@astrale-os/sdk 0.6.0-beta.22 → 0.6.0-beta.23

package/dist/deployment/adapter/adapter.d.ts

@@ -1,4 +1,4 @@
-import type { FrozenConfigurationV1 } from '../address/index.js';
+import type { DeploymentConfiguration } from '../address/index.js';
 import type { Bundler } from './bundle/index.js';
 import type { ArtifactSource, DeployContext, DeployResult, PrepareContext } from './legacy/index.js';
 import type { AdapterCommand, ConfigureContext, ListContext, ListedDeployment, Placement, PlacementContext, ReleaseDeployContext, ReleaseDeployResult, RetainContext } from './release/index.js';
@@ -26,8 +26,12 @@ export interface Adapter<Parameters extends object = object> {
     readonly bundler: Bundler;
     /** Refuse parameters that cannot serve this Environment, before any effect. */
     admit?(parameters: Parameters, context: AdapterEnvironmentContext): void;
-    /** Freeze what a deployment of this Environment binds beside its build. Pure. */
-    configure(parameters: Parameters, context: ConfigureContext): FrozenConfigurationV1;
+    /**
+     * Freeze what a deployment of this Environment binds beside its build: a `FrozenConfigurationV1`
+     * for a host that binds a generated Worker's settings itself, a `WorkerConfigurationV1` for a
+     * Worker host that binds only what it is asked (Admin's Services). Pure.
+     */
+    configure(parameters: Parameters, context: ConfigureContext): DeploymentConfiguration;
     /** Where the host places this Environment's deployments. No effect at the host. */
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     /** Create, or reuse, the immutable deployment of one sealed release. */
@@ -68,7 +72,7 @@ export interface AdapterInput<Parameters extends object> {
     readonly version: string;
     readonly bundler: Bundler;
     admit?(parameters: Parameters, context: AdapterEnvironmentContext): void;
-    configure(parameters: Parameters, context: ConfigureContext): FrozenConfigurationV1;
+    configure(parameters: Parameters, context: ConfigureContext): DeploymentConfiguration;
     placement(parameters: Parameters, context: PlacementContext): Promise<Placement>;
     deployRelease(parameters: Parameters, context: ReleaseDeployContext): Promise<ReleaseDeployResult>;
     list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;

package/dist/deployment/adapter/release/context.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentCommitV1, FrozenConfigurationV1, LineAddressing } from '../../address/index.js';
+import type { DeploymentCommitV1, DeploymentConfiguration, LineAddressing } from '../../address/index.js';
 import type { Release } from '../../release/index.js';
 import type { Bundle } from '../bundle/index.js';
 /**
@@ -10,8 +10,7 @@ export interface ConfigureContext {
     readonly environment: string;
     /**
      * The names of the Environment's current secrets (the adapter's `secretsFile`), sorted and
-     * unique: exactly the secrets `deployRelease` receives, which the configuration declares in
-     * `bindings.secrets`.
+     * unique: exactly the secrets `deployRelease` receives, which the configuration declares.
      */
     readonly secrets: readonly string[];
 }
@@ -53,7 +52,7 @@ export interface ReleaseDeployContext {
     /** The environment-free bytes of the adapter's `bundler`, identified by `bundle.digest`. */
     readonly bundle: Bundle;
     /** What `configure` froze for this Environment. */
-    readonly configuration: FrozenConfigurationV1;
+    readonly configuration: DeploymentConfiguration;
     /** Where `placement` said the host places the deployment. */
     readonly placement: Placement;
     /**

package/dist/deployment/address/configuration.d.ts

@@ -1,4 +1,5 @@
 import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+import type { WorkerConfigurationV1 } from '../worker/configuration.js';
 export declare const FROZEN_CONFIGURATION_FORMAT = "astrale.deployment.configuration";
 export declare const FROZEN_CONFIGURATION_VERSION = 1;
 /**
@@ -70,6 +71,17 @@ export interface FrozenDurableOptions {
     };
     readonly stepTimeoutMs?: number;
 }
+/**
+ * What one deployment freezes beside its build, as its adapter's `configure` returns it: a
+ * `FrozenConfigurationV1`, which a Cloudflare dispatch namespace binds (namespace mode), or a
+ * `WorkerConfigurationV1` (`@astrale-os/sdk/deployment/worker`), which a Worker host binds
+ * (Admin's Services). Its digest and the build digest make the deployment's label.
+ */
+export type DeploymentConfiguration = FrozenConfigurationV1 | WorkerConfigurationV1;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export declare function deploymentConfigurationDigest(configuration: DeploymentConfiguration): Digest;
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export declare function isFrozenConfiguration(configuration: DeploymentConfiguration): configuration is FrozenConfigurationV1;
 /** A configuration before its canonical order: lists in any order, no format header. */
 export type FrozenConfigurationInput = Omit<FrozenConfigurationV1, 'format' | 'version'>;
 /** Freeze one deployment configuration in the one canonical order its digest is taken in. */

package/dist/deployment/address/configuration.js

@@ -1,5 +1,6 @@
 import { json } from '@astrale-os/kernel-dsl/value';
 import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { isWorkerConfiguration, workerConfigurationDigest } from '../worker/configuration.js';
 export const FROZEN_CONFIGURATION_FORMAT = 'astrale.deployment.configuration';
 export const FROZEN_CONFIGURATION_VERSION = 1;
 /** Service binding through which an immutable deployment reaches the instance router. */
@@ -10,6 +11,16 @@ const COMPATIBILITY_DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const BINDING_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
 /** A Cloudflare dispatch namespace name. */
 const NAMESPACE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+/** The digest of one frozen configuration of either format, as the deployment's label keeps it. */
+export function deploymentConfigurationDigest(configuration) {
+    return isWorkerConfiguration(configuration)
+        ? workerConfigurationDigest(configuration)
+        : configurationDigest(configuration);
+}
+/** Whether a configuration is a `FrozenConfigurationV1`, by its format alone (not admitted). */
+export function isFrozenConfiguration(configuration) {
+    return configuration?.format === FROZEN_CONFIGURATION_FORMAT;
+}
 /** Freeze one deployment configuration in the one canonical order its digest is taken in. */
 export function frozenConfiguration(input) {
     if (input === null || typeof input !== 'object')

package/dist/deployment/address/index.d.ts

@@ -1,5 +1,5 @@
-export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, type FrozenConfigurationInput, type FrozenDurableOptions, type FrozenConfigurationV1, } from './configuration.js';
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, type DeploymentConfiguration, type FrozenConfigurationInput, type FrozenDurableOptions, type FrozenConfigurationV1, } from './configuration.js';
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, type DeploymentLabelParts, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, type DeploymentLineInput, type LineAddressing, } from './line.js';
-export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, type DeploymentCommitV1, type DeploymentRecordV1, } from './record.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, type DeploymentCommitV1, type DeploymentRecordDocument, type DeploymentRecordV1, } from './record.js';
 export type { DeploymentSummaryV1 } from './summary.js';

package/dist/deployment/address/index.js

@@ -1,4 +1,4 @@
-export { configurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, } from './configuration.js';
+export { configurationDigest, deploymentConfigurationDigest, frozenConfiguration, FROZEN_CONFIGURATION_FORMAT, FROZEN_CONFIGURATION_VERSION, isFrozenConfiguration, } from './configuration.js';
 export { DEPLOYMENT_LABEL, deploymentContent, deploymentLabel, deploymentUrl, parseDeploymentLabel, } from './label.js';
 export { deploymentLine, lineFingerprint, readablePart, } from './line.js';
-export { acceptDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_VERSION, } from './record.js';
+export { acceptDeploymentRecord, decodeDeploymentRecord, DEPLOYMENT_RECORD_FORMAT, DEPLOYMENT_RECORD_MEDIA_TYPE, DEPLOYMENT_RECORD_VERSION, encodeDeploymentRecord, } from './record.js';

package/dist/deployment/address/label.d.ts

@@ -1,6 +1,6 @@
 import type { Digest } from '@astrale-os/kernel-protocol/artifact';
 import type { BuildDigest } from '../build/manifest.js';
-import type { FrozenConfigurationV1 } from './configuration.js';
+import type { DeploymentConfiguration } from './configuration.js';
 /**
  * Every deployment label: an optional readable part, the 16-character line fingerprint and the
  * 16-character content, both lower-case base32. A legacy provider name (a UUID, a stable Worker
@@ -16,11 +16,11 @@ export interface DeploymentLabelParts {
 }
 /**
  * The 16-character content of one deployment: the first 80 bits of
- * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest(configuration)))` in lower-case
- * base32. It covers the build and the frozen configuration, never a secret: one address serves
- * one release, and a changed variable gives another address.
+ * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(deploymentConfigurationDigest(configuration)))` in
+ * lower-case base32. It covers the build and the frozen configuration, never a secret: one address
+ * serves one release, and a changed variable gives another address.
  */
-export declare function deploymentContent(build: BuildDigest, configuration: FrozenConfigurationV1): string;
+export declare function deploymentContent(build: BuildDigest, configuration: DeploymentConfiguration): string;
 /** The content of a build and a full configuration digest, as a deployment record holds them. */
 export declare function contentOf(build: BuildDigest, configuration: Digest): string;
 /**

package/dist/deployment/address/label.js

@@ -1,4 +1,4 @@
-import { configurationDigest } from './configuration.js';
+import { deploymentConfigurationDigest } from './configuration.js';
 import { first80 } from './fingerprint.js';
 /**
  * Every deployment label: an optional readable part, the 16-character line fingerprint and the
@@ -18,12 +18,12 @@ const MAXIMUM_LABEL_LENGTH = MAXIMUM_LINE_LENGTH + 17;
 const MAXIMUM_HOST_LENGTH = 253;
 /**
  * The 16-character content of one deployment: the first 80 bits of
- * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest(configuration)))` in lower-case
- * base32. It covers the build and the frozen configuration, never a secret: one address serves
- * one release, and a changed variable gives another address.
+ * `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(deploymentConfigurationDigest(configuration)))` in
+ * lower-case base32. It covers the build and the frozen configuration, never a secret: one address
+ * serves one release, and a changed variable gives another address.
  */
 export function deploymentContent(build, configuration) {
-    return contentOf(build, configurationDigest(configuration));
+    return contentOf(build, deploymentConfigurationDigest(configuration));
 }
 /** The content of a build and a full configuration digest, as a deployment record holds them. */
 export function contentOf(build, configuration) {

package/dist/deployment/address/record.d.ts

@@ -4,6 +4,11 @@ import type { ReleaseDigest } from '@astrale-os/kernel-protocol/release';
 import type { BuildDigest } from '../build/manifest.js';
 export declare const DEPLOYMENT_RECORD_FORMAT = "astrale.deployment-record";
 export declare const DEPLOYMENT_RECORD_VERSION = 1;
+/**
+ * The media type of a `DeploymentRecordV1` document: what a Domain deployer publishes it with, and
+ * what a host serves it with at `/.well-known/astrale/deployment.json`.
+ */
+export declare const DEPLOYMENT_RECORD_MEDIA_TYPE = "application/vnd.astrale.deployment-record+json;v=1";
 /** The commit a deployment was built from, as the deployer declared it. */
 export interface DeploymentCommitV1 {
     /** The full commit SHA, 40 hexadecimal digits in either case; git prints it in lower case. */
@@ -50,3 +55,19 @@ export interface DeploymentRecordV1 {
  * does, and never fails the whole listing over it.
  */
 export declare function acceptDeploymentRecord(input: unknown): DeploymentRecordV1;
+/** The document of one record: what a Domain deployer publishes and a host serves verbatim. */
+export interface DeploymentRecordDocument {
+    readonly contentType: string;
+    readonly bytes: Uint8Array;
+}
+/**
+ * The document of one record, as a Domain deployer publishes it: the record admitted, as the
+ * UTF-8 bytes of its RFC 8785 canonical JSON, with `DEPLOYMENT_RECORD_MEDIA_TYPE`. One record has
+ * one document, byte for byte, whoever writes it.
+ */
+export declare function encodeDeploymentRecord(record: DeploymentRecordV1): DeploymentRecordDocument;
+/**
+ * Admit the document of one record: `DEPLOYMENT_RECORD_MEDIA_TYPE`, and UTF-8 JSON whose value
+ * `acceptDeploymentRecord` admits. Anything else throws.
+ */
+export declare function decodeDeploymentRecord(document: DeploymentRecordDocument): DeploymentRecordV1;

package/dist/deployment/address/record.js

@@ -1,10 +1,16 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { json } from '@astrale-os/kernel-dsl/value';
 import { isVersion } from '../../platform/versioning/version.js';
 import { ENVIRONMENT_NAME } from '../environment.js';
 import { contentOf, parseDeploymentLabel } from './label.js';
 import { deploymentLine } from './line.js';
 export const DEPLOYMENT_RECORD_FORMAT = 'astrale.deployment-record';
 export const DEPLOYMENT_RECORD_VERSION = 1;
+/**
+ * The media type of a `DeploymentRecordV1` document: what a Domain deployer publishes it with, and
+ * what a host serves it with at `/.well-known/astrale/deployment.json`.
+ */
+export const DEPLOYMENT_RECORD_MEDIA_TYPE = 'application/vnd.astrale.deployment-record+json;v=1';
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 /** The full hexadecimal SHA-1 of a commit, in either case, as a deployment name reads it. */
 const SHA = /^[0-9a-f]{40}$/iu;
@@ -64,6 +70,34 @@ export function acceptDeploymentRecord(input) {
         commit: record.commit === null ? null : commit(record.commit),
     });
 }
+/**
+ * The document of one record, as a Domain deployer publishes it: the record admitted, as the
+ * UTF-8 bytes of its RFC 8785 canonical JSON, with `DEPLOYMENT_RECORD_MEDIA_TYPE`. One record has
+ * one document, byte for byte, whoever writes it.
+ */
+export function encodeDeploymentRecord(record) {
+    return Object.freeze({
+        contentType: DEPLOYMENT_RECORD_MEDIA_TYPE,
+        bytes: new TextEncoder().encode(json.serialize(acceptDeploymentRecord(record))),
+    });
+}
+/**
+ * Admit the document of one record: `DEPLOYMENT_RECORD_MEDIA_TYPE`, and UTF-8 JSON whose value
+ * `acceptDeploymentRecord` admits. Anything else throws.
+ */
+export function decodeDeploymentRecord(document) {
+    if (document?.contentType !== DEPLOYMENT_RECORD_MEDIA_TYPE) {
+        throw new TypeError('Deployment record document has another media type.');
+    }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(document.bytes));
+    }
+    catch (cause) {
+        throw new TypeError('Deployment record document is not UTF-8 JSON.', { cause });
+    }
+    return acceptDeploymentRecord(value);
+}
 function commit(input) {
     const based = input !== null && typeof input === 'object' && Object.hasOwn(input, 'base');
     const value = exact(input, based ? ['sha', 'dirty', 'base'] : ['sha', 'dirty'], 'commit');

package/dist/deployment/verify/index.d.ts

@@ -2,4 +2,4 @@ export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
 export type { BundleInput, PreflightInput } from './preflight/index.js';
-export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';
+export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';

package/dist/deployment/verify/index.js

@@ -1,4 +1,4 @@
 export { preflight as verifyPreflight } from './preflight/index.js';
 export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
-export { readiness as verifyReadiness, verifyDeployment } from './readiness/index.js';
+export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';

package/dist/deployment/verify/readiness/index.d.ts

@@ -11,4 +11,11 @@ export { verifyRelease } from './release.js';
  * deployment's `release.json` (release digest and build digest), or a stable target's
  * `domain.json` (deprecated, `legacy/`).
  */
+/**
+ * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
+ * deployment serves its release: its `release.json`, its Bundle and its issuer documents (the
+ * OpenID configuration and its key set). A host that probes paths before it activates a
+ * deployment probes these.
+ */
+export declare function readinessPaths(deployed: Release): readonly string[];
 export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,3 +1,5 @@
+import { issuer } from '@astrale-os/kernel-protocol';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { verifyIdentity } from './identity.js';
 import { verifyPublication } from './legacy/index.js';
 import { verifyRelease } from './release.js';
@@ -10,6 +12,21 @@ export { verifyRelease } from './release.js';
  * deployment's `release.json` (release digest and build digest), or a stable target's
  * `domain.json` (deprecated, `legacy/`).
  */
+/**
+ * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
+ * deployment serves its release: its `release.json`, its Bundle and its issuer documents (the
+ * OpenID configuration and its key set). A host that probes paths before it activates a
+ * deployment probes these.
+ */
+export function readinessPaths(deployed) {
+    const { configuration, keys } = issuer.paths(deployed.url);
+    return Object.freeze([
+        new URL(release.url(deployed.url)).pathname,
+        new URL(deployed.document.schema.bundle.href).pathname,
+        configuration,
+        keys,
+    ]);
+}
 export async function readiness(release, options = {}) {
     if (release.kind === 'release') {
         await verifyRelease(release, options);

package/dist/deployment/worker/address.d.ts

@@ -0,0 +1,26 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/**
+ * The name of a project a Worker host keeps Services for: lower-case letters, digits, `.`, `_`
+ * and `-`, starting and ending with a letter or a digit, at most 253 characters. A Domain origin is
+ * one (a Domain deployer names its project by its origin).
+ */
+export declare const PROJECT_NAME: RegExp;
+/**
+ * The name of the Service of one project in one environment: the first 80 bits of
+ * `sha256(utf8(project) ‖ 0x00 ‖ utf8(environment))` in lower-case base32, 16 characters. It is
+ * opaque, so a Service's URL says nothing of whose code it serves, and it is the line fingerprint
+ * of `@astrale-os/sdk/deployment/address` (`lineFingerprint`) when the project is a Domain origin:
+ * a Domain's Service keeps its name.
+ */
+export declare function serviceName(project: string, environment: string): string;
+/**
+ * The label of one Worker deployment, `<service>-<content>`: its Service's name, then the first
+ * 80 bits of `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest))` in lower-case base32.
+ * The same code and configuration in the same Service always give the same label, so a redeploy
+ * of a release reuses its deployment; anything else gives another.
+ */
+export declare function workerDeploymentLabel(input: {
+    readonly service: string;
+    readonly buildDigest: Digest;
+    readonly configurationDigest: Digest;
+}): string;

package/dist/deployment/worker/address.js

@@ -0,0 +1,43 @@
+import { first80 } from '../address/fingerprint.js';
+import { deploymentLabel } from '../address/label.js';
+import { ENVIRONMENT_NAME } from '../environment.js';
+/**
+ * The name of a project a Worker host keeps Services for: lower-case letters, digits, `.`, `_`
+ * and `-`, starting and ending with a letter or a digit, at most 253 characters. A Domain origin is
+ * one (a Domain deployer names its project by its origin).
+ */
+export const PROJECT_NAME = /^[a-z0-9](?:[a-z0-9._-]{0,251}[a-z0-9])?$/u;
+/** The longest environment name a Service is named by. */
+const MAXIMUM_ENVIRONMENT_LENGTH = 63;
+/**
+ * The name of the Service of one project in one environment: the first 80 bits of
+ * `sha256(utf8(project) ‖ 0x00 ‖ utf8(environment))` in lower-case base32, 16 characters. It is
+ * opaque, so a Service's URL says nothing of whose code it serves, and it is the line fingerprint
+ * of `@astrale-os/sdk/deployment/address` (`lineFingerprint`) when the project is a Domain origin:
+ * a Domain's Service keeps its name.
+ */
+export function serviceName(project, environment) {
+    if (typeof project !== 'string' || !PROJECT_NAME.test(project)) {
+        throw new TypeError('Worker project must be a lower-case project name.');
+    }
+    if (typeof environment !== 'string' ||
+        environment.length > MAXIMUM_ENVIRONMENT_LENGTH ||
+        !ENVIRONMENT_NAME.test(environment)) {
+        throw new TypeError('Worker environment must be a project environment name.');
+    }
+    return first80(project, environment);
+}
+/**
+ * The label of one Worker deployment, `<service>-<content>`: its Service's name, then the first
+ * 80 bits of `sha256(utf8(buildDigest) ‖ 0x00 ‖ utf8(configurationDigest))` in lower-case base32.
+ * The same code and configuration in the same Service always give the same label, so a redeploy
+ * of a release reuses its deployment; anything else gives another.
+ */
+export function workerDeploymentLabel(input) {
+    for (const digest of [input.buildDigest, input.configurationDigest]) {
+        if (typeof digest !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(digest)) {
+            throw new TypeError('Worker deployment digests must be sha256 digests.');
+        }
+    }
+    return deploymentLabel(input.service, first80(input.buildDigest, input.configurationDigest));
+}

package/dist/deployment/worker/build.d.ts

@@ -0,0 +1,60 @@
+import type { Value } from '@astrale-os/kernel-dsl/value';
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+/** How Workers loads one module. */
+export type WorkerModuleKind = 'esm' | 'wasm' | 'text' | 'data';
+/** One module of a Worker, by the name the others import it by. */
+export interface WorkerModule {
+    readonly name: string;
+    readonly kind: WorkerModuleKind;
+    readonly bytes: Uint8Array;
+}
+/** One static asset of a Worker, by the absolute URL path it is served at. */
+export interface WorkerAsset {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    /** The media type the asset is uploaded with; not part of the build digest. */
+    readonly contentType?: string;
+}
+/**
+ * The members of a build manifest its deployer declares: at least its `format` and `version`,
+ * then whatever provenance the deployer identifies its builds by. A host never reads them: it only
+ * digests them with the `entrypoint` and `files` it computes from the uploaded bytes.
+ *
+ * A generic Worker declares `WORKER_BUILD_MANIFEST`. A Domain deployer declares its
+ * `BuildManifestV1` without `entrypoint` and `files` (`format`, `version`, `origin`, `schema`,
+ * `bundler`), so the digest is exactly the Domain's build digest.
+ */
+export type WorkerBuildManifest = Readonly<Record<string, Value>> & {
+    readonly format: string;
+    readonly version: number;
+};
+/** The build manifest members of a Worker that declares no provenance of its own. */
+export declare const WORKER_BUILD_MANIFEST: WorkerBuildManifest;
+/** The code of one Worker: its modules, its main module, its static assets and its manifest. */
+export interface WorkerCode {
+    readonly manifest: WorkerBuildManifest;
+    readonly mainModule: string;
+    readonly modules: readonly WorkerModule[];
+    readonly assets?: readonly WorkerAsset[];
+}
+/**
+ * The build manifest of one Worker: its declared members, its `entrypoint` (the main module) and
+ * its `files`, sorted by path (UTF-16 code units), each `{ path, digest, size }`. A module is the
+ * file of its own name, a static asset `/<path>` the file `assets/<path>`. A module whose kind is
+ * not the one its name implies (`wasm` for a `.wasm` name, `esm` otherwise) also records its
+ * `kind`, so a module loaded another way is another build. The code is admitted first.
+ */
+export declare function workerBuildManifest(code: WorkerCode): Readonly<Record<string, Value>>;
+/**
+ * The build digest of one Worker: `sha256` of the canonical JSON (RFC 8785) of its build manifest.
+ * A host binds it as `ASTRALE_BUILD_DIGEST`; with a Domain's declared members it is the Domain's
+ * build digest.
+ */
+export declare function workerBuildDigest(code: WorkerCode): Digest;
+/**
+ * Admit the code of one Worker: declared manifest members (a `format`, a positive `version`, no
+ * `entrypoint` nor `files`, at most `manifestSize` bytes of canonical JSON), one to `modules`
+ * modules with safe relative names, unique, the main module among them, and at most `assets`
+ * assets at unique canonical absolute paths. Sizes are bounded per file and for the whole Worker.
+ */
+export declare function acceptWorkerCode(code: WorkerCode): WorkerCode;

package/dist/deployment/worker/build.js

@@ -0,0 +1,172 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+/** The build manifest members of a Worker that declares no provenance of its own. */
+export const WORKER_BUILD_MANIFEST = Object.freeze({
+    format: 'astrale.worker.build',
+    version: 1,
+});
+const MANIFEST_MEDIA_TYPE = 'application/vnd.astrale.worker-build+json;v=1';
+const FILE_MEDIA_TYPE = 'application/octet-stream';
+const MAXIMUM_MODULE_NAME_LENGTH = 256;
+const MAXIMUM_ASSET_PATH_LENGTH = 2_048;
+const KINDS = Object.freeze(['esm', 'wasm', 'text', 'data']);
+/**
+ * The build manifest of one Worker: its declared members, its `entrypoint` (the main module) and
+ * its `files`, sorted by path (UTF-16 code units), each `{ path, digest, size }`. A module is the
+ * file of its own name, a static asset `/<path>` the file `assets/<path>`. A module whose kind is
+ * not the one its name implies (`wasm` for a `.wasm` name, `esm` otherwise) also records its
+ * `kind`, so a module loaded another way is another build. The code is admitted first.
+ */
+export function workerBuildManifest(code) {
+    const admitted = acceptWorkerCode(code);
+    const files = [
+        ...admitted.modules.map((module) => ({
+            path: module.name,
+            ...identity(module.bytes),
+            ...(module.kind === impliedKind(module.name) ? {} : { kind: module.kind }),
+        })),
+        ...(admitted.assets ?? []).map((asset) => ({
+            path: `assets${asset.path}`,
+            ...identity(asset.bytes),
+        })),
+    ].sort((left, right) => compare(left.path, right.path));
+    for (let index = 1; index < files.length; index += 1) {
+        if (files[index - 1].path === files[index].path) {
+            invalid(`the module and the asset file ${files[index].path} collide`);
+        }
+    }
+    return Object.freeze({ ...admitted.manifest, entrypoint: admitted.mainModule, files });
+}
+/**
+ * The build digest of one Worker: `sha256` of the canonical JSON (RFC 8785) of its build manifest.
+ * A host binds it as `ASTRALE_BUILD_DIGEST`; with a Domain's declared members it is the Domain's
+ * build digest.
+ */
+export function workerBuildDigest(code) {
+    return identify(json.encode(workerBuildManifest(code)), MANIFEST_MEDIA_TYPE).digest;
+}
+/**
+ * Admit the code of one Worker: declared manifest members (a `format`, a positive `version`, no
+ * `entrypoint` nor `files`, at most `manifestSize` bytes of canonical JSON), one to `modules`
+ * modules with safe relative names, unique, the main module among them, and at most `assets`
+ * assets at unique canonical absolute paths. Sizes are bounded per file and for the whole Worker.
+ */
+export function acceptWorkerCode(code) {
+    if (code === null || typeof code !== 'object')
+        invalid('it is not an object');
+    const manifest = acceptManifest(code.manifest);
+    const limits = WORKER_DEPLOYMENT_LIMITS;
+    if (!Array.isArray(code.modules) || code.modules.length === 0)
+        invalid('it has no module');
+    if (code.modules.length > limits.modules)
+        invalid('it has too many modules');
+    const assets = code.assets ?? [];
+    if (!Array.isArray(assets) || assets.length > limits.assets)
+        invalid('it has too many assets');
+    let size = 0;
+    const modules = code.modules.map((module) => {
+        if (!isModuleName(module?.name))
+            invalid('a module name is not a safe relative path');
+        if (!KINDS.includes(module.kind))
+            invalid(`module ${module.name} has an unknown kind`);
+        size += bounded(module.bytes, limits.moduleSize, `module ${module.name}`);
+        return Object.freeze({ name: module.name, kind: module.kind, bytes: module.bytes });
+    });
+    unique(modules.map((module) => module.name), 'module names');
+    if (!modules.some((module) => module.name === code.mainModule)) {
+        invalid('its main module is not one of its modules');
+    }
+    const files = assets.map((asset) => {
+        if (!isAssetPath(asset?.path))
+            invalid('an asset path is not a canonical absolute URL path');
+        if (asset.contentType !== undefined && typeof asset.contentType !== 'string') {
+            invalid(`asset ${asset.path} has an invalid content type`);
+        }
+        size += bounded(asset.bytes, limits.assetSize, `asset ${asset.path}`);
+        return Object.freeze({
+            path: asset.path,
+            bytes: asset.bytes,
+            ...(asset.contentType === undefined ? {} : { contentType: asset.contentType }),
+        });
+    });
+    unique(files.map((asset) => asset.path), 'asset paths');
+    if (size > limits.workerSize)
+        invalid('its files exceed the size of one Worker');
+    return Object.freeze({
+        manifest,
+        mainModule: code.mainModule,
+        modules: Object.freeze(modules),
+        ...(files.length === 0 ? {} : { assets: Object.freeze(files) }),
+    });
+}
+/** The kind a module's name implies: `wasm` for a `.wasm` module, `esm` otherwise. */
+function impliedKind(name) {
+    return name.endsWith('.wasm') ? 'wasm' : 'esm';
+}
+function acceptManifest(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('its manifest is not an object');
+    }
+    const manifest = input;
+    if (typeof manifest.format !== 'string' || manifest.format.length === 0) {
+        invalid('its manifest names no format');
+    }
+    if (!Number.isSafeInteger(manifest.version) || manifest.version < 1) {
+        invalid('its manifest names no version');
+    }
+    if (Object.hasOwn(manifest, 'entrypoint') || Object.hasOwn(manifest, 'files')) {
+        invalid('its manifest declares the entrypoint or the files its host computes');
+    }
+    let text;
+    try {
+        text = json.serialize(manifest);
+    }
+    catch (cause) {
+        throw new TypeError('Worker code is invalid: its manifest is not portable JSON.', { cause });
+    }
+    if (new TextEncoder().encode(text).byteLength > WORKER_DEPLOYMENT_LIMITS.manifestSize) {
+        invalid('its manifest is too large');
+    }
+    return JSON.parse(text);
+}
+function identity(bytes) {
+    const { digest, size } = identify(bytes, FILE_MEDIA_TYPE);
+    return { digest, size };
+}
+function bounded(bytes, maximum, label) {
+    if (!(bytes instanceof Uint8Array))
+        invalid(`${label} has no bytes`);
+    if (bytes.byteLength > maximum)
+        invalid(`${label} exceeds its size limit`);
+    return bytes.byteLength;
+}
+/** A safe relative module path: no leading `/`, no `\`, `?` or `#`, no empty, `.` or `..` part. */
+function isModuleName(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    if (value.length > MAXIMUM_MODULE_NAME_LENGTH || /^\/|[\\?#]/u.test(value))
+        return false;
+    return value.split('/').every((part) => part.length > 0 && part !== '.' && part !== '..');
+}
+/** An absolute canonical URL path: `/`, then non-empty parts other than `.` and `..`. */
+function isAssetPath(value) {
+    if (typeof value !== 'string' || value.length > MAXIMUM_ASSET_PATH_LENGTH)
+        return false;
+    if (!value.startsWith('/') || /[\\?#]/u.test(value))
+        return false;
+    return value
+        .slice(1)
+        .split('/')
+        .every((part) => part.length > 0 && part !== '.' && part !== '..');
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length)
+        invalid(`its ${label} are not unique`);
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid(reason) {
+    throw new TypeError(`Worker code is invalid: ${reason}.`);
+}