Public request path

handlePublicSiteRequest() is the Cloudflare adapter’s anonymous request boundary.

1. It accepts only GET and HEAD requests without __edit or __preview.
2. It checks the edge cache before domain resolution, database access, authentication, or rendering.
3. On a cache miss, it resolves a verified hostname through the D1 control plane.
4. It asks the published-site renderer for a response, marks successful cookie-free output as public-cacheable, and schedules the cache write with waitUntil.
5. Preview/edit and mutation requests return null to a separate private/authenticated handler; they never share the public cache flow.

The concrete Astro named-cache policy also rejects /api/*, /admin, and reserved framework paths. This path check is security-critical: a queryless authenticated GET must never become publicly cacheable merely because it returns 200 without setting a cookie.

The adapter does not cache responses with Set-Cookie, errors, or non-success statuses. A concrete Worker wires caches.default, D1ControlPlane, and the renderer/service binding into this host-neutral shape.