@astrale-os/adapter-astrale 0.1.0

package/dist/astrale.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `astrale(envs)` — the Astrale-managed deployment adapter.
+ *
+ * Ships the domain THROUGH the target instance's `services` domain instead of to
+ * the author's own cloud account. `deploy` builds the same single-module workerd
+ * bundle the Cloudflare adapter ships (shared codegen + `wrangler deploy
+ * --dry-run`), then:
+ *
+ *   1. hosts it on the instance's services domain — `CloudflareWorker.deploy
+ *      { name, entry, modules, assets, vars }` → a public worker `url`;
+ *   2. (optional) pushes runtime secrets via the service's `setSecret`;
+ *   3. installs the domain on the instance from that `url`
+ *      (`astrale domain install <url>` → the child kernel's `Root.installDomain`,
+ *      which fetches + verifies the signed bundle and runs its `postInstall`).
+ *
+ * The admin control plane is NOT involved: hosting moved out of admin into the
+ * per-instance `services` domain (a separate bounded context). No Cloudflare
+ * account, no wrangler auth — the only credential is the author's Astrale
+ * identity, supplied by the `astrale` CLI session this adapter shells out to.
+ *
+ * REQUIRES the `services` domain installed on the target instance. An instance
+ * without it can't host managed deploys — `deploy` fails loud with that hint.
+ *
+ * `watch` is identical to the Cloudflare adapter's local dev (wrangler dev on
+ * localhost) — managed deploys change WHERE the worker runs, not how you iterate.
+ */
+import type { DomainAdapter } from '@astrale-os/sdk';
+import type { AstraleParams } from './params';
+export declare function astrale(envs: Record<string, AstraleParams>): DomainAdapter<AstraleParams>;
+/** Service name from the origin: first DNS label (e.g. `my-notes.example.dev` → `my-notes`). */
+export declare function serviceNameFor(origin: string): string;
+//# sourceMappingURL=astrale.d.ts.map

package/dist/astrale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astrale.d.ts","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAmBpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAK7C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,aAAa,CAAC,aAAa,CAAC,CA2JzF;AAwBD,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGrD"}

package/dist/astrale.js

@@ -0,0 +1,255 @@
+/**
+ * `astrale(envs)` — the Astrale-managed deployment adapter.
+ *
+ * Ships the domain THROUGH the target instance's `services` domain instead of to
+ * the author's own cloud account. `deploy` builds the same single-module workerd
+ * bundle the Cloudflare adapter ships (shared codegen + `wrangler deploy
+ * --dry-run`), then:
+ *
+ *   1. hosts it on the instance's services domain — `CloudflareWorker.deploy
+ *      { name, entry, modules, assets, vars }` → a public worker `url`;
+ *   2. (optional) pushes runtime secrets via the service's `setSecret`;
+ *   3. installs the domain on the instance from that `url`
+ *      (`astrale domain install <url>` → the child kernel's `Root.installDomain`,
+ *      which fetches + verifies the signed bundle and runs its `postInstall`).
+ *
+ * The admin control plane is NOT involved: hosting moved out of admin into the
+ * per-instance `services` domain (a separate bounded context). No Cloudflare
+ * account, no wrangler auth — the only credential is the author's Astrale
+ * identity, supplied by the `astrale` CLI session this adapter shells out to.
+ *
+ * REQUIRES the `services` domain installed on the target instance. An instance
+ * without it can't host managed deploys — `deploy` fails loud with that hint.
+ *
+ * `watch` is identical to the Cloudflare adapter's local dev (wrangler dev on
+ * localhost) — managed deploys change WHERE the worker runs, not how you iterate.
+ */
+// The shared Cloudflare-Workers build toolkit — the managed adapter ships the
+// SAME bundle the direct `cloudflare` adapter does, then routes it through the
+// platform instead of `wrangler deploy`.
+import { buildClient, CLIENT_DIST_DIR, logTo, prepare, runWranglerBundle, runWranglerDev, } from '@astrale-os/adapter-cloudflare/build';
+import { defineAdapter } from '@astrale-os/sdk';
+import { loadDotenvFile } from '@astrale-os/sdk/cli';
+import { spawn } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const DEFAULT_PORT = 8787;
+const DEFAULT_SERVICES_ORIGIN = 'services.astrale.ai';
+export function astrale(envs) {
+    return defineAdapter({
+        name: 'astrale',
+        envs,
+        // Local dev is unchanged: wrangler dev on localhost. Managed deploys change
+        // WHERE the worker ships, not the inner loop.
+        async watch(params, ctx) {
+            const { configPath } = await prepare({
+                ...(params.vars ? { vars: params.vars } : {}),
+                ...(params.host ? { host: params.host } : {}),
+                port: params.port ?? DEFAULT_PORT,
+            }, ctx, 'dev');
+            const handle = await runWranglerDev({
+                projectDir: ctx.projectDir,
+                configPath,
+                port: params.port ?? DEFAULT_PORT,
+                remote: false,
+                autoPickPort: params.port === undefined,
+                ...(params.host ? { ip: '0.0.0.0' } : {}),
+                onReload: ctx.onReload,
+                onLog: logTo(),
+            });
+            return { url: params.host ?? handle.url, stop: handle.stop };
+        },
+        // Config hot-regen for the local dev loop: same codegen as `watch` (the
+        // running `wrangler dev` reloads its generated config + entry itself) —
+        // the params mapping must stay identical to `watch`'s prepare call.
+        async regenerate(params, ctx) {
+            await prepare({
+                ...(params.vars ? { vars: params.vars } : {}),
+                ...(params.host ? { host: params.host } : {}),
+                port: params.port ?? DEFAULT_PORT,
+            }, ctx, 'dev');
+        },
+        async deploy(params, ctx) {
+            const log = logTo();
+            const instance = params.instance;
+            if (!instance) {
+                throw new Error(`astrale adapter: this env has no "instance" — managed deploys need the target ` +
+                    `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`);
+            }
+            const servicesOrigin = params.servicesOrigin ?? DEFAULT_SERVICES_ORIGIN;
+            const name = params.name ?? serviceNameFor(ctx.domain.origin);
+            // Build + pack the client SPA: the services worker serves it under /ui.
+            let assetFiles = [];
+            if (ctx.clientDir) {
+                await buildClient(ctx.clientDir, ctx.projectDir, log);
+                assetFiles = readAssetFiles(join(ctx.projectDir, CLIENT_DIST_DIR));
+                if (assetFiles.length)
+                    log(`packed client SPA (${assetFiles.length} files) — /ui ships managed`);
+            }
+            // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
+            //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
+            const { clientDir: _omitted, ...bundleCtx } = ctx;
+            const { configPath } = await prepare({}, bundleCtx, 'dev');
+            const outDir = join(ctx.projectDir, '.astrale', 'dist-managed');
+            const bundlePath = await runWranglerBundle({
+                projectDir: ctx.projectDir,
+                configPath,
+                outDir,
+                onLog: log,
+            });
+            const bundle = readFileSync(bundlePath);
+            // 2. Host it on the instance's services domain. `CloudflareWorker.deploy`
+            //    upserts a worker by name on the platform's CF Workers-for-Platforms
+            //    backend and returns its public URL. Payload rides STDIN — a bundle is
+            //    megabytes of base64, far past argv limits.
+            log(`deploying "${name}" to the services domain on "${instance}"…`);
+            const deployed = (await astraleCall(ctx.projectDir, params, {
+                instance,
+                path: `/${servicesOrigin}/class.CloudflareWorker/deploy`,
+                data: {
+                    name,
+                    entry: 'index.mjs',
+                    modules: [{ name: 'index.mjs', contentBase64: bundle.toString('base64'), kind: 'esm' }],
+                    ...(assetFiles.length
+                        ? {
+                            assets: {
+                                files: assetFiles,
+                                notFound: 'single-page-application',
+                                runWorkerFirst: true,
+                            },
+                        }
+                        : {}),
+                    ...(params.vars ? { vars: params.vars } : {}),
+                },
+                viaStdin: true,
+            }));
+            if (deployed.error || !deployed.url) {
+                throw new Error(`services deploy failed: state=${deployed.state ?? '?'} error=${deployed.error ?? '?'}. ` +
+                    `Is the services domain installed on "${instance}"?`);
+            }
+            const url = deployed.url;
+            // 3. Author runtime secrets: read the env's dotenv locally and push each
+            //    via the service's write-only `setSecret` (values ride stdin, never argv).
+            if (params.secrets) {
+                const secrets = loadDotenvFile(join(ctx.projectDir, params.secrets));
+                const keys = Object.keys(secrets);
+                if (keys.length)
+                    log(`setting ${keys.length} secret(s) from ${params.secrets}…`);
+                for (const [key, value] of Object.entries(secrets)) {
+                    await astraleCall(ctx.projectDir, params, {
+                        instance,
+                        path: `/${servicesOrigin}/services/${name}/setSecret`,
+                        data: { name: key, value },
+                        viaStdin: true,
+                    });
+                }
+            }
+            // 4. Install the domain on the instance from the hosted URL. The child
+            //    kernel fetches the signed bundle, verifies it, and runs its postInstall.
+            log(`installing "${ctx.domain.origin}" on "${instance}" from ${url}…`);
+            await runAstrale(astraleBin(ctx.projectDir), ctx.projectDir, [
+                'instance',
+                'install',
+                url,
+                '-i',
+                instance,
+                '--json',
+                '--timeout',
+                '240000',
+            ]);
+            return {
+                url,
+                nextSteps: `  installed on "${instance}" — call it:\n` +
+                    `      astrale call "/${ctx.domain.origin}/..." -i ${instance}`,
+            };
+        },
+        secretsFile(params) {
+            return params.secrets;
+        },
+    });
+}
+/** Walk a built SPA dir into the services schema's `AssetFileSchema[]` (paths rooted at `/`). */
+function readAssetFiles(distClientDir) {
+    const out = [];
+    if (!existsSync(distClientDir))
+        return out;
+    const walk = (dir) => {
+        for (const entry of readdirSync(dir)) {
+            const full = join(dir, entry);
+            if (statSync(full).isDirectory())
+                walk(full);
+            else {
+                out.push({
+                    path: `/${relative(distClientDir, full).split('\\').join('/')}`,
+                    contentBase64: readFileSync(full).toString('base64'),
+                });
+            }
+        }
+    };
+    walk(distClientDir);
+    return out;
+}
+/** Service name from the origin: first DNS label (e.g. `my-notes.example.dev` → `my-notes`). */
+export function serviceNameFor(origin) {
+    const label = origin.split('.')[0] ?? origin;
+    return label.toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+}
+/**
+ * Invoke the user's `astrale` CLI for one platform call (against the target
+ * INSTANCE) and parse its JSON output. The CLI owns identity (IdP session,
+ * audience scoping, delegation minting) — reimplementing that here would fork
+ * the trust path.
+ */
+async function astraleCall(projectDir, params, call) {
+    // Saga-sized timeout: a cold managed deploy regularly exceeds the CLI's 30s
+    // default. Target the instance (`-i`), not admin — the services domain lives
+    // on the instance.
+    const args = ['call', call.path, '-i', call.instance, '--json', '--timeout', '240000'];
+    if (params.identity)
+        args.push('--as', params.identity);
+    const payload = JSON.stringify(call.data);
+    if (!call.viaStdin)
+        args.push('--data', payload);
+    const out = await runAstrale(astraleBin(projectDir), projectDir, args, call.viaStdin ? payload : undefined);
+    try {
+        return JSON.parse(out);
+    }
+    catch {
+        throw new Error(`astrale call ${call.path}: could not parse CLI output: ${out.slice(0, 300)}`);
+    }
+}
+/** Spawn the astrale CLI, feed optional stdin, return stdout+stderr. Throws on non-zero exit. */
+async function runAstrale(bin, cwd, args, stdin) {
+    const { code, out } = await new Promise((resolve, reject) => {
+        const child = spawn(bin, args, {
+            cwd,
+            stdio: [stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+        });
+        let out = '';
+        child.stdout?.on('data', (b) => (out += b.toString()));
+        child.stderr?.on('data', (b) => (out += b.toString()));
+        child.on('exit', (c) => resolve({ code: c ?? 1, out }));
+        child.on('error', reject);
+        if (stdin !== undefined) {
+            child.stdin?.write(stdin);
+            child.stdin?.end();
+        }
+    });
+    if (code !== 0) {
+        const authShaped = /AUTH_ERROR|expired|not signed in|credential/i.test(out);
+        throw new Error(`astrale ${args[0]} ${args[1] ?? ''} failed (exit ${code}): ${out.trim().slice(0, 500)}` +
+            (authShaped ? `\nIs the astrale CLI installed and signed in? (astrale auth login)` : ''));
+    }
+    return out;
+}
+/** The user's astrale CLI: ~/.astrale/bin/astrale when present, else PATH. */
+function astraleBin(_projectDir) {
+    const home = process.env.HOME;
+    if (home) {
+        const installed = join(home, '.astrale', 'bin', 'astrale');
+        if (existsSync(installed))
+            return installed;
+    }
+    return 'astrale';
+}
+//# sourceMappingURL=astrale.js.map

package/dist/astrale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astrale.js","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EACL,WAAW,EACX,eAAe,EACf,KAAK,EACL,OAAO,EACP,iBAAiB,EACjB,cAAc,GACf,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAI1C,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,uBAAuB,GAAG,qBAAqB,CAAA;AAErD,MAAM,UAAU,OAAO,CAAC,IAAmC;IACzD,OAAO,aAAa,CAAgB;QAClC,IAAI,EAAE,SAAS;QACf,IAAI;QAEJ,4EAA4E;QAC5E,8CAA8C;QAC9C,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACrB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAClC;gBACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;aAClC,EACD,GAAG,EACH,KAAK,CACN,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;gBACjC,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS;gBACvC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9D,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG;YAC1B,MAAM,OAAO,CACX;gBACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;aAClC,EACD,GAAG,EACH,KAAK,CACN,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;YACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,gFAAgF;oBAC9E,kEAAkE,CACrE,CAAA;YACH,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,uBAAuB,CAAA;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAE7D,wEAAwE;YACxE,IAAI,UAAU,GAAgB,EAAE,CAAA;YAChC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBACrD,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAA;gBAClE,IAAI,UAAU,CAAC,MAAM;oBACnB,GAAG,CAAC,sBAAsB,UAAU,CAAC,MAAM,6BAA6B,CAAC,CAAA;YAC7E,CAAC;YAED,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,CAAA;YACjD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,MAAM;gBACN,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;YAEvC,0EAA0E;YAC1E,yEAAyE;YACzE,2EAA2E;YAC3E,gDAAgD;YAChD,GAAG,CAAC,cAAc,IAAI,gCAAgC,QAAQ,IAAI,CAAC,CAAA;YACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE;gBAC1D,QAAQ;gBACR,IAAI,EAAE,IAAI,cAAc,gCAAgC;gBACxD,IAAI,EAAE;oBACJ,IAAI;oBACJ,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;oBACvF,GAAG,CAAC,UAAU,CAAC,MAAM;wBACnB,CAAC,CAAC;4BACE,MAAM,EAAE;gCACN,KAAK,EAAE,UAAU;gCACjB,QAAQ,EAAE,yBAAyB;gCACnC,cAAc,EAAE,IAAI;6BACrB;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC,CAA2E,CAAA;YAE7E,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,CAAC,KAAK,IAAI,GAAG,UAAU,QAAQ,CAAC,KAAK,IAAI,GAAG,IAAI;oBACvF,wCAAwC,QAAQ,IAAI,CACvD,CAAA;YACH,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAA;YAExB,yEAAyE;YACzE,+EAA+E;YAC/E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACjC,IAAI,IAAI,CAAC,MAAM;oBAAE,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;gBAChF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE;wBACxC,QAAQ;wBACR,IAAI,EAAE,IAAI,cAAc,aAAa,IAAI,YAAY;wBACrD,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;wBAC1B,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,8EAA8E;YAC9E,GAAG,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,MAAM,SAAS,QAAQ,UAAU,GAAG,GAAG,CAAC,CAAA;YACtE,MAAM,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE;gBAC3D,UAAU;gBACV,SAAS;gBACT,GAAG;gBACH,IAAI;gBACJ,QAAQ;gBACR,QAAQ;gBACR,WAAW;gBACX,QAAQ;aACT,CAAC,CAAA;YAEF,OAAO;gBACL,GAAG;gBACH,SAAS,EACP,mBAAmB,QAAQ,gBAAgB;oBAC3C,wBAAwB,GAAG,CAAC,MAAM,CAAC,MAAM,YAAY,QAAQ,EAAE;aAClE,CAAA;QACH,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAID,iGAAiG;AACjG,SAAS,cAAc,CAAC,aAAqB;IAC3C,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,GAAG,CAAA;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAA;iBACvC,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,IAAI,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC/D,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACrD,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,aAAa,CAAC,CAAA;IACnB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;IAC5C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CACxB,UAAkB,EAClB,MAAqB,EACrB,IAA2E;IAE3E,4EAA4E;IAC5E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IACtF,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,UAAU,CAAC,UAAU,CAAC,EACtB,UAAU,EACV,IAAI,EACJ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACpC,CAAA;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,GAAW,EACX,IAAc,EACd,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,CAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,GAAG;YACH,KAAK,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACjE,CAAC,CAAA;QACF,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3E,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACtF,CAAC,UAAU,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3F,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@astrale-os/adapter-astrale` — deploy an Astrale domain as a MANAGED service
+ * through the Astrale platform (no Cloudflare account, no wrangler auth — the
+ * only credential is your `astrale auth login` session).
+ *
+ *   import { astrale } from '@astrale-os/adapter-astrale'
+ *
+ *   adapter: astrale({
+ *     dev:  { secrets: '.env.dev' },          // local wrangler dev, unchanged
+ *     prod: { instance: '<your-instance-slug>' },
+ *   })
+ *
+ * It builds the SAME Cloudflare Workers bundle the `cloudflare` adapter ships
+ * (via `@astrale-os/adapter-cloudflare/build`), then hosts it on the target
+ * instance's `services` domain and installs the domain from the resulting URL.
+ * For deploying to YOUR OWN Cloudflare account instead, use
+ * `@astrale-os/adapter-cloudflare`.
+ */
+export { astrale } from './astrale';
+export type { AstraleParams } from './params';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,20 @@
+/**
+ * `@astrale-os/adapter-astrale` — deploy an Astrale domain as a MANAGED service
+ * through the Astrale platform (no Cloudflare account, no wrangler auth — the
+ * only credential is your `astrale auth login` session).
+ *
+ *   import { astrale } from '@astrale-os/adapter-astrale'
+ *
+ *   adapter: astrale({
+ *     dev:  { secrets: '.env.dev' },          // local wrangler dev, unchanged
+ *     prod: { instance: '<your-instance-slug>' },
+ *   })
+ *
+ * It builds the SAME Cloudflare Workers bundle the `cloudflare` adapter ships
+ * (via `@astrale-os/adapter-cloudflare/build`), then hosts it on the target
+ * instance's `services` domain and installs the domain from the resulting URL.
+ * For deploying to YOUR OWN Cloudflare account instead, use
+ * `@astrale-os/adapter-cloudflare`.
+ */
+export { astrale } from './astrale';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA"}

package/dist/params.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `AstraleParams` — the provider-typed config for the Astrale-managed adapter.
+ *
+ * One type covers every env; per-env differences are just optional fields. The
+ * same `{ dev, prod, canary, … }` map a developer writes in `astrale.config.ts`
+ * is `Record<string, AstraleParams>`.
+ *
+ * `watch` is local `wrangler dev` (identical to the Cloudflare adapter's dev);
+ * `deploy` ships the bundle through the target instance's `services` domain and
+ * installs it — so `instance` is required for `deploy`, ignored by `watch`.
+ */
+export interface AstraleParams {
+    /**
+     * Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`).
+     * Required for `deploy` (managed publish + install); ignored by `watch`
+     * (local dev) — so dev-only envs may omit it.
+     */
+    instance?: string;
+    /** Service name on the platform. Default: the origin's first DNS label. */
+    name?: string;
+    /**
+     * Origin of the `services` domain installed on the target instance — where the
+     * worker is hosted (`CloudflareWorker.deploy`). Default `'services.astrale.ai'`.
+     */
+    servicesOrigin?: string;
+    /** @deprecated Unused since hosting moved to the per-instance services domain. */
+    adminUrl?: string;
+    /** @deprecated Unused since hosting moved to the per-instance services domain. */
+    region?: string;
+    /** CLI identity (`--as`) for the deploy/install calls. Default: the CLI's active identity. */
+    identity?: string;
+    /** Gitignored secrets file. `watch`: injected into local wrangler dev. `deploy`: shipped on the install call and applied to the managed service env (encrypted at rest platform-side; platform keys win precedence). */
+    secrets?: string;
+    /** Local dev port for `wrangler dev`. Default 8787. */
+    port?: number;
+    /**
+     * Public URL the dev server is reached through (tunnel / sandbox preview /
+     * reverse proxy), e.g. `'https://my-box.preview.dev'`. Sets BOTH effects an
+     * off-localhost dev needs: wrangler binds 0.0.0.0 (reachable from outside)
+     * and `WORKER_URL` is pinned to this URL so the worker's per-request-Host
+     * identity (`iss`) doesn't drift to the proxy's internal hostname.
+     * Usually injected by `pnpm dev --host <url>` rather than written here.
+     */
+    host?: string;
+    /** Extra plain vars for local `watch`. */
+    vars?: Record<string, string>;
+}
+//# sourceMappingURL=params.d.ts.map

package/dist/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wNAAwN;IACxN,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B"}

package/dist/params.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@astrale-os/adapter-astrale",
+  "version": "0.1.0",
+  "description": "Deploy an Astrale domain as a managed service through the Astrale platform",
+  "keywords": [
+    "adapter",
+    "astrale",
+    "domain",
+    "managed",
+    "workers"
+  ],
+  "license": "MIT",
+  "author": "Astrale",
+  "files": [
+    "dist",
+    "src",
+    "template"
+  ],
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@astrale-os/adapter-cloudflare": "^0.1.9",
+    "@astrale-os/sdk": "^0.1.7"
+  },
+  "devDependencies": {
+    "@astrale-os/ox": ">=0.1.0 <1.0.0",
+    "@types/node": "^22.0.0",
+    "@typescript/native-preview": "latest",
+    "oxfmt": "latest",
+    "oxlint": "latest",
+    "typescript": "~6.0.1-rc",
+    "vitest": "^3.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "typecheck": "tsgo --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint .",
+    "format": "pnpm exec oxfmt --write .",
+    "format:check": "pnpm exec oxfmt --check .",
+    "build": "rm -rf dist && tsgo"
+  }
+}

package/src/astrale.ts

@@ -0,0 +1,309 @@
+/**
+ * `astrale(envs)` — the Astrale-managed deployment adapter.
+ *
+ * Ships the domain THROUGH the target instance's `services` domain instead of to
+ * the author's own cloud account. `deploy` builds the same single-module workerd
+ * bundle the Cloudflare adapter ships (shared codegen + `wrangler deploy
+ * --dry-run`), then:
+ *
+ *   1. hosts it on the instance's services domain — `CloudflareWorker.deploy
+ *      { name, entry, modules, assets, vars }` → a public worker `url`;
+ *   2. (optional) pushes runtime secrets via the service's `setSecret`;
+ *   3. installs the domain on the instance from that `url`
+ *      (`astrale domain install <url>` → the child kernel's `Root.installDomain`,
+ *      which fetches + verifies the signed bundle and runs its `postInstall`).
+ *
+ * The admin control plane is NOT involved: hosting moved out of admin into the
+ * per-instance `services` domain (a separate bounded context). No Cloudflare
+ * account, no wrangler auth — the only credential is the author's Astrale
+ * identity, supplied by the `astrale` CLI session this adapter shells out to.
+ *
+ * REQUIRES the `services` domain installed on the target instance. An instance
+ * without it can't host managed deploys — `deploy` fails loud with that hint.
+ *
+ * `watch` is identical to the Cloudflare adapter's local dev (wrangler dev on
+ * localhost) — managed deploys change WHERE the worker runs, not how you iterate.
+ */
+
+import type { DomainAdapter } from '@astrale-os/sdk'
+
+// The shared Cloudflare-Workers build toolkit — the managed adapter ships the
+// SAME bundle the direct `cloudflare` adapter does, then routes it through the
+// platform instead of `wrangler deploy`.
+import {
+  buildClient,
+  CLIENT_DIST_DIR,
+  logTo,
+  prepare,
+  runWranglerBundle,
+  runWranglerDev,
+} from '@astrale-os/adapter-cloudflare/build'
+import { defineAdapter } from '@astrale-os/sdk'
+import { loadDotenvFile } from '@astrale-os/sdk/cli'
+import { spawn } from 'node:child_process'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
+
+import type { AstraleParams } from './params'
+
+const DEFAULT_PORT = 8787
+const DEFAULT_SERVICES_ORIGIN = 'services.astrale.ai'
+
+export function astrale(envs: Record<string, AstraleParams>): DomainAdapter<AstraleParams> {
+  return defineAdapter<AstraleParams>({
+    name: 'astrale',
+    envs,
+
+    // Local dev is unchanged: wrangler dev on localhost. Managed deploys change
+    // WHERE the worker ships, not the inner loop.
+    async watch(params, ctx) {
+      const { configPath } = await prepare(
+        {
+          ...(params.vars ? { vars: params.vars } : {}),
+          ...(params.host ? { host: params.host } : {}),
+          port: params.port ?? DEFAULT_PORT,
+        },
+        ctx,
+        'dev',
+      )
+      const handle = await runWranglerDev({
+        projectDir: ctx.projectDir,
+        configPath,
+        port: params.port ?? DEFAULT_PORT,
+        remote: false,
+        autoPickPort: params.port === undefined,
+        ...(params.host ? { ip: '0.0.0.0' } : {}),
+        onReload: ctx.onReload,
+        onLog: logTo(),
+      })
+      return { url: params.host ?? handle.url, stop: handle.stop }
+    },
+
+    // Config hot-regen for the local dev loop: same codegen as `watch` (the
+    // running `wrangler dev` reloads its generated config + entry itself) —
+    // the params mapping must stay identical to `watch`'s prepare call.
+    async regenerate(params, ctx) {
+      await prepare(
+        {
+          ...(params.vars ? { vars: params.vars } : {}),
+          ...(params.host ? { host: params.host } : {}),
+          port: params.port ?? DEFAULT_PORT,
+        },
+        ctx,
+        'dev',
+      )
+    },
+
+    async deploy(params, ctx) {
+      const log = logTo()
+      const instance = params.instance
+      if (!instance) {
+        throw new Error(
+          `astrale adapter: this env has no "instance" — managed deploys need the target ` +
+            `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`,
+        )
+      }
+      const servicesOrigin = params.servicesOrigin ?? DEFAULT_SERVICES_ORIGIN
+      const name = params.name ?? serviceNameFor(ctx.domain.origin)
+
+      // Build + pack the client SPA: the services worker serves it under /ui.
+      let assetFiles: AssetFile[] = []
+      if (ctx.clientDir) {
+        await buildClient(ctx.clientDir, ctx.projectDir, log)
+        assetFiles = readAssetFiles(join(ctx.projectDir, CLIENT_DIST_DIR))
+        if (assetFiles.length)
+          log(`packed client SPA (${assetFiles.length} files) — /ui ships managed`)
+      }
+
+      // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
+      //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
+      const { clientDir: _omitted, ...bundleCtx } = ctx
+      const { configPath } = await prepare({}, bundleCtx, 'dev')
+      const outDir = join(ctx.projectDir, '.astrale', 'dist-managed')
+      const bundlePath = await runWranglerBundle({
+        projectDir: ctx.projectDir,
+        configPath,
+        outDir,
+        onLog: log,
+      })
+      const bundle = readFileSync(bundlePath)
+
+      // 2. Host it on the instance's services domain. `CloudflareWorker.deploy`
+      //    upserts a worker by name on the platform's CF Workers-for-Platforms
+      //    backend and returns its public URL. Payload rides STDIN — a bundle is
+      //    megabytes of base64, far past argv limits.
+      log(`deploying "${name}" to the services domain on "${instance}"…`)
+      const deployed = (await astraleCall(ctx.projectDir, params, {
+        instance,
+        path: `/${servicesOrigin}/class.CloudflareWorker/deploy`,
+        data: {
+          name,
+          entry: 'index.mjs',
+          modules: [{ name: 'index.mjs', contentBase64: bundle.toString('base64'), kind: 'esm' }],
+          ...(assetFiles.length
+            ? {
+                assets: {
+                  files: assetFiles,
+                  notFound: 'single-page-application',
+                  runWorkerFirst: true,
+                },
+              }
+            : {}),
+          ...(params.vars ? { vars: params.vars } : {}),
+        },
+        viaStdin: true,
+      })) as { name?: string; url?: string; state?: string; error?: string | null }
+
+      if (deployed.error || !deployed.url) {
+        throw new Error(
+          `services deploy failed: state=${deployed.state ?? '?'} error=${deployed.error ?? '?'}. ` +
+            `Is the services domain installed on "${instance}"?`,
+        )
+      }
+      const url = deployed.url
+
+      // 3. Author runtime secrets: read the env's dotenv locally and push each
+      //    via the service's write-only `setSecret` (values ride stdin, never argv).
+      if (params.secrets) {
+        const secrets = loadDotenvFile(join(ctx.projectDir, params.secrets))
+        const keys = Object.keys(secrets)
+        if (keys.length) log(`setting ${keys.length} secret(s) from ${params.secrets}…`)
+        for (const [key, value] of Object.entries(secrets)) {
+          await astraleCall(ctx.projectDir, params, {
+            instance,
+            path: `/${servicesOrigin}/services/${name}/setSecret`,
+            data: { name: key, value },
+            viaStdin: true,
+          })
+        }
+      }
+
+      // 4. Install the domain on the instance from the hosted URL. The child
+      //    kernel fetches the signed bundle, verifies it, and runs its postInstall.
+      log(`installing "${ctx.domain.origin}" on "${instance}" from ${url}…`)
+      await runAstrale(astraleBin(ctx.projectDir), ctx.projectDir, [
+        'instance',
+        'install',
+        url,
+        '-i',
+        instance,
+        '--json',
+        '--timeout',
+        '240000',
+      ])
+
+      return {
+        url,
+        nextSteps:
+          `  installed on "${instance}" — call it:\n` +
+          `      astrale call "/${ctx.domain.origin}/..." -i ${instance}`,
+      }
+    },
+
+    secretsFile(params) {
+      return params.secrets
+    },
+  })
+}
+
+type AssetFile = { path: string; contentBase64: string }
+
+/** Walk a built SPA dir into the services schema's `AssetFileSchema[]` (paths rooted at `/`). */
+function readAssetFiles(distClientDir: string): AssetFile[] {
+  const out: AssetFile[] = []
+  if (!existsSync(distClientDir)) return out
+  const walk = (dir: string): void => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry)
+      if (statSync(full).isDirectory()) walk(full)
+      else {
+        out.push({
+          path: `/${relative(distClientDir, full).split('\\').join('/')}`,
+          contentBase64: readFileSync(full).toString('base64'),
+        })
+      }
+    }
+  }
+  walk(distClientDir)
+  return out
+}
+
+/** Service name from the origin: first DNS label (e.g. `my-notes.example.dev` → `my-notes`). */
+export function serviceNameFor(origin: string): string {
+  const label = origin.split('.')[0] ?? origin
+  return label.toLowerCase().replace(/[^a-z0-9-]+/g, '-')
+}
+
+/**
+ * Invoke the user's `astrale` CLI for one platform call (against the target
+ * INSTANCE) and parse its JSON output. The CLI owns identity (IdP session,
+ * audience scoping, delegation minting) — reimplementing that here would fork
+ * the trust path.
+ */
+async function astraleCall(
+  projectDir: string,
+  params: AstraleParams,
+  call: { instance: string; path: string; data: unknown; viaStdin?: boolean },
+): Promise<unknown> {
+  // Saga-sized timeout: a cold managed deploy regularly exceeds the CLI's 30s
+  // default. Target the instance (`-i`), not admin — the services domain lives
+  // on the instance.
+  const args = ['call', call.path, '-i', call.instance, '--json', '--timeout', '240000']
+  if (params.identity) args.push('--as', params.identity)
+  const payload = JSON.stringify(call.data)
+  if (!call.viaStdin) args.push('--data', payload)
+
+  const out = await runAstrale(
+    astraleBin(projectDir),
+    projectDir,
+    args,
+    call.viaStdin ? payload : undefined,
+  )
+  try {
+    return JSON.parse(out)
+  } catch {
+    throw new Error(`astrale call ${call.path}: could not parse CLI output: ${out.slice(0, 300)}`)
+  }
+}
+
+/** Spawn the astrale CLI, feed optional stdin, return stdout+stderr. Throws on non-zero exit. */
+async function runAstrale(
+  bin: string,
+  cwd: string,
+  args: string[],
+  stdin?: string,
+): Promise<string> {
+  const { code, out } = await new Promise<{ code: number; out: string }>((resolve, reject) => {
+    const child = spawn(bin, args, {
+      cwd,
+      stdio: [stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+    })
+    let out = ''
+    child.stdout?.on('data', (b: Buffer) => (out += b.toString()))
+    child.stderr?.on('data', (b: Buffer) => (out += b.toString()))
+    child.on('exit', (c) => resolve({ code: c ?? 1, out }))
+    child.on('error', reject)
+    if (stdin !== undefined) {
+      child.stdin?.write(stdin)
+      child.stdin?.end()
+    }
+  })
+  if (code !== 0) {
+    const authShaped = /AUTH_ERROR|expired|not signed in|credential/i.test(out)
+    throw new Error(
+      `astrale ${args[0]} ${args[1] ?? ''} failed (exit ${code}): ${out.trim().slice(0, 500)}` +
+        (authShaped ? `\nIs the astrale CLI installed and signed in? (astrale auth login)` : ''),
+    )
+  }
+  return out
+}
+
+/** The user's astrale CLI: ~/.astrale/bin/astrale when present, else PATH. */
+function astraleBin(_projectDir: string): string {
+  const home = process.env.HOME
+  if (home) {
+    const installed = join(home, '.astrale', 'bin', 'astrale')
+    if (existsSync(installed)) return installed
+  }
+  return 'astrale'
+}

package/src/index.ts

@@ -0,0 +1,21 @@
+/**
+ * `@astrale-os/adapter-astrale` — deploy an Astrale domain as a MANAGED service
+ * through the Astrale platform (no Cloudflare account, no wrangler auth — the
+ * only credential is your `astrale auth login` session).
+ *
+ *   import { astrale } from '@astrale-os/adapter-astrale'
+ *
+ *   adapter: astrale({
+ *     dev:  { secrets: '.env.dev' },          // local wrangler dev, unchanged
+ *     prod: { instance: '<your-instance-slug>' },
+ *   })
+ *
+ * It builds the SAME Cloudflare Workers bundle the `cloudflare` adapter ships
+ * (via `@astrale-os/adapter-cloudflare/build`), then hosts it on the target
+ * instance's `services` domain and installs the domain from the resulting URL.
+ * For deploying to YOUR OWN Cloudflare account instead, use
+ * `@astrale-os/adapter-cloudflare`.
+ */
+
+export { astrale } from './astrale'
+export type { AstraleParams } from './params'

package/src/params.ts

@@ -0,0 +1,47 @@
+/**
+ * `AstraleParams` — the provider-typed config for the Astrale-managed adapter.
+ *
+ * One type covers every env; per-env differences are just optional fields. The
+ * same `{ dev, prod, canary, … }` map a developer writes in `astrale.config.ts`
+ * is `Record<string, AstraleParams>`.
+ *
+ * `watch` is local `wrangler dev` (identical to the Cloudflare adapter's dev);
+ * `deploy` ships the bundle through the target instance's `services` domain and
+ * installs it — so `instance` is required for `deploy`, ignored by `watch`.
+ */
+export interface AstraleParams {
+  /**
+   * Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`).
+   * Required for `deploy` (managed publish + install); ignored by `watch`
+   * (local dev) — so dev-only envs may omit it.
+   */
+  instance?: string
+  /** Service name on the platform. Default: the origin's first DNS label. */
+  name?: string
+  /**
+   * Origin of the `services` domain installed on the target instance — where the
+   * worker is hosted (`CloudflareWorker.deploy`). Default `'services.astrale.ai'`.
+   */
+  servicesOrigin?: string
+  /** @deprecated Unused since hosting moved to the per-instance services domain. */
+  adminUrl?: string
+  /** @deprecated Unused since hosting moved to the per-instance services domain. */
+  region?: string
+  /** CLI identity (`--as`) for the deploy/install calls. Default: the CLI's active identity. */
+  identity?: string
+  /** Gitignored secrets file. `watch`: injected into local wrangler dev. `deploy`: shipped on the install call and applied to the managed service env (encrypted at rest platform-side; platform keys win precedence). */
+  secrets?: string
+  /** Local dev port for `wrangler dev`. Default 8787. */
+  port?: number
+  /**
+   * Public URL the dev server is reached through (tunnel / sandbox preview /
+   * reverse proxy), e.g. `'https://my-box.preview.dev'`. Sets BOTH effects an
+   * off-localhost dev needs: wrangler binds 0.0.0.0 (reachable from outside)
+   * and `WORKER_URL` is pinned to this URL so the worker's per-request-Host
+   * identity (`iss`) doesn't drift to the proxy's internal hostname.
+   * Usually injected by `pnpm dev --host <url>` rather than written here.
+   */
+  host?: string
+  /** Extra plain vars for local `watch`. */
+  vars?: Record<string, string>
+}

package/template/astrale.config.ts

@@ -0,0 +1,39 @@
+/**
+ * astrale.config.ts — binds the worker-safe domain (`domain.ts`) to the managed
+ * Astrale deploy adapter for the `astrale-domain` CLI. This is a NODE-only
+ * module; the generated worker imports `domain.ts` directly, never this file.
+ *
+ * This variant ships THROUGH the Astrale platform (the managed `astrale`
+ * adapter) — no Cloudflare account needed.
+ *
+ *   pnpm dev                       # wrangler dev → prints a local URL
+ *   astrale domain install <url> --direct # mount the dev URL on an instance
+ *   pnpm prod                      # managed deploy → prints a URL + installs
+ */
+import { astrale } from '@astrale-os/adapter-astrale'
+import { deploy } from '@astrale-os/sdk'
+// Have your own Cloudflare account and prefer deploying there directly? Swap
+// the adapter — same bundle, shipped with wrangler under YOUR account (then
+// mount it yourself: `astrale domain install <url> --direct`):
+//
+//   import { cloudflare } from '@astrale-os/adapter-cloudflare'
+//   export default deploy(domain, cloudflare({
+//     dev: { secrets: '.env.dev' },
+//     prod: { route: 'astrale-domain.example.dev', secrets: '.env.prod' },
+//   }))
+
+import { domain } from './domain'
+
+export default deploy(
+  domain,
+  astrale({
+    // Local dev: `wrangler dev`. No route → URL is http://localhost:8787.
+    dev: { secrets: '.env.dev' },
+    // Managed deploy: `pnpm prod` publishes the bundle through the platform and
+    // installs the domain on this instance. The slug comes from
+    // `astrale instance create <slug>` / `astrale instance status`.
+    prod: { instance: 'my-instance-slug' },
+    // Author secrets ship via `secrets: '.env.prod'` on any env (encrypted at
+    // rest platform-side, re-applied on redeploys; omit = keep, `{}` = clear).
+  }),
+)