@sekiban/dcb-cloudflare 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,90 @@
+Elastic License 2.0
+
+Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor. Any use of the licensor's trademarks is subject to
+applicable law.
+
+Patents
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license under any patent claims the
+licensor can license, or becomes able to license, to make, have made, use,
+sell, offer for sale, import and have imported the software. This license does
+not cover any patent claims that you cause to be infringed by modifications or
+additions to the software.
+
+If you or your company make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license for the software
+granted under these terms ends immediately. If your company makes such a
+claim, your patent license ends immediately for work on behalf of your company.
+
+Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+this license.
+
+Termination
+
+If you use the software in violation of these terms, your license is not
+licensed, and your licenses will automatically terminate. If the licensor
+provides you with a notice of your violation, and you cease all violation of
+the license no later than 30 days after your receipt of the notice, your
+licenses will be reinstated retroactively. However, if you violate these terms
+after such reinstatement, any additional violation of these terms will cause
+your licenses to terminate automatically and permanently.
+
+No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable for any damages arising out of
+these terms or the use or nature of the software, under any kind of legal
+claim.
+
+Definitions
+
+The licensor is the entity offering these terms, including any portion of the
+software.
+
+you refers to the individual or entity agreeing to these terms.
+
+your company is any legal entity, sole proprietorship, or other entity that
+has control over, is under the control of, or is under common control with
+that organization.
+
+control means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+
+your licenses are all the licenses granted to you under these terms.
+
+use means anything requiring one of your licenses.
+
+trademark means trademarks, service marks, or trade names.

package/README.md

@@ -1,3 +1,49 @@
-# Temporary Holding Version
+# @sekiban/dcb-cloudflare
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Optional helper for callers who already have a Worker and want Sekiban storage beside it.
+
+This package is not an application, not a matched-set member, and not a hosted service. The caller keeps their routes, authentication, wrangler config, and Worker name. Pass that config to `dcb-cloudflare migrate` and `dcb-cloudflare deploy`.
+
+The default backend is Wrangler. `dcb-cloudflare migrate --config <path> --cli cf`
+is an opt-in remote D1 migration path: it applies each config entry by its real
+UUID `database_id`, honors `migrations_dir` and `migrations_table`, and runs cf
+from the directory containing the config. It does not support `--local`,
+`--env`, extra arguments, or deployment; `--cli cf` is refused for `deploy`.
+The helper passes the caller's environment through, so cf uses its normal
+credential order, including `CLOUDFLARE_API_TOKEN` before OAuth profiles.
+The caller must have cf 1.0.0-beta.5 or a compatible beta installed separately
+and Node 22 or newer. cf is intentionally not a dependency of this package.
+
+`composeFetch` publishes runtime HTTP routes only when the caller supplies `authorize`. The default forward list is the five serialized paths. `queue` and `scheduled` from the runtime and the caller both run, runtime first.
+
+```ts
+import { composeHandlers, requireHandlers } from "@sekiban/dcb-cloudflare";
+import { createCloudflareOnlyRuntimeWorker, type CloudflareOnlyEnv } from "@sekiban/dcb-runtime/cloudflare";
+
+interface Env extends CloudflareOnlyEnv {
+  readonly SDT_SERVICE_ID: string;
+}
+
+const runtime = requireHandlers(createCloudflareOnlyRuntimeWorker({ /* domain, config */ }));
+
+const worker: ExportedHandler<Env> = composeHandlers<Env>({
+  application: { fetch: (request, env, ctx) => new Response("app") },
+  sekiban: {
+    prefix: "/internal/sekiban",
+    fetch: runtime.fetch,
+    authorize: (request) => request.headers.get("authorization") === "Bearer <token>",
+    queue: runtime.queue,
+    scheduled: runtime.scheduled,
+  },
+});
+
+export default worker;
+```
+
+The declarations reference Workers types, so TypeScript consumers install `@cloudflare/workers-types`, include `"@cloudflare/workers-types"` in `compilerOptions.types`, and pass the environment type explicitly at the Worker boundary. The generated starter already does both. `requireHandlers()` bridges `createCloudflareOnlyRuntimeWorker()`'s result, whose handler members are optional in the Workers types.
+
+If `npm view @sekiban/dcb-cloudflare` reports E404, the package has not been published yet; use the repository-checkout alternative. The helper requires `@sekiban/dcb-runtime` 0.2.x, and the generated starter pins 0.2.0.
+
+## License
+
+Elastic License 2.0. See [LICENSE](./LICENSE).

package/dist/cli.js

@@ -0,0 +1,320 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { accessSync, constants, existsSync, readFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { dirname, isAbsolute, join, normalize, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+var CF_HELPER_MARKER = "d1-migrations";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var CF_INSTALL_HINT = "cf executable not found; install cf with `npm i -g cf` or `npm i -D cf` (cf needs node >=22)";
+function parseWranglerConfig(text) {
+  const stripped = text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+  const parsed = JSON.parse(stripped);
+  if (!Array.isArray(parsed.d1_databases) || parsed.d1_databases.length === 0) {
+    throw new Error("no-d1");
+  }
+  if (parsed.account_id !== void 0 && typeof parsed.account_id !== "string") {
+    throw new Error("invalid-account-id");
+  }
+  const d1 = [];
+  for (const entry of parsed.d1_databases) {
+    if (typeof entry !== "object" || entry === null) throw new Error("no-d1");
+    const record = entry;
+    if (typeof record.binding !== "string" || record.binding.length === 0) throw new Error("no-d1");
+    if (typeof record.database_name !== "string" || record.database_name.length === 0) throw new Error("no-d1");
+    if (record.database_id !== void 0 && typeof record.database_id !== "string") throw new Error("invalid-database-id");
+    if (record.migrations_dir !== void 0 && typeof record.migrations_dir !== "string") throw new Error("invalid-migrations-dir");
+    if (record.migrations_table !== void 0 && typeof record.migrations_table !== "string") throw new Error("invalid-migrations-table");
+    d1.push({
+      binding: record.binding,
+      databaseName: record.database_name,
+      ...record.database_id === void 0 ? {} : { databaseId: record.database_id },
+      ...record.migrations_dir === void 0 ? {} : { migrationsDir: record.migrations_dir },
+      ...record.migrations_table === void 0 ? {} : { migrationsTable: record.migrations_table }
+    });
+  }
+  return {
+    d1,
+    ...parsed.account_id === void 0 ? {} : { accountId: parsed.account_id }
+  };
+}
+function option(argv, name) {
+  const index = argv.indexOf(name);
+  if (index < 0) return void 0;
+  const value = argv[index + 1];
+  if (value === void 0 || value.startsWith("--")) throw new Error(`missing value for ${name}`);
+  return value;
+}
+function parseArguments(argv) {
+  const split = argv.indexOf("--");
+  const before = split < 0 ? [...argv] : [...argv.slice(0, split)];
+  const extra = split < 0 ? [] : [...argv.slice(split + 1)];
+  let backend = "wrangler";
+  let cliSeen = false;
+  const flags = [];
+  for (let index = 0; index < before.length; index += 1) {
+    const argument = before[index];
+    if (argument !== "--cli") {
+      flags.push(argument);
+      continue;
+    }
+    if (cliSeen) throw new Error("repeated --cli is not allowed");
+    cliSeen = true;
+    const value = before[index + 1];
+    if (value === void 0 || value.startsWith("--")) throw new Error("--cli requires a value: use --cli wrangler or --cli cf");
+    if (value !== "wrangler" && value !== "cf") throw new Error(`unsupported --cli value ${value}; use wrangler or cf`);
+    backend = value;
+    index += 1;
+  }
+  return { backend, command: flags[0], flags, extra };
+}
+function validateCfArguments(parsed, configPath) {
+  if (parsed.command !== "migrate") throw new Error("--cli cf is supported only for migrate; deploy remains a Wrangler operation");
+  if (configPath === void 0) throw new Error("--cli cf requires --config <path>");
+  if (parsed.extra.length > 0) throw new Error("--cli cf refuses arguments after --");
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = 1; index < parsed.flags.length; index += 1) {
+    const argument = parsed.flags[index];
+    if (!argument.startsWith("--")) throw new Error(`--cli cf refuses unexpected argument ${argument}`);
+    if (seen.has(argument)) throw new Error(`--cli cf refuses repeated flag ${argument}`);
+    seen.add(argument);
+    if (argument !== "--config") {
+      if (argument === "--keep-vars") throw new Error("--cli cf refuses --keep-vars");
+      if (argument === "--local") throw new Error("--cli cf refuses --local; cf local state is not Wrangler's .wrangler/state");
+      if (argument === "--env") throw new Error("--cli cf refuses --env because env blocks can swap databases");
+      throw new Error(`--cli cf refuses ${argument}; only --config and --cli are supported`);
+    }
+    const value = parsed.flags[index + 1];
+    if (value === void 0 || value.startsWith("--")) throw new Error("--config requires a value");
+    index += 1;
+  }
+}
+function migrationDirectory(database) {
+  if (database.migrationsDir !== void 0 && isAbsolute(database.migrationsDir)) return database.migrationsDir;
+  return normalize(database.migrationsDir ?? "migrations");
+}
+function cfDatabaseId(database) {
+  if (database.databaseId === void 0 || !UUID_PATTERN.test(database.databaseId)) {
+    const detail = database.databaseId === void 0 ? "is missing" : `is not a UUID (${database.databaseId})`;
+    throw new Error(`--cli cf requires a real UUID database_id for ${database.binding}; database_id ${detail}; paste the real Cloudflare database ID`);
+  }
+  return database.databaseId;
+}
+function childEnvironment(base, backend, accountId) {
+  const env = { ...base, CI: "true" };
+  if (backend === "cf") {
+    if (accountId !== void 0 && base.CLOUDFLARE_ACCOUNT_ID !== void 0 && base.CLOUDFLARE_ACCOUNT_ID !== accountId) {
+      throw new Error("--cli cf refuses a different pre-set CLOUDFLARE_ACCOUNT_ID than the config account_id");
+    }
+    if (accountId !== void 0) env.CLOUDFLARE_ACCOUNT_ID = accountId;
+    env.SEKIBAN_DCB_CF_HELPER = CF_HELPER_MARKER;
+  } else {
+    delete env.SEKIBAN_DCB_CF_HELPER;
+  }
+  return env;
+}
+function wranglerPlans(config, command, flags, extra) {
+  const configPath = option(flags, "--config");
+  if (configPath === void 0) throw new Error("missing-config");
+  const envName = option(flags, "--env");
+  const local = flags.includes("--local");
+  const keepVars = flags.includes("--keep-vars");
+  if (command === "deploy" && local) throw new Error("deploy-local");
+  const remoteFlag = command === "migrate" && local ? "--local" : "--remote";
+  const envArgs = envName === void 0 ? [] : ["--env", envName];
+  const migrations = config.d1.map((database) => [
+    "wrangler",
+    "d1",
+    "migrations",
+    "apply",
+    database.databaseName,
+    "--config",
+    configPath,
+    remoteFlag,
+    ...envArgs
+  ]);
+  if (command === "migrate") return migrations;
+  return [
+    ...migrations,
+    ["wrangler", "deploy", "--config", configPath, ...envArgs, ...keepVars ? ["--keep-vars"] : [], ...extra]
+  ];
+}
+function cfPlans(config) {
+  return config.d1.map((database) => [
+    "cf",
+    "d1",
+    "migrations",
+    "apply",
+    cfDatabaseId(database),
+    "--dir",
+    migrationDirectory(database),
+    ...database.migrationsTable === void 0 ? [] : ["--table", database.migrationsTable]
+  ]);
+}
+function planCloudflareOperations(argv, configText, options = {}) {
+  const parsed = parseArguments(argv);
+  const command = parsed.command;
+  if (command !== "migrate" && command !== "deploy") throw new Error("usage");
+  const configPath = option(parsed.flags, "--config");
+  if (parsed.backend === "cf") validateCfArguments(parsed, configPath);
+  if (configPath === void 0) throw new Error("missing-config");
+  const config = parseWranglerConfig(configText);
+  const cwd = options.cwd ?? process.cwd();
+  const env = options.env ?? process.env;
+  if (parsed.backend === "cf") {
+    const configDir = dirname(resolve(cwd, configPath));
+    const childEnv2 = childEnvironment(env, "cf", config.accountId);
+    const commands2 = cfPlans(config);
+    return commands2.map((plannedCommand) => ({
+      backend: "cf",
+      plannedCommand,
+      command: plannedCommand,
+      cwd: configDir,
+      env: childEnv2
+    }));
+  }
+  const commands = wranglerPlans(config, command, parsed.flags, parsed.extra);
+  const childEnv = childEnvironment(env, "wrangler");
+  return commands.map((plannedCommand) => ({
+    backend: "wrangler",
+    plannedCommand,
+    command: plannedCommand,
+    cwd,
+    env: childEnv
+  }));
+}
+function planCloudflareCommands(argv, configText, options = {}) {
+  return planCloudflareOperations(argv, configText, options).map((plan) => [...plan.plannedCommand]);
+}
+function executableFile(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pathExecutable(name, env) {
+  const pathValue = env.PATH ?? "";
+  for (const directory of pathValue.split(":").filter((value) => value.length > 0)) {
+    const candidate = join(directory, name);
+    if (executableFile(candidate)) return candidate;
+  }
+  return void 0;
+}
+function resolveCfExecutable(configDir, env) {
+  if (env.CF_BIN !== void 0 && env.CF_BIN.length > 0) return env.CF_BIN;
+  const local = join(configDir, "node_modules", ".bin", "cf");
+  if (existsSync(local)) return local;
+  const fromPath = pathExecutable("cf", env);
+  if (fromPath !== void 0) return fromPath;
+  throw new Error(CF_INSTALL_HINT);
+}
+function oneLine(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim();
+}
+async function executeCloudflareCli(argv, deps) {
+  let configPath;
+  try {
+    configPath = option(parseArguments(argv).flags, "--config");
+  } catch (error) {
+    const message = oneLine(error);
+    (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+    return { exitCode: 1, commands: [] };
+  }
+  if (configPath === void 0) {
+    const message = "missing-config";
+    (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+    return { exitCode: 1, commands: [] };
+  }
+  let configText;
+  try {
+    configText = deps.readText(configPath);
+  } catch {
+    const message = `unable to read config ${configPath}`;
+    (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+    return { exitCode: 1, commands: [] };
+  }
+  let plans;
+  try {
+    plans = planCloudflareOperations(argv, configText, { cwd: deps.cwd, env: deps.env });
+  } catch (error) {
+    const message = oneLine(error);
+    (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+    return { exitCode: 1, commands: [] };
+  }
+  const commands = plans.map((plan) => [...plan.plannedCommand]);
+  for (const plan of plans) {
+    let request;
+    try {
+      request = plan.backend === "cf" ? { command: [resolveCfExecutable(plan.cwd, plan.env), ...plan.command.slice(1)], cwd: plan.cwd, env: plan.env } : { command: plan.command, cwd: plan.cwd, env: plan.env };
+    } catch (error) {
+      const message = oneLine(error);
+      (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+      return { exitCode: 1, commands };
+    }
+    let status;
+    try {
+      status = await deps.spawn(request, plan.backend);
+    } catch (error) {
+      const message = oneLine(error);
+      (deps.stderr ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+      return { exitCode: 1, commands };
+    }
+    if (status !== 0) return { exitCode: status, commands };
+  }
+  return { exitCode: 0, commands };
+}
+function spawnWrangler(request) {
+  const bin = request.env.WRANGLER_BIN;
+  const executable = bin !== void 0 && bin.length > 0 ? bin : "npx";
+  const args = bin !== void 0 && bin.length > 0 ? request.command.slice(1) : ["--no-install", ...request.command];
+  return new Promise((resolveExit) => {
+    const child = spawn(executable, args, {
+      cwd: request.cwd,
+      stdio: "inherit",
+      env: request.env
+    });
+    child.on("close", (code) => resolveExit(code ?? 1));
+    child.on("error", () => resolveExit(1));
+  });
+}
+function spawnCf(request) {
+  return new Promise((resolveExit) => {
+    const child = spawn(request.command[0], request.command.slice(1), {
+      cwd: request.cwd,
+      stdio: "inherit",
+      env: request.env
+    });
+    child.on("close", (code) => resolveExit(code ?? 1));
+    child.on("error", () => {
+      process.stderr.write(`${CF_INSTALL_HINT}
+`);
+      resolveExit(1);
+    });
+  });
+}
+var invokedDirectly = process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly) {
+  const runner = async (request, backend) => backend === "wrangler" ? spawnWrangler(request) : spawnCf(request);
+  const result = await executeCloudflareCli(process.argv.slice(2), {
+    readText: (path) => readFileSync(path, "utf8"),
+    spawn: runner
+  });
+  process.exit(result.exitCode);
+}
+export {
+  executeCloudflareCli,
+  parseWranglerConfig,
+  planCloudflareCommands,
+  planCloudflareOperations,
+  resolveCfExecutable
+};

package/dist/compose.d.ts

@@ -0,0 +1,39 @@
+export declare const SERIALIZED_PATHS: readonly ["/api/sekiban/serialized/commit", "/api/sekiban/serialized/query", "/api/sekiban/serialized/list-query", "/api/sekiban/serialized/tag-latest-sortable", "/api/sekiban/serialized/tag-state"];
+export type IncomingRequest<CfHostMetadata = unknown> = Request<CfHostMetadata, IncomingRequestCfProperties<CfHostMetadata>>;
+export type FetchHandler<Env = unknown, Ctx = ExecutionContext, RequestType extends Request = IncomingRequest> = (request: RequestType, env: Env, ctx: Ctx) => Promise<Response> | Response;
+export type QueueHandler<Env = unknown, Ctx = ExecutionContext, Batch = MessageBatch<unknown>> = (batch: Batch, env: Env, ctx: Ctx) => Promise<void> | void;
+export type ScheduledHandler<Env = unknown, Ctx = ExecutionContext, Controller = ScheduledController> = (controller: Controller, env: Env, ctx: Ctx) => Promise<void> | void;
+export type AuthorizeResult = boolean | Response;
+export type Authorize<RequestType extends Request = IncomingRequest> = (request: RequestType) => AuthorizeResult | Promise<AuthorizeResult>;
+export interface SekibanMount<Env = unknown, Ctx = ExecutionContext, RequestType extends Request = IncomingRequest, Batch = MessageBatch<unknown>, Controller = ScheduledController> {
+    prefix: string;
+    fetch: FetchHandler<Env, Ctx, Request>;
+    authorize: Authorize<RequestType>;
+    extraPaths?: readonly string[];
+    queue?: QueueHandler<Env, Ctx, Batch>;
+    scheduled?: ScheduledHandler<Env, Ctx, Controller>;
+}
+export interface ApplicationHandlers<Env = unknown, Ctx = ExecutionContext, RequestType extends Request = IncomingRequest, Batch = MessageBatch<unknown>, Controller = ScheduledController> {
+    fetch: FetchHandler<Env, Ctx, RequestType>;
+    queue?: QueueHandler<Env, Ctx, Batch>;
+    scheduled?: ScheduledHandler<Env, Ctx, Controller>;
+}
+export interface RequiredHandlers<Env, Ctx = ExecutionContext, Batch = MessageBatch<unknown>, Controller = ScheduledController> {
+    fetch: (request: Request, env: Env, ctx: Ctx) => Promise<Response>;
+    queue: QueueHandler<Env, Ctx, Batch>;
+    scheduled: ScheduledHandler<Env, Ctx, Controller>;
+}
+/** Bridge the optional handler members returned by createCloudflareOnlyRuntimeWorker(). */
+export declare function requireHandlers<Env, Ctx, CfHostMetadata, Batch, Controller>(handlers: {
+    fetch?: FetchHandler<Env, Ctx, IncomingRequest<CfHostMetadata>>;
+    queue?: QueueHandler<Env, Ctx, Batch>;
+    scheduled?: ScheduledHandler<Env, Ctx, Controller>;
+}): RequiredHandlers<Env, Ctx, Batch, Controller>;
+export declare function composeFetch<Env = unknown, Ctx = ExecutionContext, RequestType extends Request = IncomingRequest>(input: {
+    application: FetchHandler<Env, Ctx, RequestType>;
+    sekiban?: SekibanMount<Env, Ctx, RequestType, never, never>;
+}): FetchHandler<Env, Ctx, RequestType>;
+export declare function composeHandlers<Env = unknown, Ctx = ExecutionContext, RequestType extends Request = IncomingRequest, Batch = MessageBatch<unknown>, Controller = ScheduledController>(input: {
+    application: ApplicationHandlers<Env, Ctx, RequestType, Batch, Controller>;
+    sekiban?: SekibanMount<Env, Ctx, RequestType, Batch, Controller>;
+}): ApplicationHandlers<Env, Ctx, RequestType, Batch, Controller>;

package/dist/compose.js

@@ -0,0 +1,87 @@
+// src/compose.ts
+var SERIALIZED_PATHS = [
+  "/api/sekiban/serialized/commit",
+  "/api/sekiban/serialized/query",
+  "/api/sekiban/serialized/list-query",
+  "/api/sekiban/serialized/tag-latest-sortable",
+  "/api/sekiban/serialized/tag-state"
+];
+function requireHandlers(handlers) {
+  const { fetch, queue, scheduled } = handlers;
+  if (fetch === void 0) throw new Error("fetch handler is required");
+  if (queue === void 0) throw new Error("queue handler is required");
+  if (scheduled === void 0) throw new Error("scheduled handler is required");
+  return {
+    fetch: async (request, env, ctx) => fetch(request, env, ctx),
+    queue,
+    scheduled
+  };
+}
+function assertPrefix(prefix) {
+  if (prefix === "" || prefix === "/") {
+    throw new Error("prefix must not be empty or /");
+  }
+  if (!prefix.startsWith("/") || prefix.endsWith("/")) {
+    throw new Error("prefix must be an absolute path without a trailing slash");
+  }
+}
+function segmentPrefix(pathname, prefix) {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+function stripPrefix(pathname, prefix) {
+  if (pathname === prefix) return "/";
+  return pathname.slice(prefix.length);
+}
+function rewriteRequest(request, pathname) {
+  const url = new URL(request.url);
+  url.pathname = pathname;
+  return new Request(url, request);
+}
+function allowlist(mount) {
+  return /* @__PURE__ */ new Set([...SERIALIZED_PATHS, ...mount.extraPaths ?? []]);
+}
+function composeFetch(input) {
+  const mount = input.sekiban;
+  if (mount !== void 0) {
+    if (typeof mount.authorize !== "function") {
+      throw new Error("authorize is required to mount runtime routes");
+    }
+    assertPrefix(mount.prefix);
+  }
+  const allowed = mount === void 0 ? /* @__PURE__ */ new Set() : allowlist(mount);
+  return async (request, env, ctx) => {
+    if (mount === void 0) return input.application(request, env, ctx);
+    const url = new URL(request.url);
+    if (!segmentPrefix(url.pathname, mount.prefix)) return input.application(request, env, ctx);
+    const stripped = stripPrefix(url.pathname, mount.prefix);
+    if (!allowed.has(stripped)) return new Response("runtime route is not forwarded", { status: 404 });
+    const decision = await mount.authorize(request);
+    if (decision instanceof Response) return decision;
+    if (decision !== true) return new Response("runtime route denied", { status: 403 });
+    return mount.fetch(rewriteRequest(request, stripped), env, ctx);
+  };
+}
+function chain(first, second) {
+  if (first === void 0 && second === void 0) return void 0;
+  const wrapped = async (...args) => {
+    if (first !== void 0) await first(...args);
+    if (second !== void 0) await second(...args);
+  };
+  return wrapped;
+}
+function composeHandlers(input) {
+  const fetch = composeFetch({ application: input.application.fetch, sekiban: input.sekiban });
+  const queue = chain(input.sekiban?.queue, input.application.queue);
+  const scheduled = chain(input.sekiban?.scheduled, input.application.scheduled);
+  return {
+    fetch,
+    ...queue === void 0 ? {} : { queue },
+    ...scheduled === void 0 ? {} : { scheduled }
+  };
+}
+export {
+  SERIALIZED_PATHS,
+  composeFetch,
+  composeHandlers,
+  requireHandlers
+};

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { AllocatorDurableObject, BootstrapCoordinatorDurableObject, JournalDurableObject, TagDurableObject, TagStateDurableObject, } from "@sekiban/dcb-runtime/cloudflare";
+export { SERIALIZED_PATHS, composeFetch, composeHandlers, requireHandlers, } from "./compose.js";
+export type { ApplicationHandlers, Authorize, AuthorizeResult, FetchHandler, IncomingRequest, QueueHandler, RequiredHandlers, ScheduledHandler, SekibanMount, } from "./compose.js";

package/dist/index.js

@@ -0,0 +1,101 @@
+// src/index.ts
+import {
+  AllocatorDurableObject,
+  BootstrapCoordinatorDurableObject,
+  JournalDurableObject,
+  TagDurableObject,
+  TagStateDurableObject
+} from "@sekiban/dcb-runtime/cloudflare";
+
+// src/compose.ts
+var SERIALIZED_PATHS = [
+  "/api/sekiban/serialized/commit",
+  "/api/sekiban/serialized/query",
+  "/api/sekiban/serialized/list-query",
+  "/api/sekiban/serialized/tag-latest-sortable",
+  "/api/sekiban/serialized/tag-state"
+];
+function requireHandlers(handlers) {
+  const { fetch, queue, scheduled } = handlers;
+  if (fetch === void 0) throw new Error("fetch handler is required");
+  if (queue === void 0) throw new Error("queue handler is required");
+  if (scheduled === void 0) throw new Error("scheduled handler is required");
+  return {
+    fetch: async (request, env, ctx) => fetch(request, env, ctx),
+    queue,
+    scheduled
+  };
+}
+function assertPrefix(prefix) {
+  if (prefix === "" || prefix === "/") {
+    throw new Error("prefix must not be empty or /");
+  }
+  if (!prefix.startsWith("/") || prefix.endsWith("/")) {
+    throw new Error("prefix must be an absolute path without a trailing slash");
+  }
+}
+function segmentPrefix(pathname, prefix) {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+function stripPrefix(pathname, prefix) {
+  if (pathname === prefix) return "/";
+  return pathname.slice(prefix.length);
+}
+function rewriteRequest(request, pathname) {
+  const url = new URL(request.url);
+  url.pathname = pathname;
+  return new Request(url, request);
+}
+function allowlist(mount) {
+  return /* @__PURE__ */ new Set([...SERIALIZED_PATHS, ...mount.extraPaths ?? []]);
+}
+function composeFetch(input) {
+  const mount = input.sekiban;
+  if (mount !== void 0) {
+    if (typeof mount.authorize !== "function") {
+      throw new Error("authorize is required to mount runtime routes");
+    }
+    assertPrefix(mount.prefix);
+  }
+  const allowed = mount === void 0 ? /* @__PURE__ */ new Set() : allowlist(mount);
+  return async (request, env, ctx) => {
+    if (mount === void 0) return input.application(request, env, ctx);
+    const url = new URL(request.url);
+    if (!segmentPrefix(url.pathname, mount.prefix)) return input.application(request, env, ctx);
+    const stripped = stripPrefix(url.pathname, mount.prefix);
+    if (!allowed.has(stripped)) return new Response("runtime route is not forwarded", { status: 404 });
+    const decision = await mount.authorize(request);
+    if (decision instanceof Response) return decision;
+    if (decision !== true) return new Response("runtime route denied", { status: 403 });
+    return mount.fetch(rewriteRequest(request, stripped), env, ctx);
+  };
+}
+function chain(first, second) {
+  if (first === void 0 && second === void 0) return void 0;
+  const wrapped = async (...args) => {
+    if (first !== void 0) await first(...args);
+    if (second !== void 0) await second(...args);
+  };
+  return wrapped;
+}
+function composeHandlers(input) {
+  const fetch = composeFetch({ application: input.application.fetch, sekiban: input.sekiban });
+  const queue = chain(input.sekiban?.queue, input.application.queue);
+  const scheduled = chain(input.sekiban?.scheduled, input.application.scheduled);
+  return {
+    fetch,
+    ...queue === void 0 ? {} : { queue },
+    ...scheduled === void 0 ? {} : { scheduled }
+  };
+}
+export {
+  AllocatorDurableObject,
+  BootstrapCoordinatorDurableObject,
+  JournalDurableObject,
+  SERIALIZED_PATHS,
+  TagDurableObject,
+  TagStateDurableObject,
+  composeFetch,
+  composeHandlers,
+  requireHandlers
+};

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@sekiban/dcb-cloudflare",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "private": false,
+  "description": "Optional Cloudflare composition helper. Mounts Sekiban storage beside the caller's own Worker. Not an application and not part of the matched set.",
+  "license": "Elastic-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/J-Tech-Japan/sekiban-dcb-ts.git",
+    "directory": "packages/dcb-cloudflare"
+  },
+  "homepage": "https://github.com/J-Tech-Japan/sekiban-dcb-ts/tree/main/packages/dcb-cloudflare#readme",
+  "bugs": {
+    "url": "https://github.com/J-Tech-Japan/sekiban-dcb-ts/issues"
+  },
+  "keywords": ["sekiban", "dcb", "cloudflare", "compose"],
+  "engines": {
+    "node": ">=20"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "dcb-cloudflare": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": ["dist", "README.md", "LICENSE"],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@sekiban/dcb-runtime": "0.2.0"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-types": "^5.20260820.1"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && esbuild src/compose.ts --bundle --format=esm --platform=neutral --outfile=dist/compose.js && esbuild src/index.ts --bundle --format=esm --platform=neutral --external:@sekiban/dcb-runtime --external:@sekiban/dcb-runtime/cloudflare --outfile=dist/index.js && esbuild src/cli.ts --bundle --format=esm --platform=node --banner:js='#!/usr/bin/env node' --outfile=dist/cli.js",
+    "test": "npm run build && node --test test/cli.node-test.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}