@takazudo/zfb-adapter-cloudflare 0.1.0-next.80 → 0.1.0-next.82

package/README.md

@@ -2,10 +2,10 @@
 
 > Rust-built static-site engine for Astro and Next.js users — millisecond rebuilds, single binary.
 
-The Cloudflare adapter for [zfb][zfb-site], targeting **Workers Static
-Assets** (also deployable to Cloudflare Pages advanced mode). It wraps the
-`@takazudo/zfb-runtime` page router into a Worker entry (`_worker.js`),
-threading `(env, ctx)` through to user code via `AsyncLocalStorage`.
+The Cloudflare adapter for [zfb][zfb-site], verified on **Workers Static
+Assets**. It wraps the `@takazudo/zfb-runtime` page router into a Worker entry
+(`_worker.js`), threading `(env, ctx)` through to user code via
+`AsyncLocalStorage`. Cloudflare Pages advanced mode is unverified.
 
 This package is the Cloudflare half of the SSR adapter contract. Other
 targets (Node, Netlify, …) will land as sibling `@takazudo/zfb-adapter-*`
@@ -69,9 +69,9 @@ lifecycle (`wrangler d1 create`, migrations, preview-vs-prod).
 1. Render every SSG page (`prerender !== false`) into static HTML under
    `dist/`.
 2. Hand the SSR bundle to this adapter, which writes `dist/_worker.js`
-   (the wrapper), `dist/_zfb_inner.mjs` (the bundle), and
-   `dist/.assetsignore` (see below) — ready to deploy as a Worker with
-   Static Assets, or via Cloudflare Pages advanced mode.
+   (the wrapper), `dist/_zfb_inner.mjs` (the bundle), copied
+   `x-<hash>.wasm` modules, and `dist/.assetsignore` (see below) — ready
+   for Workers Static Assets.
 
 ## `wrangler.toml`
 
@@ -134,34 +134,47 @@ wrangler deploy  # ship it
 ## `.assetsignore`
 
 The adapter emits `dist/.assetsignore` alongside `_worker.js` and
-`_zfb_inner.mjs`:
+`_zfb_inner.mjs`. When zfb passes one or more `--asset` Wasm modules, it
+also adds every copied basename:
 
 ```
 _worker.js
 _zfb_inner.mjs
+index_bg-a1b2c3d4.wasm
 ```
 
-This excludes the wrapper and the inner SSR bundle from the asset
-upload, so they are reachable only through the Worker's own module
+This excludes the wrapper, inner SSR bundle, and compiled Wasm modules from
+the asset upload, so they are reachable only through the Worker's own module
 graph — never served as public static files. Without it, a request for
 `/_worker.js` or `/_zfb_inner.mjs` would serve your server code as a
 plain-text download.
 
-**Precedence:** zfb copies your project's `public/` directory into
-`dist/` _after_ running this adapter. If your `public/` directory
-contains its own `.assetsignore`, it overrides the one this adapter
-emits — the adapter's excludes are silently dropped. Only add a
-`public/.assetsignore` if you have additional paths to exclude and
-include the two lines above yourself.
-
-## Cloudflare Pages compatibility
-
-The same `dist/` output is still deployable to Cloudflare Pages
-advanced mode (a `_worker.js` at the root of the Pages output directory
-is Pages' equivalent convention). The `_worker.js` wrapper dispatches
-requests identically on both platforms; the only platform-visible
-difference is that trailing-slash asset redirects come back as `307`
-on Workers Static Assets versus `308` on Pages.
+**Merge behavior:** zfb copies your project's `public/` directory into
+`dist/` _after_ running this adapter. If `public/.assetsignore` adds entries,
+zfb merges them with the generated entries; it does not drop the wrapper,
+inner-bundle, or Wasm exclusions.
+
+## CLI asset contract
+
+zfb calls the package CLI with the SSR bundle plus one repeatable `--asset`
+path for every bundle-relative Wasm module:
+
+```sh
+zfb-adapter-cloudflare bundle ./bundle.mjs --outdir ./dist \
+  --asset index_bg-a1b2c3d4.wasm
+```
+
+Each asset path must be relative to the input bundle directory. The CLI copies
+it into `outdir` under its basename and records that basename in
+`.assetsignore`; paths that escape the input directory or collide with emitted
+output fail the build.
+
+## Cloudflare Pages advanced mode
+
+The root-level `_worker.js` follows the Cloudflare Pages advanced-mode
+convention, but this adapter is only verified on Workers Static Assets.
+Cloudflare Pages advanced mode remains unverified and should not be treated as
+a supported deployment target until it has a dedicated smoke test.
 
 ## Why two bundle files instead of one
 

package/bin/cli.mjs

@@ -4,13 +4,14 @@
 //
 // Subcommands:
 //
-//   bundle <input> --outdir <dir>
+//   bundle <input> --outdir <dir> [--asset <path>]...
 //
 //     Wrap the input ESM bundle into a Cloudflare Workers Static Assets
-//     (Pages-compatible) `_worker.js` placed under <dir>, alongside a
-//     `.assetsignore` that excludes the wrapper and inner bundle from
-//     the asset upload. The input bundle is the file `zfb_build`'s
-//     bundler emits; <dir> is typically the project's `dist/`.
+//     `_worker.js` placed under <dir>, alongside a `.assetsignore` that
+//     excludes the wrapper, inner bundle, and every copied --asset basename
+//     from the asset upload. The input bundle is the file `zfb_build`'s
+//     bundler emits; <dir> is typically the project's `dist/`. Cloudflare
+//     Pages advanced mode is unverified.
 //
 // The CLI is intentionally tiny and dependency-free. It imports the
 // wrapper string from the canonical `src/worker-wrapper.mjs` (plain JS,
@@ -34,8 +35,13 @@ export { WORKER_WRAPPER_SOURCE };
 
 import { emitWorker as _emitWorker } from "../src/emit-worker.mjs";
 
-export async function emitWorker({ inputBundlePath, outdir }) {
-  return _emitWorker({ inputBundlePath, outdir, workerWrapperSource: WORKER_WRAPPER_SOURCE });
+export async function emitWorker({ inputBundlePath, outdir, assets = [] }) {
+  return _emitWorker({
+    inputBundlePath,
+    outdir,
+    assets,
+    workerWrapperSource: WORKER_WRAPPER_SOURCE,
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -49,14 +55,15 @@ function fail(message) {
 
 function printUsage() {
   process.stdout.write(`Usage:
-  zfb-adapter-cloudflare bundle <input> --outdir <dir>
+  zfb-adapter-cloudflare bundle <input> --outdir <dir> [--asset <path>]...
 
 Wrap an ESM bundle (the output of zfb-build's bundler) into a
 Cloudflare Workers Static Assets \`_worker.js\` placed under <dir>
-(also deployable to Cloudflare Pages advanced mode).
+with a protected \`.assetsignore\`. Cloudflare Pages advanced mode is unverified.
 
 Options:
   --outdir <dir>    Output directory. Required.
+  --asset <path>    Bundle-relative Wasm asset to copy. Repeatable.
   -h, --help        Show this help.
 `);
 }
@@ -73,6 +80,7 @@ function parseArgs(argv) {
 
   let input = null;
   let outdir = null;
+  const assets = [];
   let i = 1;
   while (i < args.length) {
     const arg = args[i];
@@ -88,6 +96,20 @@ function parseArgs(argv) {
       i += 1;
       continue;
     }
+    if (arg === "--asset") {
+      const next = args[i + 1];
+      if (!next) fail("--asset requires a path argument");
+      assets.push(next);
+      i += 2;
+      continue;
+    }
+    if (arg.startsWith("--asset=")) {
+      const asset = arg.slice("--asset=".length);
+      if (!asset) fail("--asset requires a path argument");
+      assets.push(asset);
+      i += 1;
+      continue;
+    }
     if (arg.startsWith("--")) {
       fail(`unknown option: ${arg}`);
     }
@@ -102,7 +124,7 @@ function parseArgs(argv) {
   if (!input) fail("missing required positional argument: <input>");
   if (!outdir) fail("missing required option: --outdir <dir>");
 
-  return { command: "bundle", input, outdir };
+  return { command: "bundle", input, outdir, assets };
 }
 
 async function main() {
@@ -140,6 +162,7 @@ async function main() {
   const out = await emitWorker({
     inputBundlePath: inputAbs,
     outdir: outdirAbs,
+    assets: parsed.assets,
   });
   process.stdout.write(
     `wrote ${out.workerPath}\nwrote ${out.innerBundlePath}\nwrote ${out.assetsIgnorePath}\n`,

package/dist/build.d.ts

@@ -19,9 +19,18 @@ export interface EmitWorkerInput {
     /**
      * Absolute path to the output directory. The emitter creates it if
      * missing and writes `_worker.js`, `_zfb_inner.mjs` (the copied input
-     * bundle), and `.assetsignore` into it.
+     * bundle), copied Wasm assets, and `.assetsignore` into it. The ignore
+     * file protects every generated JavaScript and Wasm basename from the
+     * public asset upload.
      */
     readonly outdir: string;
+    /**
+     * Wasm modules emitted beside the input bundle. Relative paths resolve from
+     * the input bundle's directory and each module is copied into the Worker
+     * package under its basename, then added to `.assetsignore` so it remains a
+     * Worker module rather than a public static asset.
+     */
+    readonly assets?: readonly string[];
 }
 /**
  * Output paths the emitter produced. Returned for callers that want to
@@ -33,17 +42,18 @@ export interface EmitWorkerOutput {
     readonly assetsIgnorePath: string;
 }
 /**
- * Emit a Cloudflare Workers Static Assets (Pages-compatible) `_worker.js`
- * that wraps the zfb input bundle.
+ * Emit a Cloudflare Workers Static Assets `_worker.js` that wraps the zfb
+ * input bundle. Cloudflare Pages advanced mode is unverified.
  *
- * Output shape (three files in `outdir`):
+ * Output shape (two generated JavaScript files, `.assetsignore`, and zero or
+ * more copied Wasm assets in `outdir`):
  *
- *   _worker.js       — Worker entry point (`main` in wrangler.toml, or the
- *                      Pages advanced-mode convention)
+ *   _worker.js       — Worker entry point (`main` in wrangler.toml)
  *   _zfb_inner.mjs   — the input bundle, copied verbatim
- *   .assetsignore    — excludes the two files above from the asset upload
- *                      so they are only reachable through the Worker's
- *                      module graph, never served as a public static file
+ *   <asset>.wasm     — each bundle-relative Wasm input, copied by basename
+ *   .assetsignore    — excludes every generated JavaScript and Wasm basename
+ *                      from the asset upload so they are only reachable
+ *                      through the Worker's module graph
  *
  * The wrapper imports the inner bundle via the relative path
  * `./_zfb_inner.mjs`. Workerd's Module loader resolves relative ESM

package/dist/build.js

@@ -20,17 +20,18 @@ import { emitWorker as _emitWorker } from "./emit-worker.mjs";
  */
 export const WORKER_WRAPPER_SOURCE = _wrapper;
 /**
- * Emit a Cloudflare Workers Static Assets (Pages-compatible) `_worker.js`
- * that wraps the zfb input bundle.
+ * Emit a Cloudflare Workers Static Assets `_worker.js` that wraps the zfb
+ * input bundle. Cloudflare Pages advanced mode is unverified.
  *
- * Output shape (three files in `outdir`):
+ * Output shape (two generated JavaScript files, `.assetsignore`, and zero or
+ * more copied Wasm assets in `outdir`):
  *
- *   _worker.js       — Worker entry point (`main` in wrangler.toml, or the
- *                      Pages advanced-mode convention)
+ *   _worker.js       — Worker entry point (`main` in wrangler.toml)
  *   _zfb_inner.mjs   — the input bundle, copied verbatim
- *   .assetsignore    — excludes the two files above from the asset upload
- *                      so they are only reachable through the Worker's
- *                      module graph, never served as a public static file
+ *   <asset>.wasm     — each bundle-relative Wasm input, copied by basename
+ *   .assetsignore    — excludes every generated JavaScript and Wasm basename
+ *                      from the asset upload so they are only reachable
+ *                      through the Worker's module graph
  *
  * The wrapper imports the inner bundle via the relative path
  * `./_zfb_inner.mjs`. Workerd's Module loader resolves relative ESM
@@ -46,6 +47,7 @@ export async function emitWorker(input) {
     return _emitWorker({
         inputBundlePath: input.inputBundlePath,
         outdir: input.outdir,
+        assets: input.assets,
         workerWrapperSource: WORKER_WRAPPER_SOURCE,
     });
 }

package/dist/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,kEAAkE;AAClE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,mEAAmE;AAEnE,0EAA0E;AAC1E,sCAAsC;AACtC,OAAO,EAAE,qBAAqB,IAAI,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAW,QAAkB,CAAC;AAgChE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,OAAO,WAAW,CAAC;QACjB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,qBAAqB;KAC3C,CAA8B,CAAC;AAClC,CAAC","sourcesContent":["// `@takazudo/zfb-adapter-cloudflare/build` — Node-only build helpers.\n//\n// This sub-entry is intentionally **not** imported by the Workers-runtime\n// entry (`./`). Code in this module may freely use Node built-ins\n// (`node:fs`, `node:path`, …) because it only ever runs in a Node 22+\n// build environment, never inside a Cloudflare Worker isolate.\n//\n// The `./` entry (`src/index.ts`) exports only Workers-runtime-safe code\n// (AsyncLocalStorage helpers) that can be bundled into the worker.\n\n// @ts-expect-error worker-wrapper.mjs has no declaration file; the export\n// shape is narrowed explicitly below.\nimport { WORKER_WRAPPER_SOURCE as _wrapper } from \"./worker-wrapper.mjs\";\n// @ts-expect-error emit-worker.mjs has no declaration file; the export\n// shape is narrowed via EmitWorkerInput/EmitWorkerOutput below.\nimport { emitWorker as _emitWorker } from \"./emit-worker.mjs\";\n\n/**\n * The wrapper source written to `_worker.js`. Imported from the single\n * canonical `.mjs` file so `src/build.ts` and `bin/cli.mjs` always stay\n * in sync without any duplication.\n */\nexport const WORKER_WRAPPER_SOURCE: string = _wrapper as string;\n\n/**\n * Inputs to [`emitWorker`].\n */\nexport interface EmitWorkerInput {\n  /**\n   * Absolute path to the input ESM bundle produced by `zfb-build`. The\n   * bundle must export a Workers-shaped `default { fetch: (request) =>\n   * Promise<Response> }` (this is the contract `zfb_build::bundler`\n   * pins). The file is copied verbatim next to the emitted wrapper so\n   * relative imports inside it keep resolving.\n   */\n  readonly inputBundlePath: string;\n  /**\n   * Absolute path to the output directory. The emitter creates it if\n   * missing and writes `_worker.js`, `_zfb_inner.mjs` (the copied input\n   * bundle), and `.assetsignore` into it.\n   */\n  readonly outdir: string;\n}\n\n/**\n * Output paths the emitter produced. Returned for callers that want to\n * log them (the Rust orchestrator surfaces them in build output).\n */\nexport interface EmitWorkerOutput {\n  readonly workerPath: string;\n  readonly innerBundlePath: string;\n  readonly assetsIgnorePath: string;\n}\n\n/**\n * Emit a Cloudflare Workers Static Assets (Pages-compatible) `_worker.js`\n * that wraps the zfb input bundle.\n *\n * Output shape (three files in `outdir`):\n *\n *   _worker.js       — Worker entry point (`main` in wrangler.toml, or the\n *                      Pages advanced-mode convention)\n *   _zfb_inner.mjs   — the input bundle, copied verbatim\n *   .assetsignore    — excludes the two files above from the asset upload\n *                      so they are only reachable through the Worker's\n *                      module graph, never served as a public static file\n *\n * The wrapper imports the inner bundle via the relative path\n * `./_zfb_inner.mjs`. Workerd's Module loader resolves relative ESM\n * imports inside the `_worker.js` directory, so this layout works\n * without re-bundling.\n *\n * Why two bundle files instead of one: re-bundling here would require a\n * second esbuild pass and would force the adapter to ship its own\n * esbuild binary slot. The two-file layout keeps the adapter\n * dependency-free at runtime — it is just `node:fs` glue.\n */\nexport async function emitWorker(input: EmitWorkerInput): Promise<EmitWorkerOutput> {\n  return _emitWorker({\n    inputBundlePath: input.inputBundlePath,\n    outdir: input.outdir,\n    workerWrapperSource: WORKER_WRAPPER_SOURCE,\n  }) as Promise<EmitWorkerOutput>;\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,kEAAkE;AAClE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,mEAAmE;AAEnE,0EAA0E;AAC1E,sCAAsC;AACtC,OAAO,EAAE,qBAAqB,IAAI,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAW,QAAkB,CAAC;AAyChE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,OAAO,WAAW,CAAC;QACjB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,qBAAqB;KAC3C,CAA8B,CAAC;AAClC,CAAC","sourcesContent":["// `@takazudo/zfb-adapter-cloudflare/build` — Node-only build helpers.\n//\n// This sub-entry is intentionally **not** imported by the Workers-runtime\n// entry (`./`). Code in this module may freely use Node built-ins\n// (`node:fs`, `node:path`, …) because it only ever runs in a Node 22+\n// build environment, never inside a Cloudflare Worker isolate.\n//\n// The `./` entry (`src/index.ts`) exports only Workers-runtime-safe code\n// (AsyncLocalStorage helpers) that can be bundled into the worker.\n\n// @ts-expect-error worker-wrapper.mjs has no declaration file; the export\n// shape is narrowed explicitly below.\nimport { WORKER_WRAPPER_SOURCE as _wrapper } from \"./worker-wrapper.mjs\";\n// @ts-expect-error emit-worker.mjs has no declaration file; the export\n// shape is narrowed via EmitWorkerInput/EmitWorkerOutput below.\nimport { emitWorker as _emitWorker } from \"./emit-worker.mjs\";\n\n/**\n * The wrapper source written to `_worker.js`. Imported from the single\n * canonical `.mjs` file so `src/build.ts` and `bin/cli.mjs` always stay\n * in sync without any duplication.\n */\nexport const WORKER_WRAPPER_SOURCE: string = _wrapper as string;\n\n/**\n * Inputs to [`emitWorker`].\n */\nexport interface EmitWorkerInput {\n  /**\n   * Absolute path to the input ESM bundle produced by `zfb-build`. The\n   * bundle must export a Workers-shaped `default { fetch: (request) =>\n   * Promise<Response> }` (this is the contract `zfb_build::bundler`\n   * pins). The file is copied verbatim next to the emitted wrapper so\n   * relative imports inside it keep resolving.\n   */\n  readonly inputBundlePath: string;\n  /**\n   * Absolute path to the output directory. The emitter creates it if\n   * missing and writes `_worker.js`, `_zfb_inner.mjs` (the copied input\n   * bundle), copied Wasm assets, and `.assetsignore` into it. The ignore\n   * file protects every generated JavaScript and Wasm basename from the\n   * public asset upload.\n   */\n  readonly outdir: string;\n  /**\n   * Wasm modules emitted beside the input bundle. Relative paths resolve from\n   * the input bundle's directory and each module is copied into the Worker\n   * package under its basename, then added to `.assetsignore` so it remains a\n   * Worker module rather than a public static asset.\n   */\n  readonly assets?: readonly string[];\n}\n\n/**\n * Output paths the emitter produced. Returned for callers that want to\n * log them (the Rust orchestrator surfaces them in build output).\n */\nexport interface EmitWorkerOutput {\n  readonly workerPath: string;\n  readonly innerBundlePath: string;\n  readonly assetsIgnorePath: string;\n}\n\n/**\n * Emit a Cloudflare Workers Static Assets `_worker.js` that wraps the zfb\n * input bundle. Cloudflare Pages advanced mode is unverified.\n *\n * Output shape (two generated JavaScript files, `.assetsignore`, and zero or\n * more copied Wasm assets in `outdir`):\n *\n *   _worker.js       — Worker entry point (`main` in wrangler.toml)\n *   _zfb_inner.mjs   — the input bundle, copied verbatim\n *   <asset>.wasm     — each bundle-relative Wasm input, copied by basename\n *   .assetsignore    — excludes every generated JavaScript and Wasm basename\n *                      from the asset upload so they are only reachable\n *                      through the Worker's module graph\n *\n * The wrapper imports the inner bundle via the relative path\n * `./_zfb_inner.mjs`. Workerd's Module loader resolves relative ESM\n * imports inside the `_worker.js` directory, so this layout works\n * without re-bundling.\n *\n * Why two bundle files instead of one: re-bundling here would require a\n * second esbuild pass and would force the adapter to ship its own\n * esbuild binary slot. The two-file layout keeps the adapter\n * dependency-free at runtime — it is just `node:fs` glue.\n */\nexport async function emitWorker(input: EmitWorkerInput): Promise<EmitWorkerOutput> {\n  return _emitWorker({\n    inputBundlePath: input.inputBundlePath,\n    outdir: input.outdir,\n    assets: input.assets,\n    workerWrapperSource: WORKER_WRAPPER_SOURCE,\n  }) as Promise<EmitWorkerOutput>;\n}\n"]}

package/dist/emit-worker.mjs

@@ -9,33 +9,132 @@
 //
 // invariant: no runtime npm deps — see SECURITY-DEPS.md
 
-import { copyFile, mkdir, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { copyFile, lstat, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 
-// `.assetsignore` tells the Workers Static Assets uploader (and Pages'
-// asset server) to skip these two files, so they are only ever reachable
-// through the Worker's module graph, not served as public static assets.
-const ASSETS_IGNORE_CONTENT = "_worker.js\n_zfb_inner.mjs\n";
+// `.assetsignore` tells the Workers Static Assets uploader to skip the
+// generated JavaScript files. Every copied Wasm basename is appended later,
+// so it too is reachable only through the Worker's module graph and never
+// served as a public static asset.
+const ASSETS_IGNORE_BASE_ENTRIES = ["_worker.js", "_zfb_inner.mjs"];
+const RESERVED_OUTPUT_NAMES = new Set([...ASSETS_IGNORE_BASE_ENTRIES, ".assetsignore"]);
+
+function isPathWithin(parent, candidate) {
+  const pathFromParent = relative(parent, candidate);
+  return (
+    pathFromParent === "" ||
+    (!pathFromParent.startsWith(`..${sep}`) &&
+      pathFromParent !== ".." &&
+      !isAbsolute(pathFromParent))
+  );
+}
+
+async function resolveAssets(inputBundlePath, assetPaths) {
+  const inputDir = dirname(inputBundlePath);
+  const canonicalInputDir = await realpath(inputDir);
+  const names = new Set();
+  const resolvedAssets = [];
+
+  for (const assetPath of assetPaths) {
+    if (typeof assetPath !== "string" || isAbsolute(assetPath)) {
+      throw new Error("asset path must be bundle-relative: " + String(assetPath));
+    }
+    const sourcePath = resolve(inputDir, assetPath);
+    if (!isPathWithin(inputDir, sourcePath)) {
+      throw new Error("asset path escapes the input bundle directory: " + assetPath);
+    }
+
+    const sourceInfo = await stat(sourcePath);
+    if (!sourceInfo.isFile()) {
+      throw new Error("asset is not a file: " + sourcePath);
+    }
+    const canonicalSourcePath = await realpath(sourcePath);
+    if (!isPathWithin(canonicalInputDir, canonicalSourcePath)) {
+      throw new Error("asset path resolves outside the input bundle directory: " + assetPath);
+    }
+
+    const outputName = basename(sourcePath);
+    if (!outputName || outputName === "." || outputName === "..") {
+      throw new Error("asset path has no valid basename: " + assetPath);
+    }
+    if (RESERVED_OUTPUT_NAMES.has(outputName)) {
+      throw new Error("asset basename collides with generated adapter output: " + outputName);
+    }
+    if (names.has(outputName)) {
+      throw new Error("asset basename collision: " + outputName);
+    }
+    names.add(outputName);
+    resolvedAssets.push({ sourcePath: canonicalSourcePath, outputName });
+  }
+
+  return resolvedAssets;
+}
+
+async function pathExists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+async function readExistingAssetsIgnore(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+
+function mergeAssetsIgnore(existing, requiredEntries) {
+  const listed = new Set(existing.split(/\r?\n/));
+  const missing = requiredEntries.filter((entry) => !listed.has(entry));
+  if (missing.length === 0) {
+    return existing;
+  }
+
+  const prefix = existing.length > 0 && !existing.endsWith("\n") ? existing + "\n" : existing;
+  return prefix + missing.map((entry) => entry + "\n").join("");
+}
 
 /**
- * Emit a Cloudflare Workers Static Assets (Pages-compatible) `_worker.js`
- * that wraps the zfb input bundle.
+ * Emit a Cloudflare Workers Static Assets `_worker.js` that wraps the zfb
+ * input bundle. Cloudflare Pages advanced mode is unverified.
  *
- * Output shape (three files in `outdir`):
+ * Output shape (two generated JavaScript files, `.assetsignore`, and zero or
+ * more copied Wasm assets in `outdir`):
  *
- *   _worker.js       — Worker entry point (`main` in wrangler.toml, or the
- *                      Pages advanced-mode convention)
+ *   _worker.js       — Worker entry point (`main` in wrangler.toml)
  *   _zfb_inner.mjs   — the input bundle, copied verbatim
- *   .assetsignore    — excludes the two files above from the asset upload
+ *   <asset>.wasm     — each bundle-relative Wasm input, copied by basename
+ *   .assetsignore    — excludes every generated JavaScript and Wasm basename
+ *                      from the asset upload
  *
- * @param {{ inputBundlePath: string; outdir: string; workerWrapperSource: string }} input
+ * @param {{ inputBundlePath: string; outdir: string; assets?: readonly string[]; workerWrapperSource: string }} input
  * @returns {Promise<{ workerPath: string; innerBundlePath: string; assetsIgnorePath: string }>}
  */
-export async function emitWorker({ inputBundlePath, outdir, workerWrapperSource }) {
+export async function emitWorker({ inputBundlePath, outdir, assets = [], workerWrapperSource }) {
   const outdirAbs = resolve(outdir);
   const inputAbs = resolve(inputBundlePath);
+  const resolvedAssets = await resolveAssets(inputAbs, assets);
 
   await mkdir(outdirAbs, { recursive: true });
+  for (const asset of resolvedAssets) {
+    const destination = join(outdirAbs, asset.outputName);
+    if (await pathExists(destination)) {
+      throw new Error(
+        "asset basename collision: " + asset.outputName + " would overwrite " + destination,
+      );
+    }
+  }
+
   const innerBundlePath = join(outdirAbs, "_zfb_inner.mjs");
   await copyFile(inputAbs, innerBundlePath);
 
@@ -43,7 +142,15 @@ export async function emitWorker({ inputBundlePath, outdir, workerWrapperSource
   await writeFile(workerPath, workerWrapperSource, "utf8");
 
   const assetsIgnorePath = join(outdirAbs, ".assetsignore");
-  await writeFile(assetsIgnorePath, ASSETS_IGNORE_CONTENT, "utf8");
+  const existingAssetsIgnore = await readExistingAssetsIgnore(assetsIgnorePath);
+  for (const asset of resolvedAssets) {
+    await copyFile(asset.sourcePath, join(outdirAbs, asset.outputName));
+  }
+  const assetsIgnore = mergeAssetsIgnore(existingAssetsIgnore, [
+    ...ASSETS_IGNORE_BASE_ENTRIES,
+    ...resolvedAssets.map((asset) => asset.outputName),
+  ]);
+  await writeFile(assetsIgnorePath, assetsIgnore, "utf8");
 
   return { workerPath, innerBundlePath, assetsIgnorePath };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takazudo/zfb-adapter-cloudflare",
-  "version": "0.1.0-next.80",
+  "version": "0.1.0-next.82",
   "private": false,
   "type": "module",
   "description": "Rust-built static-site engine for Astro and Next.js users — millisecond rebuilds, single binary. Cloudflare adapter: Workers Static Assets (Pages-compatible).",

package/src/emit-worker.mjs

@@ -9,33 +9,132 @@
 //
 // invariant: no runtime npm deps — see SECURITY-DEPS.md
 
-import { copyFile, mkdir, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { copyFile, lstat, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 
-// `.assetsignore` tells the Workers Static Assets uploader (and Pages'
-// asset server) to skip these two files, so they are only ever reachable
-// through the Worker's module graph, not served as public static assets.
-const ASSETS_IGNORE_CONTENT = "_worker.js\n_zfb_inner.mjs\n";
+// `.assetsignore` tells the Workers Static Assets uploader to skip the
+// generated JavaScript files. Every copied Wasm basename is appended later,
+// so it too is reachable only through the Worker's module graph and never
+// served as a public static asset.
+const ASSETS_IGNORE_BASE_ENTRIES = ["_worker.js", "_zfb_inner.mjs"];
+const RESERVED_OUTPUT_NAMES = new Set([...ASSETS_IGNORE_BASE_ENTRIES, ".assetsignore"]);
+
+function isPathWithin(parent, candidate) {
+  const pathFromParent = relative(parent, candidate);
+  return (
+    pathFromParent === "" ||
+    (!pathFromParent.startsWith(`..${sep}`) &&
+      pathFromParent !== ".." &&
+      !isAbsolute(pathFromParent))
+  );
+}
+
+async function resolveAssets(inputBundlePath, assetPaths) {
+  const inputDir = dirname(inputBundlePath);
+  const canonicalInputDir = await realpath(inputDir);
+  const names = new Set();
+  const resolvedAssets = [];
+
+  for (const assetPath of assetPaths) {
+    if (typeof assetPath !== "string" || isAbsolute(assetPath)) {
+      throw new Error("asset path must be bundle-relative: " + String(assetPath));
+    }
+    const sourcePath = resolve(inputDir, assetPath);
+    if (!isPathWithin(inputDir, sourcePath)) {
+      throw new Error("asset path escapes the input bundle directory: " + assetPath);
+    }
+
+    const sourceInfo = await stat(sourcePath);
+    if (!sourceInfo.isFile()) {
+      throw new Error("asset is not a file: " + sourcePath);
+    }
+    const canonicalSourcePath = await realpath(sourcePath);
+    if (!isPathWithin(canonicalInputDir, canonicalSourcePath)) {
+      throw new Error("asset path resolves outside the input bundle directory: " + assetPath);
+    }
+
+    const outputName = basename(sourcePath);
+    if (!outputName || outputName === "." || outputName === "..") {
+      throw new Error("asset path has no valid basename: " + assetPath);
+    }
+    if (RESERVED_OUTPUT_NAMES.has(outputName)) {
+      throw new Error("asset basename collides with generated adapter output: " + outputName);
+    }
+    if (names.has(outputName)) {
+      throw new Error("asset basename collision: " + outputName);
+    }
+    names.add(outputName);
+    resolvedAssets.push({ sourcePath: canonicalSourcePath, outputName });
+  }
+
+  return resolvedAssets;
+}
+
+async function pathExists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+async function readExistingAssetsIgnore(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+
+function mergeAssetsIgnore(existing, requiredEntries) {
+  const listed = new Set(existing.split(/\r?\n/));
+  const missing = requiredEntries.filter((entry) => !listed.has(entry));
+  if (missing.length === 0) {
+    return existing;
+  }
+
+  const prefix = existing.length > 0 && !existing.endsWith("\n") ? existing + "\n" : existing;
+  return prefix + missing.map((entry) => entry + "\n").join("");
+}
 
 /**
- * Emit a Cloudflare Workers Static Assets (Pages-compatible) `_worker.js`
- * that wraps the zfb input bundle.
+ * Emit a Cloudflare Workers Static Assets `_worker.js` that wraps the zfb
+ * input bundle. Cloudflare Pages advanced mode is unverified.
  *
- * Output shape (three files in `outdir`):
+ * Output shape (two generated JavaScript files, `.assetsignore`, and zero or
+ * more copied Wasm assets in `outdir`):
  *
- *   _worker.js       — Worker entry point (`main` in wrangler.toml, or the
- *                      Pages advanced-mode convention)
+ *   _worker.js       — Worker entry point (`main` in wrangler.toml)
  *   _zfb_inner.mjs   — the input bundle, copied verbatim
- *   .assetsignore    — excludes the two files above from the asset upload
+ *   <asset>.wasm     — each bundle-relative Wasm input, copied by basename
+ *   .assetsignore    — excludes every generated JavaScript and Wasm basename
+ *                      from the asset upload
  *
- * @param {{ inputBundlePath: string; outdir: string; workerWrapperSource: string }} input
+ * @param {{ inputBundlePath: string; outdir: string; assets?: readonly string[]; workerWrapperSource: string }} input
  * @returns {Promise<{ workerPath: string; innerBundlePath: string; assetsIgnorePath: string }>}
  */
-export async function emitWorker({ inputBundlePath, outdir, workerWrapperSource }) {
+export async function emitWorker({ inputBundlePath, outdir, assets = [], workerWrapperSource }) {
   const outdirAbs = resolve(outdir);
   const inputAbs = resolve(inputBundlePath);
+  const resolvedAssets = await resolveAssets(inputAbs, assets);
 
   await mkdir(outdirAbs, { recursive: true });
+  for (const asset of resolvedAssets) {
+    const destination = join(outdirAbs, asset.outputName);
+    if (await pathExists(destination)) {
+      throw new Error(
+        "asset basename collision: " + asset.outputName + " would overwrite " + destination,
+      );
+    }
+  }
+
   const innerBundlePath = join(outdirAbs, "_zfb_inner.mjs");
   await copyFile(inputAbs, innerBundlePath);
 
@@ -43,7 +142,15 @@ export async function emitWorker({ inputBundlePath, outdir, workerWrapperSource
   await writeFile(workerPath, workerWrapperSource, "utf8");
 
   const assetsIgnorePath = join(outdirAbs, ".assetsignore");
-  await writeFile(assetsIgnorePath, ASSETS_IGNORE_CONTENT, "utf8");
+  const existingAssetsIgnore = await readExistingAssetsIgnore(assetsIgnorePath);
+  for (const asset of resolvedAssets) {
+    await copyFile(asset.sourcePath, join(outdirAbs, asset.outputName));
+  }
+  const assetsIgnore = mergeAssetsIgnore(existingAssetsIgnore, [
+    ...ASSETS_IGNORE_BASE_ENTRIES,
+    ...resolvedAssets.map((asset) => asset.outputName),
+  ]);
+  await writeFile(assetsIgnorePath, assetsIgnore, "utf8");
 
   return { workerPath, innerBundlePath, assetsIgnorePath };
 }