@astrale-os/adapter-cloudflare 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Deploy an Astrale domain as a standalone Cloudflare Worker",
   "keywords": [
     "adapter",

package/template/README.md

@@ -97,11 +97,12 @@ adapter-owned keys `name`, `main`, `assets`, `routes` are rejected (use
 
 - **Edit a handler** (`core/` logic or `runtime/` wiring) → hot-reloads at the same URL. Nothing to reinstall.
 - **Edit the schema** (`schema/`) → rebuilds the graph; reinstall with `astrale domain install <url> --direct`.
-- **`postInstall`** (the static `Monitor.seed` method) runs once after install, as
-  the system identity, so the domain can seed `/monitoring/monitors` and
-  `/monitoring/pages/status` and set its own grants. It
-  must be a class-hosted static addressed by a typed colon-path
-  (`/:origin:class.X:seed`) — the kernel refuses tree paths here.
+- **`postInstall`** (the standalone `seed` function in `functions/`) runs once
+  after install, as the system identity, so the domain can seed
+  `/monitoring/monitors` and `/monitoring/pages/status` and set its own grants.
+  `domain.ts` references it directly (`postInstall: functions.seed`) and the SDK
+  derives its path — functions are first-class domain members, addressable at
+  `/:origin:function.seed`.
 
 ## Identity
 

package/template/functions/index.ts

@@ -10,11 +10,13 @@
  * A standalone function's `execute` receives the same request context as a
  * method MINUS `self` (it is not node-bound): `{ params, kernel, deps, auth, … }`.
  */
-import { defineRemoteFunction } from '@astrale-os/sdk'
+import { __SYSTEM__ } from '@astrale-os/kernel-core'
+import { assertPerm, defineRemoteFunction, EDIT } from '@astrale-os/sdk'
 import { z } from 'zod'
 
 import type { Deps } from '../deps'
 
+import { MONITORS_PARENT } from '../core/monitor'
 import { monitor } from '../runtime/monitoring'
 
 export const functions = {
@@ -23,11 +25,21 @@ export const functions = {
   // function's own identity), so the domain comes up demonstrable. Must stay
   // idempotent — a re-install runs it again. `auth: 'required'` (the default)
   // makes `ctx.kernel` non-null; the body delegates to the per-operation seed
-  // logic in `runtime/monitor/seed.ts`.
+  // logic in `runtime/monitoring/monitor/seed.ts`.
   seed: defineRemoteFunction<Record<string, never>, { seeded: number }, Deps>({
     inputSchema: z.object({}),
     outputSchema: z.object({ seeded: z.number().int() }),
-    authorize: async () => undefined,
+    // Additive throw-to-deny pre-check (the kernel ALSO enforces `has_perm` on the
+    // create downstream — this just fails fast with the exact target). Two cases:
+    //   • postInstall runs as __SYSTEM__ (full authority) and on the FIRST install
+    //     `/monitoring/monitors` doesn't exist yet — seed creates it — so the
+    //     short-circuit MUST skip the check, or first install would wrongly deny.
+    //   • A later DIRECT call carries a real principal (and by then the folder
+    //     exists), so require EDIT — the bit a child-create under it needs.
+    authorize: async ({ kernel, auth }) => {
+      if (auth.principal === __SYSTEM__) return
+      await assertPerm(kernel, MONITORS_PARENT, auth.principal, EDIT)
+    },
     execute: ({ kernel, deps }) => monitor.seed(kernel, deps.prober()),
   }),
 }

package/template/package.json

@@ -14,8 +14,8 @@
     "typecheck": "tsgo --noEmit"
   },
   "dependencies": {
-    "@astrale-os/adapter-cloudflare": ">=0.3.0 <1.0.0",
-    "@astrale-os/kernel-core": ">=0.4.3 <1.0.0",
+    "@astrale-os/adapter-cloudflare": ">=0.3.1 <1.0.0",
+    "@astrale-os/kernel-core": ">=0.5.0 <1.0.0",
     "@astrale-os/kernel-dsl": ">=0.1.2 <1.0.0",
     "@astrale-os/sdk": ">=0.2.0 <1.0.0",
     "@hono/node-server": "^1.19.0",