@astrale-os/adapter-cloudflare 0.5.0-beta.8 → 0.5.0-beta.80

package/dist/build/worker/execution.prepare.js

@@ -0,0 +1,109 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from '../../identity/binding.js';
+import { runWranglerBundle } from '../../wrangler/bundle.js';
+import { admitWorkerBundle } from '../bundle/admit.js';
+import { generateExecutionEntry, generateExecutionService } from '../codegen/execution.js';
+import { generateWranglerConfig } from '../codegen/wrangler.js';
+import { workerInvocationTimeout, workerRequestLimit } from '../configuration.js';
+import { qualifyWorkerBundle } from '../qualification.js';
+import { workerModuleSpecifier } from './specifier.js';
+export const RELEASE_ENTRY = 'bundle/index.mjs';
+export const RELEASE_SERVICE = 'bundle/service.mjs';
+export async function prepareExecution(input) {
+    const runtimePath = resolve(input.context.projectDir, input.context.runtime.reference.path);
+    const runtimeSpecifier = moduleSpecifier(relative(input.directory, runtimePath));
+    const workerSpecifier = workerModuleSpecifier();
+    const maximumRequestBytes = workerRequestLimit(input.params.maximumRequestBytes);
+    const invocationTimeoutMs = workerInvocationTimeout(input.params.invocationTimeoutMs);
+    const serviceSource = generateExecutionService({
+        origin: input.context.build.schema.compiled.root.origin,
+        runtimeSpecifier,
+        workerSpecifier,
+        build: input.context.build,
+        ...(maximumRequestBytes === undefined ? {} : { maximumRequestBytes }),
+        ...(invocationTimeoutMs === undefined ? {} : { invocationTimeoutMs }),
+        ...(input.configuredIssuer === undefined && input.direct
+            ? { providerAssignedWorker: input.name }
+            : {}),
+        ...(input.router === undefined
+            ? {}
+            : {
+                router: {
+                    binding: input.router.binding,
+                    hostSuffix: input.router.hostSuffix,
+                    minLabels: input.router.minLabels,
+                },
+            }),
+    });
+    const serviceSourcePath = join(input.directory, 'service.gen.ts');
+    await writeFile(serviceSourcePath, serviceSource);
+    const serviceConfigPath = join(input.directory, 'wrangler.service.prepare.jsonc');
+    await writeFile(serviceConfigPath, generateWranglerConfig({
+        workerName: input.name,
+        main: './service.gen.ts',
+        vars: runtimeVars(input.params, input.configuredIssuer),
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        ...(input.router === undefined
+            ? {}
+            : { router: { binding: input.router.binding, service: input.router.service } }),
+        ...(input.params.wrangler === undefined ? {} : { wrangler: input.params.wrangler }),
+        selfBinding: false,
+    }));
+    const serviceOutput = join(input.directory, 'dist-service');
+    await rm(serviceOutput, { recursive: true, force: true });
+    const emittedService = await runWranglerBundle({
+        projectDir: input.context.projectDir,
+        configPath: serviceConfigPath,
+        outDir: serviceOutput,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: emittedService.metafilePath,
+        inputRoot: dirname(serviceConfigPath),
+    });
+    await admitWorkerBundle(emittedService.bundlePath);
+    const service = new Uint8Array(await readFile(emittedService.bundlePath));
+    await mkdir(dirname(join(input.directory, RELEASE_SERVICE)), { recursive: true });
+    await writeFile(join(input.directory, RELEASE_SERVICE), service);
+    const sourcePath = join(input.directory, 'worker.gen.ts');
+    await writeFile(sourcePath, generateExecutionEntry('./service.mjs', workerSpecifier));
+    const configPath = join(input.directory, 'wrangler.prepare.jsonc');
+    await writeFile(configPath, generateWranglerConfig({
+        workerName: input.name,
+        ...(input.params.route === undefined ? {} : { route: input.params.route }),
+        vars: runtimeVars(input.params, input.configuredIssuer),
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        modules: { baseDir: '.', rules: [{ type: 'ESModule', globs: [RELEASE_SERVICE] }] },
+        ...(input.router === undefined
+            ? {}
+            : { router: { binding: input.router.binding, service: input.router.service } }),
+        ...(input.params.wrangler === undefined ? {} : { wrangler: input.params.wrangler }),
+        selfBinding: false,
+    }));
+    const output = join(input.directory, 'dist-prepare');
+    await rm(output, { recursive: true, force: true });
+    const emitted = await runWranglerBundle({
+        projectDir: input.context.projectDir,
+        configPath,
+        outDir: output,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: emitted.metafilePath,
+        inputRoot: dirname(configPath),
+    });
+    await admitWorkerBundle(emitted.bundlePath);
+    return Object.freeze({
+        entry: new Uint8Array(await readFile(emitted.bundlePath)),
+        service,
+    });
+}
+export function runtimeVars(params, configuredIssuer) {
+    return {
+        ...params.vars,
+        ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
+    };
+}
+function moduleSpecifier(input) {
+    const normalized = input.split('\\').join('/');
+    return normalized.startsWith('.') ? normalized : `./${normalized}`;
+}

package/dist/build/worker/index.d.ts

@@ -0,0 +1,2 @@
+export { loadWorkerArtifact } from './artifact.load.js';
+export type { WorkerArtifact } from './artifact.js';

package/dist/build/worker/index.js

@@ -0,0 +1 @@
+export { loadWorkerArtifact } from './artifact.load.js';

package/dist/build/worker/modules.d.ts

@@ -0,0 +1,11 @@
+import type { WorkerArtifact } from './artifact.js';
+type WranglerModuleType = 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
+/** Project one admitted Worker module inventory into Wrangler's relative module discovery. */
+export declare function workerModules(worker: WorkerArtifact['release']): {
+    readonly baseDir: string;
+    readonly rules: readonly {
+        readonly type: WranglerModuleType;
+        readonly globs: readonly string[];
+    }[];
+};
+export {};

package/dist/build/worker/modules.js

@@ -0,0 +1,26 @@
+import { posix } from 'node:path';
+const TYPES = Object.freeze({
+    esm: 'ESModule',
+    wasm: 'CompiledWasm',
+    text: 'Text',
+    data: 'Data',
+});
+/** Project one admitted Worker module inventory into Wrangler's relative module discovery. */
+export function workerModules(worker) {
+    const directory = posix.dirname(worker.entrypoint);
+    const groups = new Map();
+    for (const module of worker.modules) {
+        if (module.path === worker.entrypoint)
+            continue;
+        const relative = posix.relative(directory, module.path);
+        if (relative === '' || relative === '..' || relative.startsWith('../')) {
+            throw new TypeError('Cloudflare Worker module escapes its entrypoint directory.');
+        }
+        const type = TYPES[module.kind];
+        const globs = groups.get(type) ?? [];
+        globs.push(relative);
+        groups.set(type, globs);
+    }
+    const rules = [...groups].map(([type, globs]) => Object.freeze({ type, globs: Object.freeze(globs) }));
+    return Object.freeze({ baseDir: `./${directory}`, rules: Object.freeze(rules) });
+}

package/dist/build/worker/runtime.d.ts

@@ -0,0 +1,10 @@
+export interface WorkerRuntimeConfiguration {
+    readonly compatibilityDate: string;
+    readonly compatibilityFlags: readonly string[];
+    readonly vars: Readonly<Record<string, string>>;
+    readonly services: readonly {
+        readonly name: string;
+        readonly service: string;
+    }[];
+}
+export declare function admitWorkerRuntimeConfiguration(input: string): WorkerRuntimeConfiguration;

package/dist/build/worker/runtime.js

@@ -0,0 +1,35 @@
+export function admitWorkerRuntimeConfiguration(input) {
+    const value = JSON.parse(input);
+    const compatibilityDate = value.compatibility_date;
+    const compatibilityFlags = value.compatibility_flags;
+    const vars = value.vars ?? {};
+    const services = value.services ?? [];
+    if (typeof compatibilityDate !== 'string' ||
+        !Array.isArray(compatibilityFlags) ||
+        compatibilityFlags.some((flag) => typeof flag !== 'string') ||
+        vars === null ||
+        typeof vars !== 'object' ||
+        Array.isArray(vars) ||
+        Object.values(vars).some((item) => typeof item !== 'string') ||
+        !Array.isArray(services)) {
+        invalidRuntime();
+    }
+    const admittedServices = services.map((input) => {
+        if (input === null || typeof input !== 'object' || Array.isArray(input))
+            invalidRuntime();
+        const binding = Reflect.get(input, 'binding');
+        const service = Reflect.get(input, 'service');
+        if (typeof binding !== 'string' || typeof service !== 'string')
+            invalidRuntime();
+        return Object.freeze({ name: binding, service });
+    });
+    return Object.freeze({
+        compatibilityDate,
+        compatibilityFlags: Object.freeze([...compatibilityFlags]),
+        vars: Object.freeze({ ...vars }),
+        services: Object.freeze(admittedServices),
+    });
+}
+function invalidRuntime() {
+    throw new TypeError('Generated Cloudflare runtime configuration is invalid.');
+}

package/dist/build/worker/specifier.d.ts

@@ -0,0 +1 @@
+export declare function workerModuleSpecifier(): string;

package/dist/build/worker/specifier.js

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+const workerModule = import.meta.resolve('@astrale-os/adapter-cloudflare/worker');
+export function workerModuleSpecifier() {
+    return fileURLToPath(workerModule);
+}

package/dist/cloudflare.d.ts

@@ -1,34 +1 @@
-/**
- * `cloudflare(envs)` — the Cloudflare deployment adapter.
- *
- * Owns everything target-specific: it codegens the Worker entry + wrangler
- * config (the dev never sees a `wrangler.jsonc`), materializes the optional frontend
- * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
- * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
- * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the CLI
- * prints and `astrale domain install <url>` consumes.
- */
-import type { DomainAdapter } from '@astrale-os/sdk';
-import type { CloudflareParams } from './params.js';
-import { bulkPutSecrets, buildCloudflareWorker, buildFrontend, logTo, prepare, runWranglerDeploy, runWranglerDev, runWranglerTypes, watchFrontend } from './build/index.js';
-export declare function cloudflare(envs: Record<string, CloudflareParams>): DomainAdapter<CloudflareParams>;
-interface CloudflareAdapterDependencies {
-    readonly bulkPutSecrets: typeof bulkPutSecrets;
-    readonly buildCloudflareWorker: typeof buildCloudflareWorker;
-    readonly buildFrontend: typeof buildFrontend;
-    readonly logTo: typeof logTo;
-    readonly prepare: typeof prepare;
-    readonly runWranglerDeploy: typeof runWranglerDeploy;
-    readonly runWranglerDev: typeof runWranglerDev;
-    readonly runWranglerTypes: typeof runWranglerTypes;
-    readonly watchFrontend: typeof watchFrontend;
-    readonly waitUntilLive: typeof waitUntilLive;
-}
-/** Exact orchestration seam used by adapter-level deployment qualification. */
-export declare function cloudflareWithDependencies(envs: Record<string, CloudflareParams>, dependencies: CloudflareAdapterDependencies): DomainAdapter<CloudflareParams>;
-/**
- * Poll until the deployed Worker health endpoint returns exactly 200.
- */
-declare function waitUntilLive(url: string, onLog: (line: string) => void, expectedDeploymentVersion?: string, timeoutMs?: number): Promise<void>;
-export {};
-//# sourceMappingURL=cloudflare.d.ts.map
+export { cloudflare } from './adapter.js';

package/dist/cloudflare.js

@@ -1,205 +1 @@
-/**
- * `cloudflare(envs)` — the Cloudflare deployment adapter.
- *
- * Owns everything target-specific: it codegens the Worker entry + wrangler
- * config (the dev never sees a `wrangler.jsonc`), materializes the optional frontend
- * SPA, and shells out to `wrangler`. `watch` → `wrangler dev` (local URL);
- * `deploy` → `wrangler deploy` (workers.dev or a custom-domain URL); secrets →
- * `wrangler secret bulk`. Both `watch` and `deploy` return the URL the CLI
- * prints and `astrale domain install <url>` consumes.
- */
-import { defineAdapter } from '@astrale-os/sdk';
-import { bulkPutSecrets, buildCloudflareWorker, buildFrontend, logTo, prepare, runWranglerDeploy, runWranglerDev, runWranglerTypes, watchFrontend, } from './build/index.js';
-export function cloudflare(envs) {
-    return cloudflareWithDependencies(envs, {
-        bulkPutSecrets,
-        buildCloudflareWorker,
-        buildFrontend,
-        logTo,
-        prepare,
-        runWranglerDeploy,
-        runWranglerDev,
-        runWranglerTypes,
-        watchFrontend,
-        waitUntilLive,
-    });
-}
-/** Exact orchestration seam used by adapter-level deployment qualification. */
-export function cloudflareWithDependencies(envs, dependencies) {
-    return defineAdapter({
-        name: 'cloudflare',
-        envs,
-        async build(params, ctx) {
-            await dependencies.buildCloudflareWorker({
-                params,
-                context: ctx,
-                onLog: dependencies.logTo(),
-            });
-        },
-        async watch(params, ctx) {
-            const onLog = dependencies.logTo();
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog,
-            });
-            const { configPath, port } = await dependencies.prepare(params, ctx, 'dev', frontend);
-            const handle = await dependencies.runWranglerDev({
-                projectDir: ctx.projectDir,
-                configPath,
-                port,
-                remote: Boolean(params.remote),
-                autoPickPort: params.port === undefined,
-                ...(params.host ? { ip: '0.0.0.0' } : {}),
-                onReload: ctx.onReload,
-                onLog,
-            });
-            let frontendWatch;
-            try {
-                frontendWatch = dependencies.watchFrontend({
-                    definition: ctx.definition,
-                    projectDir: ctx.projectDir,
-                    onLog,
-                    // Routes and source recipes are immutable for this watch generation.
-                    // Wrangler already observes the atomically swapped asset stage, so a
-                    // source rebuild needs no config regeneration.
-                    onRebuild: ctx.onReload,
-                });
-            }
-            catch (error) {
-                try {
-                    await handle.stop();
-                }
-                catch (cleanupError) {
-                    throw new AggregateError([error, cleanupError], 'cloudflare frontend watcher startup failed and Wrangler cleanup also failed');
-                }
-                throw error;
-            }
-            // With --host the actionable URL is the PUBLIC one (the tunnel/proxy
-            // front), not the local bind — print and spec-stamp that.
-            return {
-                url: params.host ?? handle.url,
-                async stop() {
-                    const errors = [];
-                    try {
-                        await frontendWatch?.stop();
-                    }
-                    catch (error) {
-                        errors.push(error);
-                    }
-                    try {
-                        await handle.stop();
-                    }
-                    catch (error) {
-                        errors.push(error);
-                    }
-                    if (errors.length === 1)
-                        throw errors[0];
-                    if (errors.length > 1) {
-                        throw new AggregateError(errors, 'cloudflare development cleanup failed');
-                    }
-                },
-            };
-        },
-        // Config hot-regen: rewrite the generated files only — the running
-        // `wrangler dev` watches its `--config` (and the worker entry) and reloads
-        // them itself, so a `astrale.config.ts` edit lands without a restart.
-        // Mirrors `watch`'s prep exactly (codegen + frontend build), minus the spawn.
-        async regenerate(params, ctx) {
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog: dependencies.logTo(),
-            });
-            const { configPath } = await dependencies.prepare(params, ctx, 'dev', frontend);
-            await dependencies.runWranglerTypes({
-                projectDir: ctx.projectDir,
-                configPath,
-                onLog: dependencies.logTo(),
-            });
-        },
-        async deploy(params, ctx) {
-            const frontend = await dependencies.buildFrontend({
-                definition: ctx.definition,
-                projectDir: ctx.projectDir,
-                onLog: dependencies.logTo(),
-            });
-            const { configPath, fallbackConfigPath, workerName: name, } = await dependencies.prepare(params, ctx, 'deploy', frontend);
-            const { url, deploymentVersion } = await dependencies.runWranglerDeploy({
-                projectDir: ctx.projectDir,
-                configPath,
-                workerName: name,
-                ...(fallbackConfigPath ? { fallbackConfigPath } : {}),
-                ...(params.route ? { route: params.route } : {}),
-                onLog: dependencies.logTo(),
-            });
-            if (Object.keys(ctx.secrets).length > 0) {
-                await dependencies.bulkPutSecrets({
-                    projectDir: ctx.projectDir,
-                    configPath,
-                    secrets: ctx.secrets,
-                    onLog: dependencies.logTo(),
-                });
-            }
-            // A first deploy on a fresh `*.workers.dev` host can take ~30-60s to
-            // propagate; an `astrale domain install <url>` issued right away would
-            // 404 (Cloudflare 1042). Block until the URL actually serves so the
-            // install line we print is immediately actionable.
-            await dependencies.waitUntilLive(url, dependencies.logTo(), deploymentVersion);
-            return { url };
-        },
-        secretsFile(params) {
-            return params.secrets;
-        },
-    });
-}
-/**
- * Poll until the deployed Worker health endpoint returns exactly 200.
- */
-async function waitUntilLive(url, onLog, expectedDeploymentVersion, timeoutMs = 90_000) {
-    const probe = new URL('/health', url);
-    const metadata = new URL('/meta', url);
-    const deadline = Date.now() + timeoutMs;
-    let waited = false;
-    let lastStatus;
-    let lastDeploymentVersion;
-    for (;;) {
-        try {
-            const res = await fetch(probe, { redirect: 'manual' });
-            lastStatus = res.status;
-            await res.body?.cancel();
-            if (res.status === 200) {
-                if (expectedDeploymentVersion === undefined)
-                    return;
-                const meta = await fetch(metadata, { redirect: 'manual' });
-                if (meta.status === 200) {
-                    const body = (await meta.json());
-                    lastDeploymentVersion =
-                        typeof body.deploymentVersion === 'string' ? body.deploymentVersion : undefined;
-                    if (lastDeploymentVersion === expectedDeploymentVersion)
-                        return;
-                }
-                else {
-                    await meta.body?.cancel();
-                }
-            }
-        }
-        catch {
-            // Network hiccup — treat like "not live yet" and keep polling.
-        }
-        if (Date.now() >= deadline) {
-            throw new Error(`deployed Worker health did not reach HTTP 200 within ${Math.round(timeoutMs / 1000)}s` +
-                (lastStatus === undefined ? '' : ` (last status ${lastStatus})`) +
-                (expectedDeploymentVersion === undefined
-                    ? ''
-                    : `; deployment version ${JSON.stringify(lastDeploymentVersion)} ` +
-                        `did not reach ${JSON.stringify(expectedDeploymentVersion)}`));
-        }
-        if (!waited) {
-            waited = true;
-            onLog('waiting for the URL to go live (first deploys can take ~30-60s)…');
-        }
-        await new Promise((r) => setTimeout(r, 3000));
-    }
-}
-//# sourceMappingURL=cloudflare.js.map
+export { cloudflare } from './adapter.js';

package/dist/deploy/deploy.d.ts

@@ -0,0 +1,16 @@
+import type { DeployContext, DeployResult } from '@astrale-os/sdk/deployment/adapter';
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import type { materialize } from '../build/artifact.js';
+import type { signingIdentity } from '../identity/source.js';
+import type { CloudflareParams } from '../params.js';
+import type { runWranglerDeploy } from '../wrangler/deploy.js';
+import type { runWranglerDeploymentStatus } from '../wrangler/status.js';
+export interface CloudflareDeployDependencies {
+    readonly materialize: typeof materialize;
+    readonly runWranglerDeploy: typeof runWranglerDeploy;
+    readonly runWranglerDeploymentStatus: typeof runWranglerDeploymentStatus;
+    readonly waitForReadiness: (release: Release, signal: AbortSignal) => Promise<void>;
+    readonly signingIdentity: typeof signingIdentity;
+}
+/** Atomically advance one stable Worker address to the prepared implementation. */
+export declare function deployCloudflare(parameters: CloudflareParams, context: DeployContext, dependencies: CloudflareDeployDependencies): Promise<DeployResult>;

package/dist/deploy/deploy.js

@@ -0,0 +1,204 @@
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { workerName } from '../build/configuration.js';
+import { admitDirectPlacement } from '../build/direct.js';
+import { loadWorkerArtifact } from '../build/worker/index.js';
+import { signingIdentitySecrets } from '../identity/secret.js';
+import { WranglerDeployError } from '../wrangler/deploy.js';
+const NONE = Object.freeze({ kind: 'none' });
+/** Atomically advance one stable Worker address to the prepared implementation. */
+export async function deployCloudflare(parameters, context, dependencies) {
+    let secrets;
+    try {
+        const identity = await dependencies.signingIdentity({
+            projectDir: context.projectDir,
+            source: parameters.signingIdentity,
+            origin: context.artifact.build.schema.compiled.root.origin,
+            mode: 'deploy',
+        });
+        secrets = signingIdentitySecrets(context.secrets, identity);
+    }
+    catch (cause) {
+        return failed('prerequisite', progress({}), cause);
+    }
+    let worker;
+    try {
+        worker = loadWorkerArtifact(context.artifact);
+        for (const name of worker.bindings.requiredSecrets) {
+            if (!Object.hasOwn(secrets, name)) {
+                throw new TypeError(`Cloudflare Worker requires secret ${name}.`);
+            }
+        }
+        admitDirectPlacement(context.artifact, worker, parameters);
+    }
+    catch (cause) {
+        return failed('prerequisite', progress({}), cause);
+    }
+    const stateDirectory = join(context.projectDir, '.astrale');
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'deploy-'));
+    try {
+        await dependencies.materialize(directory, context.artifact.files);
+        const name = workerName(parameters, context.artifact.build.schema.compiled.root.origin);
+        const configPath = join(directory, 'wrangler.jsonc');
+        let deployed;
+        try {
+            deployed = await dependencies.runWranglerDeploy({
+                projectDir: context.projectDir,
+                configPath,
+                secrets,
+                ...(parameters.route === undefined ? {} : { route: parameters.route }),
+                signal: context.signal,
+            });
+        }
+        catch (cause) {
+            return failed('provider', progress({ provider: partialProvider(cause, context.artifact) }), cause);
+        }
+        const configuration = Object.freeze({
+            kind: 'applied',
+            evidence: Object.freeze({ names: Object.keys(secrets).sort() }),
+        });
+        const retained = Object.freeze({
+            kind: 'partial',
+            evidence: Object.freeze({
+                provider: 'cloudflare',
+                deployment: deployed.deploymentVersion,
+                artifact: context.artifact.digest,
+            }),
+        });
+        let selected;
+        try {
+            selected = observeAddressing(context.artifact, deployed.url, name);
+        }
+        catch (cause) {
+            return failed('addressing', progress({
+                provider: retained,
+                configuration,
+            }), cause);
+        }
+        let observed;
+        try {
+            observed = await dependencies.runWranglerDeploymentStatus({
+                projectDir: context.projectDir,
+                configPath,
+                workerName: name,
+                signal: context.signal,
+            });
+            requireCurrentDeployment(observed, deployed.deploymentVersion);
+        }
+        catch (cause) {
+            return failed('readiness', progress({
+                provider: retained,
+                configuration,
+            }), cause);
+        }
+        let release;
+        try {
+            release = assemble(context.artifact.build, selected);
+        }
+        catch (cause) {
+            return failed('release', progress({ provider: retained, configuration }), cause);
+        }
+        try {
+            await dependencies.waitForReadiness(release, context.signal);
+        }
+        catch (cause) {
+            return failed('readiness', progress({ provider: retained, configuration }), cause, release);
+        }
+        const provider = Object.freeze({
+            kind: 'applied',
+            evidence: Object.freeze({
+                provider: 'cloudflare',
+                deployment: deployed.deploymentVersion,
+                artifact: context.artifact.digest,
+                issuer: selected.issuer,
+            }),
+        });
+        return Object.freeze({
+            status: 'ready',
+            phase: 'complete',
+            progress: Object.freeze({ ...progress({ configuration }), provider }),
+            release,
+        });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+function partialProvider(cause, artifact) {
+    if (!(cause instanceof WranglerDeployError) || cause.applied?.deploymentVersion === undefined) {
+        return Object.freeze({ kind: 'unknown' });
+    }
+    let issuer;
+    if (cause.applied.url !== undefined) {
+        try {
+            issuer = addressing(cause.applied.url).issuer;
+        }
+        catch {
+            // The provider effect remains known when its printed URL is not Addressing.
+        }
+    }
+    return Object.freeze({
+        kind: 'partial',
+        evidence: Object.freeze({
+            provider: 'cloudflare',
+            deployment: cause.applied.deploymentVersion,
+            artifact: artifact.digest,
+            ...(issuer === undefined ? {} : { issuer }),
+        }),
+    });
+}
+function requireCurrentDeployment(observed, expectedVersion) {
+    if (observed.versions.length !== 1 ||
+        observed.versions[0].percentage !== 100 ||
+        observed.versions[0].version !== expectedVersion) {
+        throw new TypeError('Cloudflare Worker is not one exact version at 100%.');
+    }
+}
+function observeAddressing(artifact, deployedUrl, expectedWorker) {
+    if (artifact.addressing.kind === 'configured') {
+        if (deployedUrl === undefined)
+            return artifact.addressing.addressing;
+        const observed = addressing(deployedUrl);
+        if (observed.issuer !== artifact.addressing.addressing.issuer) {
+            throw new TypeError('Cloudflare deployed URL differs from configured Addressing.');
+        }
+        return observed;
+    }
+    if (deployedUrl === undefined) {
+        throw new TypeError('Cloudflare did not report provider-assigned Addressing.');
+    }
+    const observed = addressing(deployedUrl);
+    if (artifact.addressing.claim !== expectedWorker) {
+        throw new TypeError('PreparedArtifact worker claim differs from the deployment target.');
+    }
+    const url = new URL(observed.issuer);
+    const labels = url.hostname.split('.');
+    if (url.protocol !== 'https:' ||
+        labels.length < 4 ||
+        labels[0] !== artifact.addressing.claim ||
+        labels.at(-2) !== 'workers' ||
+        labels.at(-1) !== 'dev') {
+        throw new TypeError('Cloudflare workers.dev URL does not satisfy its prepared worker claim.');
+    }
+    return observed;
+}
+function progress(input) {
+    return Object.freeze({
+        prerequisite: input.prerequisite ?? NONE,
+        provider: input.provider ?? NONE,
+        configuration: input.configuration ?? NONE,
+        installation: input.installation ?? NONE,
+    });
+}
+function failed(phase, progressValue, cause, release) {
+    const error = cause instanceof Error ? cause : new Error(String(cause));
+    return Object.freeze({
+        status: 'failed',
+        phase,
+        progress: progressValue,
+        error,
+        ...(release === undefined ? {} : { release }),
+    });
+}