@astrale-os/adapter-cloudflare 0.1.8 → 0.1.10

package/dist/astrale.js

@@ -1,222 +0,0 @@
-/**
- * `astrale(envs)` — the Astrale-managed deployment adapter.
- *
- * Ships the domain THROUGH the platform instead of to the author's own cloud
- * account: `deploy` builds the same single-module workerd bundle the Cloudflare
- * adapter ships (shared codegen + `wrangler deploy --dry-run`), then publishes
- * it via the admin domain's catalog — `DomainPublished.register` →
- * `::release { bundleBase64 }` (the worker stages the bytes in the platform
- * registry) → `::install { instanceId, source: { kind: 'package' } }`, which
- * deploys it as a host-local Service next to the target instance and installs
- * the domain on it. No Cloudflare account, no wrangler auth — the only
- * credential is the author's Astrale identity, supplied by the `astrale` CLI
- * session this adapter shells out to (the same trust source as
- * `astrale instance install`).
- *
- * `watch` is identical to the Cloudflare adapter's local dev (wrangler dev on
- * localhost) — managed deploys change WHERE the worker runs, not how you
- * iterate locally.
- *
- * Managed deploys ship the client SPA (served under `/ui` by the box) and
- * runtime secrets (dotenv map on the install call, encrypted at rest
- * platform-side; platform-managed env keys always win precedence).
- */
-import { defineAdapter, loadDotenvFile } from '@astrale-os/devkit';
-import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { packAssets } from './assets-pack';
-import { buildClient } from './client';
-import { logTo, prepare } from './cloudflare';
-import { runWranglerBundle, runWranglerDev } from './wrangler-cli';
-const DEFAULT_PORT = 8787;
-const DEFAULT_ADMIN_URL = 'https://admin.eu.astrale.ai/api';
-const DEFAULT_REGION = 'eu';
-const ADMIN_ORIGIN = 'admin.astrale.ai';
-export function astrale(envs) {
-    return defineAdapter({
-        name: 'astrale',
-        envs,
-        // Local dev is unchanged: wrangler dev on localhost. Managed deploys change
-        // WHERE the worker ships, not the inner loop.
-        async watch(params, ctx) {
-            const { configPath } = await prepare({
-                ...(params.vars ? { vars: params.vars } : {}),
-                ...(params.host ? { host: params.host } : {}),
-                port: params.port ?? DEFAULT_PORT,
-            }, ctx, 'dev');
-            const handle = await runWranglerDev({
-                projectDir: ctx.projectDir,
-                configPath,
-                port: params.port ?? DEFAULT_PORT,
-                remote: false,
-                autoPickPort: params.port === undefined,
-                ...(params.host ? { ip: '0.0.0.0' } : {}),
-                onReload: ctx.onReload,
-                onLog: logTo(),
-            });
-            return { url: params.host ?? handle.url, stop: handle.stop };
-        },
-        // Config hot-regen for the local dev loop: same codegen as `watch` (the
-        // running `wrangler dev` reloads its generated config + entry itself) —
-        // the params mapping must stay identical to `watch`'s prepare call.
-        async regenerate(params, ctx) {
-            await prepare({
-                ...(params.vars ? { vars: params.vars } : {}),
-                ...(params.host ? { host: params.host } : {}),
-                port: params.port ?? DEFAULT_PORT,
-            }, ctx, 'dev');
-        },
-        async deploy(params, ctx) {
-            const log = logTo();
-            if (!params.instance) {
-                throw new Error(`astrale adapter: this env has no "instance" — managed deploys need the target ` +
-                    `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`);
-            }
-            // Build + pack the client SPA: managed services serve it under /ui (the
-            // platform stages the archive and the box downloads it at Service.init).
-            let assetsGz = null;
-            if (ctx.clientDir) {
-                await buildClient(ctx.clientDir, ctx.projectDir, log);
-                assetsGz = packAssets(join(ctx.projectDir, 'dist-client'));
-                if (assetsGz)
-                    log(`packed client SPA (${assetsGz.length} bytes gz) — /ui ships managed`);
-            }
-            // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
-            //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
-            //    `clientDir` is stripped: managed packages don't ship SPA assets yet,
-            //    and leaving it in would put a dangling `assets.directory` (the
-            //    unbuilt dist-client) into the generated config.
-            const { clientDir: _omitted, ...bundleCtx } = ctx;
-            const { configPath } = await prepare({}, bundleCtx, 'dev');
-            const outDir = join(ctx.projectDir, '.astrale', 'dist-managed');
-            const bundlePath = await runWranglerBundle({
-                projectDir: ctx.projectDir,
-                configPath,
-                outDir,
-                onLog: log,
-            });
-            const bundle = await readFile(bundlePath);
-            // 2. Publish through the platform, authenticated by the author's astrale
-            //    CLI session. The release payload rides STDIN — a bundle is megabytes
-            //    of base64, far past argv limits.
-            const name = params.name ?? packageNameFor(ctx.domain.origin);
-            const adminUrl = params.adminUrl ?? DEFAULT_ADMIN_URL;
-            const version = `0.0.0-managed.${Date.now()}`;
-            log(`registering "${name}" (${ctx.domain.origin}) in the platform catalog…`);
-            await astraleCall(ctx.projectDir, params, adminUrl, {
-                path: `/${ADMIN_ORIGIN}/class.DomainPublished/register`,
-                data: { origin: ctx.domain.origin, name },
-            });
-            log(`publishing ${name}@${version} (${bundle.length} bytes)…`);
-            await astraleCall(ctx.projectDir, params, adminUrl, {
-                path: `/admin/domains/${name}::release`,
-                data: {
-                    version,
-                    bundleBase64: bundle.toString('base64'),
-                    makeCurrent: true,
-                    ...(assetsGz ? { assetsGzBase64: assetsGz.toString('base64') } : {}),
-                },
-                viaStdin: true,
-            });
-            // Author runtime secrets: read the env's dotenv locally, ship the map on
-            // the INSTALL call (never the release — secrets are per instance, never
-            // catalog-resident). Rides stdin so values never appear in argv.
-            let secrets;
-            if (params.secrets) {
-                secrets = loadDotenvFile(join(ctx.projectDir, params.secrets));
-                log(`shipping ${Object.keys(secrets).length} secret(s) from ${params.secrets}…`);
-            }
-            log(`installing on instance "${params.instance}"…`);
-            const installed = (await astraleCall(ctx.projectDir, params, adminUrl, {
-                path: `/admin/domains/${name}::install`,
-                data: {
-                    instanceId: params.instance,
-                    source: { kind: 'package' },
-                    ...(secrets ? { secrets } : {}),
-                },
-                viaStdin: true,
-            }));
-            if (installed.error || installed.state !== 'installed') {
-                throw new Error(`managed install failed: state=${installed.state ?? '?'} error=${installed.error ?? '?'}`);
-            }
-            if (!installed.serviceSlug) {
-                throw new Error('managed install returned no serviceSlug — cannot derive the service URL');
-            }
-            const region = params.region ?? DEFAULT_REGION;
-            const url = `https://${installed.serviceSlug}.svc.${region}.astrale.ai`;
-            return {
-                url,
-                // Managed deploys already installed on the instance — override the
-                // devkit's default "install on an instance" footer with the truth.
-                nextSteps: `  installed on "${params.instance}" — call it:\n` +
-                    `      astrale call "/${ctx.domain.origin}/..." -i ${params.instance}`,
-            };
-        },
-        secretsFile(params) {
-            return params.secrets;
-        },
-    });
-}
-/** Catalog package name from the origin: first DNS label (e.g. `my-notes.example.dev` → `my-notes`). */
-function packageNameFor(origin) {
-    const label = origin.split('.')[0] ?? origin;
-    return label.toLowerCase().replace(/[^a-z0-9-]+/g, '-');
-}
-/**
- * Invoke the user's `astrale` CLI for one platform call and parse its JSON
- * output. The CLI owns identity (IdP session, audience scoping, delegation
- * minting) — reimplementing that here would fork the trust path.
- */
-async function astraleCall(projectDir, params, adminUrl, call) {
-    // Saga-sized timeout: a COLD managed install (fresh service on the host)
-    // runs runtime staging + serve probes and regularly exceeds the CLI's 30s
-    // default — which doesn't just fail the client, it can kill the saga
-    // mid-flight. Same budget as `astrale instance create`.
-    const args = ['call', call.path, '--url', adminUrl, '--json', '--timeout', '240000'];
-    if (params.identity)
-        args.push('--as', params.identity);
-    const payload = JSON.stringify(call.data);
-    if (!call.viaStdin)
-        args.push('--data', payload);
-    const { code, out } = await new Promise((resolve, reject) => {
-        const child = spawn(astraleBin(projectDir), args, {
-            cwd: projectDir,
-            stdio: [call.viaStdin ? 'pipe' : 'ignore', 'pipe', 'pipe'],
-        });
-        let out = '';
-        child.stdout?.on('data', (b) => (out += b.toString()));
-        child.stderr?.on('data', (b) => (out += b.toString()));
-        child.on('exit', (c) => resolve({ code: c ?? 1, out }));
-        child.on('error', reject);
-        if (call.viaStdin) {
-            child.stdin?.write(payload);
-            child.stdin?.end();
-        }
-    });
-    if (code !== 0) {
-        // Only suggest re-login for AUTH-shaped failures — a timeout or audience
-        // error pointed at "auth login" sends users chasing the wrong fix.
-        const authShaped = /AUTH_ERROR|expired|not signed in|credential/i.test(out);
-        throw new Error(`astrale call ${call.path} failed (exit ${code}): ${out.trim().slice(0, 500)}` +
-            (authShaped ? `\nIs the astrale CLI installed and signed in? (astrale auth login)` : ''));
-    }
-    try {
-        return JSON.parse(out);
-    }
-    catch {
-        throw new Error(`astrale call ${call.path}: could not parse CLI output: ${out.slice(0, 300)}`);
-    }
-}
-/** The user's astrale CLI: ~/.astrale/bin/astrale when present, else PATH. */
-function astraleBin(_projectDir) {
-    const home = process.env.HOME;
-    if (home) {
-        const installed = join(home, '.astrale', 'bin', 'astrale');
-        if (existsSync(installed))
-            return installed;
-    }
-    return 'astrale';
-}
-//# sourceMappingURL=astrale.js.map

package/dist/astrale.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"astrale.js","sourceRoot":"","sources":["../src/astrale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAElE,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,cAAc,GAAG,IAAI,CAAA;AAC3B,MAAM,YAAY,GAAG,kBAAkB,CAAA;AAEvC,MAAM,UAAU,OAAO,CAAC,IAAmC;IACzD,OAAO,aAAa,CAAgB;QAClC,IAAI,EAAE,SAAS;QACf,IAAI;QAEJ,4EAA4E;QAC5E,8CAA8C;QAC9C,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACrB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAClC;gBACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;aAClC,EACD,GAAG,EACH,KAAK,CACN,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;gBACjC,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS;gBACvC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9D,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG;YAC1B,MAAM,OAAO,CACX;gBACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,YAAY;aAClC,EACD,GAAG,EACH,KAAK,CACN,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;YACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gFAAgF;oBAC9E,kEAAkE,CACrE,CAAA;YACH,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBACrD,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;gBAC1D,IAAI,QAAQ;oBAAE,GAAG,CAAC,sBAAsB,QAAQ,CAAC,MAAM,gCAAgC,CAAC,CAAA;YAC1F,CAAC;YAED,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,CAAA;YACjD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU;gBACV,MAAM;gBACN,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAEzC,yEAAyE;YACzE,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAA;YACrD,MAAM,OAAO,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAE7C,GAAG,CAAC,gBAAgB,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAA;YAC5E,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,IAAI,YAAY,iCAAiC;gBACvD,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAA;YAEF,GAAG,CAAC,cAAc,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,UAAU,CAAC,CAAA;YAC9D,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE;oBACJ,OAAO;oBACP,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACvC,WAAW,EAAE,IAAI;oBACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;YAEF,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,OAA2C,CAAA;YAC/C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9D,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;YAClF,CAAC;YAED,GAAG,CAAC,2BAA2B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACrE,IAAI,EAAE,kBAAkB,IAAI,WAAW;gBACvC,IAAI,EAAE;oBACJ,UAAU,EAAE,MAAM,CAAC,QAAQ;oBAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChC;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAoE,CAAA;YAEtE,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,iCAAiC,SAAS,CAAC,KAAK,IAAI,GAAG,UAAU,SAAS,CAAC,KAAK,IAAI,GAAG,EAAE,CAC1F,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;YAC5F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;YAC9C,MAAM,GAAG,GAAG,WAAW,SAAS,CAAC,WAAW,QAAQ,MAAM,aAAa,CAAA;YACvE,OAAO;gBACL,GAAG;gBACH,mEAAmE;gBACnE,mEAAmE;gBACnE,SAAS,EACP,mBAAmB,MAAM,CAAC,QAAQ,gBAAgB;oBAClD,wBAAwB,GAAG,CAAC,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,QAAQ,EAAE;aACzE,CAAA;QACH,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;IAC5C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,UAAkB,EAClB,MAAqB,EACrB,QAAgB,EAChB,IAAyD;IAEzD,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,CAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;YAChD,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAC3D,CAAC,CAAA;QACF,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,UAAU,GAAG,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3E,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC5E,CAAC,UAAU,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3F,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/src/astrale.ts

@@ -1,259 +0,0 @@
-/**
- * `astrale(envs)` — the Astrale-managed deployment adapter.
- *
- * Ships the domain THROUGH the platform instead of to the author's own cloud
- * account: `deploy` builds the same single-module workerd bundle the Cloudflare
- * adapter ships (shared codegen + `wrangler deploy --dry-run`), then publishes
- * it via the admin domain's catalog — `DomainPublished.register` →
- * `::release { bundleBase64 }` (the worker stages the bytes in the platform
- * registry) → `::install { instanceId, source: { kind: 'package' } }`, which
- * deploys it as a host-local Service next to the target instance and installs
- * the domain on it. No Cloudflare account, no wrangler auth — the only
- * credential is the author's Astrale identity, supplied by the `astrale` CLI
- * session this adapter shells out to (the same trust source as
- * `astrale instance install`).
- *
- * `watch` is identical to the Cloudflare adapter's local dev (wrangler dev on
- * localhost) — managed deploys change WHERE the worker runs, not how you
- * iterate locally.
- *
- * Managed deploys ship the client SPA (served under `/ui` by the box) and
- * runtime secrets (dotenv map on the install call, encrypted at rest
- * platform-side; platform-managed env keys always win precedence).
- */
-
-import type { DomainAdapter } from '@astrale-os/devkit'
-
-import { defineAdapter, loadDotenvFile } from '@astrale-os/devkit'
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { readFile } from 'node:fs/promises'
-import { join } from 'node:path'
-
-import type { AstraleParams } from './params'
-
-import { packAssets } from './assets-pack'
-import { buildClient } from './client'
-import { logTo, prepare } from './cloudflare'
-import { runWranglerBundle, runWranglerDev } from './wrangler-cli'
-
-const DEFAULT_PORT = 8787
-const DEFAULT_ADMIN_URL = 'https://admin.eu.astrale.ai/api'
-const DEFAULT_REGION = 'eu'
-const ADMIN_ORIGIN = 'admin.astrale.ai'
-
-export function astrale(envs: Record<string, AstraleParams>): DomainAdapter<AstraleParams> {
-  return defineAdapter<AstraleParams>({
-    name: 'astrale',
-    envs,
-
-    // Local dev is unchanged: wrangler dev on localhost. Managed deploys change
-    // WHERE the worker ships, not the inner loop.
-    async watch(params, ctx) {
-      const { configPath } = await prepare(
-        {
-          ...(params.vars ? { vars: params.vars } : {}),
-          ...(params.host ? { host: params.host } : {}),
-          port: params.port ?? DEFAULT_PORT,
-        },
-        ctx,
-        'dev',
-      )
-      const handle = await runWranglerDev({
-        projectDir: ctx.projectDir,
-        configPath,
-        port: params.port ?? DEFAULT_PORT,
-        remote: false,
-        autoPickPort: params.port === undefined,
-        ...(params.host ? { ip: '0.0.0.0' } : {}),
-        onReload: ctx.onReload,
-        onLog: logTo(),
-      })
-      return { url: params.host ?? handle.url, stop: handle.stop }
-    },
-
-    // Config hot-regen for the local dev loop: same codegen as `watch` (the
-    // running `wrangler dev` reloads its generated config + entry itself) —
-    // the params mapping must stay identical to `watch`'s prepare call.
-    async regenerate(params, ctx) {
-      await prepare(
-        {
-          ...(params.vars ? { vars: params.vars } : {}),
-          ...(params.host ? { host: params.host } : {}),
-          port: params.port ?? DEFAULT_PORT,
-        },
-        ctx,
-        'dev',
-      )
-    },
-
-    async deploy(params, ctx) {
-      const log = logTo()
-      if (!params.instance) {
-        throw new Error(
-          `astrale adapter: this env has no "instance" — managed deploys need the target ` +
-            `instance slug (e.g. prod: { instance: '<your-instance-slug>' }).`,
-        )
-      }
-      // Build + pack the client SPA: managed services serve it under /ui (the
-      // platform stages the archive and the box downloads it at Service.init).
-      let assetsGz: Buffer | null = null
-      if (ctx.clientDir) {
-        await buildClient(ctx.clientDir, ctx.projectDir, log)
-        assetsGz = packAssets(join(ctx.projectDir, 'dist-client'))
-        if (assetsGz) log(`packed client SPA (${assetsGz.length} bytes gz) — /ui ships managed`)
-      }
-
-      // 1. Codegen + bundle: the exact worker module a Cloudflare deploy would
-      //    ship, produced locally with `wrangler deploy --dry-run` (no auth).
-      //    `clientDir` is stripped: managed packages don't ship SPA assets yet,
-      //    and leaving it in would put a dangling `assets.directory` (the
-      //    unbuilt dist-client) into the generated config.
-      const { clientDir: _omitted, ...bundleCtx } = ctx
-      const { configPath } = await prepare({}, bundleCtx, 'dev')
-      const outDir = join(ctx.projectDir, '.astrale', 'dist-managed')
-      const bundlePath = await runWranglerBundle({
-        projectDir: ctx.projectDir,
-        configPath,
-        outDir,
-        onLog: log,
-      })
-      const bundle = await readFile(bundlePath)
-
-      // 2. Publish through the platform, authenticated by the author's astrale
-      //    CLI session. The release payload rides STDIN — a bundle is megabytes
-      //    of base64, far past argv limits.
-      const name = params.name ?? packageNameFor(ctx.domain.origin)
-      const adminUrl = params.adminUrl ?? DEFAULT_ADMIN_URL
-      const version = `0.0.0-managed.${Date.now()}`
-
-      log(`registering "${name}" (${ctx.domain.origin}) in the platform catalog…`)
-      await astraleCall(ctx.projectDir, params, adminUrl, {
-        path: `/${ADMIN_ORIGIN}/class.DomainPublished/register`,
-        data: { origin: ctx.domain.origin, name },
-      })
-
-      log(`publishing ${name}@${version} (${bundle.length} bytes)…`)
-      await astraleCall(ctx.projectDir, params, adminUrl, {
-        path: `/admin/domains/${name}::release`,
-        data: {
-          version,
-          bundleBase64: bundle.toString('base64'),
-          makeCurrent: true,
-          ...(assetsGz ? { assetsGzBase64: assetsGz.toString('base64') } : {}),
-        },
-        viaStdin: true,
-      })
-
-      // Author runtime secrets: read the env's dotenv locally, ship the map on
-      // the INSTALL call (never the release — secrets are per instance, never
-      // catalog-resident). Rides stdin so values never appear in argv.
-      let secrets: Record<string, string> | undefined
-      if (params.secrets) {
-        secrets = loadDotenvFile(join(ctx.projectDir, params.secrets))
-        log(`shipping ${Object.keys(secrets).length} secret(s) from ${params.secrets}…`)
-      }
-
-      log(`installing on instance "${params.instance}"…`)
-      const installed = (await astraleCall(ctx.projectDir, params, adminUrl, {
-        path: `/admin/domains/${name}::install`,
-        data: {
-          instanceId: params.instance,
-          source: { kind: 'package' },
-          ...(secrets ? { secrets } : {}),
-        },
-        viaStdin: true,
-      })) as { serviceSlug?: string; state?: string; error?: string | null }
-
-      if (installed.error || installed.state !== 'installed') {
-        throw new Error(
-          `managed install failed: state=${installed.state ?? '?'} error=${installed.error ?? '?'}`,
-        )
-      }
-      if (!installed.serviceSlug) {
-        throw new Error('managed install returned no serviceSlug — cannot derive the service URL')
-      }
-      const region = params.region ?? DEFAULT_REGION
-      const url = `https://${installed.serviceSlug}.svc.${region}.astrale.ai`
-      return {
-        url,
-        // Managed deploys already installed on the instance — override the
-        // devkit's default "install on an instance" footer with the truth.
-        nextSteps:
-          `  installed on "${params.instance}" — call it:\n` +
-          `      astrale call "/${ctx.domain.origin}/..." -i ${params.instance}`,
-      }
-    },
-
-    secretsFile(params) {
-      return params.secrets
-    },
-  })
-}
-
-/** Catalog package name from the origin: first DNS label (e.g. `my-notes.example.dev` → `my-notes`). */
-function packageNameFor(origin: string): string {
-  const label = origin.split('.')[0] ?? origin
-  return label.toLowerCase().replace(/[^a-z0-9-]+/g, '-')
-}
-
-/**
- * Invoke the user's `astrale` CLI for one platform call and parse its JSON
- * output. The CLI owns identity (IdP session, audience scoping, delegation
- * minting) — reimplementing that here would fork the trust path.
- */
-async function astraleCall(
-  projectDir: string,
-  params: AstraleParams,
-  adminUrl: string,
-  call: { path: string; data: unknown; viaStdin?: boolean },
-): Promise<unknown> {
-  // Saga-sized timeout: a COLD managed install (fresh service on the host)
-  // runs runtime staging + serve probes and regularly exceeds the CLI's 30s
-  // default — which doesn't just fail the client, it can kill the saga
-  // mid-flight. Same budget as `astrale instance create`.
-  const args = ['call', call.path, '--url', adminUrl, '--json', '--timeout', '240000']
-  if (params.identity) args.push('--as', params.identity)
-  const payload = JSON.stringify(call.data)
-  if (!call.viaStdin) args.push('--data', payload)
-
-  const { code, out } = await new Promise<{ code: number; out: string }>((resolve, reject) => {
-    const child = spawn(astraleBin(projectDir), args, {
-      cwd: projectDir,
-      stdio: [call.viaStdin ? 'pipe' : 'ignore', 'pipe', 'pipe'],
-    })
-    let out = ''
-    child.stdout?.on('data', (b: Buffer) => (out += b.toString()))
-    child.stderr?.on('data', (b: Buffer) => (out += b.toString()))
-    child.on('exit', (c) => resolve({ code: c ?? 1, out }))
-    child.on('error', reject)
-    if (call.viaStdin) {
-      child.stdin?.write(payload)
-      child.stdin?.end()
-    }
-  })
-  if (code !== 0) {
-    // Only suggest re-login for AUTH-shaped failures — a timeout or audience
-    // error pointed at "auth login" sends users chasing the wrong fix.
-    const authShaped = /AUTH_ERROR|expired|not signed in|credential/i.test(out)
-    throw new Error(
-      `astrale call ${call.path} failed (exit ${code}): ${out.trim().slice(0, 500)}` +
-        (authShaped ? `\nIs the astrale CLI installed and signed in? (astrale auth login)` : ''),
-    )
-  }
-  try {
-    return JSON.parse(out)
-  } catch {
-    throw new Error(`astrale call ${call.path}: could not parse CLI output: ${out.slice(0, 300)}`)
-  }
-}
-
-/** The user's astrale CLI: ~/.astrale/bin/astrale when present, else PATH. */
-function astraleBin(_projectDir: string): string {
-  const home = process.env.HOME
-  if (home) {
-    const installed = join(home, '.astrale', 'bin', 'astrale')
-    if (existsSync(installed)) return installed
-  }
-  return 'astrale'
-}

package/template/client/src/lib/kernel.ts

@@ -1,135 +0,0 @@
-/**
- * Minimal, self-contained kernel JSON client — just enough to load a node via
- * `@<id>::get`, without pulling in `@astrale-os/kernel-client` (and its
- * transitive deps). It reproduces the kernel ENVELOPE wire shape inline.
- *
- * Wire contract (authoritative source: `kernel/api/envelope/`):
- *   - Request:  POST <kernelUrl> with headers
- *       content-type: application/vnd.astrale.kernel+json
- *       accept:       application/vnd.astrale.kernel+json
- *       authorization: <delegationToken>      (BARE token — no "Bearer " prefix)
- *     body JSON `{ method, params, id }` (see `encode.ts:encodeKernelRequest`).
- *   - Response: JSON, exactly one of (decode precedence error → redirect → result,
- *     mirroring `decode.ts:decodeKernelResponse`):
- *       { error: { code, message }, id }   → throw Error("<code>: <message>")
- *       { redirect, id }                   → throw (we don't follow redirects here)
- *       { result, id }                     → return result
- *
- * Deliberately JSON-only: no msgpack codec, no streaming/binary, no redirect
- * following, no schema/batching. Those live in `@astrale-os/kernel-client`,
- * which this self-contained build omits on purpose.
- */
-
-// From `kernel/api/envelope/types.ts` (KERNEL_CONTENT_TYPE_JSON). Inlined so the
-// template needs no @astrale-os import.
-const KERNEL_CONTENT_TYPE_JSON = 'application/vnd.astrale.kernel+json'
-
-// Module-local monotonic request id. Strings keep ids stable across reloads and
-// distinguishable in logs; the kernel echoes `id` back but we don't correlate
-// (one request per fetch).
-let idSeq = 0
-function nextId(): string {
-  idSeq += 1
-  return `c${idSeq}`
-}
-
-/**
- * Prop key constants — the graph stores props with fully-qualified keys
- * (`<domain>:<member>.property.<name>`). The kernel `Named.name` key is fixed
- * and known; domain props (`title`, `body`) are qualified by the (build-time
- * unknown) domain origin — read those by suffix with `readPropBySuffix`.
- */
-export const PROP = {
-  named: {
-    name: 'kernel.astrale.ai:interface.Named.property.name',
-  },
-} as const
-
-export type KernelNode = {
-  id: string
-  path: string
-  class: string | { raw?: string }
-  props: Record<string, unknown>
-}
-
-export function readProp(props: Record<string, unknown>, key: string): string | undefined {
-  const v = props[key]
-  return typeof v === 'string' ? v : undefined
-}
-
-/**
- * Read a string prop by key suffix — for domain-qualified props whose full key
- * embeds the (build-time-unknown) domain origin. e.g.
- * `readPropBySuffix(props, '.property.body')`.
- */
-export function readPropBySuffix(
-  props: Record<string, unknown>,
-  suffix: string,
-): string | undefined {
-  for (const [k, v] of Object.entries(props)) {
-    if (k.endsWith(suffix) && typeof v === 'string') return v
-  }
-  return undefined
-}
-
-/** Short class name from a `class.raw` path `/:<domain>:class.<Name>` → `<Name>`. */
-export function classShortName(node: KernelNode): string {
-  const raw = (typeof node.class === 'string' ? node.class : node.class?.raw) ?? ''
-  const last = raw.split(':').pop() ?? ''
-  const dot = last.indexOf('.')
-  return dot >= 0 ? last.slice(dot + 1) : last
-}
-
-/**
- * POST a single kernel call and return its `result`. Throws on a kernel error
- * envelope or an unexpected redirect. `token` is the bare delegation credential
- * from the shell handshake; the iframe authenticates SOLELY with it (the parent
- * minted it for this kernel, so the audience already matches — no cookie/mint).
- */
-export async function kernelCall(
-  kernelUrl: string,
-  token: string,
-  method: string,
-  params: Record<string, unknown> = {},
-): Promise<unknown> {
-  // The kernel routes on a trailing slash; the parent absolutizes the URL, but
-  // not always with the slash, so normalize here.
-  const url = kernelUrl.endsWith('/') ? kernelUrl : `${kernelUrl}/`
-  const id = nextId()
-
-  const res = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'content-type': KERNEL_CONTENT_TYPE_JSON,
-      accept: KERNEL_CONTENT_TYPE_JSON,
-      authorization: token,
-    },
-    body: JSON.stringify({ method, params, id }),
-  })
-
-  let body: unknown
-  try {
-    body = await res.json()
-  } catch {
-    throw new Error(`kernel returned a non-JSON response (HTTP ${res.status})`)
-  }
-
-  if (body === null || typeof body !== 'object') {
-    throw new Error(`kernel returned an unexpected response (HTTP ${res.status})`)
-  }
-  const obj = body as Record<string, unknown>
-
-  // Decode precedence error → redirect → result (mirrors decodeKernelResponse).
-  if ('error' in obj && obj.error && typeof obj.error === 'object') {
-    const err = obj.error as { code?: unknown; message?: unknown }
-    const code = typeof err.code === 'number' ? err.code : 5000
-    const message = typeof err.message === 'string' ? err.message : 'Unknown error'
-    throw new Error(`${code}: ${message}`)
-  }
-  if ('redirect' in obj && obj.redirect) {
-    // Redirects (remote-domain Functions) aren't followed by this minimal
-    // client — they require credential re-minting against the target worker.
-    throw new Error('unexpected redirect from kernel (not supported by the template client)')
-  }
-  return obj.result
-}