@astrale-os/adapter-cloudflare 0.1.3 → 0.1.5

package/dist/assets-pack.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Pack a built client SPA (`dist-client/`) into the host box's asset-archive
+ * format: `gzip(JSON [{ path, contentBase64 }])` — the exact shape
+ * `downloadAssets` on the box consumes (kernel/host workerd service layout).
+ */
+/** Gzip the SPA dir into the box's asset archive. Returns null when empty. */
+export declare function packAssets(distClientDir: string): Buffer | null;
+//# sourceMappingURL=assets-pack.d.ts.map

package/dist/assets-pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-pack.d.ts","sourceRoot":"","sources":["../src/assets-pack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D"}

package/dist/assets-pack.js

@@ -0,0 +1,30 @@
+/**
+ * Pack a built client SPA (`dist-client/`) into the host box's asset-archive
+ * format: `gzip(JSON [{ path, contentBase64 }])` — the exact shape
+ * `downloadAssets` on the box consumes (kernel/host workerd service layout).
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { gzipSync } from 'node:zlib';
+function walk(dir, root, out) {
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory())
+            walk(full, root, out);
+        else {
+            out.push({
+                path: relative(root, full).split('\\').join('/'),
+                contentBase64: readFileSync(full).toString('base64'),
+            });
+        }
+    }
+}
+/** Gzip the SPA dir into the box's asset archive. Returns null when empty. */
+export function packAssets(distClientDir) {
+    const files = [];
+    walk(distClientDir, distClientDir, files);
+    if (files.length === 0)
+        return null;
+    return gzipSync(Buffer.from(JSON.stringify(files)));
+}
+//# sourceMappingURL=assets-pack.js.map

package/dist/assets-pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-pack.js","sourceRoot":"","sources":["../src/assets-pack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAIpC,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAgB;IACvD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;aAClD,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAChD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC"}

package/dist/astrale.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"astrale.d.ts","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAQvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAU7C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,aAAa,CAAC,aAAa,CAAC,CA2FzF"}
+{"version":3,"file":"astrale.d.ts","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAQvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAY7C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,aAAa,CAAC,aAAa,CAAC,CAsHzF"}

package/dist/astrale.js

@@ -21,11 +21,13 @@
  * serve no `/ui` yet) and no runtime secrets reach the service — the bundle
  * must be self-contained (its signing identity is baked in by the codegen).
  */
-import { defineAdapter } from '@astrale-os/devkit';
+import { defineAdapter, loadDotenvFile } from '@astrale-os/devkit';
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { packAssets } from './assets-pack';
+import { buildClient } from './client';
 import { logTo, prepare } from './cloudflare';
 import { runWranglerBundle, runWranglerDev } from './wrangler-cli';
 const DEFAULT_PORT = 8787;
@@ -52,9 +54,18 @@ export function astrale(envs) {
         },
         async deploy(params, ctx) {
             const log = logTo();
+            if (!params.instance) {
+                throw new Error(`astrale adapter: this env has no "instance" — managed deploys need the target ` +
+                    `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`);
+            }
+            // Build + pack the client SPA: managed services serve it under /ui (the
+            // platform stages the archive and the box downloads it at Service.init).
+            let assetsGz = null;
             if (ctx.clientDir) {
-                log(`client/ detected — managed deploys do not ship SPA assets yet; ` +
-                    `/ui will not serve on the managed service (functions/methods are unaffected).`);
+                await buildClient(ctx.clientDir, ctx.projectDir, log);
+                assetsGz = packAssets(join(ctx.projectDir, 'dist-client'));
+                if (assetsGz)
+                    log(`packed client SPA (${assetsGz.length} bytes gz) — /ui ships managed`);
             }
             // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
             //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
@@ -85,13 +96,31 @@ export function astrale(envs) {
             log(`publishing ${name}@${version} (${bundle.length} bytes)…`);
             await astraleCall(ctx.projectDir, params, adminUrl, {
                 path: `/admin/domains/${name}::release`,
-                data: { version, bundleBase64: bundle.toString('base64'), makeCurrent: true },
+                data: {
+                    version,
+                    bundleBase64: bundle.toString('base64'),
+                    makeCurrent: true,
+                    ...(assetsGz ? { assetsGzBase64: assetsGz.toString('base64') } : {}),
+                },
                 viaStdin: true,
             });
+            // Author runtime secrets: read the env's dotenv locally, ship the map on
+            // the INSTALL call (never the release — secrets are per instance, never
+            // catalog-resident). Rides stdin so values never appear in argv.
+            let secrets;
+            if (params.secrets) {
+                secrets = loadDotenvFile(join(ctx.projectDir, params.secrets));
+                log(`shipping ${Object.keys(secrets).length} secret(s) from ${params.secrets}…`);
+            }
             log(`installing on instance "${params.instance}"…`);
             const installed = (await astraleCall(ctx.projectDir, params, adminUrl, {
                 path: `/admin/domains/${name}::install`,
-                data: { instanceId: params.instance, source: { kind: 'package' } },
+                data: {
+                    instanceId: params.instance,
+                    source: { kind: 'package' },
+                    ...(secrets ? { secrets } : {}),
+                },
+                viaStdin: true,
             }));
             if (installed.error || installed.state !== 'installed') {
                 throw new Error(`managed install failed: state=${installed.state ?? '?'} error=${installed.error ?? '?'}`);

package/dist/astrale.js.map

@@ -1 +1 @@
-{"version":3,"file":"astrale.js","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAElE,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,cAAc,GAAG,IAAI,CAAA;AAC3B,MAAM,YAAY,GAAG,kBAAkB,CAAA;AAEvC,MAAM,UAAU,OAAO,CAAC,IAAmC;IACzD,OAAO,aAAa,CAAgB;QAClC,IAAI,EAAE,SAAS;QACf,IAAI;QAEJ,4EAA4E;QAC5E,8CAA8C;QAC9C,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACrB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAClC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,EACpF,GAAG,EACH,KAAK,CACN,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;gBACjC,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;YACnB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,GAAG,CACD,iEAAiE;oBAC/D,+EAA+E,CAClF,CAAA;YACH,CAAC;YAED,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,CAAA;YACjD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,MAAM;gBACN,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAEzC,yEAAyE;YACzE,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAA;YACrD,MAAM,OAAO,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAE7C,GAAG,CAAC,gBAAgB,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAA;YAC5E,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,IAAI,YAAY,iCAAiC;gBACvD,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAA;YAEF,GAAG,CAAC,cAAc,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,UAAU,CAAC,CAAA;YAC9D,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;gBAC7E,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;YAEF,GAAG,CAAC,2BAA2B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACrE,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;aACnE,CAAC,CAAoE,CAAA;YAEtE,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,iCAAiC,SAAS,CAAC,KAAK,IAAI,GAAG,UAAU,SAAS,CAAC,KAAK,IAAI,GAAG,EAAE,CAC1F,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;YAC5F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;YAC9C,OAAO,EAAE,GAAG,EAAE,WAAW,SAAS,CAAC,WAAW,QAAQ,MAAM,aAAa,EAAE,CAAA;QAC7E,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;IAC5C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,UAAkB,EAClB,MAAqB,EACrB,QAAgB,EAChB,IAAyD;IAEzD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,CAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;YAChD,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAC3D,CAAC,CAAA;QACF,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YAC9E,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"astrale.js","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAElE,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,cAAc,GAAG,IAAI,CAAA;AAC3B,MAAM,YAAY,GAAG,kBAAkB,CAAA;AAEvC,MAAM,UAAU,OAAO,CAAC,IAAmC;IACzD,OAAO,aAAa,CAAgB;QAClC,IAAI,EAAE,SAAS;QACf,IAAI;QAEJ,4EAA4E;QAC5E,8CAA8C;QAC9C,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACrB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAClC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,EACpF,GAAG,EACH,KAAK,CACN,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;gBACjC,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;YACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gFAAgF;oBAC9E,kEAAkE,CACrE,CAAA;YACH,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBACrD,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;gBAC1D,IAAI,QAAQ;oBAAE,GAAG,CAAC,sBAAsB,QAAQ,CAAC,MAAM,gCAAgC,CAAC,CAAA;YAC1F,CAAC;YAED,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,CAAA;YACjD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,MAAM;gBACN,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAEzC,yEAAyE;YACzE,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAA;YACrD,MAAM,OAAO,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAE7C,GAAG,CAAC,gBAAgB,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAA;YAC5E,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,IAAI,YAAY,iCAAiC;gBACvD,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAA;YAEF,GAAG,CAAC,cAAc,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,UAAU,CAAC,CAAA;YAC9D,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE;oBACJ,OAAO;oBACP,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACvC,WAAW,EAAE,IAAI;oBACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;YAEF,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,OAA2C,CAAA;YAC/C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9D,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;YAClF,CAAC;YAED,GAAG,CAAC,2BAA2B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACrE,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE;oBACJ,UAAU,EAAE,MAAM,CAAC,QAAQ;oBAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChC;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAoE,CAAA;YAEtE,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,iCAAiC,SAAS,CAAC,KAAK,IAAI,GAAG,UAAU,SAAS,CAAC,KAAK,IAAI,GAAG,EAAE,CAC1F,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;YAC5F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;YAC9C,OAAO,EAAE,GAAG,EAAE,WAAW,SAAS,CAAC,WAAW,QAAQ,MAAM,aAAa,EAAE,CAAA;QAC7E,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;IAC5C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,UAAkB,EAClB,MAAqB,EACrB,QAAgB,EAChB,IAAyD;IAEzD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,CAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;YAChD,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAC3D,CAAC,CAAA;QACF,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YAC9E,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/params.d.ts

@@ -49,8 +49,12 @@ export interface CloudflareParams {
 }
 /** Params for the Astrale-managed adapter (`astrale(envs)`). */
 export interface AstraleParams {
-    /** Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`). */
-    instance: string;
+    /**
+     * Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`).
+     * Required for `deploy` (managed publish + install); ignored by `watch`
+     * (local dev) — so dev-only envs may omit it.
+     */
+    instance?: string;
     /** Catalog package name. Default: the origin's first DNS label. */
     name?: string;
     /** Admin kernel URL the publish calls target. Default the platform admin. */
@@ -59,7 +63,7 @@ export interface AstraleParams {
     region?: string;
     /** CLI identity (`--as`) for the publish calls. Default: the CLI's active identity. */
     identity?: string;
-    /** Gitignored secrets file — injected ONLY into local `watch` (managed services receive no secrets yet). */
+    /** Gitignored secrets file. `watch`: injected into local wrangler dev. `deploy`: shipped on the install call and applied to the managed service env (encrypted at rest platform-side; platform keys win precedence). */
     secrets?: string;
     /** Local dev port for `wrangler dev`. Default 8787. */
     port?: number;

package/dist/params.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4GAA4G;IAC5G,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B"}
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wNAAwN;IACxN,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Deploy an Astrale domain as a standalone Cloudflare Worker",
   "keywords": [
     "adapter",
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "jose": "^6.1.3",
-    "@astrale-os/devkit": "^0.1.2"
+    "@astrale-os/devkit": "^0.1.4"
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.0 <1.0.0",

package/src/assets-pack.ts

@@ -0,0 +1,32 @@
+/**
+ * Pack a built client SPA (`dist-client/`) into the host box's asset-archive
+ * format: `gzip(JSON [{ path, contentBase64 }])` — the exact shape
+ * `downloadAssets` on the box consumes (kernel/host workerd service layout).
+ */
+
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { gzipSync } from 'node:zlib'
+
+type AssetFile = { path: string; contentBase64: string }
+
+function walk(dir: string, root: string, out: AssetFile[]): void {
+  for (const name of readdirSync(dir)) {
+    const full = join(dir, name)
+    if (statSync(full).isDirectory()) walk(full, root, out)
+    else {
+      out.push({
+        path: relative(root, full).split('\\').join('/'),
+        contentBase64: readFileSync(full).toString('base64'),
+      })
+    }
+  }
+}
+
+/** Gzip the SPA dir into the box's asset archive. Returns null when empty. */
+export function packAssets(distClientDir: string): Buffer | null {
+  const files: AssetFile[] = []
+  walk(distClientDir, distClientDir, files)
+  if (files.length === 0) return null
+  return gzipSync(Buffer.from(JSON.stringify(files)))
+}

package/src/astrale.ts

@@ -24,7 +24,7 @@
 
 import type { DomainAdapter } from '@astrale-os/devkit'
 
-import { defineAdapter } from '@astrale-os/devkit'
+import { defineAdapter, loadDotenvFile } from '@astrale-os/devkit'
 import { spawn } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
@@ -32,6 +32,8 @@ import { join } from 'node:path'
 
 import type { AstraleParams } from './params'
 
+import { packAssets } from './assets-pack'
+import { buildClient } from './client'
 import { logTo, prepare } from './cloudflare'
 import { runWranglerBundle, runWranglerDev } from './wrangler-cli'
 
@@ -66,12 +68,20 @@ export function astrale(envs: Record<string, AstraleParams>): DomainAdapter<Astr
 
     async deploy(params, ctx) {
       const log = logTo()
-      if (ctx.clientDir) {
-        log(
-          `client/ detected — managed deploys do not ship SPA assets yet; ` +
-            `/ui will not serve on the managed service (functions/methods are unaffected).`,
+      if (!params.instance) {
+        throw new Error(
+          `astrale adapter: this env has no "instance" — managed deploys need the target ` +
+            `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`,
         )
       }
+      // Build + pack the client SPA: managed services serve it under /ui (the
+      // platform stages the archive and the box downloads it at Service.init).
+      let assetsGz: Buffer | null = null
+      if (ctx.clientDir) {
+        await buildClient(ctx.clientDir, ctx.projectDir, log)
+        assetsGz = packAssets(join(ctx.projectDir, 'dist-client'))
+        if (assetsGz) log(`packed client SPA (${assetsGz.length} bytes gz) — /ui ships managed`)
+      }
 
       // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
       //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
@@ -105,14 +115,33 @@ export function astrale(envs: Record<string, AstraleParams>): DomainAdapter<Astr
       log(`publishing ${name}@${version} (${bundle.length} bytes)…`)
       await astraleCall(ctx.projectDir, params, adminUrl, {
         path: `/admin/domains/${name}::release`,
-        data: { version, bundleBase64: bundle.toString('base64'), makeCurrent: true },
+        data: {
+          version,
+          bundleBase64: bundle.toString('base64'),
+          makeCurrent: true,
+          ...(assetsGz ? { assetsGzBase64: assetsGz.toString('base64') } : {}),
+        },
         viaStdin: true,
       })
 
+      // Author runtime secrets: read the env's dotenv locally, ship the map on
+      // the INSTALL call (never the release — secrets are per instance, never
+      // catalog-resident). Rides stdin so values never appear in argv.
+      let secrets: Record<string, string> | undefined
+      if (params.secrets) {
+        secrets = loadDotenvFile(join(ctx.projectDir, params.secrets))
+        log(`shipping ${Object.keys(secrets).length} secret(s) from ${params.secrets}…`)
+      }
+
       log(`installing on instance "${params.instance}"…`)
       const installed = (await astraleCall(ctx.projectDir, params, adminUrl, {
         path: `/admin/domains/${name}::install`,
-        data: { instanceId: params.instance, source: { kind: 'package' } },
+        data: {
+          instanceId: params.instance,
+          source: { kind: 'package' },
+          ...(secrets ? { secrets } : {}),
+        },
+        viaStdin: true,
       })) as { serviceSlug?: string; state?: string; error?: string | null }
 
       if (installed.error || installed.state !== 'installed') {

package/src/params.ts

@@ -50,8 +50,12 @@ export interface CloudflareParams {
 
 /** Params for the Astrale-managed adapter (`astrale(envs)`). */
 export interface AstraleParams {
-  /** Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`). */
-  instance: string
+  /**
+   * Target instance slug the domain installs onto (e.g. `'bryan-e2e5'`).
+   * Required for `deploy` (managed publish + install); ignored by `watch`
+   * (local dev) — so dev-only envs may omit it.
+   */
+  instance?: string
   /** Catalog package name. Default: the origin's first DNS label. */
   name?: string
   /** Admin kernel URL the publish calls target. Default the platform admin. */
@@ -60,7 +64,7 @@ export interface AstraleParams {
   region?: string
   /** CLI identity (`--as`) for the publish calls. Default: the CLI's active identity. */
   identity?: string
-  /** Gitignored secrets file — injected ONLY into local `watch` (managed services receive no secrets yet). */
+  /** Gitignored secrets file. `watch`: injected into local wrangler dev. `deploy`: shipped on the install call and applied to the managed service env (encrypted at rest platform-side; platform keys win precedence). */
   secrets?: string
   /** Local dev port for `wrangler dev`. Default 8787. */
   port?: number

package/template/.agents/skills/astrale-domain/SKILL.md

@@ -0,0 +1,321 @@
+---
+name: Astrale Domain
+description: Develop, deploy, and iterate an Astrale domain end-to-end — schema modeling (classes, interfaces, edges, methods), handler implementation, calling the kernel and other domains from handlers, integrating external APIs (the core use case — DI, secrets, idempotency, sagas), views, testing, and the deploy/install loop with the cloudflare or astrale adapter. Use whenever creating a domain, adding classes/methods/views, structuring external API calls, or debugging install/dispatch/permission errors. Pairs with the astrale-cli skill (CLI ops) — together they cover working an Astrale instance autonomously.
+---
+
+# Astrale Domain — the authoring bible
+
+An Astrale **domain** is a typed contract installed into a kernel's graph plus a
+**worker you own** that executes it. The kernel stores the schema (classes,
+edges, function contracts), enforces permissions, and routes calls; every
+method body runs on YOUR worker (Cloudflare worker or Astrale-managed service).
+The graph is the database AND the bus: domains read/write nodes+edges through
+the kernel and call each other's functions through it.
+
+**Mental model:** schema = what exists and what's callable · graph = state ·
+worker = behavior · kernel = router + authorizer. You never run a database or
+an RPC layer; you declare a contract and implement handlers.
+
+## 0 · Start
+
+```bash
+npx -y create-astrale-domain@latest my-domain --yes   # scaffold
+cd my-domain && pnpm install
+pnpm dev      # local wrangler dev (prints a URL; install it on an instance to test)
+pnpm dev --port 8899   # when 8787 is taken (orphan wrangler etc.)
+pnpm prod     # deploy + (astrale adapter) auto-install on your instance
+```
+
+Project anatomy (the scaffold is the reference — read its comments):
+
+```
+astrale.config.ts   # THE manifest: schema + postInstall + adapter (where it ships)
+schema/             # classes/interfaces/edges — the contract (zod props, fn signatures)
+methods/            # handler logic (transport-agnostic fns) + thin wiring (index.ts)
+services/           # RECOMMENDED: ports + factories for external APIs (see §4)
+functions/          # standalone remote functions (webhook-shaped endpoints)
+views/              # iframe-mountable UI declarations (defineView)
+client/             # the SPA served under /ui (vite)
+env.ts              # typed worker env — config + secrets arrive here, as ctx.deps
+```
+
+Iteration loop: edit → `pnpm prod` → call it. Managed redeploys keep the same
+service URL and reinstall the contract; schema changes are merge/reconcile
+(removed entries can leave old nodes behind — see the astrale-live-domain-edit
+skill for graph-level cleanup).
+
+## 1 · Schema modeling
+
+```ts
+import { KernelSchema, defineSchema, edgeClass, nodeClass, nodeInterface } from '@astrale-os/kernel-core'
+import { fn } from '@astrale-os/kernel-dsl'
+import { z } from 'zod'
+
+export const ContactOps = nodeInterface({           // interface = shared contract
+  methods: { createContact: fn({ static: true, params: {...}, returns: ... }) },
+})
+export const Contact = nodeClass({
+  implements: [ContactOps, KernelSchema.interfaces.Container],  // Container → can hold children
+  props: { email: z.string(), company: z.string().optional() },
+  methods: { assign: fn({ params: { project: z.string(), role: z.string() }, returns: ... }) },
+})
+export const works_on = edgeClass(                  // edges are CLASSES with PROPS
+  { as: 'contact', types: [Contact] },
+  { as: 'project', types: [Project] },
+  { props: { role: z.string() } },
+)
+export const schema = defineSchema('my-domain.example.dev', {
+  interfaces: { ContactOps },
+  classes: { Contact, Project, works_on },  // EDGE classes register under `classes` too
+  imports: [KernelSchema],
+})
+```
+
+Conventions and rules:
+- Naming: classes/interfaces `PascalCase`, methods `camelCase`, **edges `snake_case`**.
+- `static: true` = called on the class (`/origin/class.X/method`); otherwise
+  instance-dispatched (`/path/to/node::method`, handler gets `self`). Statics
+  work on classes AND interfaces, wired through the same `method()` /
+  `classMethods()` helpers (the scaffold's `seed` is a class-hosted static).
+- Model relations as **edges with props** (not foreign-key strings): create via
+  `::link {edgeClass, target, props}`, walk via `::getLinks`. Prefer FLAT nodes
+  + edges for peer resources; use Folders (Container) only for list-able
+  hierarchies (`::listChildren` works on Folders).
+- Props are zod; they land in the graph under QUALIFIED keys
+  (`origin:class.X.property.y`). Never hand-write key strings — derive them
+  from the compiled schema: `D.Contact.email.key`, `K.Named.name.key`.
+- Known sharp edges: `::update` currently drops `z.enum()` props silently
+  (create is fine — track status as plain string if you must update it); edge
+  prop accessors exist at runtime but not in types yet (cast).
+
+## 2 · Handlers
+
+Separate LOGIC from WIRING. Logic = plain async functions taking the kernel
+client + ports + params (testable with fakes). Wiring = `method()` /
+`classMethods()` / `interfaceMethods()` in `methods/index.ts`:
+
+```ts
+const kickoff = method(schema, 'Project', 'kickoff', {
+  authorize: async () => undefined,   // see §6 for real authorization
+  execute: ({ kernel, self, params, deps }) => {
+    if (!kernel) throw new Error('kickoff requires a kernel credential')
+    return kickoffLogic(kernel, createWeatherClient(deps), self.path.raw, params)
+  },
+})
+```
+
+Handler context: `kernel` (callback client bound to the composed credential —
+caller's delegated authority ∪ this function's own), `self` (instance methods),
+`params` (zod-validated), `deps` (your typed `Env`), `auth` (principal,
+verified claims). Construct external clients from `deps` per request — NEVER
+at module load (workers must be import-side-effect-free).
+
+## 3 · Talking to the kernel (and other domains)
+
+Everything is `kernel.call(path, params)`. Addressing forms:
+
+| Form | Example | Use |
+|---|---|---|
+| tree path + `::method` | `/projects/apollo::get` | instance dispatch on a node |
+| static slash form | `/origin/class.X/method` | static class/interface methods |
+| colon MethodPath | `/:origin:class.X:method` | canonical form; REQUIRED in postInstall |
+| `@<uuid>::method` | `@4548…::get` | by graph id (NOT slugs/paths) |
+
+Core ops from handlers (all proven patterns):
+
+```ts
+await kernel.call(K.Node.createNode.path.method.raw, { class: D.Contact.path.class.raw, path, props })
+await kernel.call(`${path}::update`, { props: { [D.Project.title.key]: 'New' } })
+// Edge props use QUALIFIED keys; the edge-prop TYPE accessor is missing today — use this cast:
+const ROLE_KEY = (D.works_on as unknown as { role: { key: string } }).role.key
+await kernel.call(`${path}::link`, { edgeClass: D.works_on.path.class.raw, target, props: { [ROLE_KEY]: role } })
+const links = await kernel.call(`${path}::getLinks`, {})       // filter by edge class
+await kernel.call('/other.domain/class.Echo/echo', { message }) // ANOTHER domain's function
+```
+
+- **Cross-function calls work** (same- or cross-domain): the kernel redirects
+  to the target worker and your worker mints a next-hop delegation as ITSELF —
+  the receiver sees your function as the caller, with the original caller's
+  authority threaded through the grant chain. Design service-to-service flows
+  on this; no direct HTTP between workers.
+- Upsert idiom: try `createNode`, on path-conflict fall back to `::update`.
+- A missing parent yields `Permission denied: EDIT on /<parent>` — read that
+  error as "does the parent exist?" first. Seed required folders in postInstall.
+
+## 4 · External APIs — the core pattern
+
+Almost every real domain wraps an external API (payment, calendar, LLM
+gateway, cloud provider). The shape (see admin/domain for the full-scale
+example — Scaleway/WorkOS/KV):
+
+1. **Port** — a narrow interface declaring only what the logic needs
+   (`WeatherClient { forecast(city) }`). Logic depends on the port, never on
+   fetch/SDKs/env.
+2. **Factory** — `createXClient(env)` in `services/`: reads config + secrets
+   from `env`, validates LOUDLY (`if (!env.X_API_KEY) throw`), sets base URLs
+   (overridable so tests point at a stub), timeouts (`AbortSignal.timeout`),
+   and maps upstream failures to meaningful errors with the upstream detail in
+   `cause` (the kernel threads cause chains to callers).
+3. **Wiring** — the `execute` hook builds the client from `deps` per request
+   and passes it to the logic.
+
+Secrets & config:
+- Declare every var as a typed field on `Env` in `env.ts`. Secrets ship via
+  the adapter's `secrets: '.env.dev' / '.env.prod'` (cloudflare adapter) —
+  never committed, never defaulted. Fail fast for root-of-trust values; allow
+  multi-name fallbacks only for developer convenience, never silently in prod.
+- Both adapters ship secrets from `secrets: '.env.<env>'` — cloudflare via
+  wrangler secrets, astrale (managed) via the encrypted per-install store.
+
+Reliability rules (learned from the admin provisioning engine):
+- **Order effects**: external call FIRST, graph write AFTER when possible — a
+  failed upstream then leaves nothing to clean up. When you must write first
+  (reservations), write an INTENT record (state: 'provisioning'), make the
+  external call idempotent (tags/external ids so re-entry ADOPTS instead of
+  duplicating), and compensate on failure.
+- **Sagas for multi-step flows**: ordered phases; record state transitions on
+  nodes (`provisioning → ready | failed`); compensation runs best-effort in
+  reverse and NEVER throws (each step returns ok/skipped/error). Document
+  which phases are safe to re-enter.
+- **Idempotency before mutation**: check existing state before writing; design
+  re-runs of any handler to converge, not duplicate (postInstall seeds
+  especially — they re-run on every reinstall).
+
+Anti-patterns (all observed in production code — don't):
+- constructing clients at module load, or monkey-patching `globalThis.fetch`;
+- scattering kernel-error message matching — the kernel exposes no stable
+  error codes to handlers yet, so when you must match (the PATH_CONFLICT
+  upsert), isolate it in ONE helper (the scaffold's `isPathConflict`) and
+  treat it as tech debt;
+- god persistence files — split graph CRUD by entity;
+- leaving state fields mid-transition with no failure path (`'installing'`
+  forever after a crash);
+- stringly-typed prop keys or class paths (always compiled accessors).
+
+## 5 · Views & standalone functions (webhooks)
+
+- `defineView({ auth, mount: '/ui/contact', viewFor: selfOf(Contact) })` in
+  `views/` + register in `views/index.ts` — the MAP KEY is the view's node
+  slug (`'ui-contact'` → `/<origin>/core/views/ui-contact`). Installs a View
+  node whose binding URL = `<serving url><mount>` (managed:
+  `https://<slug>.svc.<region>.astrale.ai/ui/contact`). The client/ SPA
+  serves `/ui/*` — BOTH adapters ship it (cloudflare via Workers Assets;
+  managed via the platform's per-version asset archive); the SPA must handle
+  any `/ui/<route>` via its fallback (the scaffold's vite config does).
+- Discovery: clients/GUIs find a node's views via
+  `kernel.call('/kernel.astrale.ai/class.View/resolve', { node: <path> })` →
+  `[{ path, url, name, origin }]` — `url` is the mounted iframe target.
+- `functions/` declares standalone callables (`defineRemoteFunction`) not
+  attached to a class — each serves at `POST <worker>/functions/<slug>` and
+  materializes a Function node under `/<origin>/core/functions/`. This is the
+  INBOUND integration surface (webhooks).
+
+**The webhook-that-writes pattern** (validated): keep `auth: 'required'` and
+configure the external system's auth header with a minted delegation token —
+`astrale token --audience <service url> --ttl <seconds> --raw` (use a
+dedicated, attenuated identity: grant it only what the webhook needs).
+For `auth: 'public'` upstreams that can't carry a header (HMAC-signature
+webhooks, Stripe-style): `kernel` is null, but `ctx.selfKernel()` gives a
+session authenticated as THE FUNCTION'S OWN identity (its grants only) —
+VERIFY THE UPSTREAM SIGNATURE FIRST, then act as yourself. Needs
+`deps.INSTANCE_KERNEL_URL` (managed deploys set it) and the function identity
+granted exactly what it writes (e.g. EDIT on the target folder + USE on
+createNode + USE on the class — narrow, never root).
+
+**Webhook idempotency** (senders retry — design for replays): derive a
+DETERMINISTIC node path from the sender's id (`/contacts/lead-<externalId>`),
+and make that key BOTH the existence check AND the write target. The classic
+bug is checking one key and writing another (random-suffixed) — the replay
+then duplicates. Custom `binding` supports REST-ish routes + header/body
+capture when the sender's shape is fixed (see distribution's proxy functions).
+
+## 6 · Identity, auth, permissions
+
+- Your worker IS an identity: at install, every callable gets `(iss = serving
+  URL, sub = function path)` stamped in the graph; the kernel verifies your
+  worker's signatures against your live JWKS. `astrale.config.ts` origin =
+  `schema.domain` (aliasing another origin triggers a DANGER prompt).
+- Inbound calls carry a delegation of the caller; your handler's `kernel` acts
+  with `union(caller's delegated authority, your function's own grants)` —
+  attenuation is automatic (you can't exceed what the caller + you hold).
+- `authorize` hook: return `undefined` to allow (relying on kernel-level
+  checks downstream), or assert claims/perms before `execute` runs.
+- Permissions are bitmasks (READ/EDIT/USE/SHARE) on `has_perm` edges; grants
+  on a node cascade down the tree. Function identities get USE on
+  `mintDelegationCredential` at install (enables cross-function calls).
+
+## 7 · Deploy & install
+
+Adapter choice in `astrale.config.ts`:
+- `cloudflare({...})` — your CF account; `dev` (wrangler dev), `prod` (route or
+  workers.dev); ships secrets + SPA assets; extra bindings via a deep-merged
+  `wrangler` block.
+- `astrale({ dev: {...}, prod: { instance: '<slug>' } })` — managed: publishes
+  the bundle THROUGH the platform and installs it as a host-local service next
+  to your instance (`https://<name>-<hash>.svc.<region>.astrale.ai`). No CF
+  account; auth = your `astrale auth login` session. Ships the client SPA
+  (`/ui` serves managed) and author secrets (`prod.secrets: '.env.prod'` —
+  encrypted at rest platform-side, re-applied on redeploys; omit = keep,
+  `{}` = clear; platform keys always win).
+
+The first deploy generates `.astrale/identity.ts` — the domain's SIGNING
+IDENTITY (its private key). Losing or regenerating it breaks reinstalls under
+the same origin; back it up (or commit it knowingly for throwaway domains).
+
+Dev-loop reality: `pnpm dev` serves on localhost — a REMOTE instance's kernel
+cannot fetch its install bundle. Local URL installs only work against a kernel
+that can reach you (local kernel, or a tunnel). Against a managed/remote
+instance, iterate with `pnpm prod` (the managed loop is ~25s and keeps the
+service URL stable).
+
+`postInstall` runs after every install — MUST be a colon MethodPath
+(`/:origin:class.X:seed`; tree paths are rejected) and MUST be idempotent
+(catch path-conflicts). Seed folders, defaults, and demo data here.
+
+Manual install of any served domain: `astrale instance install <url>`.
+
+The managed catalog surface (what `pnpm prod` shells into) is callable
+directly — useful for recovery and inspection:
+`/admin/domains/<name>::install {instanceId, source:{kind:'package'}}` ·
+`::uninstall {instanceId}` (the un-wedge recipe before a retry) ·
+`::installations` · `::versions` — all on the admin instance (`-i admin`).
+
+## 8 · Testing
+
+- **Logic**: unit-test with fake ports (the DI in §4 exists for this) and a
+  fake kernel — an in-memory `{ call(path, params) }` that records calls /
+  returns canned nodes. Assert call ORDER and failure paths (best-effort
+  flows: one failing step must not block the rest).
+- **Wiring/contract**: typecheck is the contract test (`pnpm typecheck` /
+  `tsgo --noEmit`); the schema drives param validation at runtime.
+- **Live smoke** (always finish with this): deploy, then drive the REAL surface
+  with the CLI — create a node, call an instance method, walk an edge, call a
+  cross-domain function. Fixture-green alone proves nothing about dispatch,
+  identity, or bindings.
+
+## 9 · Debugging quick table
+
+| Symptom | Likely cause |
+|---|---|
+| `Permission denied: EDIT on /x (param-target)` | `/x` doesn't exist — seed the parent |
+| `method "x" not found … call it as "/:o:class.C/x"` | instance form used for a static method |
+| `Delegation mint failed for <url>` | check `--debug` cause chain; worker→worker call machinery |
+| postInstall `not within origin` | tree path used — switch to `/:origin:class.X:method` |
+| install: `missing remote binding` | a callable lacks `binding.remoteUrl` — build via the adapter, not hand-rolled specs |
+| `ERR_PNPM_IGNORED_BUILDS` / approve-builds on `pnpm run` | template's pnpm-workspace.yaml needs `ignoredBuiltDependencies` + `verifyDepsBeforeRun: false` (recent scaffolds have it) |
+| stale/broken package versions on scaffold | clear pnpm metadata cache; check template floors are current |
+| TS: "Types of property '__brand' are incompatible" in untouched files | TWO copies of kernel-core/dsl in the tree (mixed link:/registry/override resolution) — unify versions, then `pnpm dedupe` |
+| runtime 500: `MISSING_DEF: Def at path "…" is not registered` | SAME dual-copy disease at runtime (defineSchema wrote copy A, compile read copy B) — and on managed installs it presents as the service never turning ready / install stuck `installing`. Unify + dedupe. |
+| managed install stuck at `installing` | check the SERVICE first: `curl <svc>/meta` (500 = the bundle itself is broken — run it locally with wrangler to see the real error); then `…::uninstall {instanceId}` and re-run the install |
+| `Path not found: /admin/instances/<uuid>` on install | `instanceId` takes the instance SLUG, not the node UUID (`astrale instance status <slug>` shows both) |
+| deploy: `Export named 'X' not found` from an @astrale-os module | a transitive dep resolved below its REAL floor — `pnpm add @astrale-os/<pkg>@<needed>` then `pnpm dedupe` |
+
+Use `astrale call <path> --describe` for any callable's schema, `--debug` for
+the full error chain, and `curl <worker>/meta` for what a worker serves
+(domainName, schemaHash).
+
+## Related skills
+- **astrale-cli** — every CLI command (auth, instances, calls, install).
+- **astrale-live-domain-edit** — graph-level schema surgery on a live kernel
+  (no worker changes): temp specs, reinstall semantics, minimum class/method
+  graph material.

package/template/README.md

@@ -1,7 +1,16 @@
 # astrale-domain
 
+
 A standalone [Astrale](https://astrale.ai) domain, deployed as a Cloudflare Worker.
 
+## For AI agents
+
+The complete domain-authoring guide ships with this project at
+`.agents/skills/astrale-domain/SKILL.md` — schema modeling, handlers, kernel
+calls, external-API patterns (DI, secrets, idempotency), views, webhooks,
+deploys. Load it before making changes. For CLI operations (auth, instances,
+calls), use the `astrale-cli` skill.
+
 > **Requires [Bun](https://bun.sh)** — the `astrale-domain` CLI behind `pnpm dev`
 > / `pnpm prod` imports `astrale.config.ts` and your ★ files directly, so it
 > needs a TypeScript-native runtime.

package/template/package.json

@@ -14,11 +14,11 @@
     "typecheck": "tsgo --noEmit"
   },
   "dependencies": {
-    "@astrale-os/adapter-cloudflare": ">=0.1.0 <1.0.0",
-    "@astrale-os/devkit": ">=0.1.0 <1.0.0",
-    "@astrale-os/kernel-core": ">=0.3.0 <1.0.0",
-    "@astrale-os/kernel-dsl": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": ">=0.1.0 <1.0.0",
+    "@astrale-os/adapter-cloudflare": ">=0.1.4 <1.0.0",
+    "@astrale-os/devkit": ">=0.1.3 <1.0.0",
+    "@astrale-os/kernel-core": ">=0.4.3 <1.0.0",
+    "@astrale-os/kernel-dsl": ">=0.1.2 <1.0.0",
+    "@astrale-os/sdk": ">=0.1.3 <1.0.0",
     "@hono/node-server": "^1.19.0",
     "zod": "^4.3.6"
   },

package/template/pnpm-workspace.yaml

@@ -15,3 +15,26 @@ allowBuilds:
   esbuild: true
   sharp: true
   workerd: true
+  # Explicit `false` for the @astrale-os no-op preinstalls — without these,
+  # `pnpm add` of a new version re-prompts and writes placeholder entries here.
+  '@astrale-os/kernel-api': false
+  '@astrale-os/kernel-client': false
+  '@astrale-os/kernel-core': false
+  '@astrale-os/kernel-dsl': false
+  '@astrale-os/kernel-server': false
+  '@astrale-os/sdk': false
+
+# @astrale-os packages ship a guarded no-op preinstall (a workspace-dev guard
+# that exits instantly outside the monorepo); declare them intentionally
+# ignored so pnpm's build gate stays quiet.
+ignoredBuiltDependencies:
+  - '@astrale-os/kernel-api'
+  - '@astrale-os/kernel-client'
+  - '@astrale-os/kernel-core'
+  - '@astrale-os/kernel-dsl'
+  - '@astrale-os/kernel-server'
+  - '@astrale-os/sdk'
+
+# pnpm v11 gates `pnpm run` on a deps-status check that misfires on the
+# ignored preinstalls above.
+verifyDepsBeforeRun: false