orez 0.9.5 → 0.9.6

package/README.md

@@ -21,6 +21,29 @@ hosts. It replaces Zero's server side and speaks the Zero protocol to the real
 forking Zero's query or mutation API. See the
 [Orez Lite server documentation](docs/sync/README.md).
 
+## Cloudflare deploy integration
+
+`orez/cf-deploy` is the canonical deploy-time integration for One/Orez apps
+using the split app-worker and Durable Object data-worker architecture. It
+exports worker-shim generators, migration-module builders, wrangler
+normalization, bundle pruning, and readiness checks. Consumers provide their
+own token prefix and app-specific policy:
+
+```ts
+import { buildRustSyncUserShimSource, cfDeployConfig } from 'orez/cf-deploy'
+
+const config = cfDeployConfig('example', {
+  compiledWasmModules: ['example-wasm/module.wasm'],
+})
+
+const source = buildRustSyncUserShimSource(config, {
+  feedTables: {},
+})
+```
+
+Individual modules are also exported, such as
+`orez/cf-deploy/bundle` and `orez/cf-deploy/nativeMigrations`.
+
 ## Requirements
 
 - **Bun** 1.0+ or **Node.js** 20+

package/dist/cf-deploy/bundle.d.ts

@@ -0,0 +1,21 @@
+import { type Plugin } from 'esbuild';
+import type { CfDeployConfig } from './config.js';
+import type { WorkerChunkPruneSignatures } from './prune.js';
+export interface BundleCloudflareDoWorkerOptions {
+    workerDir: string;
+    shimPath: string;
+    outfile: string;
+    writeMigrationModule: (workerDir: string) => Promise<string>;
+    chunkPruneSignatures?: WorkerChunkPruneSignatures;
+}
+export declare const SERVER_CONTEXT_STUBS: Record<string, string>;
+export declare function orezCfAliasPlugin(cfg: CfDeployConfig, aliases: Record<string, string>, resolveDir: string, nodeModulesPath: string, wasmOutDir?: string, options?: {
+    nativeApplicationSql?: boolean;
+}): Plugin;
+export declare function bundleCloudflareDoWorker(cfg: CfDeployConfig, options: BundleCloudflareDoWorkerOptions): Promise<void>;
+/** bundle a One app with SQL storage but without the zero-cache runtime. */
+export declare function bundleCloudflareRustSyncAppWorker(cfg: CfDeployConfig, options: BundleCloudflareDoWorkerOptions): Promise<void>;
+export declare function bundleCloudflareDoDataWorker(cfg: CfDeployConfig, options: BundleCloudflareDoWorkerOptions): Promise<void>;
+/** bundle a data worker that owns the SQL DO without the PG translator or zero-cache. */
+export declare function bundleCloudflareNativeDataWorker(cfg: CfDeployConfig, options: BundleCloudflareDoWorkerOptions): Promise<void>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/cf-deploy/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/cf-deploy/bundle.ts"],"names":[],"mappings":"AAYA,OAAO,EAAS,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AAa5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD;AAWD,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEvD,CAAA;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,UAAU,SAAa,EACvB,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C,MAAM,CAuIR;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,+BAA+B,iBAoBzC;AAED,4EAA4E;AAC5E,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,+BAA+B,iBAiBzC;AAyID,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,+BAA+B,iBA6CzC;AAED,yFAAyF;AACzF,wBAAsB,gCAAgC,CACpD,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,+BAA+B,iBAiCzC"}

package/dist/cf-deploy/bundle.js

@@ -0,0 +1,347 @@
+import { copyFileSync, existsSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync, } from 'fs';
+import { createRequire } from 'module';
+import { basename, dirname, join } from 'path';
+import { build } from 'esbuild';
+import { getBrowserAliases, getBrowserDefine } from '../worker/browser-build-config.js';
+import { prepareZeroCacheForCF } from '../worker/cf-patches.js';
+import { NODE_EXTERNALS, isCloudflarePgImporter, isOrezAliasImporter, resolveAlias, } from './leaves.js';
+import { pruneUnreachableWorkerModules, shimWorkerCreateRequire } from './prune.js';
+import { cloudflarePgVirtualModule } from './sources.js';
+// react's build-context marker packages, resolved for the SERVER context these
+// workers are. 'server-only' ships a throwing default entry (its guard targets
+// client bundles); under this bundle's [workerd, worker, import] conditions it
+// resolves to that throw and kills any importing module at init — in prod this
+// took out the data-worker push handler for every custom mutator (2026-07-09).
+// the DO/data worker is a server context, so the marker must be a no-op here.
+// unlike the generic aliases below, these apply to EVERY importer (consumer
+// code, not just orez internals). scripts/check/zero-push-graph.ts asserts this
+// map covers any marker package the push graph imports.
+export const SERVER_CONTEXT_STUBS = {
+    'server-only': 'export {}\n',
+};
+export function orezCfAliasPlugin(cfg, aliases, resolveDir, nodeModulesPath, wasmOutDir = resolveDir, options) {
+    const entries = Object.entries(aliases);
+    const utilVirtualModule = 'export function promisify(fn) { return fn }\nexport function inspect(value) { try { return JSON.stringify(value) } catch { return String(value) } }\nexport function format(...args) { return args.map((arg) => typeof arg === "string" ? arg : inspect(arg)).join(" ") }\nexport function stripVTControlCharacters(value) { return value }\nexport function styleText(_format, text) { return text }\nexport function inherits(ctor, superCtor) { ctor.prototype = Object.create(superCtor.prototype); ctor.prototype.constructor = ctor }\nexport function deprecate(fn) { return fn }\nexport const types = { isDate: (value) => value instanceof Date, isRegExp: (value) => value instanceof RegExp, isTypedArray: (value) => ArrayBuffer.isView(value) && !(value instanceof DataView), isProxy: () => false }\nexport default { promisify, inspect, format, stripVTControlCharacters, styleText, inherits, deprecate, types }\n';
+    const eventsVirtualModule = 'export class EventEmitter { constructor() { this._events = new Map() } on(event, listener) { const list = this._events.get(event) || []; list.push(listener); this._events.set(event, list); return this } once(event, listener) { const wrapped = (...args) => { this.off(event, wrapped); listener(...args) }; return this.on(event, wrapped) } off(event, listener) { const list = this._events.get(event); if (list) this._events.set(event, list.filter((item) => item !== listener)); return this } removeListener(event, listener) { return this.off(event, listener) } removeAllListeners(event) { if (event === undefined) this._events.clear(); else this._events.delete(event); return this } emit(event, ...args) { for (const listener of this._events.get(event) || []) listener(...args); return true } }\nexport default EventEmitter\n';
+    const fsVirtualModule = 'const missing = () => new Error("filesystem is not available in Cloudflare Workers")\nexport function existsSync() { return false }\nexport function readFileSync() { return "" }\nexport function writeFileSync() {}\nexport function mkdirSync() {}\nexport function rmSync() {}\nexport function statSync() { return { size: 0, mode: 0, isFile: () => false, isDirectory: () => false } }\nexport function stat(_path, callback) { const error = missing(); if (callback) { queueMicrotask(() => callback(error)); return } return Promise.reject(error) }\nexport function createReadStream() { return { on() { return this }, once() { return this }, pipe(target) { return target }, destroy() {} } }\nexport function readFile() { return Promise.resolve("") }\nexport function writeFile() { return Promise.resolve() }\nexport function mkdir() { return Promise.resolve() }\nexport function mkdtemp(prefix = "") { return Promise.resolve(`${prefix}stub`) }\nexport function rm() { return Promise.resolve() }\nexport function access() { return Promise.reject(missing()) }\nexport const promises = { readFile, writeFile, mkdir, mkdtemp, rm, stat: () => Promise.reject(missing()), access }\nexport default { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, statSync, stat, createReadStream, readFile, writeFile, mkdir, mkdtemp, rm, access, promises }\n';
+    const pathVirtualModule = 'export const sep = "/"\nfunction normalizePath(path) { const absolute = String(path).startsWith("/"); const parts = []; for (const part of String(path).split("/")) { if (!part || part === ".") continue; if (part === "..") parts.pop(); else parts.push(part) } const normalized = parts.join("/"); return `${absolute ? "/" : ""}${normalized}` || (absolute ? "/" : ".") }\nexport const normalize = normalizePath\nexport function join(...parts) { return normalizePath(parts.filter(Boolean).join("/")) }\nexport function resolve(...parts) { const joined = parts.filter(Boolean).join("/"); return normalizePath(joined.startsWith("/") ? joined : `/${joined}`) }\nexport function basename(path) { const normalized = normalizePath(path); return normalized === "/" ? "" : normalized.split("/").pop() || "" }\nexport function dirname(path) { const normalized = normalizePath(path); if (normalized === "/") return "/"; const parts = normalized.split("/"); parts.pop(); return parts.join("/") || (normalized.startsWith("/") ? "/" : ".") }\nexport function relative(_from, to) { return normalizePath(to) }\nexport function extname(path) { const base = basename(path); const dot = base.lastIndexOf("."); return dot > 0 ? base.slice(dot) : "" }\nexport default { sep, normalize, join, resolve, basename, dirname, relative, extname }\n';
+    const bufferVirtualModule = 'export const Buffer = globalThis.Buffer\nexport default { Buffer }\n';
+    const virtualModules = {
+        buffer: bufferVirtualModule,
+        'node:buffer': bufferVirtualModule,
+        util: utilVirtualModule,
+        'node:util': utilVirtualModule,
+        events: eventsVirtualModule,
+        'node:events': eventsVirtualModule,
+        fs: fsVirtualModule,
+        'node:fs': fsVirtualModule,
+        'fs/promises': fsVirtualModule,
+        'node:fs/promises': fsVirtualModule,
+        path: pathVirtualModule,
+        'node:path': pathVirtualModule,
+        '@dotenvx/dotenvx': 'const empty = { parsed: {}, error: undefined }\nexport function config() { return empty }\nexport function configDotenv() { return empty }\nexport function parse() { return {} }\nexport function populate(target, source = {}) { if (target && source && typeof target === "object") Object.assign(target, source); return target }\nexport function decrypt() { return "" }\nexport default { config, configDotenv, parse, populate, decrypt }\n',
+        '@fastify/websocket': 'export default function websocket() {}\n',
+        '@opentelemetry/api': 'const noopSpan = { setAttribute() { return this }, setAttributes() { return this }, addEvent() { return this }, recordException() { return this }, setStatus() { return this }, end() {}, spanContext() { return {} } }\nexport const ROOT_CONTEXT = {}\nexport const SpanStatusCode = { OK: 1, ERROR: 2, UNSET: 0 }\nexport const DiagLogLevel = { NONE: 0, ERROR: 30, WARN: 50, INFO: 60, DEBUG: 70, VERBOSE: 80, ALL: 9999 }\nexport const context = { active() { return ROOT_CONTEXT }, with(_ctx, fn, thisArg, ...args) { return fn.apply(thisArg, args) }, bind(_ctx, target) { return target } }\nexport const propagation = { inject() {}, extract(_ctx) { return _ctx || ROOT_CONTEXT } }\nexport const trace = { getTracer() { return { startSpan() { return noopSpan }, startActiveSpan(_name, a, b, c) { const fn = typeof a === "function" ? a : typeof b === "function" ? b : c; return fn(noopSpan) } } }, setSpan(ctx) { return ctx }, getSpan() { return noopSpan } }\nexport const metrics = { getMeter() { return { createCounter() { return { add() {} } }, createUpDownCounter() { return { add() {} } }, createHistogram() { return { record() {} } }, createGauge() { return { record() {} } }, createObservableGauge() { return { addCallback() {} } }, createObservableCounter() { return { addCallback() {} } } } } }\nexport const diag = { setLogger() {}, debug() {}, info() {}, warn() {}, error() {}, verbose() {} }\n',
+        '@opentelemetry/api-logs': 'export const SeverityNumber = { TRACE: 1, DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17, FATAL: 21 }\nexport const logs = { getLogger() { return { emit() {} } } }\n',
+        '@opentelemetry/auto-instrumentations-node': 'export function getNodeAutoInstrumentations() { return [] }\n',
+        '@opentelemetry/exporter-metrics-otlp-http': 'export class OTLPMetricExporter { constructor() {} }\n',
+        '@opentelemetry/resources': 'export function resourceFromAttributes(attributes) { return { attributes } }\n',
+        '@opentelemetry/sdk-metrics': 'export class MeterProvider { constructor() {} getMeter() { return { createObservableGauge() { return { addCallback() {} } }, createObservableCounter() { return { addCallback() {} } } } } async shutdown() {} }\nexport class PeriodicExportingMetricReader { constructor() {} }\n',
+        '@opentelemetry/sdk-node': 'export class NodeSDK { constructor() {} start() {} async shutdown() {} }\n',
+        '@opentelemetry/semantic-conventions': "export const ATTR_SERVICE_VERSION = 'service.version'\n",
+        'chalk-template': 'export function template(strings, ...values) { return String.raw({ raw: strings }, ...values) }\nexport default template\n',
+        'command-line-usage': 'export default function commandLineUsage() { return "" }\n',
+        'is-in-subnet': 'export function isIPv6(value) { return String(value).includes(":") }\nexport function isPrivate() { return false }\nexport function isReserved() { return false }\n',
+        ...SERVER_CONTEXT_STUBS,
+    };
+    if (!options?.nativeApplicationSql) {
+        const doBackendPath = join(nodeModulesPath, 'orez', 'dist', 'pg-proxy-do-backend.js');
+        const doBackendVirtualSpecifier = `${cfg.prefix}-do-backend`;
+        virtualModules.pg = cloudflarePgVirtualModule(cfg, doBackendPath);
+        virtualModules[doBackendVirtualSpecifier] =
+            `export { DoBackend } from ${JSON.stringify(doBackendPath)}\n`;
+    }
+    return {
+        name: 'orez-cf-aliases',
+        setup(buildApi) {
+            // consumer-declared .wasm modules (cfg.compiledWasmModules) → attach each as a
+            // CompiledWasm worker module: resolve the specifier (honoring its package
+            // exports), copy the file next to the worker output, and rewrite the import to
+            // a relative external specifier. wrangler's CompiledWasm rule then turns it
+            // into a WebAssembly.Module at runtime (workerd forbids compiling wasm from
+            // bytes). app-neutral — every specifier comes from the consumer's config, not
+            // baked in here. each onResolve only fires when that specifier is imported.
+            const wasmModules = cfg.compiledWasmModules ?? [];
+            if (wasmModules.length > 0) {
+                const requireFrom = createRequire(join(nodeModulesPath, '..', '_orez-cf.cjs'));
+                for (const specifier of wasmModules) {
+                    const filter = new RegExp(`^${specifier.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
+                    buildApi.onResolve({ filter }, () => {
+                        const real = requireFrom.resolve(specifier);
+                        const name = basename(real);
+                        copyFileSync(real, join(wasmOutDir, name));
+                        return { path: `./${name}`, external: true };
+                    });
+                }
+            }
+            for (const specifier of Object.keys(virtualModules)) {
+                const filter = new RegExp(`^${specifier.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
+                buildApi.onResolve({ filter }, (args) => {
+                    if (specifier === 'pg' || specifier.endsWith('-do-backend')) {
+                        if (args.importer &&
+                            !isCloudflarePgImporter(args.importer, resolveDir) &&
+                            !isOrezAliasImporter(args.importer)) {
+                            return undefined;
+                        }
+                        return { path: specifier, namespace: 'orez-cf-virtual' };
+                    }
+                    // server-context stubs apply regardless of importer: consumer app
+                    // code (e.g. an auth module's `import 'server-only'`) must hit the
+                    // no-op, not the throwing client-guard entry
+                    if (specifier in SERVER_CONTEXT_STUBS) {
+                        return { path: specifier, namespace: 'orez-cf-virtual' };
+                    }
+                    if (args.importer && !isOrezAliasImporter(args.importer))
+                        return undefined;
+                    return { path: specifier, namespace: 'orez-cf-virtual' };
+                });
+            }
+            buildApi.onLoad({ filter: /.*/, namespace: 'orez-cf-virtual' }, (args) => ({
+                contents: virtualModules[args.path],
+                loader: 'js',
+                resolveDir,
+            }));
+            for (const [specifier, target] of entries) {
+                const filter = new RegExp(`^${specifier.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
+                buildApi.onResolve({ filter }, async (args) => {
+                    const isZeroRunner = specifier === '@rocicorp/zero/out/zero-cache/src/server/runner/run-worker.js';
+                    const isPatchedParser = specifier.startsWith('libpg-query');
+                    if (!isZeroRunner &&
+                        !isPatchedParser &&
+                        args.importer &&
+                        !isOrezAliasImporter(args.importer)) {
+                        return undefined;
+                    }
+                    return ((await resolveAlias(buildApi, target, resolveDir, args.kind)) ?? {
+                        path: target,
+                    });
+                });
+            }
+        },
+    };
+}
+export async function bundleCloudflareDoWorker(cfg, options) {
+    const { workerDir } = options;
+    const nodeModulesPath = realpathSync([
+        join(workerDir, 'node_modules'),
+        join(workerDir, '..', '..', 'node_modules'),
+        join(process.cwd(), 'node_modules'),
+    ].find((candidate) => existsSync(candidate)) || join(process.cwd(), 'node_modules'));
+    const zeroOverlay = prepareZeroCacheForCF({
+        nodeModulesPath,
+        outDir: join(workerDir, '.orez/zero-cache-cf'),
+    });
+    return bundleCloudflareSplitAppWorker(cfg, options, nodeModulesPath, getBrowserAliases(zeroOverlay));
+}
+/** bundle a One app with SQL storage but without the zero-cache runtime. */
+export async function bundleCloudflareRustSyncAppWorker(cfg, options) {
+    const { workerDir } = options;
+    const nodeModulesPath = realpathSync([
+        join(workerDir, 'node_modules'),
+        join(workerDir, '..', '..', 'node_modules'),
+        join(process.cwd(), 'node_modules'),
+    ].find((candidate) => existsSync(candidate)) || join(process.cwd(), 'node_modules'));
+    return bundleCloudflareSplitAppWorker(cfg, options, nodeModulesPath, {}, { nativeApplicationSql: true });
+}
+async function bundleCloudflareSplitAppWorker(cfg, options, nodeModulesPath, aliases, pluginOptions) {
+    const { workerDir, shimPath, outfile, writeMigrationModule } = options;
+    await writeMigrationModule(workerDir);
+    // expose One's worker output under a stable name so the shim can DYNAMICALLY
+    // import it (getOneWorker -> './one-app.js'). esbuild code-splitting then emits
+    // it as its own lazily-evaluated chunk, so the DO isolates (schema migration /
+    // SQL backend) never evaluate the One app graph — the fix for the 128 MiB DO
+    // OOM. without code-splitting, a single-outfile bundle inlines + eagerly
+    // evaluates the dynamic import, which is what OOMed the DO.
+    const oneAppPath = join(workerDir, 'one-app.js');
+    copyFileSync(join(workerDir, 'index.js'), oneAppPath);
+    // Workers node compatibility provides streams. leaving these external avoids
+    // pulling readable-stream's browser dependency graph into the DO bundle.
+    for (const key of [
+        'node:stream',
+        'stream',
+        'node:stream/promises',
+        'stream/promises',
+        'readable-stream',
+    ]) {
+        delete aliases[key];
+    }
+    // split output into a directory so dynamic imports become real lazy chunks.
+    const outDir = join(workerDir, '.do-bundle');
+    if (existsSync(outDir))
+        rmSync(outDir, { recursive: true, force: true });
+    await build({
+        entryPoints: [shimPath],
+        outdir: outDir,
+        entryNames: 'index',
+        bundle: true,
+        splitting: true,
+        format: 'esm',
+        platform: 'neutral',
+        target: 'es2022',
+        conditions: ['workerd', 'worker', 'import'],
+        mainFields: ['browser', 'module', 'main'],
+        external: ['cloudflare:*', './assets/*', ...NODE_EXTERNALS],
+        define: {
+            ...getBrowserDefine(),
+            // shim the CJS module globals, which are undefined in this workerd ESM
+            // bundle (platform: 'neutral' does not inject them). a bundled dep that
+            // references __filename/__dirname — common in RN/node libraries pulled
+            // into the SSR worker — otherwise throws "__filename is not defined" at
+            // worker startup, failing deploy validation.
+            __filename: JSON.stringify('index.js'),
+            __dirname: JSON.stringify('/'),
+        },
+        plugins: [
+            orezCfAliasPlugin(cfg, aliases, workerDir, nodeModulesPath, workerDir, pluginOptions),
+        ],
+        logLevel: 'silent',
+    });
+    const oneAppChunks = readdirSync(outDir).filter((name) => /^one-app-[A-Za-z0-9_-]+\.js$/.test(name));
+    if (oneAppChunks.length > 1) {
+        throw new Error(`expected at most one lazy one-app chunk, found ${oneAppChunks.length}: ${oneAppChunks.join(', ')}`);
+    }
+    const oneAppChunk = oneAppChunks[0];
+    if (oneAppChunk) {
+        // dynamic Rust-sync shims emit one lazy app chunk. one's external asset
+        // modules import the entry's helpers back from ../index.js, so retarget
+        // those references to that chunk. the static app shim emits no chunk and
+        // needs no rewrite.
+        const assetsDir = join(workerDir, 'assets');
+        if (existsSync(assetsDir)) {
+            for (const name of readdirSync(assetsDir)) {
+                if (!name.endsWith('.js') && !name.endsWith('.mjs'))
+                    continue;
+                const file = join(assetsDir, name);
+                const source = readFileSync(file, 'utf8');
+                const rewritten = source.replace(/(\b(?:from|import)\s*\(?\s*)(['"])\.\.\/index\.js\2/g, `$1$2../${oneAppChunk}$2`);
+                if (rewritten !== source)
+                    writeFileSync(file, rewritten);
+            }
+        }
+    }
+    rmSync(oneAppPath, { force: true });
+    // the shim entry (shimPath) plus the migration + schema-version modules it
+    // statically imports are esbuild INPUTS: esbuild inlined their code into
+    // index.js, so the root source files are orphans. leave them and wrangler's
+    // general `*-*.js` module rule (they all contain a dash) attaches dead
+    // duplicates into every DO isolate — resident weight against the 128 MiB DO
+    // budget the code-splitting above exists to protect. rm them like one-app.js.
+    rmSync(shimPath, { force: true });
+    rmSync(join(workerDir, 'orez-migrations.js'), { force: true });
+    rmSync(join(workerDir, 'orez-schema-version.js'), { force: true });
+    // collect the split output: index.js (entry) + chunk-*.js (lazy graphs) ->
+    // place them where wrangler attaches modules. the entry goes to `outfile`; the
+    // chunks go next to it (the rules glob `assets/**` doesn't cover them, so they
+    // sit beside index.js in dist/worker and the `./chunk-*.js` relative imports
+    // resolve).
+    for (const name of readdirSync(outDir)) {
+        const src = join(outDir, name);
+        if (name === 'index.js') {
+            copyFileSync(src, outfile);
+        }
+        else {
+            copyFileSync(src, join(workerDir, name));
+        }
+    }
+    rmSync(outDir, { recursive: true, force: true });
+    // prune asset modules UNREACHABLE from the worker entry's import graph.
+    // wrangler's `assets/**/*.js` rule attaches every chunk in assets/ as a worker
+    // module, and workerd holds ALL attached modules resident in EVERY isolate.
+    // hundreds of those are orphans (client-only / dead route chunks the server
+    // never imports). that resident-module weight — not the migration — is what
+    // OOMs the 128 MiB DO isolate. attach only what the entry actually reaches.
+    pruneUnreachableWorkerModules(workerDir, basename(outfile));
+    // neutralize the CJS-interop banner that throws at module eval in workerd.
+    shimWorkerCreateRequire(workerDir);
+}
+// bundle the LEAN data-tier worker: the orez data shim (ZeroSqlDO + ZeroCacheDO +
+// embed + migration), NONE of the One app. single-outfile (no splitting needed —
+// this graph is small, ~2.4 MiB, and runs with full DO-isolate headroom). reuses
+// bundleCloudflareDoWorker's orez machinery (overlay + migration module + pg/
+// browser aliases) but skips the one-app copy/split/prune.
+export async function bundleCloudflareDoDataWorker(cfg, options) {
+    const { workerDir, shimPath, outfile, writeMigrationModule } = options;
+    const nodeModulesPath = realpathSync([
+        join(workerDir, 'node_modules'),
+        join(workerDir, '..', '..', 'node_modules'),
+        join(process.cwd(), 'node_modules'),
+    ].find((candidate) => existsSync(candidate)) || join(process.cwd(), 'node_modules'));
+    const zeroOverlay = prepareZeroCacheForCF({
+        nodeModulesPath,
+        outDir: join(workerDir, '.orez/zero-cache-cf'),
+    });
+    await writeMigrationModule(workerDir);
+    const aliases = getBrowserAliases(zeroOverlay);
+    for (const key of [
+        'node:stream',
+        'stream',
+        'node:stream/promises',
+        'stream/promises',
+        'readable-stream',
+    ]) {
+        delete aliases[key];
+    }
+    await build({
+        entryPoints: [shimPath],
+        outfile,
+        bundle: true,
+        format: 'esm',
+        platform: 'neutral',
+        target: 'es2022',
+        conditions: ['workerd', 'worker', 'import'],
+        mainFields: ['browser', 'module', 'main'],
+        external: ['cloudflare:*', ...NODE_EXTERNALS],
+        define: {
+            ...getBrowserDefine(),
+            __filename: JSON.stringify('index.js'),
+            __dirname: JSON.stringify('/'),
+        },
+        plugins: [
+            orezCfAliasPlugin(cfg, aliases, workerDir, nodeModulesPath, dirname(outfile)),
+        ],
+        logLevel: 'silent',
+    });
+}
+/** bundle a data worker that owns the SQL DO without the PG translator or zero-cache. */
+export async function bundleCloudflareNativeDataWorker(cfg, options) {
+    const { workerDir, shimPath, outfile, writeMigrationModule } = options;
+    const nodeModulesPath = realpathSync([
+        join(workerDir, 'node_modules'),
+        join(workerDir, '..', '..', 'node_modules'),
+        join(process.cwd(), 'node_modules'),
+    ].find((candidate) => existsSync(candidate)) || join(process.cwd(), 'node_modules'));
+    await writeMigrationModule(workerDir);
+    await build({
+        entryPoints: [shimPath],
+        outfile,
+        bundle: true,
+        format: 'esm',
+        platform: 'neutral',
+        target: 'es2022',
+        conditions: ['workerd', 'worker', 'import'],
+        mainFields: ['browser', 'module', 'main'],
+        external: ['cloudflare:*', ...NODE_EXTERNALS],
+        define: {
+            ...getBrowserDefine(),
+            __filename: JSON.stringify('index.js'),
+            __dirname: JSON.stringify('/'),
+        },
+        plugins: [
+            orezCfAliasPlugin(cfg, {}, workerDir, nodeModulesPath, dirname(outfile), {
+                nativeApplicationSql: true,
+            }),
+        ],
+        logLevel: 'silent',
+    });
+}
+//# sourceMappingURL=bundle.js.map

package/dist/cf-deploy/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/cf-deploy/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,IAAI,CAAA;AACX,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAe,MAAM,SAAS,CAAA;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AAaxD,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAA2B;IAC1D,aAAa,EAAE,aAAa;CAC7B,CAAA;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,OAA+B,EAC/B,UAAkB,EAClB,eAAuB,EACvB,UAAU,GAAG,UAAU,EACvB,OAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,iBAAiB,GACrB,u4BAAu4B,CAAA;IACz4B,MAAM,mBAAmB,GACvB,yzBAAyzB,CAAA;IAC3zB,MAAM,eAAe,GACnB,+zCAA+zC,CAAA;IACj0C,MAAM,iBAAiB,GACrB,uyCAAuyC,CAAA;IACzyC,MAAM,mBAAmB,GACvB,sEAAsE,CAAA;IACxE,MAAM,cAAc,GAA2B;QAC7C,MAAM,EAAE,mBAAmB;QAC3B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,mBAAmB;QAC3B,aAAa,EAAE,mBAAmB;QAClC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,eAAe;QAC9B,kBAAkB,EAAE,eAAe;QACnC,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,iBAAiB;QAC9B,kBAAkB,EAChB,qbAAqb;QACvb,oBAAoB,EAAE,0CAA0C;QAChE,oBAAoB,EAClB,u3CAAu3C;QACz3C,yBAAyB,EACvB,+JAA+J;QACjK,2CAA2C,EACzC,+DAA+D;QACjE,2CAA2C,EACzC,wDAAwD;QAC1D,0BAA0B,EACxB,gFAAgF;QAClF,4BAA4B,EAC1B,qRAAqR;QACvR,yBAAyB,EACvB,4EAA4E;QAC9E,qCAAqC,EACnC,yDAAyD;QAC3D,gBAAgB,EACd,4HAA4H;QAC9H,oBAAoB,EAAE,4DAA4D;QAClF,cAAc,EACZ,qKAAqK;QACvK,GAAG,oBAAoB;KACxB,CAAA;IACD,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAA;QACrF,MAAM,yBAAyB,GAAG,GAAG,GAAG,CAAC,MAAM,aAAa,CAAA;QAC5D,cAAc,CAAC,EAAE,GAAG,yBAAyB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACjE,cAAc,CAAC,yBAAyB,CAAC;YACvC,6BAA6B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAA;IAClE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,QAAQ;YACZ,+EAA+E;YAC/E,0EAA0E;YAC1E,+EAA+E;YAC/E,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,4EAA4E;YAC5E,MAAM,WAAW,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAA;YACjD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;gBAC9E,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,IAAI,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CACxD,CAAA;oBACD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;wBAClC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;wBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;wBAC3B,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAA;wBAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;oBAC9C,CAAC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;oBACtC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC5D,IACE,IAAI,CAAC,QAAQ;4BACb,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;4BAClD,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;4BACD,OAAO,SAAS,CAAA;wBAClB,CAAC;wBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;oBAC1D,CAAC;oBACD,kEAAkE;oBAClE,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,SAAS,IAAI,oBAAoB,EAAE,CAAC;wBACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;oBAC1D,CAAC;oBACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAAE,OAAO,SAAS,CAAA;oBAC1E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;gBAC1D,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACzE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBACnC,MAAM,EAAE,IAAI;gBACZ,UAAU;aACX,CAAC,CAAC,CAAA;YAEH,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC5C,MAAM,YAAY,GAChB,SAAS,KAAK,+DAA+D,CAAA;oBAC/E,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;oBAC3D,IACE,CAAC,YAAY;wBACb,CAAC,eAAe;wBAChB,IAAI,CAAC,QAAQ;wBACb,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;wBACD,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,OAAO,CACL,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;wBAC/D,IAAI,EAAE,MAAM;qBACb,CACF,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,eAAe,GAAG,YAAY,CAClC;QACE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACpC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CACpF,CAAA;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,eAAe;QACf,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;KAC/C,CAAC,CAAA;IACF,OAAO,8BAA8B,CACnC,GAAG,EACH,OAAO,EACP,eAAe,EACf,iBAAiB,CAAC,WAAW,CAAC,CAC/B,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,GAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,eAAe,GAAG,YAAY,CAClC;QACE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACpC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CACpF,CAAA;IACD,OAAO,8BAA8B,CACnC,GAAG,EACH,OAAO,EACP,eAAe,EACf,EAAE,EACF,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B,CAAA;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,GAAmB,EACnB,OAAwC,EACxC,eAAuB,EACvB,OAA+B,EAC/B,aAAkD;IAElD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAA;IACtE,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAChD,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;IACrD,6EAA6E;IAC7E,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI;QAChB,aAAa;QACb,QAAQ;QACR,sBAAsB;QACtB,iBAAiB;QACjB,iBAAiB;KAClB,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IACD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC3C,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;QACzC,QAAQ,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC;QAC3D,MAAM,EAAE;YACN,GAAG,gBAAgB,EAAE;YACrB,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,6CAA6C;YAC7C,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC/B;QACD,OAAO,EAAE;YACP,iBAAiB,CACf,GAAG,EACH,OAAO,EACP,SAAS,EACT,eAAe,EACf,SAAS,EACT,aAAa,CACd;SACF;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,kDAAkD,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oBAAoB;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBAClC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACzC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAC9B,sDAAsD,EACtD,UAAU,WAAW,IAAI,CAC1B,CAAA;gBACD,IAAI,SAAS,KAAK,MAAM;oBAAE,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY;IACZ,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhD,wEAAwE;IACxE,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAE3D,2EAA2E;IAC3E,uBAAuB,CAAC,SAAS,CAAC,CAAA;AACpC,CAAC;AAED,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAA;IACtE,MAAM,eAAe,GAAG,YAAY,CAClC;QACE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACpC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CACpF,CAAA;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,eAAe;QACf,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;KAC/C,CAAC,CAAA;IACF,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC9C,KAAK,MAAM,GAAG,IAAI;QAChB,aAAa;QACb,QAAQ;QACR,sBAAsB;QACtB,iBAAiB;QACjB,iBAAiB;KAClB,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IACD,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC3C,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;QACzC,QAAQ,EAAE,CAAC,cAAc,EAAE,GAAG,cAAc,CAAC;QAC7C,MAAM,EAAE;YACN,GAAG,gBAAgB,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC/B;QACD,OAAO,EAAE;YACP,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9E;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAA;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAA;IACtE,MAAM,eAAe,GAAG,YAAY,CAClC;QACE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACpC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CACpF,CAAA;IACD,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC3C,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;QACzC,QAAQ,EAAE,CAAC,cAAc,EAAE,GAAG,cAAc,CAAC;QAC7C,MAAM,EAAE;YACN,GAAG,gBAAgB,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC/B;QACD,OAAO,EAAE;YACP,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBACvE,oBAAoB,EAAE,IAAI;aAC3B,CAAC;SACH;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAA;AACJ,CAAC"}

package/dist/cf-deploy/config.d.ts

@@ -0,0 +1,52 @@
+export interface CfDeployConfig {
+    /**
+     * lowercase per-deploy token prefix. drives every `__<prefix>_*` global,
+     * `/__<prefix>_*` internal path, `x-<prefix>-*` header, `_<prefix>_*` table,
+     * `[<prefix>]` log tag, `<prefix>-do-backend` alias, `<prefix>-backup-v2`
+     * format, and the `zero_<prefix>` publication.
+     */
+    prefix: string;
+    /**
+     * PascalCase variant of `prefix` for identifier names
+     * (`run<Prefix>CloudflareMigrations`, `<Prefix>CloudflarePgPool`).
+     */
+    prefixPascal: string;
+    /**
+     * Consumer-declared import specifiers to attach as CompiledWasm worker modules.
+     * Each is resolved (honoring the package's `exports`), copied next to the worker
+     * output, and its import rewritten to a relative external specifier — so
+     * wrangler's CompiledWasm rule turns it into a `WebAssembly.Module` at runtime
+     * (workerd forbids compiling wasm from bytes). The matching `import` must appear
+     * in a worker module the esbuild step bundles (e.g. the consumer's app shim).
+     * Keeps this package app-neutral: no dependency names are baked in here.
+     */
+    compiledWasmModules?: readonly string[];
+    /**
+     * Extra fetches the data worker's minute cron (`* * * * *`) fires at the app
+     * worker over the `APP` service binding, after the data-tier warm ping. Each
+     * emits a guarded `POST <path>` carrying the value of `env.<secretEnvVar>` in the
+     * `x-cron-secret` header. The synthetic request also carries a host because One's
+     * request URL parser requires it inside a service binding. For consumers whose
+     * job/flow runner lives in the app worker and needs a periodic tick (workerd has no
+     * long-running process). Keeps this package app-neutral: no consumer paths are
+     * baked into the template.
+     */
+    minuteCronAppForwards?: readonly {
+        path: string;
+        secretEnvVar: string;
+    }[];
+    /**
+     * Optional consumer push handler for `/api/zero/push` inside the data worker.
+     * When set, ZeroCacheDO's apiFetch handles pushes without re-entering the app
+     * worker; pulls still route through the app worker. The module is imported
+     * lazily so consumer code evaluates only after the data worker has installed
+     * its request env globals.
+     */
+    dataWorkerZeroPush?: {
+        module: string;
+        exportName: string;
+    };
+}
+/** build a CfDeployConfig from a lowercase prefix, deriving the PascalCase form. */
+export declare function cfDeployConfig(prefix: string, options?: Pick<CfDeployConfig, 'compiledWasmModules' | 'minuteCronAppForwards' | 'dataWorkerZeroPush'>): CfDeployConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/cf-deploy/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cf-deploy/config.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACzE;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,IAAI,CACZ,cAAc,EACd,qBAAqB,GAAG,uBAAuB,GAAG,oBAAoB,CACvE,GACA,cAAc,CAWhB"}

package/dist/cf-deploy/config.js

@@ -0,0 +1,23 @@
+// CfDeployConfig — the single neutralization seam for the shared Cloudflare/Orez
+// deploy integration. every consumer-specific token in the worker shims is
+// derived from `prefix`:
+//
+//   prefix 'contrast' ->  __contrast_*  /__contrast_*  x-contrast-*  _contrast_*  [contrast]  zero_contrast
+//                     contrast-do-backend  contrast-backup-v2  contrast-ns (cookie)
+//   prefixPascal 'Contrast' -> runContrastCloudflareMigrations, ContrastCloudflarePgPool
+//
+// orez's own internal tokens (orez-data.local, __orez_signal_replication,
+// _orez_pg_metadata, …) are NOT derived from prefix — they are shared across all
+// consumers and stay fixed.
+/** build a CfDeployConfig from a lowercase prefix, deriving the PascalCase form. */
+export function cfDeployConfig(prefix, options) {
+    if (!/^[a-z][a-z0-9]*$/.test(prefix)) {
+        throw new Error(`cfDeployConfig: prefix must be a lowercase identifier, got ${JSON.stringify(prefix)}`);
+    }
+    return {
+        prefix,
+        prefixPascal: prefix.charAt(0).toUpperCase() + prefix.slice(1),
+        ...options,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/cf-deploy/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cf-deploy/config.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,4GAA4G;AAC5G,oFAAoF;AACpF,yFAAyF;AACzF,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,4BAA4B;AAiD5B,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAGC;IAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,8DAA8D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACvF,CAAA;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,GAAG,OAAO;KACX,CAAA;AACH,CAAC"}

package/dist/cf-deploy/index.d.ts

@@ -0,0 +1,11 @@
+export * from './bundle.js';
+export * from './config.js';
+export * from './leaves.js';
+export * from './migration.js';
+export * from './nativeMigrations.js';
+export * from './prune.js';
+export * from './shims.js';
+export * from './smoke.js';
+export * from './sources.js';
+export * from './wrangler.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cf-deploy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cf-deploy/index.ts"],"names":[],"mappings":"AAMA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/dist/cf-deploy/index.js

@@ -0,0 +1,17 @@
+// orez/cf-deploy — shared Cloudflare/Orez Durable Object deploy integration.
+//
+// app-neutral building blocks for deploying a One/orez app to Cloudflare with the
+// split app/data-worker Durable Object architecture. the consumer supplies a
+// CfDeployConfig (token prefix + policy) and gets back the worker-source shims it
+// bundles + deploys. consumers import the canonical implementation from Orez.
+export * from './bundle.js';
+export * from './config.js';
+export * from './leaves.js';
+export * from './migration.js';
+export * from './nativeMigrations.js';
+export * from './prune.js';
+export * from './shims.js';
+export * from './smoke.js';
+export * from './sources.js';
+export * from './wrangler.js';
+//# sourceMappingURL=index.js.map

package/dist/cf-deploy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cf-deploy/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/dist/cf-deploy/leaves.d.ts

@@ -0,0 +1,19 @@
+import type { OnResolveArgs, PluginBuild } from 'esbuild';
+export declare const WORKERS_DEV_URL_PATTERN: RegExp;
+export declare const HEALTH_POLL_INTERVAL_MS = 2000;
+export declare const HEALTH_POLL_MAX_ATTEMPTS = 60;
+export declare const EMBED_READY_TIMEOUT_MS = 600000;
+export declare const EMBED_WARM_TIMEOUT_MS: number;
+export declare const EMBED_WARM_INTERVAL_MS = 3000;
+export declare const EMBED_WARM_REQUEST_TIMEOUT_MS = 8000;
+export declare const INTERNAL_ZERO_MUTATE_URL = "https://orez-zero-api.local/api/zero/push";
+export declare const INTERNAL_ZERO_QUERY_URL = "https://orez-zero-api.local/api/zero/pull";
+export declare function isOrezAliasImporter(importer: string): boolean;
+export declare function resolveAlias(buildApi: PluginBuild, path: string, resolveDir: string, kind: OnResolveArgs['kind']): Promise<import("esbuild").ResolveResult | undefined>;
+export declare function packageEntryForDirectory(path: string): string;
+export declare function importSpecifier(fromDir: string, filePath: string): string;
+export declare function quoteSqlIdentifier(value: string): string;
+export declare function isCloudflarePgImporter(importer: string, workerDir: string): boolean;
+export declare function normalizeTmpSymlinkPath(path: string): string;
+export declare const NODE_EXTERNALS: string[];
+//# sourceMappingURL=leaves.d.ts.map

package/dist/cf-deploy/leaves.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaves.d.ts","sourceRoot":"","sources":["../../src/cf-deploy/leaves.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAEzD,eAAO,MAAM,uBAAuB,QACkB,CAAA;AACtD,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAC5C,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAQ1C,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAC7C,eAAO,MAAM,qBAAqB,QAAmC,CAAA;AACrE,eAAO,MAAM,sBAAsB,OAAQ,CAAA;AAC3C,eAAO,MAAM,6BAA6B,OAAQ,CAAA;AAClD,eAAO,MAAM,wBAAwB,8CAA8C,CAAA;AACnF,eAAO,MAAM,uBAAuB,8CAA8C,CAAA;AAElF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiB7D;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,WAAW,EACrB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,wDAM5B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAanF;AAKD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,eAAO,MAAM,cAAc,UAgC1B,CAAA"}