@astrale-os/adapter-cloudflare 0.5.0-beta.9 → 0.5.0-beta.91

package/dist/development/port.d.ts

@@ -0,0 +1 @@
+export declare function allocatePort(host?: string): Promise<number>;

package/dist/development/port.js

@@ -0,0 +1,12 @@
+import { createServer } from 'node:net';
+export function allocatePort(host = '127.0.0.1') {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address !== null ? address.port : 0;
+            server.close((cause) => (cause === undefined ? resolve(port) : reject(cause)));
+        });
+    });
+}

package/dist/development/readiness.d.ts

@@ -0,0 +1,14 @@
+import type { Release } from '@astrale-os/sdk/deployment/release';
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+interface ReadinessDependencies {
+    readonly verify: typeof verifyReadiness;
+    readonly resolvedFetch: typeof resolvedHttpsFetch;
+}
+/** Verify the exact Release over both public identity and its loopback transport. */
+export declare function verifyDevelopmentRelease(input: {
+    readonly release: Release;
+    readonly localUrl: string;
+    readonly signal: AbortSignal;
+}, dependencies?: ReadinessDependencies): Promise<void>;
+export {};

package/dist/development/readiness.js

@@ -0,0 +1,71 @@
+import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolvedHttpsFetch } from './resolved-fetch.js';
+const defaults = Object.freeze({
+    verify: verifyReadiness,
+    resolvedFetch: resolvedHttpsFetch,
+});
+/** Verify the exact Release over both public identity and its loopback transport. */
+export async function verifyDevelopmentRelease(input, dependencies = defaults) {
+    const sameOrigin = new URL(input.release.addressing.issuer).origin === new URL(input.localUrl).origin;
+    if (!sameOrigin) {
+        await retry(() => dependencies.verify(input.release, {
+            signal: attemptSignal(input.signal),
+            fetch: (url, init) => {
+                const requested = new URL(url);
+                const local = new URL(input.localUrl);
+                local.pathname = requested.pathname;
+                local.search = requested.search;
+                return fetch(local.href, init);
+            },
+        }), input.signal);
+    }
+    const publicHost = new URL(input.release.addressing.issuer).hostname;
+    const publicFetch = publicHost.endsWith('.trycloudflare.com')
+        ? dependencies.resolvedFetch(input.release.addressing.issuer)
+        : undefined;
+    await retry(() => dependencies.verify(input.release, {
+        signal: attemptSignal(input.signal),
+        ...(publicFetch === undefined ? {} : { fetch: publicFetch }),
+    }), input.signal);
+}
+async function retry(operation, signal) {
+    const deadline = Date.now() + 90_000;
+    let last;
+    while (Date.now() < deadline) {
+        throwIfAborted(signal);
+        try {
+            await operation();
+            return;
+        }
+        catch (cause) {
+            throwIfAborted(signal);
+            last = cause;
+            await pause(signal);
+        }
+    }
+    throw last instanceof Error
+        ? last
+        : new Error('Cloudflare development Release did not become ready.');
+}
+function attemptSignal(signal) {
+    return AbortSignal.any([signal, AbortSignal.timeout(5_000)]);
+}
+function pause(signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(done, 250);
+        const abort = () => done(signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.'));
+        signal.addEventListener('abort', abort, { once: true });
+        function done(cause) {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            if (cause === undefined)
+                resolve();
+            else
+                reject(cause);
+        }
+    });
+}
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.');
+}

package/dist/development/resolved-fetch.d.ts

@@ -0,0 +1,17 @@
+import type { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
+import { resolve4 } from 'node:dns/promises';
+type ReadinessOptions = NonNullable<Parameters<typeof verifyReadiness>[1]>;
+type ReadinessFetch = NonNullable<ReadinessOptions['fetch']>;
+type RequestAddress = typeof requestAddress;
+export interface ResolvedFetchDependencies {
+    readonly resolve: typeof resolve4;
+    readonly request: RequestAddress;
+}
+/**
+ * Fetch one HTTPS origin through the stable TryCloudflare edge addresses.
+ * Fresh Quick Tunnel hostnames can remain absent from DNS after the connector
+ * is registered, while TLS SNI and Host already route through the stable edge.
+ */
+export declare function resolvedHttpsFetch(origin: string, dependencies?: ResolvedFetchDependencies): ReadinessFetch;
+declare function requestAddress(url: URL, address: string, init: Parameters<ReadinessFetch>[1]): Promise<Response>;
+export {};

package/dist/development/resolved-fetch.js

@@ -0,0 +1,80 @@
+import { resolve4 } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { Readable } from 'node:stream';
+const defaults = Object.freeze({
+    resolve: resolve4,
+    request: requestAddress,
+});
+/**
+ * Fetch one HTTPS origin through the stable TryCloudflare edge addresses.
+ * Fresh Quick Tunnel hostnames can remain absent from DNS after the connector
+ * is registered, while TLS SNI and Host already route through the stable edge.
+ */
+export function resolvedHttpsFetch(origin, dependencies = defaults) {
+    const expected = new URL(origin);
+    if (expected.protocol !== 'https:') {
+        throw new TypeError('Resolved development fetch requires an HTTPS origin.');
+    }
+    const resolutionHost = expected.hostname.endsWith('.trycloudflare.com')
+        ? 'trycloudflare.com'
+        : expected.hostname;
+    let addresses;
+    let cursor = 0;
+    return async (input, init) => {
+        const url = new URL(input);
+        if (url.origin !== expected.origin)
+            return fetch(input, init);
+        const resolved = addresses ?? (await dependencies.resolve(resolutionHost));
+        if (resolved.length === 0)
+            throw new Error(`No IPv4 address resolved for ${expected.hostname}.`);
+        addresses = resolved;
+        let last;
+        for (let attempt = 0; attempt < resolved.length; attempt += 1) {
+            const address = resolved[(cursor + attempt) % resolved.length];
+            try {
+                const response = await dependencies.request(url, address, init);
+                cursor = (cursor + attempt + 1) % resolved.length;
+                return response;
+            }
+            catch (cause) {
+                if (init?.signal?.aborted)
+                    throw cause;
+                last = cause;
+            }
+        }
+        throw last;
+    };
+}
+function requestAddress(url, address, init) {
+    const headers = new Headers();
+    headers.set('host', url.host);
+    headers.set('accept-encoding', 'identity');
+    return new Promise((resolve, reject) => {
+        const request = httpsRequest({
+            protocol: 'https:',
+            hostname: address,
+            port: url.port === '' ? 443 : Number(url.port),
+            path: `${url.pathname}${url.search}`,
+            method: 'GET',
+            headers: Object.fromEntries(headers.entries()),
+            servername: url.hostname,
+            signal: init?.signal ?? undefined,
+        }, (incoming) => {
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (Array.isArray(value))
+                    for (const item of value)
+                        responseHeaders.append(name, item);
+                else if (value !== undefined)
+                    responseHeaders.set(name, value);
+            }
+            resolve(new Response(Readable.toWeb(incoming), {
+                status: incoming.statusCode ?? 500,
+                statusText: incoming.statusMessage,
+                headers: responseHeaders,
+            }));
+        });
+        request.once('error', reject);
+        request.end();
+    });
+}

package/dist/development/worker-output.d.ts

@@ -0,0 +1,2 @@
+/** Admit the local Worker origin printed by Wrangler and ignore its inspector endpoints. */
+export declare function parseWorkerReadyUrl(text: string, port: number): string | undefined;

package/dist/development/worker-output.js

@@ -0,0 +1,25 @@
+const READY_RE = /(?:Ready on|Listening on|⎔.*?at)\s+(https?:\/\/[^\s]+)/iu;
+/** Admit the local Worker origin printed by Wrangler and ignore its inspector endpoints. */
+export function parseWorkerReadyUrl(text, port) {
+    const ready = READY_RE.exec(text);
+    if (ready !== null)
+        return normalizeLocal(ready[1], port);
+    const localhostOnPort = new RegExp(`(https?://(?:localhost|127\\.0\\.0\\.1):${port})(?![0-9])`, 'iu');
+    const match = localhostOnPort.exec(text);
+    return match === null ? undefined : normalizeLocal(match[1], port);
+}
+function normalizeLocal(input, port) {
+    try {
+        const url = new URL(input);
+        if (url.hostname === '0.0.0.0')
+            url.hostname = '127.0.0.1';
+        if (url.hostname === 'localhost')
+            url.hostname = '127.0.0.1';
+        if (url.port === '')
+            url.port = String(port);
+        return url.origin;
+    }
+    catch {
+        return `http://127.0.0.1:${port}`;
+    }
+}

package/dist/development/worker.d.ts

@@ -0,0 +1,17 @@
+export interface WorkerHandle {
+    readonly url: string;
+    readonly finished: Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function startWorker(args: {
+    projectDir: string;
+    configPath: string;
+    port: number;
+    remote: boolean;
+    readonly ip?: string;
+    readonly autoPickPort?: boolean;
+    /** Pin ordinary local requests to one stable issuer after the final port is selected. */
+    readonly pinLocalOrigin?: boolean;
+    readonly secrets: Readonly<Record<string, string>>;
+    readonly onLog?: (line: string) => void;
+}): Promise<WorkerHandle>;

package/dist/development/worker.js

@@ -0,0 +1,147 @@
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:net';
+import { stopChild, wranglerCommand, wranglerProcessEnv } from '../wrangler/process.js';
+import { createSecretEnvironment, secretRedactor } from '../wrangler/secrets.js';
+import { runWranglerTypes } from '../wrangler/type-generation.js';
+import { parseWorkerReadyUrl } from './worker-output.js';
+export async function startWorker(args) {
+    await runWranglerTypes(args);
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const bindHost = args.ip ?? '127.0.0.1';
+    if (args.autoPickPort && !(await portFree(args.port, bindHost))) {
+        const picked = await ephemeralPort(bindHost);
+        args.onLog?.(`port ${args.port} is taken — using ${picked} instead (pass --port to pin one)`);
+        args = { ...args, port: picked };
+    }
+    const secretEnvironment = await createSecretEnvironment(args.secrets);
+    const redact = secretRedactor(args.secrets);
+    const fallbackUrl = `http://localhost:${args.port}`;
+    const wranglerArgs = [
+        ...prefix,
+        'dev',
+        '--config',
+        args.configPath,
+        '--port',
+        String(args.port),
+        '--local-protocol',
+        'http',
+        '--ip',
+        args.ip ?? '127.0.0.1',
+        ...(args.pinLocalOrigin ? ['--var', `WORKER_URL:${fallbackUrl}`] : []),
+        ...(secretEnvironment === undefined ? [] : ['--env-file', secretEnvironment.path]),
+        ...(args.remote ? ['--remote'] : []),
+    ];
+    let child;
+    try {
+        child = spawn(cmd, wranglerArgs, {
+            cwd: args.projectDir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: wranglerProcessEnv(args.projectDir),
+        });
+    }
+    catch (cause) {
+        await secretEnvironment?.remove();
+        throw cause;
+    }
+    let resolved = false;
+    let buildErrorTail = '';
+    let outputTail = '';
+    let url;
+    try {
+        url = await new Promise((resolve, reject) => {
+            const onData = (buf) => {
+                const text = redact(buf.toString());
+                outputTail = (outputTail + text).slice(-3000);
+                for (const line of text.split('\n')) {
+                    if (line.trim())
+                        args.onLog?.(line);
+                }
+                if (/✘ \[ERROR\]|Build failed|Could not resolve "/.test(text)) {
+                    buildErrorTail = (buildErrorTail + text).slice(-2000);
+                }
+                if (!resolved) {
+                    const ready = parseWorkerReadyUrl(text, args.port);
+                    if (ready) {
+                        resolved = true;
+                        resolve(ready);
+                    }
+                }
+            };
+            child.stdout?.on('data', onData);
+            child.stderr?.on('data', onData);
+            child.on('exit', (code) => {
+                if (!resolved) {
+                    resolved = true;
+                    reject(new Error(`wrangler dev exited before becoming ready (code ${code ?? 'null'}).\n${outputTail}`));
+                }
+            });
+            child.on('error', (error) => {
+                if (!resolved) {
+                    resolved = true;
+                    reject(error);
+                }
+            });
+            setTimeout(() => {
+                if (!resolved && child.exitCode === null) {
+                    resolved = true;
+                    if (buildErrorTail) {
+                        reject(new Error(`worker build failed — the dev server would hang silently.\n${buildErrorTail}`));
+                    }
+                    else {
+                        reject(new Error(`wrangler dev did not report local readiness at ${fallbackUrl}.\n${outputTail}`));
+                    }
+                }
+            }, 15_000).unref?.();
+        });
+    }
+    catch (cause) {
+        await stopChild(child);
+        await secretEnvironment?.remove();
+        throw cause;
+    }
+    let stopping = false;
+    const finished = new Promise((resolve, reject) => {
+        child.once('exit', (code, signal) => {
+            if (stopping)
+                resolve();
+            else {
+                reject(new Error(`wrangler dev stopped unexpectedly (code ${code ?? 'null'}, signal ${signal ?? 'none'}).\n${outputTail}`));
+            }
+        });
+        child.once('error', reject);
+    });
+    return Object.freeze({
+        url: args.pinLocalOrigin ? fallbackUrl : url,
+        finished,
+        async stop() {
+            if (stopping)
+                return finished;
+            stopping = true;
+            try {
+                await stopChild(child);
+            }
+            finally {
+                await secretEnvironment?.remove();
+            }
+        },
+    });
+}
+function portFree(port, host) {
+    return new Promise((resolve) => {
+        const server = createServer();
+        server.once('error', () => resolve(false));
+        server.once('listening', () => server.close(() => resolve(true)));
+        server.listen(port, host);
+    });
+}
+function ephemeralPort(host) {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            server.close(() => resolve(port));
+        });
+    });
+}

package/dist/identity/binding.d.ts

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the Domain signing private JWK. */
+export declare const SIGNING_IDENTITY_BINDING = "ASTRALE_SIGNING_IDENTITY";

package/dist/identity/binding.js

@@ -0,0 +1,2 @@
+/** Adapter-owned Worker secret that carries the Domain signing private JWK. */
+export const SIGNING_IDENTITY_BINDING = 'ASTRALE_SIGNING_IDENTITY';

package/dist/identity/index.d.ts

@@ -0,0 +1,3 @@
+/** Dependency-light custody surface for Cloudflare Domain signing identities. */
+export { signingIdentity } from './source.js';
+export { signingIdentitySecrets } from './secret.js';

package/dist/identity/index.js

@@ -0,0 +1,3 @@
+/** Dependency-light custody surface for Cloudflare Domain signing identities. */
+export { signingIdentity } from './source.js';
+export { signingIdentitySecrets } from './secret.js';

package/dist/identity/material.d.ts

@@ -0,0 +1,7 @@
+import type { JsonWebKey } from '@astrale-os/sdk/auth';
+export type SigningIdentityMaterial = JsonWebKey & {
+    readonly kid: string;
+};
+export declare function createSigningIdentity(): Promise<SigningIdentityMaterial>;
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export declare function admitSigningIdentity(input: unknown, owner: string, legacyKeyId?: string): Promise<SigningIdentityMaterial>;

package/dist/identity/material.js

@@ -0,0 +1,42 @@
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from 'jose';
+export async function createSigningIdentity() {
+    const { privateKey } = await generateKeyPair('EdDSA', { extractable: true });
+    const exported = await exportJWK(privateKey);
+    return admitSigningIdentity({
+        ...exported,
+        alg: 'EdDSA',
+        kid: await calculateJwkThumbprint(exported),
+    }, 'generated identity');
+}
+/** Admit private Ed25519 material and its collision-resistant public identity. */
+export async function admitSigningIdentity(input, owner, legacyKeyId) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(owner);
+    const value = input;
+    if (value.kty !== 'OKP' ||
+        value.crv !== 'Ed25519' ||
+        value.alg !== 'EdDSA' ||
+        typeof value.x !== 'string' ||
+        value.x.length === 0 ||
+        typeof value.d !== 'string' ||
+        value.d.length === 0) {
+        invalid(owner);
+    }
+    const thumbprint = await calculateJwkThumbprint(value);
+    const admitted = legacyKeyId !== undefined && (value.kid === undefined || value.kid === legacyKeyId)
+        ? { ...value, kid: thumbprint }
+        : value;
+    if (admitted.kid !== thumbprint) {
+        throw new TypeError(`Cloudflare signing identity '${owner}' must use its JWK thumbprint as kid.`);
+    }
+    try {
+        await importJWK(admitted, 'EdDSA');
+    }
+    catch (cause) {
+        throw invalid(owner, cause);
+    }
+    return admitted;
+}
+function invalid(owner, cause) {
+    throw new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/identity/secret.d.ts

@@ -0,0 +1,3 @@
+import type { SigningIdentitySource } from './source.js';
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export declare function signingIdentitySecrets(secrets: Readonly<Record<string, string>>, identity: SigningIdentitySource): Readonly<Record<string, string>>;

package/dist/identity/secret.js

@@ -0,0 +1,7 @@
+/** Add the adapter-owned identity without allowing a second secret authority. */
+export function signingIdentitySecrets(secrets, identity) {
+    if (Object.hasOwn(secrets, identity.binding)) {
+        throw new TypeError(`${identity.binding} is adapter-owned; configure 'signingIdentity' instead of declaring that secret.`);
+    }
+    return Object.freeze({ ...secrets, [identity.binding]: identity.secret });
+}

package/dist/identity/source.d.ts

@@ -0,0 +1,26 @@
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+export interface SigningIdentitySource {
+    readonly binding: typeof SIGNING_IDENTITY_BINDING;
+    readonly path: string;
+    readonly secret: string;
+    readonly keyId: string;
+}
+export interface SigningIdentityInput {
+    readonly projectDir: string;
+    readonly origin: string;
+    readonly source?: string;
+    readonly mode: 'local' | 'deploy';
+}
+/** Resolve one admitted Domain signing identity for local or remote provider custody. */
+export declare function signingIdentity(input: SigningIdentityInput): Promise<SigningIdentitySource>;
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export declare function readSigningIdentity(projectDir: string, declaration: string | undefined): Promise<SigningIdentitySource>;
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export declare function localSigningIdentity(projectDir: string, declaration: string | undefined, origin: string): Promise<SigningIdentitySource>;

package/dist/identity/source.js

@@ -0,0 +1,127 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from './binding.js';
+import { admitSigningIdentity, createSigningIdentity } from './material.js';
+const DEFAULT_IDENTITY = join('.astrale', 'identity.json');
+/** Resolve one admitted Domain signing identity for local or remote provider custody. */
+export function signingIdentity(input) {
+    return input.mode === 'local'
+        ? localSigningIdentity(input.projectDir, input.source, input.origin)
+        : readSigningIdentity(input.projectDir, input.source);
+}
+/**
+ * Read an explicitly retained deployment identity. Deployment never generates
+ * one: a missing file is a pre-provider configuration failure, not an implicit
+ * key rotation.
+ */
+export async function readSigningIdentity(projectDir, declaration) {
+    if (declaration === undefined || declaration.length === 0) {
+        throw new TypeError("Cloudflare deployment requires 'signingIdentity: <private-jwk-file>'. " +
+            'Run local development once to create .astrale/identity.json, then retain that file in managed secret storage.');
+    }
+    return readSource(pathOf(projectDir, declaration), declaration);
+}
+/**
+ * Resolve local development identity. The default is generated once inside
+ * `.astrale`; an explicit source is always read-only and must already exist.
+ */
+export async function localSigningIdentity(projectDir, declaration, origin) {
+    if (declaration !== undefined)
+        return readSource(pathOf(projectDir, declaration), declaration);
+    const path = join(projectDir, DEFAULT_IDENTITY);
+    if (!existsSync(path)) {
+        const legacy = join(projectDir, '.astrale', 'identity.ts');
+        if (existsSync(legacy))
+            await migrateLegacyIdentity(legacy, path, origin);
+        else
+            await generateIdentity(path);
+    }
+    return readSource(path, DEFAULT_IDENTITY);
+}
+async function generateIdentity(path) {
+    const value = await createSigningIdentity();
+    if (await installIdentity(path, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
+            `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+    }
+}
+async function migrateLegacyIdentity(legacy, destination, origin) {
+    const source = await readFile(legacy, 'utf8');
+    const match = /export const PRIVATE_JWK = (\{[\s\S]*\}) as const\n?$/u.exec(source);
+    if (match?.[1] === undefined)
+        throw invalidIdentity(legacy);
+    let decoded;
+    try {
+        decoded = JSON.parse(match[1]);
+    }
+    catch (cause) {
+        throw invalidIdentity(legacy, cause);
+    }
+    const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
+    if (await installIdentity(destination, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+    }
+}
+/** Publish a complete owner-only identity once; concurrent environments reuse the winner. */
+async function installIdentity(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const staging = `${path}.${process.pid}.${randomUUID()}.next`;
+    const file = await open(staging, 'wx', 0o600);
+    try {
+        await file.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await file.sync();
+    }
+    catch (cause) {
+        await file.close();
+        await unlink(staging).catch(() => undefined);
+        throw cause;
+    }
+    await file.close();
+    try {
+        await link(staging, path);
+        return true;
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'EEXIST'))
+            throw cause;
+        return false;
+    }
+    finally {
+        await unlink(staging).catch(() => undefined);
+    }
+}
+async function readSource(path, declaration) {
+    let source;
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'ENOENT'))
+            throw cause;
+        throw new TypeError(`Cloudflare signing identity '${declaration}' is missing at ${path}.`, {
+            cause,
+        });
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(source);
+    }
+    catch (cause) {
+        throw invalidIdentity(declaration, cause);
+    }
+    const value = await admitSigningIdentity(decoded, declaration);
+    return Object.freeze({
+        binding: SIGNING_IDENTITY_BINDING,
+        path,
+        secret: JSON.stringify(value),
+        keyId: value.kid,
+    });
+}
+function pathOf(projectDir, declaration) {
+    return isAbsolute(declaration) ? declaration : resolve(projectDir, declaration);
+}
+function invalidIdentity(owner, cause) {
+    return new TypeError(`Cloudflare signing identity '${owner}' is not a private Ed25519 JWK.`, cause === undefined ? undefined : { cause });
+}

package/dist/index.d.ts

@@ -1,15 +1,16 @@
 /**
- * `@astrale-os/adapter-cloudflare` — deploy an Astrale domain as a standalone
- * Cloudflare Worker on YOUR OWN Cloudflare account.
+ * `@astrale-os/adapter-cloudflare` — deploy an Astrale application through
+ * Cloudflare Workers on YOUR OWN Cloudflare account.
  *
  *   import { cloudflare } from '@astrale-os/adapter-cloudflare'
  *
  *   adapter: cloudflare({
  *     dev:  { secrets: '.env.dev' },
- *     prod: { route: 'crm.acme.dev', secrets: '.env.prod' },
+ *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `dev` runs the Worker and optional Vite frontend on allocated local ports;
+ * an env with no `route` ships to
  * `*.workers.dev`; an env with a `route` ships to that custom domain.
  *
  * Prefer a managed deploy (no Cloudflare account)? Use
@@ -18,4 +19,3 @@
  */
 export { cloudflare } from './cloudflare.js';
 export type { CloudflareParams } from './params.js';
-//# sourceMappingURL=index.d.ts.map