@astrale-os/adapter-cloudflare 0.5.0-beta.71 → 0.5.0-beta.72

package/dist/development/frontend.d.ts

@@ -0,0 +1,11 @@
+import type { Build } from '@astrale-os/sdk/deployment/build';
+export interface FrontendHandle {
+    readonly url: string;
+    readonly finished: Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function startFrontend(input: {
+    readonly frontend: Build['frontend'];
+    readonly projectDir: string;
+    readonly onLog?: (line: string) => void;
+}): Promise<FrontendHandle | undefined>;

package/dist/{build/frontend-v1.js → development/frontend.js}

@@ -1,26 +1,7 @@
-import { frontend as frontendBuild } from '@astrale-os/sdk/deployment/build';
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { readFile, readdir, rm } from 'node:fs/promises';
 import { createServer } from 'node:net';
 import { join } from 'node:path';
-export async function frontendFiles(input) {
-    const frontend = input.frontend;
-    if (frontend === undefined)
-        return [];
-    if (frontend.source.kind === 'external')
-        return frontendBuild.files(frontend, []);
-    const output = join(input.projectDir, '.astrale', 'frontend-build');
-    await rm(output, { recursive: true, force: true });
-    await run(viteCommand(input.projectDir), [
-        'build',
-        '--outDir',
-        output,
-        '--emptyOutDir',
-        ...(frontend.source.config === undefined ? [] : ['--config', frontend.source.config]),
-    ], input.projectDir, input.onLog);
-    return frontendBuild.files(frontend, await readFiles(output));
-}
 export async function startFrontend(input) {
     const frontend = input.frontend;
     if (frontend === undefined || frontend.source.kind !== 'vite')
@@ -52,23 +33,32 @@ export async function startFrontend(input) {
         await ready(url, child, output);
     }
     catch (cause) {
-        await stop(child);
+        await stopChild(child);
         throw cause;
     }
-    return Object.freeze({ url, stop: () => stop(child) });
-}
-async function readFiles(root, current = '') {
-    const entries = await readdir(join(root, current), { withFileTypes: true });
-    const files = [];
-    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-        const path = current === '' ? entry.name : `${current}/${entry.name}`;
-        if (entry.isDirectory())
-            files.push(...(await readFiles(root, path)));
-        else if (entry.isFile()) {
-            files.push({ path, content: new Uint8Array(await readFile(join(root, path))) });
-        }
-    }
-    return files;
+    let stopping = false;
+    const finished = child.exitCode === null
+        ? new Promise((resolve, reject) => {
+            child.once('exit', (code, signal) => {
+                if (stopping)
+                    resolve();
+                else {
+                    reject(new Error(`Vite stopped unexpectedly (code ${code ?? 'null'}, signal ${signal ?? 'none'}).\n${output.join('\n')}`));
+                }
+            });
+            child.once('error', reject);
+        })
+        : Promise.reject(new Error(`Vite stopped unexpectedly (code ${child.exitCode}).`));
+    return Object.freeze({
+        url,
+        finished,
+        async stop() {
+            if (stopping)
+                return finished.catch(() => undefined);
+            stopping = true;
+            await stopChild(child);
+        },
+    });
 }
 function viteCommand(projectDir) {
     const command = join(projectDir, 'node_modules', '.bin', 'vite');
@@ -76,25 +66,6 @@ function viteCommand(projectDir) {
         throw new TypeError('Vite frontend requires a project-local vite binary.');
     return command;
 }
-function run(command, args, cwd, onLog) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
-        let output = '';
-        const collect = (buffer) => {
-            const value = buffer.toString();
-            output += value;
-            for (const line of value.split('\n'))
-                if (line.trim() !== '')
-                    onLog?.(line);
-        };
-        child.stdout?.on('data', collect);
-        child.stderr?.on('data', collect);
-        child.on('error', reject);
-        child.on('exit', (code) => code === 0
-            ? resolve()
-            : reject(new Error(`Vite failed (code ${code ?? 1}):\n${output.slice(-1500)}`)));
-    });
-}
 function ephemeralPort() {
     return new Promise((resolve, reject) => {
         const server = createServer();
@@ -123,11 +94,16 @@ async function ready(url, child, output) {
     }
     throw new Error(`Vite did not become ready at ${url}.`);
 }
-function stop(child) {
-    if (child.exitCode !== null || child.killed)
+function stopChild(child) {
+    if (child.exitCode !== null)
         return Promise.resolve();
     return new Promise((resolve) => {
         child.once('exit', () => resolve());
         child.kill('SIGTERM');
+        setTimeout(() => {
+            if (child.exitCode === null)
+                child.kill('SIGKILL');
+            resolve();
+        }, 4_000).unref?.();
     });
 }

package/dist/development/host.d.ts

@@ -0,0 +1,2 @@
+/** Admit one externally owned public origin without inferring lifecycle ownership. */
+export declare function admitHost(input: string): string;

package/dist/development/host.js

@@ -0,0 +1,46 @@
+/** Admit one externally owned public origin without inferring lifecycle ownership. */
+export function admitHost(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare development host must be one public HTTP(S) origin.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        privateHostname(url.hostname)) {
+        throw new TypeError('Cloudflare development host must be one public HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function privateHostname(input) {
+    const host = input
+        .toLowerCase()
+        .replace(/^\[|\]$/gu, '')
+        .replace(/\.$/u, '');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (isIP(host) === 4) {
+        const parts = host.split('.').map(Number);
+        return (parts[0] === 0 ||
+            parts[0] === 10 ||
+            parts[0] === 127 ||
+            (parts[0] === 169 && parts[1] === 254) ||
+            (parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31) ||
+            (parts[0] === 192 && parts[1] === 168));
+    }
+    if (isIP(host) !== 6)
+        return false;
+    return (host === '::' ||
+        host === '::1' ||
+        host.startsWith('fc') ||
+        host.startsWith('fd') ||
+        /^fe[89ab]/u.test(host) ||
+        /^::ffff:(?:0|10|127|169\.254|172\.(?:1[6-9]|2\d|3[01])|192\.168)\./u.test(host));
+}
+import { isIP } from 'node:net';

package/dist/development/port.d.ts

@@ -0,0 +1 @@
+export declare function allocatePort(host?: string): Promise<number>;

package/dist/development/port.js

@@ -0,0 +1,12 @@
+import { createServer } from 'node:net';
+export function allocatePort(host = '127.0.0.1') {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address !== null ? address.port : 0;
+            server.close((cause) => (cause === undefined ? resolve(port) : reject(cause)));
+        });
+    });
+}

package/dist/development/readiness.d.ts

@@ -0,0 +1,14 @@
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+interface ReadinessDependencies {
+    readonly verify: typeof verifyReadiness;
+    readonly resolvedFetch: typeof resolvedHttpsFetch;
+}
+/** Verify the exact Release over both public identity and its loopback transport. */
+export declare function verifyDevelopmentRelease(input: {
+    readonly release: Release;
+    readonly localUrl: string;
+    readonly signal: AbortSignal;
+}, dependencies?: ReadinessDependencies): Promise<void>;
+export {};

package/dist/development/readiness.js

@@ -0,0 +1,71 @@
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+const defaults = Object.freeze({
+    verify: verifyReadiness,
+    resolvedFetch: resolvedHttpsFetch,
+});
+/** Verify the exact Release over both public identity and its loopback transport. */
+export async function verifyDevelopmentRelease(input, dependencies = defaults) {
+    const sameOrigin = new URL(input.release.addressing.issuer).origin === new URL(input.localUrl).origin;
+    if (!sameOrigin) {
+        await retry(() => dependencies.verify(input.release, {
+            signal: attemptSignal(input.signal),
+            fetch: (url, init) => {
+                const requested = new URL(url);
+                const local = new URL(input.localUrl);
+                local.pathname = requested.pathname;
+                local.search = requested.search;
+                return fetch(local.href, init);
+            },
+        }), input.signal);
+    }
+    const publicHost = new URL(input.release.addressing.issuer).hostname;
+    const publicFetch = publicHost.endsWith('.trycloudflare.com')
+        ? dependencies.resolvedFetch(input.release.addressing.issuer)
+        : undefined;
+    await retry(() => dependencies.verify(input.release, {
+        signal: attemptSignal(input.signal),
+        ...(publicFetch === undefined ? {} : { fetch: publicFetch }),
+    }), input.signal);
+}
+async function retry(operation, signal) {
+    const deadline = Date.now() + 90_000;
+    let last;
+    while (Date.now() < deadline) {
+        throwIfAborted(signal);
+        try {
+            await operation();
+            return;
+        }
+        catch (cause) {
+            throwIfAborted(signal);
+            last = cause;
+            await pause(signal);
+        }
+    }
+    throw last instanceof Error
+        ? last
+        : new Error('Cloudflare development Release did not become ready.');
+}
+function attemptSignal(signal) {
+    return AbortSignal.any([signal, AbortSignal.timeout(5_000)]);
+}
+function pause(signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(done, 250);
+        const abort = () => done(signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.'));
+        signal.addEventListener('abort', abort, { once: true });
+        function done(cause) {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            if (cause === undefined)
+                resolve();
+            else
+                reject(cause);
+        }
+    });
+}
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.');
+}

package/dist/development/resolved-fetch.d.ts

@@ -0,0 +1,18 @@
+import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolve4 } from 'node:dns/promises';
+type ReadinessOptions = NonNullable<Parameters<typeof verifyReadiness>[1]>;
+type ReadinessFetch = NonNullable<ReadinessOptions['fetch']>;
+type RequestAddress = typeof requestAddress;
+export interface ResolvedFetchDependencies {
+    readonly resolve: typeof resolve4;
+    readonly request: RequestAddress;
+}
+/**
+ * Fetch one HTTPS origin through authoritative A records instead of the host
+ * process' getaddrinfo cache. Quick Tunnel hostnames can be negatively cached
+ * when their URL is observed milliseconds before DNS propagation; retrying
+ * global fetch in that process then remains stuck even after the record exists.
+ */
+export declare function resolvedHttpsFetch(origin: string, dependencies?: ResolvedFetchDependencies): ReadinessFetch;
+declare function requestAddress(url: URL, address: string, init: Parameters<ReadinessFetch>[1]): Promise<Response>;
+export {};

package/dist/development/resolved-fetch.js

@@ -0,0 +1,78 @@
+import { resolve4 } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { Readable } from 'node:stream';
+const defaults = Object.freeze({
+    resolve: resolve4,
+    request: requestAddress,
+});
+/**
+ * Fetch one HTTPS origin through authoritative A records instead of the host
+ * process' getaddrinfo cache. Quick Tunnel hostnames can be negatively cached
+ * when their URL is observed milliseconds before DNS propagation; retrying
+ * global fetch in that process then remains stuck even after the record exists.
+ */
+export function resolvedHttpsFetch(origin, dependencies = defaults) {
+    const expected = new URL(origin);
+    if (expected.protocol !== 'https:') {
+        throw new TypeError('Resolved development fetch requires an HTTPS origin.');
+    }
+    let addresses;
+    let cursor = 0;
+    return async (input, init) => {
+        const url = new URL(input);
+        if (url.origin !== expected.origin)
+            return fetch(input, init);
+        const resolved = addresses ?? (await dependencies.resolve(expected.hostname));
+        if (resolved.length === 0)
+            throw new Error(`No IPv4 address resolved for ${expected.hostname}.`);
+        addresses = resolved;
+        let last;
+        for (let attempt = 0; attempt < resolved.length; attempt += 1) {
+            const address = resolved[(cursor + attempt) % resolved.length];
+            try {
+                const response = await dependencies.request(url, address, init);
+                cursor = (cursor + attempt + 1) % resolved.length;
+                return response;
+            }
+            catch (cause) {
+                if (init?.signal?.aborted)
+                    throw cause;
+                last = cause;
+            }
+        }
+        throw last;
+    };
+}
+function requestAddress(url, address, init) {
+    const headers = new Headers();
+    headers.set('host', url.host);
+    headers.set('accept-encoding', 'identity');
+    return new Promise((resolve, reject) => {
+        const request = httpsRequest({
+            protocol: 'https:',
+            hostname: address,
+            port: url.port === '' ? 443 : Number(url.port),
+            path: `${url.pathname}${url.search}`,
+            method: 'GET',
+            headers: Object.fromEntries(headers.entries()),
+            servername: url.hostname,
+            signal: init?.signal ?? undefined,
+        }, (incoming) => {
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (Array.isArray(value))
+                    for (const item of value)
+                        responseHeaders.append(name, item);
+                else if (value !== undefined)
+                    responseHeaders.set(name, value);
+            }
+            resolve(new Response(Readable.toWeb(incoming), {
+                status: incoming.statusCode ?? 500,
+                statusText: incoming.statusMessage,
+                headers: responseHeaders,
+            }));
+        });
+        request.once('error', reject);
+        request.end();
+    });
+}

package/dist/development/worker-output.d.ts

@@ -0,0 +1,2 @@
+/** Admit the local Worker origin printed by Wrangler and ignore its inspector endpoints. */
+export declare function parseWorkerReadyUrl(text: string, port: number): string | undefined;

package/dist/development/worker-output.js

@@ -0,0 +1,25 @@
+const READY_RE = /(?:Ready on|Listening on|⎔.*?at)\s+(https?:\/\/[^\s]+)/iu;
+/** Admit the local Worker origin printed by Wrangler and ignore its inspector endpoints. */
+export function parseWorkerReadyUrl(text, port) {
+    const ready = READY_RE.exec(text);
+    if (ready !== null)
+        return normalizeLocal(ready[1], port);
+    const localhostOnPort = new RegExp(`(https?://(?:localhost|127\\.0\\.0\\.1):${port})(?![0-9])`, 'iu');
+    const match = localhostOnPort.exec(text);
+    return match === null ? undefined : normalizeLocal(match[1], port);
+}
+function normalizeLocal(input, port) {
+    try {
+        const url = new URL(input);
+        if (url.hostname === '0.0.0.0')
+            url.hostname = '127.0.0.1';
+        if (url.hostname === 'localhost')
+            url.hostname = '127.0.0.1';
+        if (url.port === '')
+            url.port = String(port);
+        return url.origin;
+    }
+    catch {
+        return `http://127.0.0.1:${port}`;
+    }
+}

package/dist/{build/wrangler/development.d.ts → development/worker.d.ts}

@@ -1,8 +1,9 @@
-export interface DevHandle {
-    url: string;
+export interface WorkerHandle {
+    readonly url: string;
+    readonly finished: Promise<void>;
     stop(): Promise<void>;
 }
-export declare function runWranglerDev(args: {
+export declare function startWorker(args: {
     projectDir: string;
     configPath: string;
     port: number;
@@ -12,6 +13,5 @@ export declare function runWranglerDev(args: {
     /** Pin ordinary local requests to one stable issuer after the final port is selected. */
     readonly pinLocalOrigin?: boolean;
     readonly secrets: Readonly<Record<string, string>>;
-    readonly onReload: () => void;
     readonly onLog?: (line: string) => void;
-}): Promise<DevHandle>;
+}): Promise<WorkerHandle>;

package/dist/{build/wrangler/development.js → development/worker.js}

@@ -1,10 +1,10 @@
 import { spawn } from 'node:child_process';
 import { createServer } from 'node:net';
-import { parseDevReadyUrl } from '../parse-output.js';
-import { stopChild, wranglerCommand, wranglerProcessEnv } from './process.js';
-import { createSecretEnvironment, secretRedactor } from './secrets.js';
-import { runWranglerTypes } from './type-generation.js';
-export async function runWranglerDev(args) {
+import { stopChild, wranglerCommand, wranglerProcessEnv } from '../wrangler/process.js';
+import { createSecretEnvironment, secretRedactor } from '../wrangler/secrets.js';
+import { runWranglerTypes } from '../wrangler/type-generation.js';
+import { parseWorkerReadyUrl } from './worker-output.js';
+export async function startWorker(args) {
     await runWranglerTypes(args);
     const { cmd, prefix } = wranglerCommand(args.projectDir);
     const bindHost = args.ip ?? '127.0.0.1';
@@ -60,15 +60,12 @@ export async function runWranglerDev(args) {
                     buildErrorTail = (buildErrorTail + text).slice(-2000);
                 }
                 if (!resolved) {
-                    const ready = parseDevReadyUrl(text, args.port);
+                    const ready = parseWorkerReadyUrl(text, args.port);
                     if (ready) {
                         resolved = true;
                         resolve(ready);
                     }
                 }
-                else if (/Reloading|Detected changes|Updated/i.test(text)) {
-                    args.onReload();
-                }
             };
             child.stdout?.on('data', onData);
             child.stderr?.on('data', onData);
@@ -88,11 +85,10 @@ export async function runWranglerDev(args) {
                 if (!resolved && child.exitCode === null) {
                     resolved = true;
                     if (buildErrorTail) {
-                        void stopChild(child);
                         reject(new Error(`worker build failed — the dev server would hang silently.\n${buildErrorTail}`));
                     }
                     else {
-                        resolve(fallbackUrl);
+                        reject(new Error(`wrangler dev did not report local readiness at ${fallbackUrl}.\n${outputTail}`));
                     }
                 }
             }, 15_000).unref?.();
@@ -103,9 +99,24 @@ export async function runWranglerDev(args) {
         await secretEnvironment?.remove();
         throw cause;
     }
-    return {
+    let stopping = false;
+    const finished = new Promise((resolve, reject) => {
+        child.once('exit', (code, signal) => {
+            if (stopping)
+                resolve();
+            else {
+                reject(new Error(`wrangler dev stopped unexpectedly (code ${code ?? 'null'}, signal ${signal ?? 'none'}).\n${outputTail}`));
+            }
+        });
+        child.once('error', reject);
+    });
+    return Object.freeze({
         url: args.pinLocalOrigin ? fallbackUrl : url,
+        finished,
         async stop() {
+            if (stopping)
+                return finished;
+            stopping = true;
             try {
                 await stopChild(child);
             }
@@ -113,7 +124,7 @@ export async function runWranglerDev(args) {
                 await secretEnvironment?.remove();
             }
         },
-    };
+    });
 }
 function portFree(port, host) {
     return new Promise((resolve) => {

package/dist/identity/source.js

@@ -1,5 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from './binding.js';
 import { admitSigningIdentity, createSigningIdentity } from './material.js';
@@ -41,10 +42,10 @@ export async function localSigningIdentity(projectDir, declaration, origin) {
 }
 async function generateIdentity(path) {
     const value = await createSigningIdentity();
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
-        `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+    if (await installIdentity(path, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
+            `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+    }
 }
 async function migrateLegacyIdentity(legacy, destination, origin) {
     const source = await readFile(legacy, 'utf8');
@@ -59,9 +60,37 @@ async function migrateLegacyIdentity(legacy, destination, origin) {
         throw invalidIdentity(legacy, cause);
     }
     const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
-    await mkdir(dirname(destination), { recursive: true });
-    await writeFile(destination, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+    if (await installIdentity(destination, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+    }
+}
+/** Publish a complete owner-only identity once; concurrent environments reuse the winner. */
+async function installIdentity(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const staging = `${path}.${process.pid}.${randomUUID()}.next`;
+    const file = await open(staging, 'wx', 0o600);
+    try {
+        await file.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await file.sync();
+    }
+    catch (cause) {
+        await file.close();
+        await unlink(staging).catch(() => undefined);
+        throw cause;
+    }
+    await file.close();
+    try {
+        await link(staging, path);
+        return true;
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'EEXIST'))
+            throw cause;
+        return false;
+    }
+    finally {
+        await unlink(staging).catch(() => undefined);
+    }
 }
 async function readSource(path, declaration) {
     let source;

package/dist/index.d.ts

@@ -9,7 +9,8 @@
  *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `dev` runs the Worker and optional Vite frontend on allocated local ports;
+ * an env with no `route` ships to
  * `*.workers.dev`; an env with a `route` ships to that custom domain.
  *
  * Prefer a managed deploy (no Cloudflare account)? Use

package/dist/index.js

@@ -9,7 +9,8 @@
  *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `dev` runs the Worker and optional Vite frontend on allocated local ports;
+ * an env with no `route` ships to
  * `*.workers.dev`; an env with a `route` ships to that custom domain.
  *
  * Prefer a managed deploy (no Cloudflare account)? Use

package/dist/params.d.ts

@@ -6,7 +6,7 @@
  * is `Record<string, CloudflareParams>`.
  *
  * Three deployment shapes fall out of which fields are set:
- *   • dev (local)      — `watch()` runs `wrangler dev`; URL = http://localhost:<port>
+ *   • dev (local)      — `develop()` runs `wrangler dev`; URL = an allocated loopback port
  *   • dev-remote       — `deploy()` with no `route`; URL = https://<name>.<sub>.workers.dev
  *   • remote (custom)  — `deploy()` with `route`; URL = https://<route>
  */
@@ -29,11 +29,11 @@ export interface CloudflareParams {
     /**
      * Private Ed25519 JWK file retained outside source control. Remote deploys
      * require this explicit source so a fresh runner cannot silently rotate an
-     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * installed Domain identity. Local development generates `.astrale/identity.json`
      * once when this field is omitted.
      */
     readonly signingIdentity?: string;
-    /** Local dev port for `wrangler dev`. Default 8787. */
+    /** Strict local development port. Omit to allocate an available loopback port. */
     readonly port?: number;
     /**
      * Public URL the dev server is reached through (tunnel / sandbox preview /

package/dist/{build/wrangler → wrangler}/bundle.js

@@ -1,9 +1,7 @@
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { runCapture, wranglerCommand } from './process.js';
-import { runWranglerTypes } from './type-generation.js';
 export async function runWranglerBundle(args) {
-    await runWranglerTypes(args);
     const { cmd, prefix } = wranglerCommand(args.projectDir);
     const { code, out } = await runCapture(cmd, [
         ...prefix,

package/dist/{build/wrangler → wrangler}/deploy.js

@@ -1,4 +1,4 @@
-import { parseDeployUrl, parseDeployVersionId } from '../parse-output.js';
+import { parseDeployUrl, parseDeployVersionId } from '../deploy/output.js';
 import { runCapture, wranglerCommand } from './process.js';
 import { secretRedactor, withSecretsFile } from './secrets.js';
 import { runWranglerTypes } from './type-generation.js';

package/dist/wrangler/index.d.ts

@@ -0,0 +1,5 @@
+export { runWranglerBundle } from './bundle.js';
+export { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './deploy.js';
+export { wranglerProcessEnv } from './process.js';
+export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, type WranglerDeploymentStatus, } from './status.js';
+export { runWranglerTypes } from './type-generation.js';