#Server SDK

Status: library specification draft.

The server_sdk package supplies an ordinary library over package-declared host capabilities. Its server module owns the request-source interface; an application retains an ordinary main! and chooses its explicit state. These names are also re-exported from the package's root module.

#Request Values

std-server-sdk.request-idRequestId has public generation: u64 and sequence: u64 fields.
std-server-sdk.incoming-wireIncoming has public id: RequestId and request: std.http_wire.WireRequest fields.
std-server-sdk.request-id-identityBoth fields identify a request lease within its source instance.
std-server-sdk.response-wireHost replies use std.http_wire.WireResponse, while application handlers return std.http.Response.

#Errors And Cancellation

std-server-sdk.errorServerError has variants Closed, Expired, and Other(reason: string).
std-server-sdk.error-displayTheir display texts are server closed, request lease expired, and the supplied reason, respectively.
std-server-sdk.cancel-reasonCancelReason has variants Disconnected, Deadline, and Stopping.

#Request Source

std-server-sdk.hostThe SDK declares the package-owned host capability trait HttpServer.
std-server-sdk.accept-declIts accept!(&mut self) method returns Result[Incoming?, ServerError].
std-server-sdk.accept-endA successful absent value ends that worker's admission loop.
std-server-sdk.respond-wire-declIts respond!(&mut self, id: RequestId, response: WireResponse) method returns Result[void, ServerError].
std-server-sdk.cancelled-declIts cancelled!(&mut self, id: RequestId) method returns CancelReason.
std-server-sdk.cancelled-waitcancelled! waits until that request's source reports a cancellation reason.
std-server-sdk.clock-declIts clock(&mut self, id: RequestId) method returns a lease-owned *mut dyn std.time.Clock.
std-server-sdk.finish-declIts finish(&mut self, id: RequestId, abandoned: bool) method returns void.
std-server-sdk.finish-lifetimefinish acknowledges that the worker has finished or abandoned cleanup and no longer needs the lease.
std-server-sdk.finish-abandonedIts abandoned argument reports whether cleanup was cut short.
std-server-sdk.clock-expiredA source clock rejects operations after its lease is finished. Boundary failure: host-contract.
std-server-sdk.client-declIts client(&mut self, id: RequestId) method returns a lease-owned *mut dyn std.http.Http.
std-server-sdk.client-expiredA source client rejects operations after its lease is finished. Boundary failure: host-contract.
std-server-sdk.console-declIts console(&mut self, id: RequestId) method returns a lease-owned *mut dyn Console.
std-server-sdk.console-expiredA source console rejects writes after its lease is finished. Boundary failure: host-contract.

Why. The capability identifies request lifetimes without adding an HTTP entry form or an HTTP name known to the compiler. A test can provide it through an ordinary requirement binding.

#Serving

std-server-sdk.serve-declThe SDK declares serve![S, $R](workers: usize, state: *mut S, handler: fn!(Request, &mut S) -> Response $ R) -> Result[void, ServerError] $ R + HttpServer.
std-server-sdk.serve-widthThe worker count is workers, or one when workers is zero.
std-server-sdk.serve-lease-loopEach worker repeatedly accepts one request and runs a job-local race between its handler and the source's cancellation signal.
std-server-sdk.serve-stateEvery handler receives the same explicit state reference.
std-server-sdk.serve-joinserve! joins every worker before returning.
std-server-sdk.serve-errorIt returns the first worker error in worker order, or a successful void value when every worker succeeds.
std-server-sdk.serve-rowCalls to the handler retain the handler's requirement row.

Why. Worker concurrency uses the existing task scheduler. State mutations must leave the state valid before a suspending call; a mutable reference does not provide exclusion across suspension.

#Message Conversion

std-server-sdk.serve.public-messagesThe serving loop converts incoming wire values to public requests before calling the application handler.
std-server-sdk.serve.outgoing-wireBefore respond!, the loop validates the public response and reads its body once into wire bytes.
std-server-sdk.serve.body-errorAn already-used body or body preparation failure returns ServerError.Other before any host response call.
std-server-sdk.serve.header-errorInvalid outgoing headers return ServerError.Other before any host response call.
std-server-sdk.serve.conversion-releaseConversion failure preserves the existing lease cleanup and finish acknowledgement protocol.

#Request Cleanup

std-server-sdk.lease-clockThe worker binds the source's request clock around the handler and its cleanup bound.
std-server-sdk.lease-handler-timeoutThe handler has a twenty-second fallback timeout.
std-server-sdk.lease-timeout-responseA handler timeout produces status 504 with body request timed out.
std-server-sdk.lease-replyA completed handler's response returns with its original request ID.
std-server-sdk.lease-cancelA source cancellation cancels that handler without cancelling the worker group.
std-server-sdk.lease-external-cancelCancelling the worker externally retains the same cleanup bound.
std-server-sdk.lease-finishEvery accepted lease is finished once after response delivery or cancellation cleanup.
std-server-sdk.lease-expired-responseAn expired response lease does not end its worker's admission loop.
std-server-sdk.lease-clientThe worker binds the source's request client around the handler and its cleanup bound.
std-server-sdk.lease-cleanup-budgetThe SDK bounds cooperative cleanup to one hundred milliseconds from when cleanup begins.
std-server-sdk.lease-cleanup-backstopThe host's cancellation watchdog expires two hundred milliseconds after cancellation is sent.
std-server-sdk.lease-cleanup-escalationIf cleanup remains unacknowledged at that expiry, the host poisons or terminates the affected instance.
std-server-sdk.lease-cleanup-acknowledgedAcknowledged cleanup cancels its host watchdog.
std-server-sdk.lease-cleanup-platformPlatform CPU limits apply independently of the cleanup watchdog.
std-server-sdk.lease-consoleThe worker binds the source's request console around the handler and its cleanup.

Why. The source's admission deadline can cancel earlier than the handler's fallback timeout. The existing timeout combinator bounds cleanup when the local cancellation race or an outer cancellation wins. A CPU-bound handler or cleanup still needs platform interruption.

#JavaScript Lease Dispatcher

The SDK adapter keeps native I/O in each request's owning coroutine while the retained guest shares synchronous driver turns.

std-server-sdk.dispatch.opencreateLeaseDispatcher creates generation-tagged leases with monotonically increasing request sequences.
std-server-sdk.dispatch.ownerA lease's run() coroutine owns native operation starts and disposal.
std-server-sdk.dispatch.pollPolling another request's guest work queues its native operations for their owning lease.
std-server-sdk.dispatch.pendingoperation(context, start) returns readiness through the package provider's existing context.pending interface.
std-server-sdk.dispatch.abortAborting before an operation starts prevents its native I/O.
std-server-sdk.dispatch.lateCompletions after disposal or lease finish must not wake a later request.
std-server-sdk.dispatch.copyrespond copies response bytes and header pairs before guest lease release.
std-server-sdk.dispatch.ackrun() publishes the response only after the worker acknowledges cleanup through finish.
std-server-sdk.dispatch.failureInstance failure rejects active requests after their queued native disposal runs in their respective owners.
std-server-sdk.dispatch.poisonA failed dispatcher rejects new requests.
std-server-sdk.dispatch.cancelCancellation records the first reason for its lease without cancelling other leases.
std-server-sdk.dispatch.effecteffect(task) queues a synchronous callback for execution in the lease's owning coroutine.
std-server-sdk.dispatch.effect-releaseAlready captured effects drain before the lease owner's run() completes.

Why. A platform may cancel I/O started in another completed request. Only readiness and copied data cross shared guest turns; native I/O stays with the request that awaits it.

#JavaScript Application Adapter

adapters/application.mjs connects the dispatcher to an ordinary compiled SDK application through public runtime and generated binding modules.

std-server-sdk.application.inputs-with-logscreateApplication takes a Wasm module, generated bindings, createCoreHost, explicit grants, and an output sink or private log observer.
std-server-sdk.application.sourceThe adapter requires exactly one root package capability named server.HttpServer with an explicitly granted selector.
std-server-sdk.application.driverThe adapter drives its retained instance through serialized synchronous createDriver().step() turns.
std-server-sdk.application.valuesdispatch(request, signal) accepts an HD request value and returns response, cancellation, and cleanup-abandonment values.
std-server-sdk.application.signal-reasonAborting the supplied signal preserves Deadline and Stopping reasons and maps every other reason to lease-local Disconnected cancellation.
std-server-sdk.application.clockThe source clock queues timer creation and disposal in its request's owning coroutine.
std-server-sdk.application.stopstop() closes admission and ends idle workers while admitted requests finish.
std-server-sdk.application.failfail(error) poisons the instance and closes its core host.
std-server-sdk.application.client-policySource clients use the owning core runtime's Http policy service.
std-server-sdk.application.http-guardAn ambient Http send fails instead of substituting a client without a request lease. Boundary failure: host-contract.
std-server-sdk.application.startstart() eagerly drives the retained application's startup.
std-server-sdk.application.readyThe optional onReady callback runs once after a completed driver turn parks on request acceptance.
std-server-sdk.application.stoppedThe optional onStopped callback runs after stopped main completion closes the core host.

Note. This adapter exchanges plain values. Platform HTTP mapping, admission limits, supervision and deployment packaging are separate layers.

#Application Logs

The SDK keeps application output separate from protocol and lifecycle events. The embedding caller chooses the private log destination.

std-server-sdk.log.console-policySDK request consoles use their owning core runtime's Console authority.
std-server-sdk.log.deniedA denied write returns ConsoleError.NotGranted for stdout or stderr without capturing a record.
std-server-sdk.log.captureA permitted Console call completes when it captures its immutable text record.
std-server-sdk.log.ownerA captured request record is delivered in that request's owning coroutine.
std-server-sdk.log.recordAn application record has version: 1, stream of out or err, text, and a lease identity.
std-server-sdk.log.identityA request record's lease contains decimal-string generation and sequence fields captured from its request ID.
std-server-sdk.log.unassociatedApplication records without a request console, including startup and runtime diagnostics, have lease: null.
std-server-sdk.log.fallbackWithout a log(record) observer, Application forwards text to its output sink's corresponding stream.
std-server-sdk.log.observerLog observers run synchronously and their return values are not awaited.
std-server-sdk.log.observer-failureA throwing observer does not prevent lease completion or later record delivery.
std-server-sdk.log.privateThe SDK never copies application log text into lifecycle events or generic HTTP error responses.
std-server-sdk.log.metadataThe SDK adds no request headers, bodies, environment values, or credentials to log metadata.
std-server-sdk.log.supervisorThe supervisor delivers application records through its separate log(record) observer.
std-server-sdk.log.supervisor-unassociatedAn unassociated supervised record has request: null.
std-server-sdk.log.supervisor-staleThe supervisor ignores log messages from stale worker generations or mismatched active request identities.
std-server-sdk.log.nodeThe development Node provider emits each captured record as one JSON line on its corresponding standard stream.
std-server-sdk.log.workerA supervised record adds worker: { slot, generation } identifying its worker.
std-server-sdk.log.physical-requestA lease-associated supervised record adds request containing its physical request ID.

Why. Another request may cause a shared guest turn, so the current JavaScript turn cannot identify the owner of application output. Lease-bound consoles retain identity through handler cleanup.

#JavaScript Fetch Transport

adapters/http.mjs supplies a native-fetch transport for a lease-owned std.http.Http handle.

std-server-sdk.http.factorycreateHttpClient(lease, options) returns a JavaScript implementation of Http.send for that lease.
std-server-sdk.http.inputsIts caller supplies resolved application grants and the public core URL-validation helpers.
std-server-sdk.http.ownedNative fetch, body reading, timeout timers and abort controllers belong to the lease's operation callback.
std-server-sdk.http.manualEvery fetch uses manual redirects.
std-server-sdk.http.grantsThe transport checks the destination's written host and port against the Http grant before every fetch.
std-server-sdk.http.invalidInvalid, non-ASCII and percent-encoded hosts are rejected before fetching.
std-server-sdk.http.backslashBackslashes in request URLs or redirect locations are rejected before fetching their targets.
std-server-sdk.http.redirectsA zero redirect limit returns the first response without following or validating its Location.
std-server-sdk.http.redirect-limitExceeding a positive redirect limit returns TooManyRedirects without fetching the next target.
std-server-sdk.http.credentialsA cross-origin redirect removes Authorization, Proxy-Authorization, Cookie and Host request headers.
std-server-sdk.http.rewriteRedirects use Fetch's method and body rewriting rules.
std-server-sdk.http.responsesEvery final status completes with the whole body and final request URL.
std-server-sdk.http.timeoutThe default thirty-second provider timeout covers every redirect and final body reading.
std-server-sdk.http.abortDisposing the lease operation aborts its native request and clears its timer.
std-server-sdk.http.headersResponse headers follow the standard HTTP field-combination and separate-cookie rules.

Why. Manual redirects enforce grants on every destination and avoid forwarding credentials to another origin. The transport's own timeout requires no ambient HD Clock capability.

#Fetch Request Adapter

adapters/fetch.mjs maps standard Fetch requests to the ordinary application. Its optional timer service supports deterministic hosts and tests without changing the profile's limits.

std-server-sdk.fetch.factorycreateFetchAdapter(options) constructs one retained application and exposes its Fetch handler.
std-server-sdk.fetch.handlercreateFetchHandler(application, options) adapts an existing application or supervisor.
std-server-sdk.fetch.reservationAdmission reserves one of eight slots before reading request headers or body bytes.
std-server-sdk.fetch.overloadA ninth active request receives status 503 with Retry-After: 1, without waiting for a slot.
std-server-sdk.fetch.body-limitIncoming and outgoing whole bodies are limited to one mebibyte each.
std-server-sdk.fetch.declared-bodyA declared incoming body exceeding that limit receives status 413 before body reading.
std-server-sdk.fetch.actual-bodyThe adapter counts incoming bytes independently of the declared length.
std-server-sdk.fetch.header-limitIncoming and outgoing headers are limited to 65,536 UTF-8 bytes, including four framing bytes per field.
std-server-sdk.fetch.headers-rejectedOversized incoming headers receive status 431.
std-server-sdk.fetch.malformedInvalid incoming method tokens, lengths, or body streams receive status 400.
std-server-sdk.fetch.urlThe incoming request retains the platform's absolute URL, with an empty separate query list.
std-server-sdk.fetch.methodStandard methods map to their standard variants, and other valid tokens map to Method.Other.
std-server-sdk.fetch.framingThe adapter removes hop-by-hop fields, Connection-nominated fields, and length or transfer framing on both sides.
std-server-sdk.fetch.cookiesResponse Set-Cookie values remain separate platform header values.
std-server-sdk.fetch.statusResponse statuses must be between 200 and 599.
std-server-sdk.fetch.bodylessHEAD responses and statuses 204, 205, and 304 have no platform response body.
std-server-sdk.fetch.response-invalidInvalid or oversized guest responses become generic status 500 before platform response construction.
std-server-sdk.fetch.deadlineThe twenty-second request deadline starts at admission and includes incoming body reading.
std-server-sdk.fetch.deadline-responseAdmission deadline cancellation produces status 504.
std-server-sdk.fetch.disconnectA platform disconnect cancels only its admitted request.
std-server-sdk.fetch.reader-ownerNative reader cancellation runs in the reader's owning continuation.
std-server-sdk.fetch.backstopThe adapter applies the two-hundred-millisecond cancellation watchdog to unacknowledged work and native reader disposal.
std-server-sdk.fetch.poisonWatchdog escalation closes admission and poisons the retained application.
std-server-sdk.fetch.failureApplication failure exposes a generic status 500 and cancels other active requests.
std-server-sdk.fetch.private-logFailure logs contain event categories without guest details, bodies, or header values.
std-server-sdk.fetch.stopThe first stop() closes admission and drains already admitted work.
std-server-sdk.fetch.stop-againA second stop() cancels admitted work with Stopping.
std-server-sdk.fetch.staleLate completions after poisoning cannot reopen admission.

Note. Eight reservations bound the platform layer; an application with fewer accepting workers can still wait internally. A blocking isolate still needs an external supervisor or its platform CPU limit.

#Node Worker Supervisor

adapters/supervisor.mjs runs each retained application in a separate Node worker. Runtime, generated-binding, and application module URLs are explicit public inputs; packaging supplies them independently.

std-server-sdk.supervisor.factorycreateSupervisor takes a compiled module, module URLs, grants, explicit lifecycle budgets, and observer callbacks.
std-server-sdk.supervisor.workerEach worker retains one application instance and its state across sequential requests.
std-server-sdk.supervisor.capacityAt most one request is active per ready worker, with no waiting request queue.
std-server-sdk.supervisor.overloadUnavailable capacity returns status 503 with the configured Retry-After value.
std-server-sdk.supervisor.admission-timeRequest deadlines include time elapsed since the supplied admission timestamp.
std-server-sdk.supervisor.budgetsStartup, request, drain, outer-stop, restart-count, restart-window, and Retry-After values must be supplied explicitly.
std-server-sdk.supervisor.outer-floorThe outer-stop budget cannot precede the two-hundred-millisecond cleanup watchdog.
std-server-sdk.supervisor.watchdogThe supervisor runs the fixed cleanup watchdog outside the guest's worker thread.
std-server-sdk.supervisor.non-yieldingWatchdog expiry terminates an unacknowledged worker even when its guest never yields.
std-server-sdk.supervisor.failureWorker failure returns generic status 500 without private guest diagnostics.
std-server-sdk.supervisor.siblingRetiring one worker does not poison another worker's retained instance.
std-server-sdk.supervisor.restartReplacement respects the supplied restart count and window, reporting exhaustion to the observer.
std-server-sdk.supervisor.releaseA response result requires a matching worker generation, request ID, and release acknowledgement.
std-server-sdk.supervisor.stopFirst stop drains active work, while second stop or drain expiry starts cancellation.
std-server-sdk.supervisor.joinStop and close completion join worker termination.
std-server-sdk.supervisor.confirmationForced termination reports cleanup as unconfirmed.
std-server-sdk.supervisor.timer-upper-boundScheduled supervisor budgets startupMs, requestMs, drainMs, and stopKillMs must not exceed 2,147,483,647 milliseconds.

Note. The component supplies no deployment task, lifecycle budget defaults, or aggregate memory guarantee.

#Deployment Grants

std-server-sdk.deploy.root-manifestThe SDK's shared deployment-grant reader reads hd.toml in the selected root package directory.
std-server-sdk.deploy.production-onlyIt takes deployment grants only from that manifest's [capabilities] table.
std-server-sdk.deploy.explicit-grantsIt preserves every explicit unrestricted grant, denial and scope list.
std-server-sdk.deploy.package-consentIt preserves explicit package-capability consent and denial under the written capability path.
std-server-sdk.deploy.no-inheritanceDependency manifests, development grants, command-line grants and ambient environment values do not add deployment grants.
std-server-sdk.deploy.no-default-grantsAn absent production table or entry contributes no grant.
std-server-sdk.deploy.fresh-manifestA later deployment read uses the manifest's current contents.
std-server-sdk.deploy.invalid-manifestAn unreadable, non-TOML or non-UTF-8 root manifest fails deployment preparation.
std-server-sdk.deploy.invalid-grantA production entry with an invalid capability key or grant value fails deployment preparation.
std-server-sdk.deploy.no-value-diagnosticsManifest-reader errors do not include source excerpts or grant values.

Why. Deploy-time selection keeps the build policy-free and prevents development permissions from becoming production authority. The shared reader gives every platform adapter the same production entries.

The SDK JavaScript conformance inputs are in deployment-grants.json; its maintained test runner also checks root selection, fresh reads, invalid UTF-8 and the SDK task bridge.

#Portable Runtime Packaging

std-server-sdk.runtime.snapshotThe SDK ships a platform-neutral host graph and its host ABI model as a portable runtime snapshot.
std-server-sdk.runtime.identityThe snapshot fingerprint covers its file names, file contents, package-host ABI version and source base revision.
std-server-sdk.runtime.validateThe emitter rejects invalid snapshot metadata, an unexpected file list, a checksum mismatch or a fingerprint mismatch before creating output.
std-server-sdk.runtime.bytesEmitted runtime files preserve their snapshot contents byte for byte.
std-server-sdk.runtime.fresh-outputThe emitter creates only a fresh task-owned directory and refuses an existing destination.
std-server-sdk.runtime.installedEmitting the installed SDK's runtime requires neither a compiler checkout nor compiler-cache access.

Why. SDK-owned distribution gives deploy tasks the host modules they need while the compiler's build output stays platform-neutral and policy-free. Each platform task owns its final bundle and build validation.

The maintained runtime conformance controls check invalid snapshots, source fidelity, output ownership and a compiled application running from a relocated SDK after source and provider removal.

#Cloudflare Deployment

The SDK's deployment module prepares a Cloudflare Worker from built application artifacts. The sample's ordinary deployment task uses this API through its package-declared provider.

#Deployment API

std-server-sdk.cloudflare.artifactsArtifacts has public string fields wasm, bindings, and output.
std-server-sdk.cloudflare.optionsCloudflareOptions has public fields name: string, artifacts: Artifacts, compatibility_date: string, and env_bindings: List[string] = [].
std-server-sdk.cloudflare.receiptDeploymentReceipt has public string fields directory, runtime_fingerprint, wasm_sha256, and bindings_sha256.
std-server-sdk.cloudflare.errorDeploymentError has the variant Failed(message: string).
std-server-sdk.cloudflare.error-displayThat variant's display text is its supplied message.
std-server-sdk.cloudflare.hostDeployment is an SDK-owned package host capability trait.
std-server-sdk.cloudflare.methodIts cloudflare!(&mut self, options: CloudflareOptions) method returns Result[DeploymentReceipt, DeploymentError].
std-server-sdk.cloudflare.functioncloudflare!(options: CloudflareOptions) requires Deployment and forwards to that capability's method with the same result type.
std-server-sdk.cloudflare.task-rootThe deployment provider selects the invoking task's root package directory.
std-server-sdk.cloudflare.pathsRelative artifact and output paths resolve from that root directory.
std-server-sdk.cloudflare.nameThe Worker name must contain lowercase ASCII letters, digits, or hyphens, with alphanumeric endpoints and at most 63 characters.
std-server-sdk.cloudflare.datecompatibility_date must be a valid calendar date written as YYYY-MM-DD.
std-server-sdk.cloudflare.output-rootThe output directory must not equal or contain the selected root package directory.
std-server-sdk.cloudflare.prepare-onlyPreparation writes local deployment files without uploading or requesting deployment credentials.
std-server-sdk.cloudflare.reexportsThe package root reexports Artifacts, CloudflareOptions, DeploymentReceipt, DeploymentError, Deployment, and cloudflare!.

#Artifact And Policy Validation

std-server-sdk.cloudflare.productionPreparation uses the shared deployment-grant reader for the selected root package.
std-server-sdk.cloudflare.nominal-sourceThe contract must have exactly one source interface: server.HttpServer from the Deployment provider's validated nominal SDK package and version.
std-server-sdk.cloudflare.source-consentAt least one selector naming that source must have explicit production consent true.
std-server-sdk.cloudflare.source-vetoAny selector naming that source with production value false rejects preparation.
std-server-sdk.cloudflare.capturePreparation captures the input Wasm and binding companion once and uses those captured bytes throughout validation and emission.
std-server-sdk.cloudflare.driverThe module must export functions hd.init, hd.poll, hd.wake, and memory hd.x.
std-server-sdk.cloudflare.contract-abiThe module must contain exactly one hd.capabilities section whose package-host ABI matches the installed SDK runtime and expected schema.
std-server-sdk.cloudflare.schemaPreparation validates every used package interface and method, including returned handles, against the installed SDK's expected server ABI schema.
std-server-sdk.cloudflare.module-identityCompiler-generated module identifiers do not affect nominal identity or value-shape validation.
std-server-sdk.cloudflare.companionThe binding companion's generated data header must contain the same ABI version and contract bytes as the captured Wasm.
std-server-sdk.cloudflare.binding-codePreparation neither evaluates nor ships the supplied companion's JavaScript body.
std-server-sdk.cloudflare.rebuilt-bindingsDeployed bindings are rebuilt by SDK-owned code from the validated contract data.
std-server-sdk.cloudflare.import-membersEvery module import must name a supported function member of the portable runtime or the validated SDK package contract.
std-server-sdk.cloudflare.preflight-effectsImport validation must not instantiate the application or invoke application providers and outgoing I/O.
std-server-sdk.cloudflare.clock-random-denialA required primitive Clock or Random import with an explicit production denial rejects preparation.
std-server-sdk.cloudflare.env-namesenv_bindings must contain distinct names matching [A-Za-z_][A-Za-z0-9_]* and covered by the production Env grant.
std-server-sdk.cloudflare.env-valuesThe Worker exposes only selected string-valued platform bindings through Env, checking the production grant on access.
std-server-sdk.cloudflare.env-captureWorker startup captures selected binding values from its first request's platform environment.
std-server-sdk.cloudflare.env-privatePreparation records binding names without reading or embedding their runtime values.
std-server-sdk.cloudflare.receipt-valuesThe receipt identifies the output directory, portable runtime fingerprint, captured Wasm SHA-256, and emitted binding-module SHA-256.

Portable primitive namespace	Availability
`hd:rt`, `hd:prim`	Runtime support.
`hd:Console`	Production Console policy.
`hd:Clock`, `hd:Random`	Core policy, with explicit denials enforced.
`hd:Env`	Selected string bindings and production Env policy.
`hd:Http`	Platform Fetch transport and production destination policy.

Note. The expected schema and fingerprints record ABI compatibility and provenance. They do not authenticate a compiler or recover nominal hd value types erased by the boundary ABI.

#Output Publication

std-server-sdk.cloudflare.payloadPrepared output includes a static Wasm import, SDK-built bindings, the portable runtime, Fetch adapters, production grants, provenance, and Wrangler configuration.
std-server-sdk.cloudflare.output-ownedPreparation refuses an existing output directory without the SDK's Cloudflare ownership record.
std-server-sdk.cloudflare.output-unchangedPreparation refuses modified SDK generations or an externally changed Wrangler selector.
std-server-sdk.cloudflare.output-generationEach complete payload occupies an immutable generation directory.
std-server-sdk.cloudflare.output-selectorPublication atomically replaces the regular wrangler.json selector with one naming a complete generation.
std-server-sdk.cloudflare.output-retainPublication retains earlier generations so readers of an earlier selector can finish using their original payload.
std-server-sdk.cloudflare.output-extrasPreparation preserves unrelated output-root files and platform caches without traversing them.
std-server-sdk.cloudflare.output-writersSDK writers must acquire the output lock before publication.
std-server-sdk.cloudflare.output-reservedOther writers must not concurrently modify the SDK ownership record, generation store, or Wrangler selector.
std-server-sdk.cloudflare.output-retryAn interrupted SDK-owned publication without a selector may be retried after validating its completed generations.

Why. A small selector commit keeps the active configuration and its immutable payload together while allowing Wrangler to retain its cache. The SDK owns reserved output paths, rather than replacing a nonempty directory containing files managed by other tools.

The maintained deployment controls exercise ordinary tasks, artifact validation, production policy and relocated output. Output controls cover ownership and publication; binding controls and schema controls cover companion pairing, value codecs and the SDK's expected ABI data.

#Vercel Node Deployment

The SDK's deployment module prepares a supervised Node function in Vercel Build Output format. The sample's ordinary deployment task uses the existing Deployment capability.

#Vercel API

std-server-sdk.vercel.supervisor-fieldsSupervisorPolicy has the public fields in the following table.
std-server-sdk.vercel.optionsVercelOptions has public fields name: string, artifacts: Artifacts, supervisor: SupervisorPolicy, and env_bindings: List[string] = [].
std-server-sdk.vercel.methodDeployment declares vercel!(&mut self, options: VercelOptions) -> Result[DeploymentReceipt, DeploymentError].
std-server-sdk.vercel.functionvercel!(options: VercelOptions) requires Deployment and forwards to that capability's method with the same result type.
std-server-sdk.vercel.shared-valuesVercel preparation uses the existing Artifacts, DeploymentReceipt, and DeploymentError types.
std-server-sdk.vercel.worker-countsupervisor.workers must be between one and eight.
std-server-sdk.vercel.positive-budgetsStartup, drain, outer-stop and restart-window milliseconds must be positive.
std-server-sdk.vercel.outer-stop-floorsupervisor.stop_kill_ms must be at least 200.
std-server-sdk.vercel.explicit-policyAll supervisor policy fields must be supplied explicitly.
std-server-sdk.vercel.request-budgetThe Vercel task fixes the supervisor request budget at 20,000 milliseconds.
std-server-sdk.vercel.namename must match [a-z0-9][a-z0-9-]{0,62}.
std-server-sdk.vercel.retry-aftersupervisor.retry_after must be nonempty and contain only printable ASCII characters from U+0020 through U+007E.
std-server-sdk.vercel.reexportsThe package root reexports SupervisorPolicy, VercelOptions, and vercel!.
std-server-sdk.vercel.timer-upper-boundVercel preparation rejects startup, request, drain, or outer-stop budgets greater than 2,147,483,647 milliseconds.

SupervisorPolicy field	Type	Meaning
`workers`	`u32`	Number of supervised worker instances.
`startup_ms`	`u32`	Worker startup budget in milliseconds.
`drain_ms`	`u32`	Drain budget in milliseconds.
`stop_kill_ms`	`u32`	Outer-stop budget in milliseconds.
`restart_limit`	`u32`	Maximum restarts within the restart window.
`restart_window_ms`	`u32`	Restart window in milliseconds.
`retry_after`	`string`	Retry-After value for unavailable capacity.

#Vercel Preparation

std-server-sdk.vercel.rootThe Vercel provider resolves relative artifact and output paths from the invoking task's root package directory.
std-server-sdk.vercel.productionVercel preparation reads only that root's production grants through the shared deployment-grant reader.
std-server-sdk.vercel.nominal-sourceThe Vercel contract must have exactly one source interface, matching the Deployment provider's validated SDK package, version and server.HttpServer identity.
std-server-sdk.vercel.source-consentThe Vercel source requires explicit production consent true.
std-server-sdk.vercel.source-vetoAny production selector for that source with value false rejects Vercel preparation.
std-server-sdk.vercel.captured-artifactsVercel validation and emission use one captured copy of each input Wasm and binding companion.
std-server-sdk.vercel.shared-preflightVercel applies Cloudflare's driver-export, package-host ABI, expected-schema, companion-header, and supported-import validation requirements.
std-server-sdk.vercel.data-bindingsVercel rebuilds SDK-owned bindings from validated contract data without evaluating or shipping the companion's JavaScript body.
std-server-sdk.vercel.preflight-effectsVercel preflight must not instantiate the application or invoke application providers and outgoing I/O.
std-server-sdk.vercel.primitive-denialVercel rejects a required Clock or Random import when its production grant is explicitly false.
std-server-sdk.vercel.env-selectionVercel Env names must be distinct binding identifiers covered by production grants, using the Cloudflare name-selection requirements.
std-server-sdk.vercel.env-captureThe generated Node entry captures only the selected named environment values at module initialization.
std-server-sdk.vercel.env-accessEach worker's Env provider exposes selected string values only when the production grant covers the requested name.
std-server-sdk.vercel.no-env-valuesVercel preparation emits selected names without reading or embedding their environment values.
std-server-sdk.vercel.receipt-valuesIts receipt records the output directory, portable runtime fingerprint, captured Wasm SHA-256, and emitted binding-module SHA-256.
std-server-sdk.vercel.output-rootThe Vercel output directory must not equal or contain the selected root package directory.
std-server-sdk.vercel.local-onlyThe Vercel task prepares local output without uploading or requesting deployment credentials.

Note. Shared preflight uses the same portable runtime and expected ABI data as Cloudflare preparation. Those records establish compatibility and provenance, without authenticating arbitrary compiler output.

#Node Hosting

std-server-sdk.vercel.retained-supervisorEach generated Node function process retains one supervisor with the explicitly selected policy.
std-server-sdk.vercel.retained-stateEach supervisor worker retains its own application instance and state across requests.
std-server-sdk.vercel.admissionIngress returns 503 with the selected Retry-After value when no worker is ready, without queuing requests for startup.
std-server-sdk.vercel.shared-mapperNative Node requests and responses pass through the SDK's existing Fetch mapper.
std-server-sdk.vercel.native-bodyNative request bodies retain stream backpressure and reach the shared mapper for byte-limit enforcement.
std-server-sdk.vercel.get-head-bodyGET and HEAD request bodies reach the guest when the native Node request supplies them.
std-server-sdk.vercel.cookiesSeparate response Set-Cookie values remain separate native header values.
std-server-sdk.vercel.disconnectNative request abortion or premature response closure cancels only the owned request.
std-server-sdk.vercel.malformed-nativeAn admitted native request with malformed authority, target or headers receives 400 before guest dispatch.
std-server-sdk.vercel.shared-cleanupThe existing hundred-millisecond SDK cleanup bound and two-hundred-millisecond supervisor watchdog remain in effect.

Why. Native transport adaptation preserves physical response ownership outside the worker that the supervisor can terminate. Per-worker state remains independent, including across replacement and parallel requests.

#Vercel Output

std-server-sdk.vercel.build-outputPreparation emits Build Output version 3 with a catch-all route selecting one complete immutable Node function generation.
std-server-sdk.vercel.output-layoutFunction generations use functions/<name>-<hash>.func, where hash is the first 48 hexadecimal characters of the complete generation SHA-256.
std-server-sdk.vercel.route-pathThe catch-all route sets request.path to /$1 so the Node runtime receives its matched pathname.
std-server-sdk.vercel.function-configEach function declares runtime nodejs24.x, handler index.mjs, launcher type Nodejs, and disabled launcher helpers.
std-server-sdk.vercel.function-payloadA function generation includes captured Wasm, rebuilt bindings, the portable runtime, Node adapters, production grants and provenance.
std-server-sdk.vercel.output-ownedVercel preparation refuses existing output without its SDK Vercel ownership record.
std-server-sdk.vercel.output-integrityModified generations, unknown function directories, or an externally modified selector reject publication.
std-server-sdk.vercel.output-selectorPublication atomically replaces regular config.json with a selector for the complete generation under functions/.
std-server-sdk.vercel.output-digestEach Node generation record must store generation as a full 64-character hexadecimal SHA-256 digest equal to the recomputed configuration and payload digest.
std-server-sdk.vercel.output-retainPrior function generations remain available to readers using an earlier selector.
std-server-sdk.vercel.output-extrasFiles outside the reserved ownership record, function store and selector remain untouched and are not traversed.
std-server-sdk.vercel.output-lockSDK Vercel writers must acquire the output lock before publishing.
std-server-sdk.vercel.output-reservedOther writers must not concurrently modify the ownership record, functions/ store, or config.json selector.

Note. Local official builder and launcher checks do not establish remote build or hosted deployment acceptance.

The maintained Vercel deployment controls cover ordinary tasks, artifact and policy checks, relocation, and emitted Node HTTP behavior. Vercel output controls cover ownership, immutable function generations, selector publication and cancellation.