@sanoma-ai/connector-cloudflare 0.6.1 → 0.6.2

package/dist/fake.d.ts

@@ -1,6 +1,7 @@
+import type { AppBundle } from "@sanoma-ai/app";
 import { type FakeOptions } from "@sanoma-ai/workflows/fake";
 import { host } from "./connector.ts";
-import { type Application, type ReadBinding, type ZoneRecord } from "./ops.ts";
+import { type Application, type HyperdriveOrigin, type ReadBinding, type ZoneRecord } from "./ops.ts";
 /** A `GET /wake` a container answered: when. */
 export interface FakeWake {
     at: Date;
@@ -21,6 +22,12 @@ export type StartContainer = (input: {
 export interface FakeCloudflareOptions extends FakeOptions {
     /** What a container runs. Default: a stub that answers `/healthz` 200 and `/wake` 204. */
     start?: StartContainer;
+    /**
+     * The app bundle a container's worker builds at a revision, which its port's
+     * `/__sanoma/app-bundle` answers (202 on the first ask, as the runtime's route does). Default:
+     * `stubAppBundle`.
+     */
+    bundle?: (revision: string) => AppBundle;
     /** The zones the account holds, by name. Default: every one asked for, as a sandbox's account holds its domains. */
     zones?: readonly string[];
 }
@@ -37,8 +44,14 @@ export interface FakeCloudflareState extends Record<string, unknown> {
         images: Record<string, string>;
         main_module?: string;
         modules?: string[];
+        compatibility_flags?: string[];
         assets?: Record<string, string>;
     }>;
+    /** The account's Hyperdrive configs, by id: each one's name and its origin, its password left out. */
+    hyperdrives: Record<string, {
+        name: string;
+        origin: Omit<HyperdriveOrigin, "password">;
+    }>;
     /** The account's assets, by hash: the type each was uploaded with (the content is not kept). */
     assets: Record<string, string>;
     /** The container applications, by id. */
@@ -58,27 +71,40 @@ export interface FakeCloudflareState extends Record<string, unknown> {
     /** Each zone's DNS records, by the zone's name: any set's, and any added by hand (a test's). */
     dns: Record<string, ZoneRecord[]>;
 }
+/**
+ * The app bundle the fake's containers build unless it is given `bundle`: one main module and one
+ * asset. Its fetch answers `/healthz`, an asset from `ASSETS`, a POST by having the host start the
+ * worker (as a page that queues a run does), and any other page with the revision it was built at
+ * (`x-sanoma-revision`) and the visitor's address it was given (`x-sanoma-client-ip`); a 500
+ * without its `DATABASE` binding. Not the app's own bundle: that one is a build for `workerd`
+ * (`nodejs_compat`, its wasm modules), which Node cannot import.
+ */
+export declare function stubAppBundle(revision: string): AppBundle;
 /**
  * An in-memory Cloudflare account for tests, as the API answers: Workers in `state.scripts`,
- * container applications in `state.applications`, the images copied into its registry in
- * `state.images` (nothing is pulled), their custom domains in `state.domains` (every zone held
- * unless `zones` names them), each zone's DNS records in `state.dns`, by the zone's name (a batch
- * is all or nothing: an identical record or one beside a CNAME fails it whole), and the account's
- * workers.dev URLs served in
- * this process, one server on a port of this machine per Worker name (a name with no Worker
- * answers workers.dev's 404). Each Worker runs the package's own object code
- * (`worker/instance.js`) over a `ctx` in this process: its container runs `start`'s runtime
- * (the image and the revision label it was started at, the Worker's text bindings as its
- * environment), its storage is in memory, and its alarm rings on a timer, again after a throw.
- * An upload restarts the object over the new bindings and images, its container, storage and
- * alarm kept: a new image starts the container again at the next request, as the object finds its
- * label changed. `copyImage` pins its copy by a made-up digest, and `prepareImage` answers ready
- * for an image pinned in the account's registry. An assets upload session asks for the hashes
- * `state.assets` lacks, in one bucket, and an upload that redeems its completion jwt keeps each
- * path's hash on the Worker (`state.scripts[…].assets`); the Worker's requests still go to its
- * object, as the fake runs no sites bundle. `stop(name)` stops a company's
- * container as ten quiet minutes would, `fire()` rings every alarm now, `wakes()` lists the
- * `/wake`s the containers answered, `close()` (and `reset()`) stops everything.
+ * container applications in `state.applications`, Hyperdrive configs in `state.hyperdrives`
+ * (their passwords left out), the images copied into its registry in `state.images` (nothing is
+ * pulled), their custom domains in `state.domains` (every zone held unless `zones` names them),
+ * each zone's DNS records in `state.dns`, by the zone's name (a batch is all or nothing: an
+ * identical record or one beside a CNAME fails it whole), and the account's workers.dev URLs
+ * served in this process, one server on a port of this machine per Worker name (a name with no
+ * Worker answers workers.dev's 404).
+ *
+ * Each Worker runs the package's own code (`worker/instance.js`): its fetch (`serve`) over the
+ * upload's `app/index.js`, written to a folder and imported (the placeholder of a create's first
+ * uploads, then the bundle's main module, `stubAppBundle` unless `bundle` says), its `DATABASE`
+ * the config's direct URL, its `ASSETS` the uploaded contents; and its object over a `ctx` in this
+ * process: its container runs `start`'s runtime (the image and the revision label it was started
+ * at, the Worker's text bindings as its environment), its port's `/__sanoma/app-bundle` answers
+ * `bundle`'s as the runtime's route does, SIGTERM stops the runtime, its storage is in memory, and
+ * its alarm rings on a timer, again after a throw. An upload restarts the object over the new
+ * bindings and images, its container, storage and alarm kept: the object finds the labels changed
+ * at the next start, and drains and replaces it. `copyImage` pins its copy by a made-up digest,
+ * and `prepareImage` answers ready for an image pinned in the account's registry. An assets upload
+ * session asks for the hashes `state.assets` lacks, in one bucket, and an upload that redeems its
+ * completion jwt keeps each path's hash on the Worker (`state.scripts[…].assets`). `stop(name)`
+ * stops a company's container as ten quiet minutes would, `fire()` rings every alarm now,
+ * `wakes()` lists the `/wake`s the containers answered, `close()` (and `reset()`) stops everything.
  */
 export declare function fakeCloudflare(options?: FakeCloudflareOptions): import("@sanoma-ai/workflows/fake").Fake<FakeCloudflareState, import("@sanoma-ai/workflows").OpIdOf<"cloudflare", {
     host: (typeof host)["ops"];

package/dist/fake.js

@@ -1,13 +1,27 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { DriverError, errorMessage, retryableStatus } from "@sanoma-ai/workflows";
 import { defineFake } from "@sanoma-ai/workflows/fake";
+import { APP_BUNDLE_HEADER, APP_BUNDLE_PATH } from "@sanoma-ai/workflows/shared";
 import { NodeRequest, sendNodeResponse } from "srvx/node";
+import { Instance, serve } from "../worker/instance.js";
 import { caaContent, cloudflareOps, host } from "./connector.js";
+import { OBJECT_CLASS } from "./deploy.js";
 import { alarmOps, containerOps, inZone, scriptOf, } from "./ops.js";
 import { recordsOps } from "./records.js";
 import { accountImage, accountPinned, pinImage } from "./registry.js";
-import { Instance, OBJECT_CLASS, worker } from "./worker.js";
 /** The fake account's id, which its registry's references name: the fixtures' made-up one. */
 const FAKE_ACCOUNT = "0123456789abcdef0123456789abcdef";
 /** The named sizes `start` takes under the policy: `basic` is not one of them (the runtime refuses it, as it did live on 2026-10-28). */
@@ -35,6 +49,8 @@ function dnsRecordOf(zone, { type, name, ttl, comment, proxied, content, priorit
         proxied,
     };
 }
+/** A Hyperdrive config's origin as a database URL: what the fake's `DATABASE` binding gives. */
+const connectionString = ({ scheme, user, password, host: at, port, database }) => `${scheme}://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${at}:${port}/${encodeURIComponent(database)}`;
 /** workers.dev's answer for a name with no Worker behind it. */
 const nothingHere = () => new Response("<!doctype html><title>There is nothing here yet</title>", {
     status: 404,
@@ -60,6 +76,57 @@ const stubContainer = async () => {
         stop: () => new Promise((done) => server.close(() => done())),
     };
 };
+const b64 = (text) => Buffer.from(text).toString("base64");
+/**
+ * The app bundle the fake's containers build unless it is given `bundle`: one main module and one
+ * asset. Its fetch answers `/healthz`, an asset from `ASSETS`, a POST by having the host start the
+ * worker (as a page that queues a run does), and any other page with the revision it was built at
+ * (`x-sanoma-revision`) and the visitor's address it was given (`x-sanoma-client-ip`); a 500
+ * without its `DATABASE` binding. Not the app's own bundle: that one is a build for `workerd`
+ * (`nodejs_compat`, its wasm modules), which Node cannot import.
+ */
+export function stubAppBundle(revision) {
+    const main = `const REVISION = ${JSON.stringify(revision)};
+export default {
+  async fetch(request, env, ctx, host) {
+    if (typeof env.DATABASE?.connectionString !== "string") return new Response("no DATABASE binding\\n", { status: 500 });
+    const url = new URL(request.url);
+    if (url.pathname === "/healthz") return new Response("ok\\n");
+    if (url.pathname.startsWith("/assets/")) return env.ASSETS.fetch(request);
+    if (request.method === "POST") {
+      ctx.waitUntil(host.startNow());
+      return new Response(null, { status: 202 });
+    }
+    return new Response(\`<!doctype html><title>\${REVISION}</title>\\n\`, {
+      headers: {
+        "content-type": "text/html",
+        "x-sanoma-revision": REVISION,
+        "x-sanoma-client-ip": request.headers.get("x-sanoma-client-ip") ?? "",
+      },
+    });
+  },
+};
+`;
+    const asset = b64("console.log('sanoma');\n");
+    return {
+        version: revision,
+        mainModule: "index.js",
+        modules: [{ name: "index.js", type: "esm", content: b64(main) }],
+        assets: [
+            {
+                path: "/assets/app.js",
+                content: asset,
+                hash: createHash("sha256").update(`${asset}js`).digest("hex").slice(0, 32),
+                size: Buffer.byteLength(asset, "base64"),
+            },
+        ],
+        compatibilityDate: "2026-10-01",
+        compatibilityFlags: ["nodejs_compat"],
+        prerendered: [],
+    };
+}
+/** An answer of the runtime's app-bundle route, marked as the route's. */
+const bundleAnswer = (status, body) => Response.json(body, { status, headers: { [APP_BUNDLE_HEADER]: "1" } });
 /**
  * One Durable Object of a Worker, in this process: the `ctx` `worker/instance.js` runs over
  * (`ctx.container` running `start`'s runtime, `ctx.storage` in memory, one alarm on a timer),
@@ -67,7 +134,7 @@ const stubContainer = async () => {
  * `images` are the ones the Worker's last upload named, by name; `source` names the image a
  * pinned one was copied from, or nothing when no application runs behind the object.
  */
-function fakeObject(start, images, source, started) {
+function fakeObject(start, bundle, images, source, started) {
     const storage = new Map();
     let running;
     let alarm;
@@ -82,6 +149,21 @@ function fakeObject(start, images, source, started) {
         running = undefined;
         await was?.runtime.then((runtime) => runtime.stop(), () => undefined);
     };
+    /** The runtime's own `/__sanoma/app-bundle`, as the worker port answers it (`appBundleRoute`). */
+    const bundleRoute = (request, mine) => {
+        const token = mine.token;
+        if (!token || request.headers.get("authorization") !== `Bearer ${token}`) {
+            return bundleAnswer(401, { error: "the token is not this instance's SANOMA_WAKEUP_TOKEN" });
+        }
+        const revision = new URL(request.url).searchParams.get("revision") ?? "";
+        if (!revision)
+            return bundleAnswer(400, { error: "revision must be a commit id (?revision=<sha>)" });
+        if (!mine.built.has(revision)) {
+            mine.built.add(revision);
+            return bundleAnswer(202, { building: revision });
+        }
+        return bundleAnswer(200, bundle(revision));
+    };
     /** Runs `work` as a request to the object: the container's inactivity counts from the last one's end. */
     const active = async (work) => {
         open++;
@@ -152,7 +234,14 @@ function fakeObject(start, images, source, started) {
                     started.push(made);
                     return made;
                 });
-                const mine = { runtime, image, labels: { ...labels }, port: Number(env.PORT) };
+                const mine = {
+                    runtime,
+                    image,
+                    labels: { ...labels },
+                    port: Number(env.PORT),
+                    ...(env.SANOMA_WAKEUP_TOKEN && { token: env.SANOMA_WAKEUP_TOKEN }),
+                    built: new Set(),
+                };
                 running = mine;
                 // A runtime that does not start leaves no container, as a failed start does.
                 runtime.catch(() => {
@@ -163,6 +252,21 @@ function fakeObject(start, images, source, started) {
             inspect: async () => (running ? { image: running.image, labels: { ...running.labels } } : null),
             // A runtime that does not start is a container that ended; one that runs never does here.
             monitor: () => (running ? running.runtime.then(() => new Promise(() => { })) : Promise.resolve()),
+            // The worker's own stop: it drains and exits, and the container with it.
+            signal(signal) {
+                if (signal !== 15)
+                    throw new TypeError(`the fake sends SIGTERM (15) alone, not ${signal}`);
+                const was = running;
+                if (!was)
+                    return;
+                void was.runtime
+                    .then((runtime) => runtime.stop())
+                    .catch(() => undefined)
+                    .finally(() => {
+                    if (running === was)
+                        running = undefined;
+                });
+            },
             destroy,
             getTcpPort: (port) => ({
                 async fetch(input, init) {
@@ -170,9 +274,12 @@ function fakeObject(start, images, source, started) {
                         throw new Error("the container is not running");
                     if (port !== running.port)
                         throw new Error(`nothing listens on port ${port} in the container`);
-                    const runtime = await running.runtime;
+                    const mine = running;
+                    const runtime = await mine.runtime;
                     const request = new Request(input, init);
                     const { pathname, search } = new URL(request.url);
+                    if (pathname === APP_BUNDLE_PATH)
+                        return bundleRoute(request, mine);
                     const headers = new Headers(request.headers);
                     for (const name of HOP)
                         headers.delete(name);
@@ -236,52 +343,109 @@ function fakeObject(start, images, source, started) {
 }
 /**
  * An in-memory Cloudflare account for tests, as the API answers: Workers in `state.scripts`,
- * container applications in `state.applications`, the images copied into its registry in
- * `state.images` (nothing is pulled), their custom domains in `state.domains` (every zone held
- * unless `zones` names them), each zone's DNS records in `state.dns`, by the zone's name (a batch
- * is all or nothing: an identical record or one beside a CNAME fails it whole), and the account's
- * workers.dev URLs served in
- * this process, one server on a port of this machine per Worker name (a name with no Worker
- * answers workers.dev's 404). Each Worker runs the package's own object code
- * (`worker/instance.js`) over a `ctx` in this process: its container runs `start`'s runtime
- * (the image and the revision label it was started at, the Worker's text bindings as its
- * environment), its storage is in memory, and its alarm rings on a timer, again after a throw.
- * An upload restarts the object over the new bindings and images, its container, storage and
- * alarm kept: a new image starts the container again at the next request, as the object finds its
- * label changed. `copyImage` pins its copy by a made-up digest, and `prepareImage` answers ready
- * for an image pinned in the account's registry. An assets upload session asks for the hashes
- * `state.assets` lacks, in one bucket, and an upload that redeems its completion jwt keeps each
- * path's hash on the Worker (`state.scripts[…].assets`); the Worker's requests still go to its
- * object, as the fake runs no sites bundle. `stop(name)` stops a company's
- * container as ten quiet minutes would, `fire()` rings every alarm now, `wakes()` lists the
- * `/wake`s the containers answered, `close()` (and `reset()`) stops everything.
+ * container applications in `state.applications`, Hyperdrive configs in `state.hyperdrives`
+ * (their passwords left out), the images copied into its registry in `state.images` (nothing is
+ * pulled), their custom domains in `state.domains` (every zone held unless `zones` names them),
+ * each zone's DNS records in `state.dns`, by the zone's name (a batch is all or nothing: an
+ * identical record or one beside a CNAME fails it whole), and the account's workers.dev URLs
+ * served in this process, one server on a port of this machine per Worker name (a name with no
+ * Worker answers workers.dev's 404).
+ *
+ * Each Worker runs the package's own code (`worker/instance.js`): its fetch (`serve`) over the
+ * upload's `app/index.js`, written to a folder and imported (the placeholder of a create's first
+ * uploads, then the bundle's main module, `stubAppBundle` unless `bundle` says), its `DATABASE`
+ * the config's direct URL, its `ASSETS` the uploaded contents; and its object over a `ctx` in this
+ * process: its container runs `start`'s runtime (the image and the revision label it was started
+ * at, the Worker's text bindings as its environment), its port's `/__sanoma/app-bundle` answers
+ * `bundle`'s as the runtime's route does, SIGTERM stops the runtime, its storage is in memory, and
+ * its alarm rings on a timer, again after a throw. An upload restarts the object over the new
+ * bindings and images, its container, storage and alarm kept: the object finds the labels changed
+ * at the next start, and drains and replaces it. `copyImage` pins its copy by a made-up digest,
+ * and `prepareImage` answers ready for an image pinned in the account's registry. An assets upload
+ * session asks for the hashes `state.assets` lacks, in one bucket, and an upload that redeems its
+ * completion jwt keeps each path's hash on the Worker (`state.scripts[…].assets`). `stop(name)`
+ * stops a company's container as ten quiet minutes would, `fire()` rings every alarm now,
+ * `wakes()` lists the `/wake`s the containers answered, `close()` (and `reset()`) stops everything.
  */
 export function fakeCloudflare(options = {}) {
     const start = options.start ?? stubContainer;
+    const bundle = options.bundle ?? stubAppBundle;
     const servers = new Map();
     const objects = new Map();
-    /** Each Worker's env: its bindings' text, the secrets' with it, which the state does not keep. */
-    const envs = new Map();
+    /**
+     * Each Worker as its last upload runs it: its env (its bindings' text, the secrets' with it,
+     * which the state does not keep, its database, assets and object), and its app, the upload's
+     * `app/index.js` imported from a folder of its own on the first request.
+     */
+    const workers = new Map();
+    /** Where each upload's modules are written, to be imported as files. */
+    let uploads;
+    /** Each Hyperdrive config's database URL, which the state does not keep: its password is in it. */
+    const databases = new Map();
+    /** The assets' contents, by hash, which the state does not keep. */
+    const contents = new Map();
     const started = [];
     /** The open assets upload sessions, by jwt: the Worker's name, its manifest and the hashes still to upload. */
     const sessions = new Map();
     /** The completion jwts an upload may redeem: the Worker's name and its manifest, each path's hash. */
     const completed = new Map();
-    /** The request to the Worker named `script`, as workers.dev passes it on. */
-    const dispatch = async (state, script, request) => {
-        const env = envs.get(script);
-        if (!env || !state.scripts[script]?.subdomain)
+    /** The asset of the Worker named `script` at the request's path, if its last upload has one. */
+    const assetOf = (state, script, request) => {
+        const hash = state.scripts[script]?.assets?.[new URL(request.url).pathname];
+        const found = hash === undefined ? undefined : contents.get(hash);
+        return found && new Response(found.content, { headers: { "content-type": found.contentType } });
+    };
+    /**
+     * The request to the Worker named `script`, as workers.dev passes it on: a path under
+     * `/assets/` its assets have straight from them (`run_worker_first`), anything else to the
+     * Worker script's fetch (`serve`, the package's own) over its last upload, with Cloudflare's
+     * `cf-connecting-ip` set from the visitor's address.
+     */
+    const dispatch = async (state, script, request, visitor = "127.0.0.1") => {
+        const worker = workers.get(script);
+        if (!worker || !state.scripts[script]?.subdomain)
             return nothingHere();
-        return worker.fetch(request, env);
+        if (new URL(request.url).pathname.startsWith("/assets/")) {
+            const asset = assetOf(state, script, request);
+            if (asset)
+                return asset;
+        }
+        const headers = new Headers(request.headers);
+        headers.set("cf-connecting-ip", visitor);
+        const ctx = {
+            waitUntil: (promise) => void promise.catch((err) => console.warn(`cloudflare fake: a waitUntil threw: ${errorMessage(err)}`)),
+        };
+        return serve(new Request(request, { headers }), worker.env, ctx, worker.loadApp);
+    };
+    /** Writes an upload's modules to a folder of their own: the app is imported from there. */
+    const written = (modules) => {
+        uploads ??= mkdtempSync(join(tmpdir(), "sanoma-cloudflare-fake-"));
+        const dir = mkdtempSync(join(uploads, "upload-"));
+        for (const { name, content } of modules.filter((m) => m.name.startsWith("app/"))) {
+            const file = join(dir, name);
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(file, content);
+        }
+        let app;
+        return () => (app ??= import(__rewriteRelativeImportExtension(pathToFileURL(join(dir, "app", "index.js")).href)));
+    };
+    /** A Hyperdrive config written: its origin in the state without the password, its URL beside it. */
+    const keep = (state, id, name, origin) => {
+        const { password: _password, ...shown } = origin;
+        (state.hyperdrives ??= {})[id] = { name, origin: shown };
+        databases.set(id, connectionString(origin));
     };
     const scriptAt = (url) => [...servers].find(([, s]) => s.url === new URL(url).origin)?.[0];
     /** The Worker name's URL: a server of its own, made at the first ask, which outlives the Worker as workers.dev's name does. */
-    const serve = async (state, script) => {
+    const listenAt = async (state, script) => {
         const found = servers.get(script);
         if (found)
             return found.url;
         const server = createServer((req, res) => {
-            void dispatch(state, script, new NodeRequest({ req, res })).then((answer) => sendNodeResponse(res, answer), (err) => {
+            // Made from its parts: undici's Request cannot copy the server's own request.
+            const { method, url, headers, body } = new NodeRequest({ req, res });
+            const request = new Request(url, { method, headers, body, duplex: "half" });
+            void dispatch(state, script, request, req.socket.remoteAddress).then((answer) => sendNodeResponse(res, answer), (err) => {
                 if (res.headersSent)
                     return void res.destroy();
                 res.writeHead(500, { "content-type": "text/plain" }).end(`${errorMessage(err)}\n`);
@@ -308,13 +472,15 @@ export function fakeCloudflare(options = {}) {
         };
         const recordsOf = (zoneId) => state.dns[zoneNamed(zoneId)] ?? [];
         return {
-            workerUrl: (script) => serve(state, script),
+            workerUrl: (script) => listenAt(state, script),
             async bindings(script) {
                 return structuredClone(state.scripts[script]?.bindings);
             },
-            async upload(script, { modules, main_module, bindings, containers, migrations, assets }) {
+            async upload(script, { modules, main_module, bindings, containers, migrations, assets, compatibility_flags }) {
                 if (!modules.some((m) => m.name === main_module))
                     throw fail(400, 10021, `no module named ${main_module}`);
+                if (!modules.some((m) => m.name === "app/index.js"))
+                    throw fail(400, 10021, "no module named app/index.js");
                 const redeemed = assets && completed.get(assets.jwt);
                 if (assets && redeemed?.script !== script) {
                     throw fail(400, 10203, "the assets' completion jwt is not one this Worker's upload session gave");
@@ -343,10 +509,22 @@ export function fakeCloudflare(options = {}) {
                             }),
                         };
                     }
-                    else if (binding.type !== "assets")
+                    else if (binding.type === "hyperdrive") {
+                        const url = databases.get(binding.id);
+                        if (url === undefined)
+                            throw fail(400, 10021, `no Hyperdrive config ${binding.id}`);
+                        // The direct URL: Hyperdrive's pooled one is Cloudflare's own.
+                        env[binding.name] = { connectionString: url };
+                    }
+                    else if (binding.type === "assets") {
+                        env[binding.name] = {
+                            fetch: async (request) => assetOf(state, script, request) ?? new Response(null, { status: 404 }),
+                        };
+                    }
+                    else
                         env[binding.name] = binding.text;
                 }
-                envs.set(script, env);
+                workers.set(script, { env, loadApp: written(modules) });
                 // The namespace the first upload made, kept across uploads as Cloudflare keeps it.
                 const namespace_id = state.scripts[script]?.bindings.find((b) => b.namespace_id)?.namespace_id ?? nextId();
                 state.scripts[script] = {
@@ -354,17 +532,18 @@ export function fakeCloudflare(options = {}) {
                         ? { type, name }
                         : type === "durable_object_namespace"
                             ? { type, name, namespace_id }
-                            : { type, name, ...("text" in rest && { text: rest.text }) }),
+                            : { type, name, ...("text" in rest && { text: rest.text }), ...("id" in rest && { id: rest.id }) }),
                     subdomain: state.scripts[script]?.subdomain ?? false,
                     images: { ...runs.images },
                     main_module,
                     modules: modules.map((m) => m.name),
+                    ...(compatibility_flags.length > 0 && { compatibility_flags: [...compatibility_flags] }),
                     ...(redeemed && { assets: { ...redeemed.manifest } }),
                 };
                 if (assets)
                     completed.delete(assets.jwt);
                 const object = objects.get(script) ??
-                    fakeObject(start, () => state.scripts[script]?.images ?? {}, (image) => appOf(script) && (state.images[image] ?? image), started);
+                    fakeObject(start, bundle, () => state.scripts[script]?.images ?? {}, (image) => appOf(script) && (state.images[image] ?? image), started);
                 objects.set(script, object);
                 object.restart(new Instance(object.ctx, env));
             },
@@ -374,9 +553,30 @@ export function fakeCloudflare(options = {}) {
                     throw fail(404, 10007, `workers/scripts/${script}: This Worker does not exist on your account.`);
                 found.subdomain = true;
             },
+            async hyperdrive(name) {
+                const id = Object.entries(state.hyperdrives ?? {}).find(([, config]) => config.name === name)?.[0];
+                return id === undefined ? undefined : { id };
+            },
+            async createHyperdrive(name, origin) {
+                if (Object.values((state.hyperdrives ??= {})).some((config) => config.name === name)) {
+                    throw fail(409, 2017, `hyperdrive/configs: a configuration named ${name} exists`);
+                }
+                const id = nextId();
+                keep(state, id, name, origin);
+                return { id };
+            },
+            async updateHyperdrive(id, name, origin) {
+                if (!state.hyperdrives?.[id])
+                    throw fail(404, 2005, `hyperdrive/configs/${id}: not found`);
+                keep(state, id, name, origin);
+            },
+            async deleteHyperdrive(id) {
+                delete state.hyperdrives?.[id];
+                databases.delete(id);
+            },
             async deleteScript(script) {
                 delete state.scripts[script];
-                envs.delete(script);
+                workers.delete(script);
                 await objects.get(script)?.remove();
                 objects.delete(script);
             },
@@ -496,10 +696,11 @@ export function fakeCloudflare(options = {}) {
                 const session = sessions.get(jwt);
                 if (!session)
                     throw fail(401, 10000, "workers/assets/upload: the jwt is no open upload session's");
-                for (const { hash, contentType } of files) {
+                for (const { hash, base64, contentType } of files) {
                     if (!session.missing.delete(hash))
                         throw fail(400, 10203, `workers/assets/upload: ${hash} is not asked for`);
                     (state.assets ??= {})[hash] = contentType;
+                    contents.set(hash, { content: Buffer.from(base64, "base64"), contentType });
                 }
                 if (session.missing.size)
                     return undefined;
@@ -521,6 +722,7 @@ export function fakeCloudflare(options = {}) {
             seq: 0,
             scripts: {},
             assets: {},
+            hyperdrives: {},
             applications: {},
             images: {},
             zones: {},
@@ -539,7 +741,12 @@ export function fakeCloudflare(options = {}) {
         for (const object of objects.values())
             await object.remove();
         objects.clear();
-        envs.clear();
+        workers.clear();
+        databases.clear();
+        contents.clear();
+        if (uploads)
+            rmSync(uploads, { recursive: true, force: true });
+        uploads = undefined;
         sessions.clear();
         completed.clear();
         for (const { server } of servers.values()) {