@astrale-os/adapter-cloudflare 0.5.0-beta.8 → 0.5.0-beta.80

package/dist/deploy/index.d.ts

@@ -0,0 +1 @@
+export { deployCloudflare, type CloudflareDeployDependencies } from './deploy.js';

package/dist/deploy/index.js

@@ -0,0 +1 @@
+export { deployCloudflare } from './deploy.js';

package/dist/deploy/output.d.ts

@@ -0,0 +1,2 @@
+export declare function parseDeployUrl(text: string, route?: string): string | undefined;
+export declare function parseDeployVersionId(text: string): string | undefined;

package/dist/deploy/output.js

@@ -0,0 +1,10 @@
+const WORKERS_DEV_RE = /(https:\/\/[^\s]+\.workers\.dev)/iu;
+const VERSION_ID_RE = /(?:Current\s+)?Version ID:\s*([a-z0-9_-]+)/iu;
+export function parseDeployUrl(text, route) {
+    if (route !== undefined)
+        return `https://${route.replace(/\/.*$/u, '')}`;
+    return WORKERS_DEV_RE.exec(text)?.[1];
+}
+export function parseDeployVersionId(text) {
+    return VERSION_ID_RE.exec(text)?.[1];
+}

package/dist/development/develop.d.ts

@@ -0,0 +1,15 @@
+import type { DevelopmentContext, DevelopmentSession } from '@astrale-os/sdk/deployment/adapter';
+import type { CloudflareParams } from '../params.js';
+import { signingIdentity } from '../identity/source.js';
+import { startFrontend } from './frontend.js';
+import { allocatePort } from './port.js';
+import { verifyDevelopmentRelease } from './readiness.js';
+import { startWorker } from './worker.js';
+export interface CloudflareDevelopmentDependencies {
+    readonly signingIdentity: typeof signingIdentity;
+    readonly startFrontend: typeof startFrontend;
+    readonly startWorker: typeof startWorker;
+    readonly allocatePort: typeof allocatePort;
+    readonly verify: typeof verifyDevelopmentRelease;
+}
+export declare function developCloudflare(parameters: CloudflareParams, context: DevelopmentContext, dependencies?: CloudflareDevelopmentDependencies): Promise<DevelopmentSession>;

package/dist/development/develop.js

@@ -0,0 +1,267 @@
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release';
+import { mkdir, rename, rm, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { generateWranglerConfig } from '../build/codegen/wrangler.js';
+import { resolveRouter, workerName } from '../build/configuration.js';
+import { loadWorkerArtifact } from '../build/worker/index.js';
+import { workerModules } from '../build/worker/modules.js';
+import { signingIdentitySecrets } from '../identity/secret.js';
+import { signingIdentity } from '../identity/source.js';
+import { startFrontend } from './frontend.js';
+import { admitHost } from './host.js';
+import { allocatePort } from './port.js';
+import { verifyDevelopmentRelease } from './readiness.js';
+import { startWorker } from './worker.js';
+export async function developCloudflare(parameters, context, dependencies = {
+    signingIdentity,
+    startFrontend,
+    startWorker,
+    allocatePort,
+    verify: verifyDevelopmentRelease,
+}) {
+    const hostSource = context.overrides.publicUrl ?? parameters.host;
+    const host = hostSource === undefined ? undefined : admitHost(hostSource);
+    const configuredPort = context.overrides.localPort ?? parameters.port;
+    if (host !== undefined && configuredPort === undefined) {
+        throw new TypeError('Cloudflare development with a public host requires a strict local port.');
+    }
+    const port = configuredPort ?? (await dependencies.allocatePort());
+    const directory = join(context.projectDir, '.astrale', 'development', context.environment, 'cloudflare');
+    await mkdir(directory, { recursive: true });
+    const configPath = join(directory, 'wrangler.development.jsonc');
+    const identity = await dependencies.signingIdentity({
+        projectDir: context.projectDir,
+        source: parameters.signingIdentity,
+        origin: context.artifact.build.schema.compiled.root.origin,
+        mode: 'local',
+    });
+    let current = Object.freeze({ artifact: context.artifact, secrets: context.secrets });
+    let artifactPaths = new Set();
+    let resources;
+    let stopping = false;
+    let resolveFinished;
+    let rejectFinished;
+    const finished = new Promise((resolve, reject) => {
+        resolveFinished = resolve;
+        rejectFinished = reject;
+    });
+    const realize = async (input) => {
+        artifactPaths = await applyArtifact(directory, artifactPaths, input.artifact);
+        if (input.artifact.build.frontend?.source.kind === 'vite') {
+            await mkdir(join(directory, 'frontend'), { recursive: true });
+        }
+        const frontend = await dependencies.startFrontend({
+            frontend: input.artifact.build.frontend,
+            projectDir: context.projectDir,
+        });
+        try {
+            await writeFile(configPath, configuration(parameters, input.artifact, frontend?.url, host, Object.keys(signingIdentitySecrets(input.secrets, identity)).sort()));
+            const worker = await dependencies.startWorker({
+                projectDir: context.projectDir,
+                configPath,
+                port,
+                remote: parameters.remote ?? false,
+                secrets: signingIdentitySecrets(input.secrets, identity),
+                autoPickPort: false,
+                pinLocalOrigin: host === undefined && parameters.remote !== true,
+                ...(host === undefined ? {} : { ip: '0.0.0.0' }),
+            });
+            const value = Object.freeze({ ...(frontend === undefined ? {} : { frontend }), worker });
+            supervise(value);
+            return value;
+        }
+        catch (cause) {
+            await frontend?.stop().catch(() => undefined);
+            throw cause;
+        }
+    };
+    const supervise = (selected) => {
+        for (const child of [selected.worker.finished, selected.frontend?.finished]) {
+            child?.catch((cause) => {
+                if (!stopping && resources === selected)
+                    rejectFinished(cause);
+            });
+        }
+    };
+    const placementFor = (selected) => Object.freeze({ releaseUrl: host ?? selected.worker.url, localUrl: selected.worker.url });
+    const verify = async (input, selected) => {
+        const placement = placementFor(selected);
+        const release = assemble(input.artifact.build, addressing(placement.releaseUrl));
+        await dependencies.verify({ release, localUrl: placement.localUrl, signal: context.signal });
+        await context.onPlacement(placement);
+    };
+    try {
+        resources = await realize(current);
+        await verify(current, resources);
+    }
+    catch (cause) {
+        stopping = true;
+        if (resources !== undefined)
+            await stopResources(resources).catch(() => undefined);
+        await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+        throw cause;
+    }
+    let updateTail = Promise.resolve();
+    const session = Object.freeze({
+        current: () => placementFor(resources),
+        update(next) {
+            if (stopping)
+                return Promise.reject(new Error('Cloudflare development session is stopping.'));
+            const operation = updateTail.then(async () => {
+                if (stopping)
+                    throw new Error('Cloudflare development session is stopping.');
+                sameDomain(current.artifact, next.artifact);
+                const previous = current;
+                const previousResources = resources;
+                const restart = frontendSignature(previous.artifact) !== frontendSignature(next.artifact) ||
+                    stable(previous.secrets) !== stable(next.secrets);
+                if (!restart) {
+                    try {
+                        artifactPaths = await applyArtifact(directory, artifactPaths, next.artifact);
+                        await writeFile(configPath, configuration(parameters, next.artifact, resources.frontend?.url, host, Object.keys(signingIdentitySecrets(next.secrets, identity)).sort()));
+                        await verify(next, resources);
+                        current = Object.freeze({ artifact: next.artifact, secrets: next.secrets });
+                    }
+                    catch (cause) {
+                        artifactPaths = await applyArtifact(directory, artifactPaths, previous.artifact);
+                        await writeFile(configPath, configuration(parameters, previous.artifact, resources.frontend?.url, host, Object.keys(signingIdentitySecrets(previous.secrets, identity)).sort()));
+                        throw cause;
+                    }
+                    return;
+                }
+                try {
+                    await stopResources(previousResources);
+                }
+                catch (cause) {
+                    rejectFinished(cause);
+                    throw cause;
+                }
+                let replacement;
+                try {
+                    replacement = await realize(next);
+                    await verify(next, replacement);
+                    resources = replacement;
+                    current = Object.freeze({ artifact: next.artifact, secrets: next.secrets });
+                }
+                catch (cause) {
+                    if (replacement !== undefined)
+                        await stopResources(replacement).catch(() => undefined);
+                    try {
+                        resources = await realize(previous);
+                        await verify(previous, resources);
+                    }
+                    catch (rollback) {
+                        rejectFinished(new AggregateError([cause, rollback], 'Cloudflare development update and rollback failed.'));
+                    }
+                    throw cause;
+                }
+            });
+            updateTail = operation.catch(() => undefined);
+            return operation;
+        },
+        finished,
+        async stop() {
+            if (stopping)
+                return finished.catch(() => undefined);
+            stopping = true;
+            await updateTail;
+            try {
+                try {
+                    await stopResources(resources);
+                }
+                finally {
+                    await rm(directory, { recursive: true, force: true });
+                }
+                resolveFinished();
+            }
+            catch (cause) {
+                rejectFinished(cause);
+                throw cause;
+            }
+        },
+    });
+    return session;
+}
+function configuration(parameters, artifact, frontendUrl, host, secretBindings) {
+    const worker = loadWorkerArtifact(artifact);
+    const router = parameters.remote === true || parameters.router !== undefined
+        ? resolveRouter(parameters.router)
+        : undefined;
+    return generateWranglerConfig({
+        workerName: workerName(parameters, artifact.build.schema.compiled.root.origin),
+        main: `./${worker.release.entrypoint}`,
+        modules: workerModules(worker.release),
+        vars: {
+            ...parameters.vars,
+            ...(host === undefined ? {} : { WORKER_URL: host }),
+            ...(frontendUrl === undefined ? {} : { FRONTEND_DEV_URL: frontendUrl }),
+        },
+        secretBindings,
+        ...(artifact.build.frontend?.source.kind === 'vite'
+            ? { frontend: { directory: './frontend', routes: frontendRoutes(artifact), dev: true } }
+            : {}),
+        ...(router === undefined
+            ? {}
+            : { router: { binding: router.binding, service: router.service } }),
+        ...(parameters.wrangler === undefined ? {} : { wrangler: parameters.wrangler }),
+        selfBinding: true,
+    });
+}
+async function applyArtifact(root, previous, artifact) {
+    const next = new Set(artifact.files.map((file) => file.path));
+    for (const file of artifact.files) {
+        const path = join(root, file.path);
+        const staging = `${path}.next`;
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(staging, file.bytes());
+        await rename(staging, path);
+    }
+    for (const path of previous) {
+        if (!next.has(path))
+            await unlink(join(root, path)).catch(() => undefined);
+    }
+    return next;
+}
+async function stopResources(resources) {
+    const results = await Promise.allSettled([
+        resources.worker.stop(),
+        resources.frontend?.stop() ?? Promise.resolve(),
+    ]);
+    const failures = results.filter((result) => result.status === 'rejected');
+    if (failures.length === 1)
+        throw failures[0].reason;
+    if (failures.length > 1) {
+        throw new AggregateError(failures.map((failure) => failure.reason), 'Cloudflare development cleanup failed.');
+    }
+}
+function frontendRoutes(artifact) {
+    const frontend = artifact.build.frontend;
+    if (frontend === undefined || frontend.source.kind !== 'vite')
+        return [];
+    return Object.freeze(frontend.routes
+        .flatMap((route) => frontend.source.kind === 'vite' && frontend.source.spa && route.path !== '/'
+        ? [route.path, `${route.path}/*`]
+        : route.path === '/'
+            ? ['/*']
+            : [route.path])
+        .sort());
+}
+function frontendSignature(artifact) {
+    return stable(artifact.build.frontend);
+}
+function sameDomain(previous, next) {
+    if (previous.build.schema.compiled.root.origin !== next.build.schema.compiled.root.origin) {
+        throw new TypeError('Cloudflare development update changed the Domain origin.');
+    }
+}
+function stable(input) {
+    if (input === null || typeof input !== 'object')
+        return JSON.stringify(input);
+    if (Array.isArray(input))
+        return `[${input.map(stable).join(',')}]`;
+    const value = input;
+    return `{${Object.keys(value)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stable(value[key])}`)
+        .join(',')}}`;
+}

package/dist/development/frontend.d.ts

@@ -0,0 +1,11 @@
+import type { Build } from '@astrale-os/sdk/deployment/build';
+export interface FrontendHandle {
+    readonly url: string;
+    readonly finished: Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function startFrontend(input: {
+    readonly frontend: Build['frontend'];
+    readonly projectDir: string;
+    readonly onLog?: (line: string) => void;
+}): Promise<FrontendHandle | undefined>;

package/dist/development/frontend.js

@@ -0,0 +1,109 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+export async function startFrontend(input) {
+    const frontend = input.frontend;
+    if (frontend === undefined || frontend.source.kind !== 'vite')
+        return undefined;
+    const port = await ephemeralPort();
+    const child = spawn(viteCommand(input.projectDir), [
+        '--host',
+        '127.0.0.1',
+        '--port',
+        String(port),
+        '--strictPort',
+        ...(frontend.source.config === undefined ? [] : ['--config', frontend.source.config]),
+    ], { cwd: input.projectDir, stdio: ['ignore', 'pipe', 'pipe'] });
+    const output = [];
+    const collect = (buffer) => {
+        for (const line of buffer.toString().split('\n')) {
+            if (line.trim() === '')
+                continue;
+            output.push(line);
+            if (output.length > 40)
+                output.shift();
+            input.onLog?.(line);
+        }
+    };
+    child.stdout?.on('data', collect);
+    child.stderr?.on('data', collect);
+    const url = `http://127.0.0.1:${port}`;
+    try {
+        await ready(url, child, output);
+    }
+    catch (cause) {
+        await stopChild(child);
+        throw cause;
+    }
+    let stopping = false;
+    const finished = child.exitCode === null
+        ? new Promise((resolve, reject) => {
+            child.once('exit', (code, signal) => {
+                if (stopping)
+                    resolve();
+                else {
+                    reject(new Error(`Vite stopped unexpectedly (code ${code ?? 'null'}, signal ${signal ?? 'none'}).\n${output.join('\n')}`));
+                }
+            });
+            child.once('error', reject);
+        })
+        : Promise.reject(new Error(`Vite stopped unexpectedly (code ${child.exitCode}).`));
+    return Object.freeze({
+        url,
+        finished,
+        async stop() {
+            if (stopping)
+                return finished.catch(() => undefined);
+            stopping = true;
+            await stopChild(child);
+        },
+    });
+}
+function viteCommand(projectDir) {
+    const command = join(projectDir, 'node_modules', '.bin', 'vite');
+    if (!existsSync(command))
+        throw new TypeError('Vite frontend requires a project-local vite binary.');
+    return command;
+}
+function ephemeralPort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address !== null ? address.port : 0;
+            server.close((cause) => (cause === undefined ? resolve(port) : reject(cause)));
+        });
+    });
+}
+async function ready(url, child, output) {
+    const deadline = Date.now() + 15_000;
+    while (Date.now() < deadline) {
+        if (child.exitCode !== null) {
+            throw new Error(`Vite exited before readiness (code ${child.exitCode}).\n${output.join('\n')}`);
+        }
+        try {
+            const response = await fetch(url, { signal: AbortSignal.timeout(500) });
+            await response.body?.cancel();
+            return;
+        }
+        catch {
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+    }
+    throw new Error(`Vite did not become ready at ${url}.`);
+}
+function stopChild(child) {
+    if (child.exitCode !== null)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        child.once('exit', () => resolve());
+        child.kill('SIGTERM');
+        setTimeout(() => {
+            if (child.exitCode === null)
+                child.kill('SIGKILL');
+            resolve();
+        }, 4_000).unref?.();
+    });
+}

package/dist/development/host.d.ts

@@ -0,0 +1,2 @@
+/** Admit one externally owned public origin without inferring lifecycle ownership. */
+export declare function admitHost(input: string): string;

package/dist/development/host.js

@@ -0,0 +1,46 @@
+/** Admit one externally owned public origin without inferring lifecycle ownership. */
+export function admitHost(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new TypeError('Cloudflare development host must be one public HTTP(S) origin.', { cause });
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        privateHostname(url.hostname)) {
+        throw new TypeError('Cloudflare development host must be one public HTTP(S) origin.');
+    }
+    return url.origin;
+}
+function privateHostname(input) {
+    const host = input
+        .toLowerCase()
+        .replace(/^\[|\]$/gu, '')
+        .replace(/\.$/u, '');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (isIP(host) === 4) {
+        const parts = host.split('.').map(Number);
+        return (parts[0] === 0 ||
+            parts[0] === 10 ||
+            parts[0] === 127 ||
+            (parts[0] === 169 && parts[1] === 254) ||
+            (parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31) ||
+            (parts[0] === 192 && parts[1] === 168));
+    }
+    if (isIP(host) !== 6)
+        return false;
+    return (host === '::' ||
+        host === '::1' ||
+        host.startsWith('fc') ||
+        host.startsWith('fd') ||
+        /^fe[89ab]/u.test(host) ||
+        /^::ffff:(?:0|10|127|169\.254|172\.(?:1[6-9]|2\d|3[01])|192\.168)\./u.test(host));
+}
+import { isIP } from 'node:net';

package/dist/development/port.d.ts

@@ -0,0 +1 @@
+export declare function allocatePort(host?: string): Promise<number>;

package/dist/development/port.js

@@ -0,0 +1,12 @@
+import { createServer } from 'node:net';
+export function allocatePort(host = '127.0.0.1') {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address !== null ? address.port : 0;
+            server.close((cause) => (cause === undefined ? resolve(port) : reject(cause)));
+        });
+    });
+}

package/dist/development/readiness.d.ts

@@ -0,0 +1,14 @@
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+interface ReadinessDependencies {
+    readonly verify: typeof verifyReadiness;
+    readonly resolvedFetch: typeof resolvedHttpsFetch;
+}
+/** Verify the exact Release over both public identity and its loopback transport. */
+export declare function verifyDevelopmentRelease(input: {
+    readonly release: Release;
+    readonly localUrl: string;
+    readonly signal: AbortSignal;
+}, dependencies?: ReadinessDependencies): Promise<void>;
+export {};

package/dist/development/readiness.js

@@ -0,0 +1,71 @@
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+const defaults = Object.freeze({
+    verify: verifyReadiness,
+    resolvedFetch: resolvedHttpsFetch,
+});
+/** Verify the exact Release over both public identity and its loopback transport. */
+export async function verifyDevelopmentRelease(input, dependencies = defaults) {
+    const sameOrigin = new URL(input.release.addressing.issuer).origin === new URL(input.localUrl).origin;
+    if (!sameOrigin) {
+        await retry(() => dependencies.verify(input.release, {
+            signal: attemptSignal(input.signal),
+            fetch: (url, init) => {
+                const requested = new URL(url);
+                const local = new URL(input.localUrl);
+                local.pathname = requested.pathname;
+                local.search = requested.search;
+                return fetch(local.href, init);
+            },
+        }), input.signal);
+    }
+    const publicHost = new URL(input.release.addressing.issuer).hostname;
+    const publicFetch = publicHost.endsWith('.trycloudflare.com')
+        ? dependencies.resolvedFetch(input.release.addressing.issuer)
+        : undefined;
+    await retry(() => dependencies.verify(input.release, {
+        signal: attemptSignal(input.signal),
+        ...(publicFetch === undefined ? {} : { fetch: publicFetch }),
+    }), input.signal);
+}
+async function retry(operation, signal) {
+    const deadline = Date.now() + 90_000;
+    let last;
+    while (Date.now() < deadline) {
+        throwIfAborted(signal);
+        try {
+            await operation();
+            return;
+        }
+        catch (cause) {
+            throwIfAborted(signal);
+            last = cause;
+            await pause(signal);
+        }
+    }
+    throw last instanceof Error
+        ? last
+        : new Error('Cloudflare development Release did not become ready.');
+}
+function attemptSignal(signal) {
+    return AbortSignal.any([signal, AbortSignal.timeout(5_000)]);
+}
+function pause(signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(done, 250);
+        const abort = () => done(signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.'));
+        signal.addEventListener('abort', abort, { once: true });
+        function done(cause) {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            if (cause === undefined)
+                resolve();
+            else
+                reject(cause);
+        }
+    });
+}
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.');
+}

package/dist/development/resolved-fetch.d.ts

@@ -0,0 +1,17 @@
+import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolve4 } from 'node:dns/promises';
+type ReadinessOptions = NonNullable<Parameters<typeof verifyReadiness>[1]>;
+type ReadinessFetch = NonNullable<ReadinessOptions['fetch']>;
+type RequestAddress = typeof requestAddress;
+export interface ResolvedFetchDependencies {
+    readonly resolve: typeof resolve4;
+    readonly request: RequestAddress;
+}
+/**
+ * Fetch one HTTPS origin through the stable TryCloudflare edge addresses.
+ * Fresh Quick Tunnel hostnames can remain absent from DNS after the connector
+ * is registered, while TLS SNI and Host already route through the stable edge.
+ */
+export declare function resolvedHttpsFetch(origin: string, dependencies?: ResolvedFetchDependencies): ReadinessFetch;
+declare function requestAddress(url: URL, address: string, init: Parameters<ReadinessFetch>[1]): Promise<Response>;
+export {};