== environment.issuer) {
+                            throw new TypeError('Cloudflare Worker request origin differs from its current Release.');
+                        }
+                        return assemble(build, addressing(environment.issuer));
+                    },
+                    initialize: (environment) => config.resolveEnvironment === undefined
+                        ? environment.bindings
+                        : config.resolveEnvironment(environment.bindings),
+                    identity(environment) {
+                        return createIdentity({
+                            issuer: issuer.accept(environment.issuer),
+                            subject: build.schema.compiled.root.origin,
+                            privateKey: typeof config.privateKey === 'function'
+                                ? config.privateKey(environment.bindings)
+                                : config.privateKey,
+                            fetch: routedFetch(application, environment, config),
+                            ...(new URL(environment.issuer).protocol === 'http:'
+                                ? { allowInsecureHttp: true }
+                                : {}),
+                        });
+                    },
+                    server: {
+                        health: { probe: { check: () => true } },
+                        limits: {
+                            maximumRequestBytes: config.maximumRequestBytes ?? 1024 * 1024,
+                            maximumPublicationBytes: 1024 * 1024,
+                            maximumBundleBytes: 8 * 1024 * 1024,
+                            maximumDeliveryBytes: 8 * 1024 * 1024,
+                            invocationTimeoutMs: config.invocationTimeoutMs ?? 30_000,
+                        },
+                    },
+                });
+                return Object.freeze({ build, application });
+            });
+            return realized;
+        };
+        return Object.freeze({
+            async fetch(request, bindings, context) {
+                const url = new URL(request.url);
+                const issuer = canonicalServingUrl(bindings.WORKER_URL ??
+                    bindings.IDENTITY_ISS ??
+                    config.resolveUrl?.(bindings, requestOrigin(url, request)) ??
+                    requestOrigin(url, request));
+                if (config.providerAssignedWorker !== undefined &&
+                    bindings.WORKER_URL === undefined &&
+                    bindings.IDENTITY_ISS === undefined &&
+                    !matchesWorkersDevClaim(issuer, config.providerAssignedWorker)) {
+                    return new Response('Request origin differs from provider-assigned Addressing.', {
+                        status: 421,
+                    });
+                }
+                if (currentIssuer !== undefined && currentIssuer !== issuer) {
+                    return new Response('Request origin differs from the current Release.', { status: 421 });
+                }
+                currentIssuer = issuer;
+                if (config.frontend !== undefined) {
+                    const frontend = await frontendAsset(config.frontend, bindings, url, request);
+                    if (frontend !== undefined)
+                        return frontend;
+                }
+                const { application, build } = await realize();
+                if (config.frontend === undefined) {
+                    const frontend = await frontendAsset(build.frontend, bindings, url, request);
+                    if (frontend !== undefined)
+                        return frontend;
+                }
+                return application.fetch(request, Object.freeze({ bindings, issuer }), context);
+            },
+        });
+    };
+}
+function routedFetch(application, environment, config) {
+    return async (input, init) => {
+        const { request, rejectRedirect } = prepareCloudflareRequest(input, init);
+        const destination = new URL(request.url);
+        if (destination.origin === environment.issuer) {
+            const self = config.selfBinding?.(environment.bindings);
+            return dispatchCloudflareRequest(request, rejectRedirect, (selected) => self === null || self === undefined
+                ? application.fetch(selected, environment)
+                : self.fetch(selected));
+        }
+        const route = config.routeSubrequest?.(destination, environment.bindings);
+        return dispatchCloudflareRequest(request, rejectRedirect, (selected) => route === null || route === undefined ? fetch(selected) : route.fetch(selected));
+    };
+}
+async function frontendAsset(frontend, environment, url, request) {
+    if (frontend === undefined || frontend.source.kind === 'external')
+        return undefined;
+    if (reserved(url.pathname) || (request.method !== 'GET' && request.method !== 'HEAD')) {
+        return undefined;
+    }
+    const development = environment.FRONTEND_DEV_URL?.replace(/\/+$/u, '');
+    if (development !== undefined && development.length > 0) {
+        return fetch(new Request(new URL(`${url.pathname}${url.search}`, `${development}/`), request));
+    }
+    const assetPath = url.pathname.startsWith('/assets/');
+    const route = assetPath
+        ? undefined
+        : frontend.routes
+            .filter((candidate) => candidate.path === url.pathname ||
+            (frontend.source.kind === 'vite' &&
+                frontend.source.spa &&
+                (candidate.path === '/' || url.pathname.startsWith(`${candidate.path}/`))))
+            .sort((left, right) => right.path.length - left.path.length)[0];
+    const assets = environment.ASSETS;
+    if (assets === undefined)
+        return undefined;
+    if (route === undefined) {
+        const response = await assets.fetch(request);
+        return assetPath || response.status !== 404 ? response : undefined;
+    }
+    if (route.path !== url.pathname) {
+        const response = await assets.fetch(request);
+        if (response.status !== 404)
+            return response;
+    }
+    return assets.fetch(new Request(new URL(`/${route.document}${url.search}`, url.origin), request));
+}
+function reserved(path) {
+    return ['/releases', '/install', '/health', '/meta', '/.well-known'].some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function requestOrigin(url, request) {
+    if (url.protocol !== 'http:')
+        return url.origin;
+    const forwarded = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase();
+    return forwarded === 'https' ? `https://${url.host}` : url.origin;
+}
+function canonicalServingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare Worker serving URL is invalid.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new TypeError('Cloudflare Worker serving URL must be one HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function matchesWorkersDevClaim(issuer, expectedWorker) {
+    const url = new URL(issuer);
+    const labels = url.hostname.split('.');
+    return (url.protocol === 'https:' &&
+        labels.length >= 4 &&
+        labels[0] === expectedWorker &&
+        labels.at(-2) === 'workers' &&
+        labels.at(-1) === 'dev');
+}

package/dist/worker/fetch.d.ts

@@ -9,4 +9,3 @@ export declare function prepareCloudflareRequest(input: Parameters<typeof fetch>
 export declare function dispatchCloudflareRequest(request: Request, rejectRedirect: boolean, dispatch: RequestDispatcher): Promise<Response>;
 /** Restore the requested URL omitted by Cloudflare service-binding Responses. */
 export declare function adaptCloudflareResponse(request: Request, response: Response): Response;
-//# sourceMappingURL=fetch.d.ts.map

package/dist/worker/fetch.js

@@ -29,4 +29,3 @@ export function adaptCloudflareResponse(request, response) {
         },
     });
 }
-//# sourceMappingURL=fetch.js.map

package/dist/worker/identity.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+/** Decode the secret representation at the Worker binding boundary. */
+export declare function decodeSigningIdentity(input: string): JsonWebKey;
+/** Remove adapter-owned signing material before Runtime initialization. */
+export declare function runtimeBindings<Bindings extends {
+    readonly ASTRALE_SIGNING_IDENTITY: string;
+}>(bindings: Bindings): Omit<Bindings, 'ASTRALE_SIGNING_IDENTITY'>;

package/dist/worker/identity.js

@@ -0,0 +1,23 @@
+/** Decode the secret representation at the Worker binding boundary. */
+export function decodeSigningIdentity(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        invalid();
+    let decoded;
+    try {
+        decoded = JSON.parse(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare signing identity secret is invalid JSON.', { cause });
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded))
+        invalid();
+    return decoded;
+}
+/** Remove adapter-owned signing material before Runtime initialization. */
+export function runtimeBindings(bindings) {
+    const { ASTRALE_SIGNING_IDENTITY: _identity, ...runtime } = bindings;
+    return runtime;
+}
+function invalid() {
+    throw new TypeError('Cloudflare signing identity secret is invalid.');
+}

package/dist/worker/index.d.ts

@@ -1,61 +1,2 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { DomainDefinition } from '@astrale-os/sdk';
-import type { Application, RemoteDeploymentInput, RemoteIdentityInput } from '@astrale-os/sdk/server';
-import type { ExecutionContext } from 'hono';
-/** SDK-owned Publication manifest passed through without adapter interpretation. */
-export type CloudflareManifest = NonNullable<RemoteDeploymentInput['manifest']>;
-export interface Fetcher {
-    fetch(request: Request): Response | Promise<Response>;
-}
-/** Adapter-owned bindings generated into every Cloudflare deployment. */
-export interface CloudflareAdapterBindings {
-    /** Native Cloudflare deployment metadata (direct Wrangler deployments). */
-    readonly ASTRALE_VERSION_METADATA?: {
-        readonly id: string;
-        readonly tag: string;
-        readonly timestamp: string;
-    };
-    /** Content-derived generation supplied by providers without version metadata. */
-    readonly ASTRALE_DEPLOYMENT_VERSION?: string;
-    readonly WORKER_URL?: string;
-    readonly ASSETS?: Fetcher;
-    readonly SELF?: Fetcher;
-    readonly FRONTEND_DEV_URL?: string;
-    readonly DISPATCHER?: {
-        get(name: string): Fetcher;
-    };
-}
-interface CloudflareWorkerSharedConfig<Bindings extends CloudflareAdapterBindings, Environment> {
-    readonly privateKey: RemoteIdentityInput['privateKey'] | ((bindings: Bindings) => RemoteIdentityInput['privateKey']);
-    /** Compose provider bindings into the exact Domain environment once per deployment generation. */
-    readonly resolveEnvironment?: (bindings: Bindings) => Environment | Promise<Environment>;
-    readonly manifest?: CloudflareManifest;
-    /** Maximum time allowed for one Domain invocation. Defaults to 30 seconds. */
-    readonly invocationTimeoutMs?: number;
-    readonly resolveUrl?: (bindings: Bindings, requestOrigin: string) => string;
-    readonly selfBinding?: (bindings: Bindings) => Fetcher | null | undefined;
-    readonly routeSubrequest?: (url: URL, bindings: Bindings) => Fetcher | null | undefined;
-}
-/**
- * Resolve a Domain lazily when its module graph is too expensive for provider startup admission.
- * The adapter resolves at most once concurrently and retries after a rejected resolution.
- */
-export type CloudflareWorkerConfig<S extends schema.DomainSchema, Bindings extends CloudflareAdapterBindings, Environment> = CloudflareWorkerSharedConfig<Bindings, Environment> & ({
-    readonly definition: DomainDefinition<S>;
-    readonly resolveDefinition?: never;
-} | {
-    readonly definition?: never;
-    readonly resolveDefinition: (bindings: Bindings) => DomainDefinition<S> | Promise<DomainDefinition<S>>;
-});
-export interface CloudflareWorker<Environment> {
-    fetch(request: Request, environment: Environment, executionContext?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * Compose one Cloudflare module Worker without request-global mutation.
- * Environment bindings are captured once per immutable serving URL/version generation.
- */
-export declare function cloudflareWorkerEntry<Bindings extends CloudflareAdapterBindings, Environment = Bindings>(): <const S extends schema.DomainSchema>(config: CloudflareWorkerConfig<S, Bindings, Environment>) => CloudflareWorker<Bindings>;
-/** Close an evicted Application before its environment bindings leave the cache. */
-export declare function closeEvictedApplication(application: Pick<Application, 'close'>, now?: () => number): Promise<void>;
-export {};
-//# sourceMappingURL=index.d.ts.map
+export * from './entry.js';
+export { decodeSigningIdentity, runtimeBindings } from './identity.js';