@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.41

package/dist/deployment/worker/index.js

@@ -0,0 +1,29 @@
+/**
+ * `@astrale-os/sdk/deployment/worker` — the contract of a Worker host (Admin's Services), agnostic
+ * of what the Worker serves: an Astrale Domain release, or any Cloudflare Worker (a cron job, an
+ * API). A deployment is one Worker release in the Service of a project and an environment:
+ *
+ * - its code (`WorkerCode`): modules, a main module, static assets, and the build manifest members
+ *   its deployer declares; `workerBuildDigest` identifies it, and its host binds that digest as
+ *   `ASTRALE_BUILD_DIGEST`;
+ * - its configuration (`WorkerConfigurationV1`): the Workers runtime, plain variables, the names of
+ *   its secrets, and what it asks of its host (`record`, `signingIdentity`, `router`);
+ * - its label, `<service>-<content>` (`workerDeploymentAddress`): the Service name derives from the
+ *   project and environment, the content from the two digests, so the same release reuses its
+ *   deployment;
+ * - its record (`WorkerRecord`): opaque bytes and a media type its host serves verbatim at
+ *   `/.well-known/astrale/deployment.json`;
+ * - readiness paths its host probes before activation, and secret values it never stores.
+ *
+ * `encodeWorkerDeploymentRequest` builds the request a deployer sends, and
+ * `decodeWorkerDeploymentRequest` admits it as a host does; the response decoders admit what a
+ * host answers.
+ */
+export { PROJECT_NAME, serviceName, workerDeploymentLabel } from './address.js';
+export { acceptWorkerCode, WORKER_BUILD_MANIFEST, workerBuildDigest, workerBuildManifest, } from './build.js';
+export { acceptWorkerConfiguration, isWorkerConfiguration, WORKER_BINDING_NAME, WORKER_CONFIGURATION_FORMAT, WORKER_CONFIGURATION_VERSION, WORKER_HOST_BINDINGS, workerConfiguration, workerConfigurationDigest, } from './configuration.js';
+export { decodeWorkerContent, encodeWorkerContent } from './content.js';
+export { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+export { acceptWorkerRecord, decodeWorkerRecord, encodeWorkerRecord, sameWorkerRecord, WORKER_RECORD_PATH, } from './record.js';
+export { decodeWorkerDeploymentRequest, encodeWorkerDeploymentRequest, WORKER_DEPLOYMENT_REQUEST_FORMAT, WORKER_DEPLOYMENT_REQUEST_VERSION, workerDeploymentAddress, WorkerDeploymentRefusal, } from './request.js';
+export { decodeWorkerDeploymentList, decodeWorkerDeploymentResponse, decodeWorkerDeploymentSummary, decodeWorkerHosting, WORKER_DEPLOYMENT_REJECTIONS, } from './response.js';

package/dist/deployment/worker/limits.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The bounds of one Worker deployment on the wire and once decoded. A host refuses a request past
+ * any of them before it reads or writes anything; a deployer refuses one before it sends it.
+ */
+export declare const WORKER_DEPLOYMENT_LIMITS: Readonly<{
+    /** Every wire string stays below Core's portable Value string limit. */
+    base64ChunkSize: number;
+    /** The Base64 of one module, chunks joined. */
+    moduleBase64Size: number;
+    /** The Base64 of one asset, chunks joined. */
+    assetBase64Size: number;
+    /** The decoded bytes of one module. */
+    moduleSize: number;
+    /** The decoded bytes of one asset. */
+    assetSize: number;
+    /** The decoded bytes of every module and asset of one Worker together. */
+    workerSize: number;
+    modules: 40;
+    assets: 2000;
+    /** The bytes of one deployment record. */
+    recordSize: number;
+    /** The canonical JSON bytes of the build manifest members a deployer declares. */
+    manifestSize: number;
+    vars: 128;
+    /** The UTF-16 length of one variable or secret value. */
+    valueLength: number;
+    secrets: 64;
+    compatibilityFlags: 64;
+    readinessPaths: 8;
+}>;

package/dist/deployment/worker/limits.js

@@ -0,0 +1,30 @@
+/**
+ * The bounds of one Worker deployment on the wire and once decoded. A host refuses a request past
+ * any of them before it reads or writes anything; a deployer refuses one before it sends it.
+ */
+export const WORKER_DEPLOYMENT_LIMITS = Object.freeze({
+    /** Every wire string stays below Core's portable Value string limit. */
+    base64ChunkSize: 512 * 1024,
+    /** The Base64 of one module, chunks joined. */
+    moduleBase64Size: 10 * 1024 * 1024,
+    /** The Base64 of one asset, chunks joined. */
+    assetBase64Size: 16 * 1024 * 1024,
+    /** The decoded bytes of one module. */
+    moduleSize: ((10 * 1024 * 1024) / 4) * 3,
+    /** The decoded bytes of one asset. */
+    assetSize: ((16 * 1024 * 1024) / 4) * 3,
+    /** The decoded bytes of every module and asset of one Worker together. */
+    workerSize: 32 * 1024 * 1024,
+    modules: 40,
+    assets: 2_000,
+    /** The bytes of one deployment record. */
+    recordSize: 64 * 1024,
+    /** The canonical JSON bytes of the build manifest members a deployer declares. */
+    manifestSize: 4 * 1024,
+    vars: 128,
+    /** The UTF-16 length of one variable or secret value. */
+    valueLength: 64 * 1024,
+    secrets: 64,
+    compatibilityFlags: 64,
+    readinessPaths: 8,
+});

package/dist/deployment/worker/record.d.ts

@@ -0,0 +1,29 @@
+/** Where a Worker host serves a deployment's record, which the deployment itself never answers. */
+export declare const WORKER_RECORD_PATH = "/.well-known/astrale/deployment.json";
+/**
+ * The record a deployer publishes for one deployment: opaque bytes and their media type. Its host
+ * serves it verbatim at `WORKER_RECORD_PATH`, immutable, and never reads it: what it says is the
+ * deployer's (a Domain deployer publishes its `DeploymentRecordV1`). A deployment keeps the record
+ * it was created with.
+ */
+export interface WorkerRecord {
+    /** A media type, served verbatim as the record's `content-type`. */
+    readonly contentType: string;
+    /** One to `WORKER_DEPLOYMENT_LIMITS.recordSize` bytes. */
+    readonly bytes: Uint8Array;
+}
+/** One record on the wire: its media type and its bytes as canonical Base64. */
+export interface WorkerRecordWireV1 {
+    readonly contentType: string;
+    readonly contentBase64: string;
+}
+/** Admit one record: a media type a response can carry as written, and bounded bytes. */
+export declare function acceptWorkerRecord(input: WorkerRecord): WorkerRecord;
+/** Whether two records are the same publication: the same media type and the same bytes. */
+export declare function sameWorkerRecord(left: WorkerRecord, right: WorkerRecord): boolean;
+/** Whether `input` is a media type a record may carry, exactly as it will be served. */
+export declare function isMediaType(input: unknown): input is string;
+/** One record on the wire. */
+export declare function encodeWorkerRecord(record: WorkerRecord): WorkerRecordWireV1;
+/** Decode one record from the wire: exactly a media type and canonical Base64 of bounded bytes. */
+export declare function decodeWorkerRecord(input: unknown): WorkerRecord;

package/dist/deployment/worker/record.js

@@ -0,0 +1,69 @@
+import { fromBase64, toBase64 } from './content.js';
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+/** Where a Worker host serves a deployment's record, which the deployment itself never answers. */
+export const WORKER_RECORD_PATH = '/.well-known/astrale/deployment.json';
+const TOKEN = "[A-Za-z0-9!#$%&'*+.^_`|~-]+";
+/** `type/subtype` and `;name=value` parameters (token or quoted value), at most 256 characters. */
+const MEDIA_TYPE = new RegExp(`^${TOKEN}/${TOKEN}(?:[ \\t]*;[ \\t]*${TOKEN}=(?:${TOKEN}|"[\\x20\\x21\\x23-\\x5b\\x5d-\\x7e]*"))*$`, 'u');
+const MAXIMUM_MEDIA_TYPE_LENGTH = 256;
+/** Admit one record: a media type a response can carry as written, and bounded bytes. */
+export function acceptWorkerRecord(input) {
+    if (input === null || typeof input !== 'object')
+        invalid('it is not an object');
+    if (!isMediaType(input.contentType))
+        invalid('its content type is not a media type');
+    if (!(input.bytes instanceof Uint8Array))
+        invalid('its bytes are not bytes');
+    if (input.bytes.byteLength === 0 ||
+        input.bytes.byteLength > WORKER_DEPLOYMENT_LIMITS.recordSize) {
+        invalid('its size is outside its limit');
+    }
+    return Object.freeze({ contentType: input.contentType, bytes: input.bytes });
+}
+/** Whether two records are the same publication: the same media type and the same bytes. */
+export function sameWorkerRecord(left, right) {
+    if (left.contentType !== right.contentType)
+        return false;
+    if (left.bytes.byteLength !== right.bytes.byteLength)
+        return false;
+    return left.bytes.every((byte, index) => byte === right.bytes[index]);
+}
+/** Whether `input` is a media type a record may carry, exactly as it will be served. */
+export function isMediaType(input) {
+    return (typeof input === 'string' && input.length <= MAXIMUM_MEDIA_TYPE_LENGTH && MEDIA_TYPE.test(input));
+}
+/** One record on the wire. */
+export function encodeWorkerRecord(record) {
+    const admitted = acceptWorkerRecord(record);
+    return Object.freeze({
+        contentType: admitted.contentType,
+        contentBase64: toBase64(admitted.bytes),
+    });
+}
+/** Decode one record from the wire: exactly a media type and canonical Base64 of bounded bytes. */
+export function decodeWorkerRecord(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== 2 ||
+        !Object.hasOwn(input, 'contentType') ||
+        !Object.hasOwn(input, 'contentBase64')) {
+        invalid('its members are not exactly contentType and contentBase64');
+    }
+    const { contentType, contentBase64 } = input;
+    if (typeof contentBase64 !== 'string' ||
+        contentBase64.length > Math.ceil(WORKER_DEPLOYMENT_LIMITS.recordSize / 3) * 4) {
+        invalid('its Base64 is invalid');
+    }
+    let bytes;
+    try {
+        bytes = fromBase64(contentBase64);
+    }
+    catch (cause) {
+        throw new TypeError('Worker record is invalid: its Base64 is invalid.', { cause });
+    }
+    return acceptWorkerRecord({ contentType: contentType, bytes });
+}
+function invalid(reason) {
+    throw new TypeError(`Worker record is invalid: ${reason}.`);
+}

package/dist/deployment/worker/request.d.ts

@@ -0,0 +1,118 @@
+import type { Digest } from '@astrale-os/kernel-protocol/artifact';
+import type { WorkerBuildManifest, WorkerCode, WorkerModule } from './build.js';
+import type { WorkerConfigurationV1 } from './configuration.js';
+import type { WorkerContentV1 } from './content.js';
+import type { WorkerRecord, WorkerRecordWireV1 } from './record.js';
+export declare const WORKER_DEPLOYMENT_REQUEST_FORMAT = "astrale.worker.deployment-request";
+export declare const WORKER_DEPLOYMENT_REQUEST_VERSION = 1;
+/**
+ * `WorkerDeploymentRequestV1`: one Worker release to host as a deployment of the Service of its
+ * project and environment. Its host knows nothing of what the Worker serves: it recomputes the
+ * build digest from the uploaded bytes and the label from the Service name, the build and the
+ * configuration, and refuses a request that states another (`build-mismatch`,
+ * `address-mismatch`), so a deployer that predicted an address is never served elsewhere. Its
+ * `secrets` are bound to a new deployment, or rewritten in place on the reused one, and never
+ * stored; a host never journals the request.
+ */
+export interface WorkerDeploymentRequestV1 {
+    readonly format: typeof WORKER_DEPLOYMENT_REQUEST_FORMAT;
+    readonly version: typeof WORKER_DEPLOYMENT_REQUEST_VERSION;
+    /**
+     * The Identity that owns the Service when this deploy creates it: the caller, or one it acts as.
+     * The caller when absent; an existing Service keeps its owner.
+     */
+    readonly owner?: string;
+    /** Any project name (`PROJECT_NAME`); a Domain deployer names its Domain's origin. */
+    readonly project: string;
+    readonly environment: string;
+    /** `<service>-<content>`, as `workerDeploymentAddress` derives it. */
+    readonly label: string;
+    /** The build digest of `worker`, as `workerBuildDigest` derives it. */
+    readonly buildDigest: string;
+    readonly configuration: WorkerConfigurationV1;
+    readonly worker: WorkerCodeWireV1;
+    /** Exactly when `configuration.record`: the record the deployment serves. */
+    readonly record?: WorkerRecordWireV1;
+    /**
+     * Local paths that must answer 200 with the deployment's `x-astrale-worker-version` before the
+     * deployment is activated; none when absent. A probe is not part of the configuration.
+     */
+    readonly readiness?: readonly string[];
+    /** The secret values, exactly the names `configuration.secrets` declares. */
+    readonly secrets: Readonly<Record<string, string>>;
+    /** Whether the Service serves the deployment once it is active; `true` when absent. */
+    readonly promote?: boolean;
+}
+/** The code of one Worker on the wire, each file in its content envelope. */
+export interface WorkerCodeWireV1 {
+    readonly manifest: WorkerBuildManifest;
+    readonly mainModule: string;
+    readonly modules: readonly {
+        readonly name: string;
+        readonly kind: WorkerModule['kind'];
+        readonly content: WorkerContentV1;
+    }[];
+    readonly assets?: readonly {
+        readonly path: string;
+        readonly contentType?: string;
+        readonly content: WorkerContentV1;
+    }[];
+}
+/** One Worker deployment as its deployer describes it, before its address is derived. */
+export interface WorkerDeploymentInput {
+    readonly owner?: string;
+    readonly project: string;
+    readonly environment: string;
+    readonly worker: WorkerCode;
+    readonly configuration: WorkerConfigurationV1;
+    readonly record?: WorkerRecord;
+    readonly readiness?: readonly string[];
+    readonly secrets?: Readonly<Record<string, string>>;
+    readonly promote?: boolean;
+}
+/** Where one Worker deployment is addressed: its Service, its digests and its label. */
+export interface WorkerDeploymentAddress {
+    readonly service: string;
+    readonly buildDigest: Digest;
+    readonly configurationDigest: Digest;
+    readonly label: string;
+}
+/** One Worker deployment as a host admitted it: decoded, digested and addressed. */
+export interface WorkerDeployment extends WorkerDeploymentAddress {
+    readonly owner?: string;
+    readonly project: string;
+    readonly environment: string;
+    readonly worker: WorkerCode;
+    readonly configuration: WorkerConfigurationV1;
+    readonly record?: WorkerRecord;
+    readonly readiness: readonly string[];
+    readonly secrets: Readonly<Record<string, string>>;
+    readonly promote: boolean;
+}
+/** Why a host refuses a Worker deployment request before reading or writing anything. */
+export declare class WorkerDeploymentRefusal extends Error {
+    readonly reason: 'invalid-deployment' | 'build-mismatch' | 'address-mismatch';
+    readonly name = "WorkerDeploymentRefusal";
+    constructor(reason: 'invalid-deployment' | 'build-mismatch' | 'address-mismatch', message: string, options?: ErrorOptions);
+}
+/** The address one Worker deployment gets: its Service's name, its two digests and its label. */
+export declare function workerDeploymentAddress(input: {
+    readonly project: string;
+    readonly environment: string;
+    readonly worker: WorkerCode;
+    readonly configuration: WorkerConfigurationV1;
+}): WorkerDeploymentAddress;
+/**
+ * Encode one Worker deployment as its request: its address derived, every file in its content
+ * envelope. A deployment its host would refuse as invalid is refused here, before any call.
+ */
+export declare function encodeWorkerDeploymentRequest(input: WorkerDeploymentInput): Promise<WorkerDeploymentRequestV1>;
+/**
+ * Decode and admit one Worker deployment request, as a host does before any graph or provider
+ * effect: exactly this request shape, every file decoded within its bounds and the Worker's, the
+ * configuration canonical, the record exactly when the configuration asks for one, the secrets
+ * exactly the names it declares. Then the build digest is recomputed from the decoded bytes
+ * (`build-mismatch` when the request states another) and the label from the Service name, that
+ * digest and the configuration (`address-mismatch`). Every refusal is a `WorkerDeploymentRefusal`.
+ */
+export declare function decodeWorkerDeploymentRequest(input: unknown): Promise<WorkerDeployment>;

package/dist/deployment/worker/request.js

@@ -0,0 +1,280 @@
+import { serviceName, workerDeploymentLabel } from './address.js';
+import { acceptWorkerCode, workerBuildDigest } from './build.js';
+import { acceptWorkerConfiguration, workerConfigurationDigest } from './configuration.js';
+import { decodeWorkerContent, encodeWorkerContent } from './content.js';
+import { WORKER_DEPLOYMENT_LIMITS } from './limits.js';
+import { acceptWorkerRecord, decodeWorkerRecord, encodeWorkerRecord } from './record.js';
+export const WORKER_DEPLOYMENT_REQUEST_FORMAT = 'astrale.worker.deployment-request';
+export const WORKER_DEPLOYMENT_REQUEST_VERSION = 1;
+/** Why a host refuses a Worker deployment request before reading or writing anything. */
+export class WorkerDeploymentRefusal extends Error {
+    reason;
+    name = 'WorkerDeploymentRefusal';
+    constructor(reason, message, options) {
+        super(message, options);
+        this.reason = reason;
+    }
+}
+/** The address one Worker deployment gets: its Service's name, its two digests and its label. */
+export function workerDeploymentAddress(input) {
+    const service = serviceName(input.project, input.environment);
+    const buildDigest = workerBuildDigest(input.worker);
+    const configurationDigest = workerConfigurationDigest(input.configuration);
+    return Object.freeze({
+        service,
+        buildDigest,
+        configurationDigest,
+        label: workerDeploymentLabel({ service, buildDigest, configurationDigest }),
+    });
+}
+/**
+ * Encode one Worker deployment as its request: its address derived, every file in its content
+ * envelope. A deployment its host would refuse as invalid is refused here, before any call.
+ */
+export async function encodeWorkerDeploymentRequest(input) {
+    const deployment = admitDeployment(input);
+    const { worker } = deployment;
+    const modules = await Promise.all(worker.modules.map(async (module) => Object.freeze({
+        name: module.name,
+        kind: module.kind,
+        content: await encodeWorkerContent(module.bytes),
+    })));
+    const assets = await Promise.all((worker.assets ?? []).map(async (asset) => Object.freeze({
+        path: asset.path,
+        ...(asset.contentType === undefined ? {} : { contentType: asset.contentType }),
+        content: await encodeWorkerContent(asset.bytes),
+    })));
+    return Object.freeze({
+        format: WORKER_DEPLOYMENT_REQUEST_FORMAT,
+        version: WORKER_DEPLOYMENT_REQUEST_VERSION,
+        ...(deployment.owner === undefined ? {} : { owner: deployment.owner }),
+        project: deployment.project,
+        environment: deployment.environment,
+        label: deployment.label,
+        buildDigest: deployment.buildDigest,
+        configuration: deployment.configuration,
+        worker: Object.freeze({
+            manifest: worker.manifest,
+            mainModule: worker.mainModule,
+            modules: Object.freeze(modules),
+            ...(assets.length === 0 ? {} : { assets: Object.freeze(assets) }),
+        }),
+        ...(deployment.record === undefined ? {} : { record: encodeWorkerRecord(deployment.record) }),
+        ...(deployment.readiness.length === 0 ? {} : { readiness: deployment.readiness }),
+        secrets: deployment.secrets,
+        ...(input.promote === undefined ? {} : { promote: input.promote }),
+    });
+}
+/**
+ * Decode and admit one Worker deployment request, as a host does before any graph or provider
+ * effect: exactly this request shape, every file decoded within its bounds and the Worker's, the
+ * configuration canonical, the record exactly when the configuration asks for one, the secrets
+ * exactly the names it declares. Then the build digest is recomputed from the decoded bytes
+ * (`build-mismatch` when the request states another) and the label from the Service name, that
+ * digest and the configuration (`address-mismatch`). Every refusal is a `WorkerDeploymentRefusal`.
+ */
+export async function decodeWorkerDeploymentRequest(input) {
+    let deployment;
+    let stated;
+    try {
+        const value = exact(input, [
+            'format',
+            'version',
+            'project',
+            'environment',
+            'label',
+            'buildDigest',
+            'configuration',
+            'worker',
+            'secrets',
+        ], ['owner', 'record', 'readiness', 'promote'], 'request');
+        if (value.format !== WORKER_DEPLOYMENT_REQUEST_FORMAT ||
+            value.version !== WORKER_DEPLOYMENT_REQUEST_VERSION) {
+            throw new TypeError('The request is not a WorkerDeploymentRequestV1.');
+        }
+        stated = { buildDigest: value.buildDigest, label: value.label };
+        deployment = admitDeployment({
+            ...(value.owner === undefined ? {} : { owner: value.owner }),
+            project: value.project,
+            environment: value.environment,
+            worker: await decodeCode(value.worker),
+            configuration: value.configuration,
+            ...(value.record === undefined ? {} : { record: decodeWorkerRecord(value.record) }),
+            ...(value.readiness === undefined ? {} : { readiness: value.readiness }),
+            secrets: value.secrets,
+            ...(value.promote === undefined ? {} : { promote: value.promote }),
+        });
+    }
+    catch (cause) {
+        if (!(cause instanceof TypeError))
+            throw cause;
+        throw new WorkerDeploymentRefusal('invalid-deployment', cause.message, { cause });
+    }
+    if (stated.buildDigest !== deployment.buildDigest) {
+        throw new WorkerDeploymentRefusal('build-mismatch', `The uploaded Worker has build digest ${deployment.buildDigest}, not ${quoted(stated.buildDigest)}.`);
+    }
+    if (stated.label !== deployment.label) {
+        throw new WorkerDeploymentRefusal('address-mismatch', `This release of this Service is deployed at ${deployment.label}, not ${quoted(stated.label)}.`);
+    }
+    return deployment;
+}
+/** A stated value as a refusal names it: short printable text as written, anything else not. */
+function quoted(value) {
+    return typeof value === 'string' && value.length <= 80 && !/[\p{Cc}]/u.test(value)
+        ? value
+        : 'the one stated';
+}
+/** Admit the decoded parts of one deployment and derive its address. */
+function admitDeployment(input) {
+    if (input === null || typeof input !== 'object')
+        invalid('it is not an object');
+    const configuration = acceptWorkerConfiguration(input.configuration);
+    const worker = acceptWorkerCode(input.worker);
+    const secrets = acceptSecrets(input.secrets ?? {}, configuration.secrets);
+    if ((input.record !== undefined) !== configuration.record) {
+        invalid(configuration.record
+            ? 'its configuration serves a record it does not carry'
+            : 'it carries a record its configuration does not serve');
+    }
+    const record = input.record === undefined ? undefined : acceptWorkerRecord(input.record);
+    const readiness = acceptReadiness(input.readiness ?? []);
+    if (input.owner !== undefined && !isText(input.owner, 256))
+        invalid('its owner is invalid');
+    if (input.promote !== undefined && typeof input.promote !== 'boolean') {
+        invalid('its promote option is not a boolean');
+    }
+    const address = workerDeploymentAddress({
+        project: input.project,
+        environment: input.environment,
+        worker,
+        configuration,
+    });
+    return Object.freeze({
+        ...address,
+        ...(input.owner === undefined ? {} : { owner: input.owner }),
+        project: input.project,
+        environment: input.environment,
+        worker,
+        configuration,
+        ...(record === undefined ? {} : { record }),
+        readiness,
+        secrets,
+        promote: input.promote ?? true,
+    });
+}
+/** Exactly the declared secret names, each value bounded text. */
+function acceptSecrets(input, declared) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('its secrets are not an object');
+    }
+    const names = Reflect.ownKeys(input);
+    if (names.length !== declared.length ||
+        names.some((name) => typeof name !== 'string' || !declared.includes(name))) {
+        invalid('its secrets are not exactly the names its configuration declares');
+    }
+    for (const name of declared) {
+        if (typeof input[name] !== 'string' ||
+            input[name].length > WORKER_DEPLOYMENT_LIMITS.valueLength) {
+            invalid(`secret ${name} is not text within its size limit`);
+        }
+    }
+    return Object.freeze(Object.fromEntries(declared.map((name) => [name, input[name]])));
+}
+/**
+ * Readiness paths: at most `readinessPaths` distinct canonical local paths, never a host, a query,
+ * credentials or a redirect destination.
+ */
+function acceptReadiness(input) {
+    if (!Array.isArray(input) ||
+        input.length > WORKER_DEPLOYMENT_LIMITS.readinessPaths ||
+        new Set(input).size !== input.length) {
+        invalid('its readiness paths are invalid');
+    }
+    for (const path of input) {
+        if (typeof path !== 'string' ||
+            path.length > 1_024 ||
+            !/^\/(?:[A-Za-z0-9._~-]+\/)*[A-Za-z0-9._~-]*$/u.test(path) ||
+            path.split('/').some((part) => part === '.' || part === '..')) {
+            invalid('its readiness paths are not canonical local paths');
+        }
+    }
+    return Object.freeze([...input]);
+}
+/** Decode the code of one Worker, each file within its bounds and all within the Worker's. */
+async function decodeCode(input) {
+    const value = exact(input, ['manifest', 'mainModule', 'modules'], ['assets'], 'worker');
+    const limits = WORKER_DEPLOYMENT_LIMITS;
+    if (!Array.isArray(value.modules) || value.modules.length > limits.modules) {
+        invalid('its modules are invalid');
+    }
+    if (value.assets !== undefined &&
+        (!Array.isArray(value.assets) || value.assets.length > limits.assets)) {
+        invalid('its assets are invalid');
+    }
+    let remaining = limits.workerSize;
+    const decode = async (content, size, base64Size) => {
+        const bytes = await decodeWorkerContent(content, {
+            size: Math.min(size, remaining),
+            base64Size,
+        });
+        remaining -= bytes.byteLength;
+        return bytes;
+    };
+    const modules = [];
+    for (const entry of value.modules) {
+        const module = exact(entry, ['name', 'kind', 'content'], [], 'module');
+        modules.push({
+            name: module.name,
+            kind: module.kind,
+            bytes: await decode(module.content, limits.moduleSize, limits.moduleBase64Size),
+        });
+    }
+    const assets = [];
+    for (const entry of (value.assets ?? [])) {
+        const asset = exact(entry, ['path', 'content'], ['contentType'], 'asset');
+        if (asset.contentType !== undefined && !isText(asset.contentType, 256)) {
+            invalid('an asset content type is invalid');
+        }
+        assets.push({
+            path: asset.path,
+            bytes: await decode(asset.content, limits.assetSize, limits.assetBase64Size),
+            ...(asset.contentType === undefined ? {} : { contentType: asset.contentType }),
+        });
+    }
+    return {
+        manifest: value.manifest,
+        mainModule: value.mainModule,
+        modules,
+        ...(assets.length === 0 ? {} : { assets }),
+    };
+}
+function isText(value, maximum) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= maximum &&
+        !/[\p{Cc}]/u.test(value));
+}
+function exact(input, required, optional, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid(`its ${label} is not an object`);
+    }
+    for (const key of Reflect.ownKeys(input)) {
+        if (typeof key !== 'string' || (!required.includes(key) && !optional.includes(key))) {
+            invalid(`its ${label} has an unknown member ${String(key)}`);
+        }
+    }
+    const value = input;
+    for (const key of required) {
+        if (!Object.hasOwn(value, key))
+            invalid(`its ${label} has no ${key}`);
+    }
+    for (const key of optional) {
+        if (Object.hasOwn(value, key) && value[key] === undefined) {
+            invalid(`its ${label} has an undefined ${key}`);
+        }
+    }
+    return value;
+}
+function invalid(reason) {
+    throw new TypeError(`Worker deployment is invalid: ${reason}.`);
+}