@astrale-os/sdk 0.6.0-beta.22 → 0.6.0-beta.23

package/dist/deployment/worker/configuration.d.ts

@@ -0,0 +1,73 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+export declare const WORKER_CONFIGURATION_FORMAT = "astrale.worker.configuration";
+export declare const WORKER_CONFIGURATION_VERSION = 1;
+/** A Cloudflare Worker binding name. */
+export declare const WORKER_BINDING_NAME: RegExp;
+/**
+ * The bindings a Worker host binds itself on every deployment, whatever it asks: never the name
+ * of a variable or a secret.
+ *
+ * - `WORKER_URL`: the deployment URL, `https://<label>.<routing domain>`;
+ * - `ASTRALE_BUILD_DIGEST`: the build digest of the uploaded Worker (`workerBuildDigest`);
+ * - `ASTRALE_VERSION_METADATA`: the provider version metadata; a Worker that asks for readiness
+ *   answers its `id` as `x-astrale-worker-version`;
+ * - `ASTRALE_SIGNING_IDENTITY`: the private Ed25519 JWK of the deployment, with `signingIdentity`;
+ * - `ROUTER`: the host's router service, with `router`;
+ * - `ASSETS`: the deployment's static assets, when it uploads some.
+ */
+export declare const WORKER_HOST_BINDINGS: readonly string[];
+/**
+ * What one Worker deployment freezes beside its code: the Workers runtime it runs on, its plain
+ * variables, the names of its secrets (never their values) and what it asks of its host. Its
+ * digest and the build digest make the deployment's label, so a changed variable, flag, secret
+ * name or option is another deployment, and a rotated secret value is not.
+ *
+ * - `record`: the deployment serves the record its deployer publishes at
+ *   `/.well-known/astrale/deployment.json` (the record's bytes are not part of the configuration:
+ *   a deployment keeps the record it was created with);
+ * - `signingIdentity`: the host generates an Ed25519 key for the deployment alone and binds it as
+ *   `ASTRALE_SIGNING_IDENTITY`;
+ * - `router`: the host binds its own router service as `ROUTER`. A deployment never names a
+ *   service or a dispatch namespace itself.
+ *
+ * How its host probes readiness is not part of it: a probe changes nothing the deployment serves.
+ */
+export interface WorkerConfigurationV1 {
+    readonly format: typeof WORKER_CONFIGURATION_FORMAT;
+    readonly version: typeof WORKER_CONFIGURATION_VERSION;
+    readonly compatibilityDate: string;
+    /** Sorted, unique. */
+    readonly compatibilityFlags: readonly string[];
+    /** Plain variables, never secrets. */
+    readonly vars: Readonly<Record<string, string>>;
+    /** The names of the secrets the deployment binds, sorted and unique. */
+    readonly secrets: readonly string[];
+    readonly record: boolean;
+    readonly signingIdentity: boolean;
+    readonly router: boolean;
+}
+/** A configuration before its canonical order: lists in any order, options false when absent. */
+export interface WorkerConfigurationInput {
+    readonly compatibilityDate: string;
+    readonly compatibilityFlags?: readonly string[];
+    readonly vars?: Readonly<Record<string, string>>;
+    readonly secrets?: readonly string[];
+    readonly record?: boolean;
+    readonly signingIdentity?: boolean;
+    readonly router?: boolean;
+}
+/** Freeze one Worker configuration in the one canonical order its digest is taken in. */
+export declare function workerConfiguration(input: WorkerConfigurationInput): WorkerConfigurationV1;
+/**
+ * Admit one exact, canonical Worker configuration: every member, lists sorted and unique, binding
+ * names Cloudflare admits, distinct across variables and secrets, and none a host binds itself.
+ * Anything else throws.
+ */
+export declare function acceptWorkerConfiguration(input: unknown): WorkerConfigurationV1;
+/**
+ * `sha256` of the canonical JSON (RFC 8785) of one admitted Worker configuration. A deployment's
+ * label keeps 80 bits of it with the build digest.
+ */
+export declare function workerConfigurationDigest(configuration: WorkerConfigurationV1): Digest;
+/** Whether a configuration is a Worker configuration, by its format alone (not admitted). */
+export declare function isWorkerConfiguration(input: unknown): input is WorkerConfigurationV1;

package/dist/deployment/worker/configuration.js

@@ -0,0 +1,165 @@
+import { json } from '@astrale-os/kernel-dsl/value';
+import { identify } from '@astrale-os/kernel-protocol/artifact';
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+export const WORKER_CONFIGURATION_FORMAT = 'astrale.worker.configuration';
+export const WORKER_CONFIGURATION_VERSION = 1;
+const MEDIA_TYPE = 'application/vnd.astrale.worker-configuration+json;v=1';
+const COMPATIBILITY_DATE = /^\d{4}-\d{2}-\d{2}$/u;
+const COMPATIBILITY_FLAG = /^[a-z0-9][a-z0-9_]{0,127}$/u;
+/** A Cloudflare Worker binding name. */
+export const WORKER_BINDING_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,127}$/u;
+/**
+ * The bindings a Worker host binds itself on every deployment, whatever it asks: never the name
+ * of a variable or a secret.
+ *
+ * - `WORKER_URL`: the deployment URL, `https://<label>.<routing domain>`;
+ * - `ASTRALE_BUILD_DIGEST`: the build digest of the uploaded Worker (`workerBuildDigest`);
+ * - `ASTRALE_VERSION_METADATA`: the provider version metadata; a Worker that asks for readiness
+ *   answers its `id` as `x-astrale-worker-version`;
+ * - `ASTRALE_SIGNING_IDENTITY`: the private Ed25519 JWK of the deployment, with `signingIdentity`;
+ * - `ROUTER`: the host's router service, with `router`;
+ * - `ASSETS`: the deployment's static assets, when it uploads some.
+ */
+export const WORKER_HOST_BINDINGS = Object.freeze([
+    'WORKER_URL',
+    'ASTRALE_BUILD_DIGEST',
+    'ASTRALE_VERSION_METADATA',
+    'ASTRALE_SIGNING_IDENTITY',
+    'ROUTER',
+    'ASSETS',
+]);
+/** Freeze one Worker configuration in the one canonical order its digest is taken in. */
+export function workerConfiguration(input) {
+    if (input === null || typeof input !== 'object')
+        invalid('it is not an object');
+    return acceptWorkerConfiguration({
+        format: WORKER_CONFIGURATION_FORMAT,
+        version: WORKER_CONFIGURATION_VERSION,
+        compatibilityDate: input.compatibilityDate,
+        compatibilityFlags: [...(input.compatibilityFlags ?? [])].sort(compare),
+        vars: sortedRecord(input.vars ?? {}),
+        secrets: [...(input.secrets ?? [])].sort(compare),
+        record: input.record ?? false,
+        signingIdentity: input.signingIdentity ?? false,
+        router: input.router ?? false,
+    });
+}
+/**
+ * Admit one exact, canonical Worker configuration: every member, lists sorted and unique, binding
+ * names Cloudflare admits, distinct across variables and secrets, and none a host binds itself.
+ * Anything else throws.
+ */
+export function acceptWorkerConfiguration(input) {
+    const value = exact(input, [
+        'format',
+        'version',
+        'compatibilityDate',
+        'compatibilityFlags',
+        'vars',
+        'secrets',
+        'record',
+        'signingIdentity',
+        'router',
+    ]);
+    if (value.format !== WORKER_CONFIGURATION_FORMAT ||
+        value.version !== WORKER_CONFIGURATION_VERSION) {
+        invalid('its format is not astrale.worker.configuration v1');
+    }
+    if (!isDate(value.compatibilityDate))
+        invalid('its compatibility date is not YYYY-MM-DD');
+    const flags = sortedNames(value.compatibilityFlags, 'compatibility flags', COMPATIBILITY_FLAG, WORKER_DEPLOYMENT_LIMITS.compatibilityFlags);
+    const vars = variables(value.vars);
+    const secrets = sortedNames(value.secrets, 'secret names', WORKER_BINDING_NAME, WORKER_DEPLOYMENT_LIMITS.secrets);
+    const names = [...Object.keys(vars), ...secrets];
+    if (new Set(names).size !== names.length)
+        invalid('a variable and a secret share a name');
+    const reserved = names.filter((name) => WORKER_HOST_BINDINGS.includes(name));
+    if (reserved.length > 0)
+        invalid(`${reserved.join(', ')} is bound by the host`);
+    for (const option of ['record', 'signingIdentity', 'router']) {
+        if (typeof value[option] !== 'boolean')
+            invalid(`its ${option} option is not a boolean`);
+    }
+    return Object.freeze({
+        format: WORKER_CONFIGURATION_FORMAT,
+        version: WORKER_CONFIGURATION_VERSION,
+        compatibilityDate: value.compatibilityDate,
+        compatibilityFlags: flags,
+        vars,
+        secrets,
+        record: value.record,
+        signingIdentity: value.signingIdentity,
+        router: value.router,
+    });
+}
+/**
+ * `sha256` of the canonical JSON (RFC 8785) of one admitted Worker configuration. A deployment's
+ * label keeps 80 bits of it with the build digest.
+ */
+export function workerConfigurationDigest(configuration) {
+    return identify(json.encode(acceptWorkerConfiguration(configuration)), MEDIA_TYPE).digest;
+}
+/** Whether a configuration is a Worker configuration, by its format alone (not admitted). */
+export function isWorkerConfiguration(input) {
+    return (input !== null &&
+        typeof input === 'object' &&
+        input.format === WORKER_CONFIGURATION_FORMAT);
+}
+function variables(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('its variables are not an object');
+    }
+    const keys = Reflect.ownKeys(input);
+    if (keys.length > WORKER_DEPLOYMENT_LIMITS.vars)
+        invalid('it has too many variables');
+    const entries = [];
+    for (const name of keys) {
+        const text = input[name];
+        if (typeof name !== 'string' || !WORKER_BINDING_NAME.test(name)) {
+            invalid('a variable name is not a Worker binding name');
+        }
+        if (typeof text !== 'string' || text.length > WORKER_DEPLOYMENT_LIMITS.valueLength) {
+            invalid(`variable ${name} is not text within its size limit`);
+        }
+        entries.push([name, text]);
+    }
+    return sortedRecord(Object.fromEntries(entries));
+}
+function sortedRecord(input) {
+    return Object.freeze(Object.fromEntries(Object.entries(input).sort(([left], [right]) => compare(left, right))));
+}
+function sortedNames(input, label, pattern, maximum) {
+    if (!Array.isArray(input) || input.length > maximum)
+        invalid(`its ${label} are invalid`);
+    for (const [index, name] of input.entries()) {
+        if (typeof name !== 'string' || !pattern.test(name))
+            invalid(`its ${label} are invalid`);
+        if (index > 0 && compare(input[index - 1], name) >= 0) {
+            invalid(`its ${label} are not sorted and unique`);
+        }
+    }
+    return Object.freeze([...input]);
+}
+/** A calendar date written `YYYY-MM-DD`, as a Worker compatibility date is. */
+function isDate(input) {
+    if (typeof input !== 'string' || !COMPATIBILITY_DATE.test(input))
+        return false;
+    const time = Date.parse(`${input}T00:00:00Z`);
+    return !Number.isNaN(time) && new Date(time).toISOString().slice(0, 10) === input;
+}
+function exact(input, keys) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== keys.length ||
+        keys.some((key) => !Object.hasOwn(input, key))) {
+        invalid(`its members are not exactly ${keys.join(', ')}`);
+    }
+    return input;
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid(reason) {
+    throw new TypeError(`Worker configuration is invalid: ${reason}.`);
+}

package/dist/deployment/worker/content.d.ts

@@ -0,0 +1,38 @@
+/**
+ * One file of a Worker deployment on the wire: its bytes as portable Base64, gzip-compressed when
+ * that is smaller, and their decoded size. The encoding is transport only: every digest and every
+ * upload describes the decoded bytes. Base64 longer than one portable chunk travels in chunks.
+ */
+export type WorkerContentV1 = {
+    readonly encoding: 'identity' | 'gzip';
+    readonly decodedSize: number;
+} & ({
+    readonly contentBase64: string;
+} | {
+    readonly contentBase64Chunks: readonly string[];
+});
+/**
+ * Encode one file for the wire: gzip when that is smaller, identity otherwise. Compression runs
+ * on `CompressionStream`, in Node and in a Worker alike.
+ */
+export declare function encodeWorkerContent(bytes: Uint8Array): Promise<WorkerContentV1>;
+/**
+ * Decode one file from the wire, refusing anything that is not exactly this envelope: canonical
+ * Base64 within `base64Size` characters (chunks of at most one portable chunk each), a declared
+ * size within `limit`, and a gzip stream that inflates to exactly that size. Inflation is bounded
+ * by the declared size as it runs, so a high-ratio stream is stopped before it allocates more.
+ */
+export declare function decodeWorkerContent(input: unknown, limits: {
+    readonly size: number;
+    readonly base64Size: number;
+}): Promise<Uint8Array>;
+/** Keep every wire string below Core's portable Value string limit. */
+export declare function portableBase64(bytes: Uint8Array): {
+    readonly contentBase64: string;
+} | {
+    readonly contentBase64Chunks: readonly string[];
+};
+/** Standard Base64 with padding, without Node's `Buffer`. */
+export declare function toBase64(bytes: Uint8Array): string;
+/** Canonical standard Base64 only: the encoding `toBase64` writes for the same bytes. */
+export declare function fromBase64(encoded: string): Uint8Array<ArrayBuffer>;

package/dist/deployment/worker/content.js

@@ -0,0 +1,169 @@
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+/** Gzip's header and trailer cost twenty bytes: smaller files are never worth compressing. */
+const GZIP_THRESHOLD = 64;
+/** The compressed bytes fed to the inflater at a time, so an overflow is caught early. */
+const INFLATE_CHUNK = 4 * 1024;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/u;
+/**
+ * Encode one file for the wire: gzip when that is smaller, identity otherwise. Compression runs
+ * on `CompressionStream`, in Node and in a Worker alike.
+ */
+export async function encodeWorkerContent(bytes) {
+    const compressed = bytes.byteLength < GZIP_THRESHOLD ? undefined : await gzip(bytes);
+    const smaller = compressed !== undefined && compressed.byteLength < bytes.byteLength;
+    return Object.freeze({
+        encoding: smaller ? 'gzip' : 'identity',
+        decodedSize: bytes.byteLength,
+        ...portableBase64(smaller ? compressed : bytes),
+    });
+}
+/**
+ * Decode one file from the wire, refusing anything that is not exactly this envelope: canonical
+ * Base64 within `base64Size` characters (chunks of at most one portable chunk each), a declared
+ * size within `limit`, and a gzip stream that inflates to exactly that size. Inflation is bounded
+ * by the declared size as it runs, so a high-ratio stream is stopped before it allocates more.
+ */
+export async function decodeWorkerContent(input, limits) {
+    const value = record(input);
+    const chunked = Object.hasOwn(value, 'contentBase64Chunks');
+    exact(value, ['encoding', 'decodedSize', chunked ? 'contentBase64Chunks' : 'contentBase64']);
+    const { encoding, decodedSize } = value;
+    if (encoding !== 'identity' && encoding !== 'gzip')
+        invalid('its encoding is unknown');
+    if (!Number.isSafeInteger(decodedSize) || decodedSize < 0) {
+        invalid('its decoded size is invalid');
+    }
+    if (decodedSize > limits.size)
+        invalid('it exceeds its size limit');
+    const encoded = joined(value, chunked, limits.base64Size);
+    const bytes = fromBase64(encoded);
+    if (encoding === 'gzip')
+        return inflate(bytes, decodedSize);
+    if (bytes.byteLength !== decodedSize)
+        invalid('it differs from its declared size');
+    return bytes;
+}
+/** Keep every wire string below Core's portable Value string limit. */
+export function portableBase64(bytes) {
+    const encoded = toBase64(bytes);
+    const size = WORKER_DEPLOYMENT_LIMITS.base64ChunkSize;
+    if (encoded.length <= size)
+        return Object.freeze({ contentBase64: encoded });
+    const chunks = [];
+    for (let offset = 0; offset < encoded.length; offset += size) {
+        chunks.push(encoded.slice(offset, offset + size));
+    }
+    return Object.freeze({ contentBase64Chunks: Object.freeze(chunks) });
+}
+/** Standard Base64 with padding, without Node's `Buffer`. */
+export function toBase64(bytes) {
+    let binary = '';
+    for (let offset = 0; offset < bytes.byteLength; offset += 0x8000) {
+        binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
+    }
+    return btoa(binary);
+}
+/** Canonical standard Base64 only: the encoding `toBase64` writes for the same bytes. */
+export function fromBase64(encoded) {
+    if (encoded.length % 4 !== 0 || !BASE64.test(encoded))
+        invalid('it is not canonical Base64');
+    let binary;
+    try {
+        binary = atob(encoded);
+    }
+    catch {
+        invalid('it is not canonical Base64');
+    }
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    if (btoa(binary) !== encoded)
+        invalid('it is not canonical Base64');
+    return bytes;
+}
+function joined(value, chunked, maximum) {
+    if (!chunked) {
+        const text = value.contentBase64;
+        if (typeof text !== 'string' || text.length > maximum)
+            invalid('its Base64 is too long');
+        return text;
+    }
+    const chunks = value.contentBase64Chunks;
+    const size = WORKER_DEPLOYMENT_LIMITS.base64ChunkSize;
+    if (!Array.isArray(chunks) || chunks.length === 0 || chunks.length > Math.ceil(maximum / size)) {
+        invalid('its Base64 chunks are invalid');
+    }
+    let length = 0;
+    for (const chunk of chunks) {
+        if (typeof chunk !== 'string' || chunk.length === 0 || chunk.length > size) {
+            invalid('its Base64 chunks are invalid');
+        }
+        length += chunk.length;
+    }
+    if (length > maximum)
+        invalid('its Base64 is too long');
+    return chunks.join('');
+}
+async function gzip(bytes) {
+    const stream = new Blob([bytes])
+        .stream()
+        .pipeThrough(new CompressionStream('gzip'));
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+async function inflate(bytes, decodedSize) {
+    // Preallocate only the admitted size and copy as bytes arrive: never collect an unbounded inflate.
+    const decoded = new Uint8Array(decodedSize);
+    let offset = 0;
+    const source = new ReadableStream({
+        pull(controller) {
+            if (offset === bytes.byteLength) {
+                controller.close();
+                return;
+            }
+            const end = Math.min(offset + INFLATE_CHUNK, bytes.byteLength);
+            controller.enqueue(bytes.subarray(offset, end));
+            offset = end;
+        },
+    }, { highWaterMark: 0 });
+    const reader = source.pipeThrough(new DecompressionStream('gzip')).getReader();
+    let written = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            if (value.byteLength > decodedSize - written)
+                invalid('it exceeds its declared size');
+            decoded.set(value, written);
+            written += value.byteLength;
+        }
+    }
+    catch (cause) {
+        await reader.cancel(cause).catch(() => undefined);
+        if (cause instanceof TypeError && cause.message.startsWith(PREFIX))
+            throw cause;
+        throw new TypeError(`${PREFIX} its gzip stream is invalid.`, { cause });
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (written !== decodedSize)
+        invalid('it differs from its declared size');
+    return decoded;
+}
+const PREFIX = 'Worker deployment content is invalid:';
+function record(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('it is not an object');
+    }
+    return input;
+}
+function exact(value, keys) {
+    const own = Reflect.ownKeys(value);
+    if (own.length !== keys.length || keys.some((key) => !Object.hasOwn(value, key))) {
+        invalid('its members are not exactly encoding, decodedSize and its Base64');
+    }
+}
+function invalid(reason) {
+    throw new TypeError(`${PREFIX} ${reason}.`);
+}

package/dist/deployment/worker/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `@astrale-os/sdk/deployment/worker` — the contract of a Worker host (Admin's Services), agnostic
+ * of what the Worker serves: an Astrale Domain release, or any Cloudflare Worker (a cron job, an
+ * API). A deployment is one Worker release in the Service of a project and an environment:
+ *
+ * - its code (`WorkerCode`): modules, a main module, static assets, and the build manifest members
+ *   its deployer declares; `workerBuildDigest` identifies it, and its host binds that digest as
+ *   `ASTRALE_BUILD_DIGEST`;
+ * - its configuration (`WorkerConfigurationV1`): the Workers runtime, plain variables, the names of
+ *   its secrets, and what it asks of its host (`record`, `signingIdentity`, `router`);
+ * - its label, `<service>-<content>` (`workerDeploymentAddress`): the Service name derives from the
+ *   project and environment, the content from the two digests, so the same release reuses its
+ *   deployment;
+ * - its record (`WorkerRecord`): opaque bytes and a media type its host serves verbatim at
+ *   `/.well-known/astrale/deployment.json`;
+ * - readiness paths its host probes before activation, and secret values it never stores.
+ *
+ * `encodeWorkerDeploymentRequest` builds the request a deployer sends, and
+ * `decodeWorkerDeploymentRequest` admits it as a host does; the response decoders admit what a
+ * host answers.
+ */
+export { PROJECT_NAME, serviceName, workerDeploymentLabel } from './address.js';
+export { acceptWorkerCode, WORKER_BUILD_MANIFEST, workerBuildDigest, workerBuildManifest, type WorkerAsset, type WorkerBuildManifest, type WorkerCode, type WorkerModule, type WorkerModuleKind, } from './build.js';
+export { acceptWorkerConfiguration, isWorkerConfiguration, WORKER_BINDING_NAME, WORKER_CONFIGURATION_FORMAT, WORKER_CONFIGURATION_VERSION, WORKER_HOST_BINDINGS, workerConfiguration, workerConfigurationDigest, type WorkerConfigurationInput, type WorkerConfigurationV1, } from './configuration.js';
+export { decodeWorkerContent, encodeWorkerContent, type WorkerContentV1 } from './content.js';
+export { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+export { acceptWorkerRecord, decodeWorkerRecord, encodeWorkerRecord, sameWorkerRecord, WORKER_RECORD_PATH, type WorkerRecord, type WorkerRecordWireV1, } from './record.js';
+export { decodeWorkerDeploymentRequest, encodeWorkerDeploymentRequest, WORKER_DEPLOYMENT_REQUEST_FORMAT, WORKER_DEPLOYMENT_REQUEST_VERSION, workerDeploymentAddress, WorkerDeploymentRefusal, type WorkerCodeWireV1, type WorkerDeployment, type WorkerDeploymentAddress, type WorkerDeploymentInput, type WorkerDeploymentRequestV1, } from './request.js';
+export { decodeWorkerDeploymentList, decodeWorkerDeploymentResponse, decodeWorkerDeploymentSummary, decodeWorkerHosting, WORKER_DEPLOYMENT_REJECTIONS, type WorkerDeploymentListRequestV1, type WorkerDeploymentRejection, type WorkerDeploymentRejectionReason, type WorkerDeploymentResponseV1, type WorkerDeploymentResult, type WorkerDeploymentState, type WorkerDeploymentSummary, type WorkerDeploymentSummaryV1, type WorkerHostingV1, } from './response.js';

package/dist/deployment/worker/index.js

@@ -0,0 +1,29 @@
+/**
+ * `@astrale-os/sdk/deployment/worker` — the contract of a Worker host (Admin's Services), agnostic
+ * of what the Worker serves: an Astrale Domain release, or any Cloudflare Worker (a cron job, an
+ * API). A deployment is one Worker release in the Service of a project and an environment:
+ *
+ * - its code (`WorkerCode`): modules, a main module, static assets, and the build manifest members
+ *   its deployer declares; `workerBuildDigest` identifies it, and its host binds that digest as
+ *   `ASTRALE_BUILD_DIGEST`;
+ * - its configuration (`WorkerConfigurationV1`): the Workers runtime, plain variables, the names of
+ *   its secrets, and what it asks of its host (`record`, `signingIdentity`, `router`);
+ * - its label, `<service>-<content>` (`workerDeploymentAddress`): the Service name derives from the
+ *   project and environment, the content from the two digests, so the same release reuses its
+ *   deployment;
+ * - its record (`WorkerRecord`): opaque bytes and a media type its host serves verbatim at
+ *   `/.well-known/astrale/deployment.json`;
+ * - readiness paths its host probes before activation, and secret values it never stores.
+ *
+ * `encodeWorkerDeploymentRequest` builds the request a deployer sends, and
+ * `decodeWorkerDeploymentRequest` admits it as a host does; the response decoders admit what a
+ * host answers.
+ */
+export { PROJECT_NAME, serviceName, workerDeploymentLabel } from './address.js';
+export { acceptWorkerCode, WORKER_BUILD_MANIFEST, workerBuildDigest, workerBuildManifest, } from './build.js';
+export { acceptWorkerConfiguration, isWorkerConfiguration, WORKER_BINDING_NAME, WORKER_CONFIGURATION_FORMAT, WORKER_CONFIGURATION_VERSION, WORKER_HOST_BINDINGS, workerConfiguration, workerConfigurationDigest, } from './configuration.js';
+export { decodeWorkerContent, encodeWorkerContent } from './content.js';
+export { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+export { acceptWorkerRecord, decodeWorkerRecord, encodeWorkerRecord, sameWorkerRecord, WORKER_RECORD_PATH, } from './record.js';
+export { decodeWorkerDeploymentRequest, encodeWorkerDeploymentRequest, WORKER_DEPLOYMENT_REQUEST_FORMAT, WORKER_DEPLOYMENT_REQUEST_VERSION, workerDeploymentAddress, WorkerDeploymentRefusal, } from './request.js';
+export { decodeWorkerDeploymentList, decodeWorkerDeploymentResponse, decodeWorkerDeploymentSummary, decodeWorkerHosting, WORKER_DEPLOYMENT_REJECTIONS, } from './response.js';

package/dist/deployment/worker/limits.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The bounds of one Worker deployment on the wire and once decoded. A host refuses a request past
+ * any of them before it reads or writes anything; a deployer refuses one before it sends it.
+ */
+export declare const WORKER_DEPLOYMENT_LIMITS: Readonly<{
+    /** Every wire string stays below Core's portable Value string limit. */
+    base64ChunkSize: number;
+    /** The Base64 of one module, chunks joined. */
+    moduleBase64Size: number;
+    /** The Base64 of one asset, chunks joined. */
+    assetBase64Size: number;
+    /** The decoded bytes of one module. */
+    moduleSize: number;
+    /** The decoded bytes of one asset. */
+    assetSize: number;
+    /** The decoded bytes of every module and asset of one Worker together. */
+    workerSize: number;
+    modules: 40;
+    assets: 2000;
+    /** The bytes of one deployment record. */
+    recordSize: number;
+    /** The canonical JSON bytes of the build manifest members a deployer declares. */
+    manifestSize: number;
+    vars: 128;
+    /** The UTF-16 length of one variable or secret value. */
+    valueLength: number;
+    secrets: 64;
+    compatibilityFlags: 64;
+    readinessPaths: 8;
+}>;

package/dist/deployment/worker/limits.js

@@ -0,0 +1,30 @@
+/**
+ * The bounds of one Worker deployment on the wire and once decoded. A host refuses a request past
+ * any of them before it reads or writes anything; a deployer refuses one before it sends it.
+ */
+export const WORKER_DEPLOYMENT_LIMITS = Object.freeze({
+    /** Every wire string stays below Core's portable Value string limit. */
+    base64ChunkSize: 512 * 1024,
+    /** The Base64 of one module, chunks joined. */
+    moduleBase64Size: 10 * 1024 * 1024,
+    /** The Base64 of one asset, chunks joined. */
+    assetBase64Size: 16 * 1024 * 1024,
+    /** The decoded bytes of one module. */
+    moduleSize: ((10 * 1024 * 1024) / 4) * 3,
+    /** The decoded bytes of one asset. */
+    assetSize: ((16 * 1024 * 1024) / 4) * 3,
+    /** The decoded bytes of every module and asset of one Worker together. */
+    workerSize: 32 * 1024 * 1024,
+    modules: 40,
+    assets: 2_000,
+    /** The bytes of one deployment record. */
+    recordSize: 64 * 1024,
+    /** The canonical JSON bytes of the build manifest members a deployer declares. */
+    manifestSize: 4 * 1024,
+    vars: 128,
+    /** The UTF-16 length of one variable or secret value. */
+    valueLength: 64 * 1024,
+    secrets: 64,
+    compatibilityFlags: 64,
+    readinessPaths: 8,
+});

package/dist/deployment/worker/record.d.ts

@@ -0,0 +1,29 @@
+/** Where a Worker host serves a deployment's record, which the deployment itself never answers. */
+export declare const WORKER_RECORD_PATH = "/.well-known/astrale/deployment.json";
+/**
+ * The record a deployer publishes for one deployment: opaque bytes and their media type. Its host
+ * serves it verbatim at `WORKER_RECORD_PATH`, immutable, and never reads it: what it says is the
+ * deployer's (a Domain deployer publishes its `DeploymentRecordV1`). A deployment keeps the record
+ * it was created with.
+ */
+export interface WorkerRecord {
+    /** A media type, served verbatim as the record's `content-type`. */
+    readonly contentType: string;
+    /** One to `WORKER_DEPLOYMENT_LIMITS.recordSize` bytes. */
+    readonly bytes: Uint8Array;
+}
+/** One record on the wire: its media type and its bytes as canonical Base64. */
+export interface WorkerRecordWireV1 {
+    readonly contentType: string;
+    readonly contentBase64: string;
+}
+/** Admit one record: a media type a response can carry as written, and bounded bytes. */
+export declare function acceptWorkerRecord(input: WorkerRecord): WorkerRecord;
+/** Whether two records are the same publication: the same media type and the same bytes. */
+export declare function sameWorkerRecord(left: WorkerRecord, right: WorkerRecord): boolean;
+/** Whether `input` is a media type a record may carry, exactly as it will be served. */
+export declare function isMediaType(input: unknown): input is string;
+/** One record on the wire. */
+export declare function encodeWorkerRecord(record: WorkerRecord): WorkerRecordWireV1;
+/** Decode one record from the wire: exactly a media type and canonical Base64 of bounded bytes. */
+export declare function decodeWorkerRecord(input: unknown): WorkerRecord;