@wtfalch/foundry 0.19.0 → 0.20.0

package/dist/plan/edge-dns.js

@@ -0,0 +1,227 @@
+import { EdgeApiError } from '@wtfalch/edge';
+/** Edge answers its platform writes from one shared slot of 4 (company-less writes). */
+export const EDGE_DNS_WRITE_CONCURRENCY = 4;
+/**
+ * Edge lists a TXT record raw, quoted (`"v=spf1 ..."`, long values in several
+ * quoted chunks), but returns it unquoted from a create or update. Everything
+ * foundry compares sees the unquoted form.
+ */
+export function unquoteTxt(content) {
+    const trimmed = content.trim();
+    if (!trimmed.startsWith('"'))
+        return content;
+    const chunks = [...trimmed.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => (m[1] ?? '').replace(/\\(.)/g, '$1'));
+    return chunks.length > 0 ? chunks.join('') : content;
+}
+function summary(record) {
+    return {
+        id: record.id,
+        type: record.type,
+        name: record.name,
+        content: record.type === 'TXT' ? unquoteTxt(record.content) : record.content,
+    };
+}
+export function limiter(max) {
+    let active = 0;
+    const waiting = [];
+    return async (task) => {
+        while (active >= max)
+            await new Promise((resolve) => waiting.push(resolve));
+        active++;
+        try {
+            return await task();
+        }
+        finally {
+            active--;
+            waiting.shift()?.();
+        }
+    };
+}
+const isEdgeNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
+const isEdgeForbidden = (error) => error instanceof EdgeApiError && error.code === 'forbidden';
+/**
+ * Edge's company-less platform calls share one per-org slot of 4 and answer a
+ * full slot with `rate_limited` and a retry hint, without queueing. The SDK
+ * does not retry, so every call here waits the hint out, up to this many tries.
+ */
+export const EDGE_DNS_RATE_LIMIT_ATTEMPTS = 5;
+const DEFAULT_RETRY_AFTER_SECONDS = 2;
+const MAX_RETRY_AFTER_SECONDS = 30;
+/**
+ * Retries a call edge answered `rate_limited`, waiting out its hint (capped at
+ * 30 s), up to {@link EDGE_DNS_RATE_LIMIT_ATTEMPTS} tries. Shared by every
+ * edge adapter, since all platform calls draw on the one slot.
+ */
+export function rateLimitRetrier(sleepOption) {
+    const sleep = sleepOption ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    return async (task) => {
+        for (let attempt = 1;; attempt++) {
+            try {
+                return await task();
+            }
+            catch (error) {
+                if (!(error instanceof EdgeApiError) ||
+                    error.code !== 'rate_limited' ||
+                    attempt >= EDGE_DNS_RATE_LIMIT_ATTEMPTS) {
+                    throw error;
+                }
+                await sleep(Math.min(error.retryAfterSeconds ?? DEFAULT_RETRY_AFTER_SECONDS, MAX_RETRY_AFTER_SECONDS) * 1000);
+            }
+        }
+    };
+}
+const OWNED_BY_COMPANY = 'owned by the company; foundry will not change it';
+/**
+ * Edge answers an update or delete of a live record with no edge row
+ * `not_found` ("adopt it first"). So the adapter adopts a record the moment it
+ * is about to be changed or removed: every record it has returned that the
+ * list reported with `owner: null` is remembered, and adopted just before the
+ * first write that names it. Adopt is idempotent and the list reports the
+ * owner once adopted, so nothing is recorded in the plan and a later apply
+ * adopts nothing. A record foundry only reads (a foreign record it refuses to
+ * overwrite) is never adopted. An `unsupported_type`, `taken` or `organisation`
+ * skip is an error; an `unclaimed` record is left alone. A company's own record
+ * (edge answers `forbidden`) is never changed: the error names zone, name and
+ * type. A `rate_limited` answer is retried with edge's hint, up to 5 tries.
+ */
+export function createEdgeDns(client, options = {}) {
+    const retrying = rateLimitRetrier(options.sleep);
+    /** The SDK client with every call retried on `rate_limited`. */
+    const dns = {
+        list: (input) => retrying(() => client.list(input)),
+        create: (input) => retrying(() => client.create(input)),
+        update: (zone, id, patch) => retrying(() => client.update(zone, id, patch)),
+        remove: (zone, id) => retrying(() => client.remove(zone, id)),
+        adopt: (input) => retrying(() => client.adopt(input)),
+    };
+    const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
+    /** zone -> record id -> a seen live record with no edge row yet. */
+    const unadopted = new Map();
+    /** zone -> record id -> every record seen, to name one in an error. */
+    const seen = new Map();
+    const describe = (zone, recordId) => {
+        const record = seen.get(zone)?.get(recordId);
+        return record ? `${record.type} ${record.name} in ${zone}` : `record ${recordId} in ${zone}`;
+    };
+    const remember = (zone, records) => {
+        const all = seen.get(zone) ?? new Map();
+        for (const record of records)
+            all.set(record.id, record);
+        seen.set(zone, all);
+        const pending = unadopted.get(zone) ?? new Map();
+        for (const record of records) {
+            if (record.owner === null)
+                pending.set(record.id, record);
+            else
+                pending.delete(record.id);
+        }
+        unadopted.set(zone, pending);
+    };
+    const adopt = async (zone, record) => {
+        const result = await writeSlot(() => dns.adopt({
+            zone,
+            records: [
+                {
+                    name: record.name,
+                    type: record.type,
+                    id: record.id,
+                    content: record.content,
+                },
+            ],
+        }));
+        const skipped = result.skipped[0];
+        if (skipped) {
+            throw new Error(skipped.reason === 'organisation'
+                ? `edge dns: ${record.type} ${record.name} in ${zone} is ${OWNED_BY_COMPANY}`
+                : `edge dns: ${record.type} ${record.name} in ${zone} cannot be adopted (${skipped.reason}); remove or fix it by hand`);
+        }
+        unadopted.get(zone)?.delete(record.id);
+    };
+    /** Adopts `recordId` when it was seen without an edge row. */
+    const ensureAdopted = async (zone, recordId) => {
+        const record = unadopted.get(zone)?.get(recordId);
+        if (record)
+            await adopt(zone, record);
+    };
+    /** Runs a write; on `not_found` adopts the live record once and retries. */
+    const writeExisting = async (zone, recordId, write) => {
+        await ensureAdopted(zone, recordId);
+        // `forbidden` also answers a revoked or under-scoped platform key, so the
+        // record is listed again and the company message is used only when its
+        // owner really is an organisation; anything else is the original error.
+        const refuseCompanyRecord = async (error) => {
+            if (!isEdgeForbidden(error))
+                throw error;
+            const known = seen.get(zone)?.get(recordId);
+            let owner;
+            try {
+                const { records } = await dns.list({
+                    zone,
+                    ...(known ? { name: known.name, type: known.type } : {}),
+                });
+                remember(zone, records);
+                owner = records.find((r) => r.id === recordId)?.owner;
+            }
+            catch {
+                throw error;
+            }
+            if (owner !== 'organisation')
+                throw error;
+            throw new Error(`edge dns: ${describe(zone, recordId)} is ${OWNED_BY_COMPANY}`);
+        };
+        try {
+            return await writeSlot(write);
+        }
+        catch (error) {
+            if (!isEdgeNotFound(error))
+                return refuseCompanyRecord(error);
+            const live = (await dns.list({ zone })).records;
+            remember(zone, live);
+            const record = live.find((r) => r.id === recordId);
+            if (!record || record.owner !== null)
+                throw error;
+            await adopt(zone, record);
+            try {
+                return await writeSlot(write);
+            }
+            catch (retryError) {
+                return refuseCompanyRecord(retryError);
+            }
+        }
+    };
+    const body = (rec) => ({
+        content: rec.content,
+        ...(rec.proxied === undefined ? {} : { proxied: rec.proxied }),
+        ...(rec.ttl === undefined ? {} : { ttl: rec.ttl }),
+        ...(rec.priority === undefined ? {} : { priority: rec.priority }),
+    });
+    const list = async (zone, opts) => {
+        const { records } = await dns.list({
+            zone,
+            ...(opts?.name ? { name: opts.name } : {}),
+            ...(opts?.type ? { type: opts.type } : {}),
+        });
+        remember(zone, records);
+        return records.map(summary);
+    };
+    return {
+        findDnsRecord: (zone, name, type) => list(zone, { name, type }),
+        listDnsRecords: list,
+        async createDnsRecord(zone, rec) {
+            const created = await writeSlot(() => dns.create({
+                zone,
+                name: rec.name,
+                type: rec.type,
+                ...body(rec),
+            }));
+            return { id: created.id, name: created.name, content: summary(created).content };
+        },
+        async updateDnsRecord(zone, recordId, rec) {
+            const updated = await writeExisting(zone, recordId, () => dns.update(zone, recordId, body(rec)));
+            return { id: updated.id, name: updated.name, content: summary(updated).content };
+        },
+        async deleteDnsRecord(zone, recordId) {
+            await writeExisting(zone, recordId, () => dns.remove(zone, recordId));
+        },
+    };
+}

package/dist/plan/edge-ratelimits.d.ts

@@ -0,0 +1,54 @@
+import type { createEdgeClient } from '@wtfalch/edge';
+import { type WriteSlot } from './edge-dns.js';
+/** The edge SDK's platform rate limiting client: `createEdgeClient({ ... }).platform.ratelimits`. */
+export type EdgePlatformRateLimits = ReturnType<typeof createEdgeClient>['platform']['ratelimits'];
+/** One rate limiting rule, in the shape foundry has always sent Cloudflare. */
+export interface RateLimitRuleInput {
+    description: string;
+    expression: string;
+    action: string;
+    ratelimit: {
+        characteristics: string[];
+        period: number;
+        requests_per_period: number;
+        mitigation_timeout: number;
+    };
+}
+/**
+ * Foundry's Cloudflare rate limiting calls. Every one goes through this; the
+ * one implementation is {@link createEdgeRateLimits}, which speaks to the edge
+ * service with the platform credential.
+ */
+export interface RateLimitPort {
+    /** Every live rule in the zone, whoever owns it. */
+    listRateLimitRules(zoneId: string): Promise<Array<{
+        id: string;
+        description: string | null;
+    }>>;
+    /** Makes the rule, or returns the one already made for that zone and description. Never changes an existing rule. */
+    createRateLimitRule(zoneId: string, rule: RateLimitRuleInput): Promise<{
+        id: string;
+    }>;
+}
+/** Edge answers a create another create of the same rule is making `conflict` + `busy`. */
+export declare const EDGE_RATELIMITS_BUSY_ATTEMPTS = 5;
+export declare const hasReason: (error: unknown, reason: string) => boolean;
+/** Waits 1 s, 2 s, 4 s, then 8 s (the cap) between tries of a `busy` answer. */
+export declare function busyRetrier(sleepOption?: (ms: number) => Promise<void>): <T>(task: () => Promise<T>) => Promise<T>;
+export interface EdgeRateLimitsOptions {
+    sleep?: (ms: number) => Promise<void>;
+    /** Share one slot of {@link EDGE_DNS_WRITE_CONCURRENCY} with the other edge adapters: edge counts them all. */
+    writeSlot?: WriteSlot;
+}
+/**
+ * {@link RateLimitPort} over edge's `platform.ratelimits`.
+ *
+ * Edge answers a create of a live rule that has no edge row `exists`. So the
+ * adapter adopts that rule the moment it is about to create it: it lists the
+ * description, and adopts a view whose `owner` is `null`. Adopt is idempotent
+ * and the list reports the owner afterwards, so nothing is recorded in the
+ * plan. A rule edge reports as `taken` is an error. Create is keyed by zone
+ * and description and never compares content, so a rule that exists comes back
+ * unchanged. A `rate_limited` or `busy` answer is retried.
+ */
+export declare function createEdgeRateLimits(client: EdgePlatformRateLimits, options?: EdgeRateLimitsOptions): RateLimitPort;

package/dist/plan/edge-ratelimits.js

@@ -0,0 +1,79 @@
+import { EdgeApiError } from '@wtfalch/edge';
+import { EDGE_DNS_WRITE_CONCURRENCY, limiter, rateLimitRetrier, } from './edge-dns.js';
+/** Edge answers a create another create of the same rule is making `conflict` + `busy`. */
+export const EDGE_RATELIMITS_BUSY_ATTEMPTS = 5;
+const BUSY_FIRST_DELAY_MS = 1000;
+const BUSY_MAX_DELAY_MS = 8000;
+export const hasReason = (error, reason) => error instanceof EdgeApiError && error.code === 'conflict' && String(error.reason) === reason;
+/** Waits 1 s, 2 s, 4 s, then 8 s (the cap) between tries of a `busy` answer. */
+export function busyRetrier(sleepOption) {
+    const sleep = sleepOption ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    return async (task) => {
+        for (let attempt = 1;; attempt++) {
+            try {
+                return await task();
+            }
+            catch (error) {
+                if (!hasReason(error, 'busy') || attempt >= EDGE_RATELIMITS_BUSY_ATTEMPTS)
+                    throw error;
+                await sleep(Math.min(BUSY_FIRST_DELAY_MS * 2 ** (attempt - 1), BUSY_MAX_DELAY_MS));
+            }
+        }
+    };
+}
+/**
+ * {@link RateLimitPort} over edge's `platform.ratelimits`.
+ *
+ * Edge answers a create of a live rule that has no edge row `exists`. So the
+ * adapter adopts that rule the moment it is about to create it: it lists the
+ * description, and adopts a view whose `owner` is `null`. Adopt is idempotent
+ * and the list reports the owner afterwards, so nothing is recorded in the
+ * plan. A rule edge reports as `taken` is an error. Create is keyed by zone
+ * and description and never compares content, so a rule that exists comes back
+ * unchanged. A `rate_limited` or `busy` answer is retried.
+ */
+export function createEdgeRateLimits(client, options = {}) {
+    const rateRetry = rateLimitRetrier(options.sleep);
+    const busyRetry = busyRetrier(options.sleep);
+    const retrying = (task) => busyRetry(() => rateRetry(task));
+    const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
+    /** `zoneId/description` keys already adopted (or created) through this adapter. */
+    const adopted = new Set();
+    const adoptLive = async (zoneId, description) => {
+        const key = `${zoneId}/${description}`;
+        if (adopted.has(key))
+            return;
+        const { rules } = await retrying(() => client.list({ zoneId, description }));
+        const view = rules.find((r) => r.description === description && r.state !== 'removed');
+        if (view && view.owner === null) {
+            const result = await writeSlot(() => retrying(() => client.adopt({ rules: [{ zoneId, description, id: view.id }] })));
+            if (result.skipped.length > 0) {
+                throw new Error(`edge rate limits: rule '${description}' in zone ${zoneId} cannot be adopted (${result.skipped[0]?.reason}); remove or fix it by hand`);
+            }
+        }
+        adopted.add(key);
+    };
+    return {
+        async listRateLimitRules(zoneId) {
+            const { rules } = await retrying(() => client.list({ zoneId }));
+            return rules
+                .filter((r) => r.state !== 'removed')
+                .map((r) => ({ id: r.id, description: r.description }));
+        },
+        async createRateLimitRule(zoneId, rule) {
+            await adoptLive(zoneId, rule.description);
+            const create = () => writeSlot(() => retrying(() => client.create({ zoneId, ...rule })));
+            try {
+                return { id: (await create()).id };
+            }
+            catch (error) {
+                if (!hasReason(error, 'exists'))
+                    throw error;
+                // The rule went live between the adopt and the create: adopt it and try once more.
+                adopted.delete(`${zoneId}/${rule.description}`);
+                await adoptLive(zoneId, rule.description);
+                return { id: (await create()).id };
+            }
+        },
+    };
+}

package/dist/plan/edge-tunnels.d.ts

@@ -0,0 +1,44 @@
+import type { TunnelIngressRule, createEdgeClient } from '@wtfalch/edge';
+import { type WriteSlot } from './edge-dns.js';
+/** The edge SDK's platform tunnel client: `createEdgeClient({ ... }).platform.tunnels`. */
+export type EdgePlatformTunnels = ReturnType<typeof createEdgeClient>['platform']['tunnels'];
+/** One ingress rule. `path` tells rules on one hostname apart; the catch-all has none. */
+export type TunnelIngress = TunnelIngressRule;
+export interface TunnelSummary {
+    /** Cloudflare's tunnel id: what every edge tunnel call takes. */
+    id: string;
+    name: string;
+}
+/**
+ * Foundry's tunnel calls. Every tunnel call in foundry goes through this; the
+ * one implementation is {@link createEdgeTunnels}, which speaks to the edge
+ * service with the platform credential.
+ */
+export interface TunnelPort {
+    /** The tunnel named `name` that foundry may use (the platform's own, or one nobody adopted yet). */
+    findTunnelByName(name: string): Promise<TunnelSummary | undefined>;
+    createTunnel(name: string): Promise<TunnelSummary>;
+    /** Replaces the whole ingress; the last rule is the catch-all and has no hostname. */
+    putTunnelConfig(tunnelId: string, config: {
+        ingress: TunnelIngress[];
+    }): Promise<void>;
+    /** The connector token: a live credential. Hand it to the connector and nowhere else. */
+    getTunnelToken(tunnelId: string): Promise<string>;
+    deleteTunnel(tunnelId: string): Promise<void>;
+}
+/**
+ * Edge answers a config, token or delete call for a live tunnel with no edge
+ * row `not_found` ("create or adopt it first"). So the adapter adopts a tunnel
+ * the moment it is about to be configured, read the token of or deleted: a
+ * tunnel it found by name (or that a create refused with `exists`) and whose
+ * owner the list reported as `null` is remembered, and adopted just before the
+ * first such call. A tunnel foundry recorded in an earlier apply and now names
+ * by id only is looked up on `not_found`, adopted if unowned, and the call
+ * retried once. Adopt is idempotent and the list reports the owner afterwards,
+ * so nothing is recorded in the plan and a later apply adopts nothing. A
+ * name claim's tunnel (`organisation`) is never touched. A `rate_limited` answer is retried with edge's hint, up to 5 tries.
+ */
+export declare function createEdgeTunnels(client: EdgePlatformTunnels, options?: {
+    sleep?: (ms: number) => Promise<void>;
+    writeSlot?: WriteSlot;
+}): TunnelPort;

package/dist/plan/edge-tunnels.js

@@ -0,0 +1,108 @@
+import { EdgeApiError } from '@wtfalch/edge';
+import { EDGE_DNS_WRITE_CONCURRENCY, limiter, rateLimitRetrier, } from './edge-dns.js';
+const isNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
+/** Edge's 409 for a live tunnel with the name and no edge row. */
+const isExists = (error) => error instanceof EdgeApiError && error.code === 'conflict' && error.reason === 'exists';
+/**
+ * Edge answers a config, token or delete call for a live tunnel with no edge
+ * row `not_found` ("create or adopt it first"). So the adapter adopts a tunnel
+ * the moment it is about to be configured, read the token of or deleted: a
+ * tunnel it found by name (or that a create refused with `exists`) and whose
+ * owner the list reported as `null` is remembered, and adopted just before the
+ * first such call. A tunnel foundry recorded in an earlier apply and now names
+ * by id only is looked up on `not_found`, adopted if unowned, and the call
+ * retried once. Adopt is idempotent and the list reports the owner afterwards,
+ * so nothing is recorded in the plan and a later apply adopts nothing. A
+ * name claim's tunnel (`organisation`) is never touched. A `rate_limited` answer is retried with edge's hint, up to 5 tries.
+ */
+export function createEdgeTunnels(client, options = {}) {
+    const retrying = rateLimitRetrier(options.sleep);
+    const tunnels = {
+        list: (filter) => retrying(() => client.list(filter)),
+        create: (input) => retrying(() => client.create(input)),
+        putConfig: (id, input) => retrying(() => client.putConfig(id, input)),
+        token: (id) => retrying(() => client.token(id)),
+        remove: (id) => retrying(() => client.remove(id)),
+        adopt: (input) => retrying(() => client.adopt(input)),
+    };
+    const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
+    /** tunnel id -> a seen live tunnel with no edge row yet. */
+    const unadopted = new Map();
+    const remember = (views) => {
+        for (const view of views) {
+            if (view.owner === null)
+                unadopted.set(view.id, view);
+            else
+                unadopted.delete(view.id);
+        }
+    };
+    const adopt = async (view) => {
+        const result = await writeSlot(() => tunnels.adopt({ tunnels: [{ name: view.name, id: view.id }] }));
+        const skipped = result.skipped[0];
+        if (skipped) {
+            throw new Error(skipped.reason === 'organisation'
+                ? `edge tunnels: ${view.name} is a company's own tunnel; foundry will not change it`
+                : `edge tunnels: ${view.name} cannot be adopted (${skipped.reason}); remove or fix it by hand`);
+        }
+        if (result.notFound.length > 0) {
+            throw new EdgeApiError(404, 'not_found', `edge tunnels: ${view.name} is no longer live`);
+        }
+        unadopted.delete(view.id);
+    };
+    /** Runs a call on a tunnel; adopts it first when seen unowned, and once more on `not_found`. */
+    const onTunnel = async (tunnelId, call) => {
+        const seen = unadopted.get(tunnelId);
+        if (seen)
+            await adopt(seen);
+        try {
+            return await call();
+        }
+        catch (error) {
+            if (!isNotFound(error))
+                throw error;
+            const live = (await tunnels.list()).tunnels;
+            remember(live);
+            const view = live.find((t) => t.id === tunnelId);
+            if (!view || view.owner !== null)
+                throw error;
+            await adopt(view);
+            return call();
+        }
+    };
+    const usable = (views) => views.find((v) => v.owner === 'platform') ?? views.find((v) => v.owner === null);
+    const findTunnelByName = async (name) => {
+        const { tunnels: found } = await tunnels.list({ name });
+        remember(found);
+        const view = usable(found.filter((v) => v.name === name && v.state !== 'removed'));
+        return view ? { id: view.id, name: view.name } : undefined;
+    };
+    return {
+        findTunnelByName,
+        async createTunnel(name) {
+            try {
+                const created = await writeSlot(() => tunnels.create({ name }));
+                return { id: created.id, name: created.name };
+            }
+            catch (error) {
+                // A live tunnel of this name exists with no edge row (made before edge
+                // owned tunnels): use it, adopting it before its first config call.
+                if (!isExists(error))
+                    throw error;
+                const found = await findTunnelByName(name);
+                if (!found)
+                    throw error;
+                return found;
+            }
+        },
+        async putTunnelConfig(tunnelId, config) {
+            await onTunnel(tunnelId, () => writeSlot(() => tunnels.putConfig(tunnelId, config)));
+        },
+        async getTunnelToken(tunnelId) {
+            const { token } = await onTunnel(tunnelId, () => tunnels.token(tunnelId));
+            return token;
+        },
+        async deleteTunnel(tunnelId) {
+            await onTunnel(tunnelId, () => writeSlot(() => tunnels.remove(tunnelId)));
+        },
+    };
+}

package/dist/plan/edge-workers.d.ts

@@ -0,0 +1,31 @@
+import type { createEdgeClient } from '@wtfalch/edge';
+import { type WriteSlot } from './edge-dns.js';
+import type { WorkersPort } from './executor.js';
+/** The edge SDK's platform Workers client: `createEdgeClient({ ... }).platform.workers`. */
+export type EdgePlatformWorkers = ReturnType<typeof createEdgeClient>['platform']['workers'];
+/** Edge answers a first upload of a name that another upload is making, or a delete in flight, `conflict` + `busy`. */
+export declare const EDGE_WORKERS_BUSY_ATTEMPTS = 5;
+/** What the host supplies: fetches the artifact and returns its bytes, verified against `sha256`. Foundry never fetches. */
+export interface EdgeWorkersOptions {
+    fetchArtifact: (url: string, sha256: string) => Promise<Uint8Array>;
+    sleep?: (ms: number) => Promise<void>;
+    /** Share one slot of {@link EDGE_DNS_WRITE_CONCURRENCY} with the other edge adapters: edge counts them all. */
+    writeSlot?: WriteSlot;
+}
+/**
+ * {@link WorkersPort} over edge's `platform.workers`. The host fetches the
+ * artifact (`fetchArtifact`); this sends its base64 bytes and the sha256 to
+ * edge, which checks the digest again. The bytes are never kept, logged or
+ * put into an error here.
+ *
+ * Edge refuses to touch a live script or route that has no edge row (an upload
+ * of a live name answers `exists`, a delete answers `not_found`). So the
+ * adapter adopts one the moment it is about to be uploaded over or deleted:
+ * it lists the name (or the zone's routes), and adopts only a view whose
+ * `owner` is `null`. Adopt is idempotent and the list reports the owner
+ * afterwards, so nothing is recorded in the plan. A `skipped` route is an
+ * error. `scriptExists` and `findRoute` only read: a foreign script or route
+ * foundry refuses to overwrite is never adopted. A 404 on a delete means gone.
+ * A `rate_limited` or `busy` answer is retried.
+ */
+export declare function createEdgeWorkers(client: EdgePlatformWorkers, options: EdgeWorkersOptions): WorkersPort;