@crewhaus/cloud-adapter-render 0.1.0

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@crewhaus/cloud-adapter-render",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "One-click deploy adapter for Render — generates a render.yaml blueprint + a Render-tuned Dockerfile and wraps the Render Deploy API for daemon target shapes (Section 44)",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "test": "bun test src"
+  },
+  "dependencies": {
+    "@crewhaus/docker-images": "0.0.0",
+    "@crewhaus/errors": "0.0.0"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Max Meier",
+    "email": "max@studiomax.io",
+    "url": "https://studiomax.io"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crewhaus/factory.git",
+    "directory": "packages/cloud-adapter-render"
+  },
+  "homepage": "https://github.com/crewhaus/factory/tree/main/packages/cloud-adapter-render#readme",
+  "bugs": {
+    "url": "https://github.com/crewhaus/factory/issues"
+  },
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ]
+}

package/src/index.test.ts

@@ -0,0 +1,284 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  RENDER_DEFAULT_API_BASE,
+  RENDER_TARGET_SHAPES,
+  RenderAdapterError,
+  deployToRender,
+  isRenderTargetShape,
+  renderBlueprintFor,
+  renderDockerfileFor,
+  scrubApiKey,
+} from "./index";
+
+describe("isRenderTargetShape", () => {
+  test("accepts the daemon shapes", () => {
+    for (const shape of RENDER_TARGET_SHAPES) {
+      expect(isRenderTargetShape(shape)).toBe(true);
+    }
+  });
+  test("rejects one-shot shapes", () => {
+    for (const shape of ["cli", "workflow", "eval", "graph", "pipeline", "crew", "research"]) {
+      expect(isRenderTargetShape(shape)).toBe(false);
+    }
+  });
+  test("rejects non-strings", () => {
+    expect(isRenderTargetShape(42)).toBe(false);
+    expect(isRenderTargetShape(undefined)).toBe(false);
+    expect(isRenderTargetShape(null)).toBe(false);
+  });
+});
+
+describe("renderBlueprintFor", () => {
+  test("emits a web-service blueprint for channel", () => {
+    const yaml = renderBlueprintFor({ target: "channel", serviceName: "my-bot" });
+    expect(yaml).toContain("services:");
+    expect(yaml).toContain("- type: web");
+    expect(yaml).toContain("name: my-bot");
+    expect(yaml).toContain("runtime: docker");
+    expect(yaml).toContain("dockerfilePath: ./Dockerfile.render");
+    expect(yaml).toContain("region: oregon");
+    expect(yaml).toContain("plan: starter");
+    expect(yaml).toContain("healthCheckPath: /healthz");
+  });
+
+  test("emits a worker blueprint for batch (no healthCheckPath)", () => {
+    const yaml = renderBlueprintFor({ target: "batch", serviceName: "my-worker" });
+    expect(yaml).toContain("- type: worker");
+    expect(yaml).not.toContain("healthCheckPath");
+  });
+
+  test("env vars are sorted deterministically", () => {
+    const a = renderBlueprintFor({
+      target: "channel",
+      serviceName: "svc",
+      envVars: { ZETA: "1", ALPHA: "2", MIDDLE: "3" },
+    });
+    const b = renderBlueprintFor({
+      target: "channel",
+      serviceName: "svc",
+      envVars: { MIDDLE: "3", ZETA: "1", ALPHA: "2" },
+    });
+    expect(a).toBe(b);
+    const alpha = a.indexOf("key: ALPHA");
+    const middle = a.indexOf("key: MIDDLE");
+    const zeta = a.indexOf("key: ZETA");
+    expect(alpha).toBeLessThan(middle);
+    expect(middle).toBeLessThan(zeta);
+  });
+
+  test("renders envVarsFromGroup references", () => {
+    const yaml = renderBlueprintFor({
+      target: "managed",
+      serviceName: "svc",
+      envVarsFromGroup: ["secrets-prod"],
+    });
+    expect(yaml).toContain("- fromGroup: secrets-prod");
+  });
+
+  test("respects region + plan overrides", () => {
+    const yaml = renderBlueprintFor({
+      target: "channel",
+      serviceName: "svc",
+      region: "frankfurt",
+      plan: "standard",
+    });
+    expect(yaml).toContain("region: frankfurt");
+    expect(yaml).toContain("plan: standard");
+  });
+
+  test("includes image tag when provided", () => {
+    const yaml = renderBlueprintFor({
+      target: "channel",
+      serviceName: "svc",
+      imageTag: "ghcr.io/me/img:0.1.0",
+    });
+    expect(yaml).toContain("image: ghcr.io/me/img:0.1.0");
+  });
+
+  test("omits image when imageTag is 'auto' (build from Dockerfile)", () => {
+    const yaml = renderBlueprintFor({ target: "channel", serviceName: "svc", imageTag: "auto" });
+    expect(yaml).not.toContain("\n    image:");
+  });
+
+  test("rejects invalid service names", () => {
+    expect(() => renderBlueprintFor({ target: "channel", serviceName: "MyBot" })).toThrow(
+      RenderAdapterError,
+    );
+    expect(() => renderBlueprintFor({ target: "channel", serviceName: "-leading" })).toThrow(
+      RenderAdapterError,
+    );
+    expect(() => renderBlueprintFor({ target: "channel", serviceName: "trailing-" })).toThrow(
+      RenderAdapterError,
+    );
+    expect(() => renderBlueprintFor({ target: "channel", serviceName: "" })).toThrow(
+      RenderAdapterError,
+    );
+  });
+
+  test("rejects unsupported target shapes", () => {
+    expect(() => renderBlueprintFor({ target: "cli", serviceName: "svc" })).toThrow(
+      RenderAdapterError,
+    );
+    expect(() => renderBlueprintFor({ target: "workflow", serviceName: "svc" })).toThrow(
+      RenderAdapterError,
+    );
+    expect(() => renderBlueprintFor({ target: "eval", serviceName: "svc" })).toThrow(
+      RenderAdapterError,
+    );
+  });
+});
+
+describe("renderDockerfileFor", () => {
+  test("web shape gets healthcheck against \\$PORT", () => {
+    const df = renderDockerfileFor({ target: "channel", baseImage: "crewhaus/channel:0.1.0" });
+    expect(df).toContain("FROM crewhaus/channel:0.1.0");
+    expect(df).toContain("ENV PORT=10000");
+    expect(df).toContain("HEALTHCHECK");
+    expect(df).toContain("http://localhost:$PORT/healthz");
+  });
+
+  test("worker shape skips HEALTHCHECK", () => {
+    const df = renderDockerfileFor({ target: "batch", baseImage: "crewhaus/batch:0.1.0" });
+    expect(df).toContain("FROM crewhaus/batch:0.1.0");
+    expect(df).not.toContain("HEALTHCHECK");
+  });
+
+  test("rejects one-shot target shapes", () => {
+    expect(() => renderDockerfileFor({ target: "cli", baseImage: "crewhaus/cli:0.1.0" })).toThrow(
+      RenderAdapterError,
+    );
+  });
+
+  test("rejects unknown target shapes", () => {
+    expect(() => renderDockerfileFor({ target: "mystery" as never, baseImage: "x" })).toThrow(
+      RenderAdapterError,
+    );
+  });
+});
+
+describe("scrubApiKey", () => {
+  test("redacts the key", () => {
+    const out = scrubApiKey("Auth failed for key rnd_abcdef1234567890", "rnd_abcdef1234567890");
+    expect(out).toBe("Auth failed for key [REDACTED:RENDER_API_KEY]");
+  });
+
+  test("redacts multiple occurrences", () => {
+    const out = scrubApiKey("key rnd_xyzlong used twice rnd_xyzlong", "rnd_xyzlong");
+    expect(out).toBe("key [REDACTED:RENDER_API_KEY] used twice [REDACTED:RENDER_API_KEY]");
+  });
+
+  test("returns input unchanged when key is short", () => {
+    expect(scrubApiKey("foo bar baz", "abc")).toBe("foo bar baz");
+  });
+
+  test("returns input unchanged when key is undefined", () => {
+    expect(scrubApiKey("foo bar baz", undefined)).toBe("foo bar baz");
+  });
+});
+
+const API_KEY_ENV = "RENDER_API_KEY";
+
+describe("deployToRender", () => {
+  const ORIGINAL_KEY = process.env[API_KEY_ENV];
+  afterEach(() => {
+    if (ORIGINAL_KEY === undefined) delete process.env[API_KEY_ENV];
+    else process.env[API_KEY_ENV] = ORIGINAL_KEY;
+  });
+
+  test("posts to the default Render base URL with Bearer auth", async () => {
+    let observed: { url: string; init: RequestInit } | undefined;
+    const fetchImpl = (async (url: string | URL, init?: RequestInit) => {
+      observed = { url: String(url), init: init ?? {} };
+      return new Response(
+        JSON.stringify({
+          service: { id: "srv-123" },
+          deploy: { id: "dep-456", status: "created" },
+        }),
+        { status: 201 },
+      );
+    }) as unknown as typeof fetch;
+    const result = await deployToRender({
+      apiKey: "rnd_testkey_abcdef",
+      blueprintYaml: "services: []\n",
+      serviceName: "svc",
+      fetchImpl,
+    });
+    expect(observed?.url).toBe(`${RENDER_DEFAULT_API_BASE}/services`);
+    expect(observed?.init.method).toBe("POST");
+    const headers = observed?.init.headers as Record<string, string>;
+    expect(headers["Authorization"]).toBe("Bearer rnd_testkey_abcdef");
+    expect(headers["Content-Type"]).toBe("application/yaml");
+    expect(result.serviceId).toBe("srv-123");
+    expect(result.deployId).toBe("dep-456");
+    expect(result.status).toBe("created");
+  });
+
+  test("scrubs the API key out of error messages", async () => {
+    const fetchImpl = (async () =>
+      new Response("forbidden — key rnd_leakingkey_full was rejected", {
+        status: 403,
+        statusText: "Forbidden",
+      })) as unknown as typeof fetch;
+    let caught: Error | undefined;
+    try {
+      await deployToRender({
+        apiKey: "rnd_leakingkey_full",
+        blueprintYaml: "services: []\n",
+        serviceName: "svc",
+        fetchImpl,
+      });
+    } catch (err) {
+      caught = err as Error;
+    }
+    expect(caught).toBeInstanceOf(RenderAdapterError);
+    expect(caught?.message).not.toContain("rnd_leakingkey_full");
+    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
+  });
+
+  test("throws clearly when no API key is configured", async () => {
+    delete process.env[API_KEY_ENV];
+    let caught: Error | undefined;
+    try {
+      await deployToRender({ blueprintYaml: "x", serviceName: "svc" });
+    } catch (err) {
+      caught = err as Error;
+    }
+    expect(caught).toBeInstanceOf(RenderAdapterError);
+    expect(caught?.message).toContain("RENDER_API_KEY is required");
+  });
+
+  test("resolves the API key from the env var when apiKey omitted", async () => {
+    process.env[API_KEY_ENV] = "rnd_env_provided_key_long";
+    let seen: string | undefined;
+    const fetchImpl = (async (_url: string | URL, init?: RequestInit) => {
+      seen = (init?.headers as Record<string, string>)["Authorization"];
+      return new Response(
+        JSON.stringify({ service: { id: "srv-x" }, deploy: { id: "d-x", status: "live" } }),
+        { status: 201 },
+      );
+    }) as unknown as typeof fetch;
+    await deployToRender({ blueprintYaml: "services: []\n", serviceName: "svc", fetchImpl });
+    expect(seen).toBe("Bearer rnd_env_provided_key_long");
+  });
+
+  test("validates service name before the network call", async () => {
+    let called = false;
+    const fetchImpl = (async () => {
+      called = true;
+      return new Response("", { status: 200 });
+    }) as unknown as typeof fetch;
+    let caught: Error | undefined;
+    try {
+      await deployToRender({
+        apiKey: "rnd_key_for_test_only",
+        blueprintYaml: "x",
+        serviceName: "BadCaps",
+        fetchImpl,
+      });
+    } catch (err) {
+      caught = err as Error;
+    }
+    expect(caught).toBeInstanceOf(RenderAdapterError);
+    expect(called).toBe(false);
+  });
+});

package/src/index.ts

@@ -0,0 +1,298 @@
+import { type TargetShape, isTargetShape } from "@crewhaus/docker-images";
+import { CrewhausError } from "@crewhaus/errors";
+
+/**
+ * Section 44 — `@crewhaus/cloud-adapter-render`
+ *
+ * One-click deploy adapter for [Render](https://render.com). Three surfaces:
+ *
+ *   - `renderBlueprintFor({target, serviceName, imageTag, …})` —
+ *     emits a deterministic `render.yaml` Infrastructure-as-Code blueprint
+ *     that points Render at the §32 docker-images Dockerfile for the
+ *     given target shape. Render reads this at the repo root.
+ *
+ *   - `renderDockerfileFor({target, …})` — wraps the §32 docker-images
+ *     Dockerfile with a Render-tuned final stage: listens on `$PORT`
+ *     (Render injects this), no fixed EXPOSE, healthcheck honors
+ *     RENDER's hosted load-balancer probe.
+ *
+ *   - `deployToRender({apiKey, blueprintYaml, …})` — POSTs the blueprint
+ *     against the Render Deploy API. Live API calls are gated on the
+ *     `RENDER_API_KEY` env (or explicit `apiKey`) plus an injectable
+ *     `fetchImpl` test seam.
+ *
+ * SECURITY (T8 credential-leak guard): the API key never appears in
+ * adapter logs / errors / deploy records. Every error path runs through
+ * `scrubApiKey()` before surfacing to the caller — same approach as the
+ * §37 `exporter-datadog` `scrubApiKey` helper.
+ *
+ * Targets: daemon-shape bundles (channel, managed, batch, voice, browser).
+ * CLI/workflow/eval shapes are one-shot and don't fit Render's
+ * always-on service model — passing them throws `RenderAdapterError`.
+ */
+
+export class RenderAdapterError extends CrewhausError {
+  override readonly name = "RenderAdapterError";
+  constructor(message: string, cause?: unknown) {
+    super("config", message, cause);
+  }
+}
+
+/**
+ * Render-deployable target shapes. CLI/workflow/eval are one-shot;
+ * Render's "web service" / "background worker" primitives are for
+ * long-running daemons. This is the canonical list for §44.
+ */
+export const RENDER_TARGET_SHAPES = [
+  "channel",
+  "managed",
+  "batch",
+  "voice",
+  "browser",
+] as const satisfies readonly TargetShape[];
+
+export type RenderTargetShape = (typeof RENDER_TARGET_SHAPES)[number];
+
+export function isRenderTargetShape(value: unknown): value is RenderTargetShape {
+  return typeof value === "string" && (RENDER_TARGET_SHAPES as readonly string[]).includes(value);
+}
+
+export const RENDER_REGIONS = ["oregon", "frankfurt", "singapore", "ohio", "virginia"] as const;
+export type RenderRegion = (typeof RENDER_REGIONS)[number];
+
+export const RENDER_PLANS = ["starter", "standard", "pro", "pro plus", "pro max"] as const;
+export type RenderPlan = (typeof RENDER_PLANS)[number];
+
+export type RenderBlueprintOptions = {
+  readonly target: TargetShape;
+  /** Render service id; doubles as DNS prefix. Lowercase letters, digits, hyphens. */
+  readonly serviceName: string;
+  /** Image registry coordinate or `auto` to let Render build from Dockerfile. */
+  readonly imageTag?: string;
+  readonly region?: RenderRegion;
+  readonly plan?: RenderPlan;
+  /** Plain-text env vars merged into the blueprint. Secret values must use `envVarsFromGroup`. */
+  readonly envVars?: Readonly<Record<string, string>>;
+  /** Reference an existing Render env-var-group for shared secrets. */
+  readonly envVarsFromGroup?: ReadonlyArray<string>;
+  /** Path to the Dockerfile inside the repo. Defaults to `./Dockerfile.render`. */
+  readonly dockerfilePath?: string;
+};
+
+const SERVICE_TYPE_FOR_TARGET: Readonly<Record<RenderTargetShape, "web" | "worker">> = {
+  channel: "web",
+  managed: "web",
+  voice: "web",
+  browser: "web",
+  batch: "worker",
+};
+
+const SERVICE_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+function assertRenderTarget(target: TargetShape): asserts target is RenderTargetShape {
+  if (!isRenderTargetShape(target)) {
+    throw new RenderAdapterError(
+      `target shape "${target}" is not supported by Render. ` +
+        `Supported daemon shapes: ${RENDER_TARGET_SHAPES.join(", ")}.`,
+    );
+  }
+}
+
+function assertServiceName(name: string): void {
+  if (!SERVICE_NAME_PATTERN.test(name)) {
+    throw new RenderAdapterError(
+      `service name "${name}" is invalid. Must be lowercase alphanumerics + hyphens, 1-63 chars, no leading/trailing hyphen.`,
+    );
+  }
+}
+
+/**
+ * Render-tuned Dockerfile final stage. Wraps the §32 base image with:
+ *   - `ENV PORT=10000` default; Render overrides at runtime.
+ *   - No fixed `EXPOSE` (Render reads `$PORT`).
+ *   - `HEALTHCHECK` curling `localhost:$PORT/healthz` — matches the
+ *     gateway-server convention used by `channel-bot` / `managed`.
+ *
+ * The caller is responsible for ensuring the base image (built by
+ * `docker-images.buildImage`) exposes a `/healthz` endpoint. The browser
+ * shape ships a stub `/healthz` in `target-browser-driver`; batch shapes
+ * don't need one because Render's worker type doesn't health-probe.
+ */
+export type RenderDockerfileOptions = {
+  readonly target: TargetShape;
+  /** Base image tag emitted by `docker-images.buildImage` (e.g. `crewhaus/channel:0.1.0`). */
+  readonly baseImage: string;
+};
+
+export function renderDockerfileFor(opts: RenderDockerfileOptions): string {
+  if (!isTargetShape(opts.target)) {
+    throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
+  }
+  assertRenderTarget(opts.target);
+  const isWeb = SERVICE_TYPE_FOR_TARGET[opts.target] === "web";
+  const lines = [
+    `# Render-tuned wrapper around ${opts.baseImage}`,
+    `FROM ${opts.baseImage}`,
+    "ENV PORT=10000",
+  ];
+  if (isWeb) {
+    lines.push(
+      // Use shell form so `$PORT` is expanded against Render's runtime value.
+      "HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \\",
+      '  CMD curl --silent --fail "http://localhost:$PORT/healthz" || exit 1',
+    );
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+/**
+ * Render Blueprint spec — minimal subset of the [Render Blueprint schema](https://render.com/docs/blueprint-spec).
+ * Emitted YAML is deterministic: stable key order, no trailing whitespace.
+ */
+export function renderBlueprintFor(opts: RenderBlueprintOptions): string {
+  if (!isTargetShape(opts.target)) {
+    throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
+  }
+  assertRenderTarget(opts.target);
+  assertServiceName(opts.serviceName);
+
+  const serviceType = SERVICE_TYPE_FOR_TARGET[opts.target];
+  const region = opts.region ?? "oregon";
+  const plan = opts.plan ?? "starter";
+  const dockerfilePath = opts.dockerfilePath ?? "./Dockerfile.render";
+
+  const lines: string[] = [
+    "# Generated by @crewhaus/cloud-adapter-render — do not edit by hand",
+    "services:",
+  ];
+  lines.push(`  - type: ${serviceType}`);
+  lines.push(`    name: ${opts.serviceName}`);
+  lines.push("    runtime: docker");
+  lines.push(`    dockerfilePath: ${dockerfilePath}`);
+  lines.push(`    region: ${region}`);
+  lines.push(`    plan: ${plan}`);
+  if (serviceType === "web") {
+    lines.push("    healthCheckPath: /healthz");
+  }
+  if (opts.imageTag !== undefined && opts.imageTag !== "auto") {
+    lines.push(`    image: ${opts.imageTag}`);
+  }
+  if (opts.envVars && Object.keys(opts.envVars).length > 0) {
+    lines.push("    envVars:");
+    for (const key of Object.keys(opts.envVars).sort()) {
+      const value = opts.envVars[key];
+      if (value === undefined) continue;
+      lines.push(`      - key: ${key}`);
+      lines.push(`        value: ${JSON.stringify(value)}`);
+    }
+  }
+  if (opts.envVarsFromGroup && opts.envVarsFromGroup.length > 0) {
+    if (!opts.envVars || Object.keys(opts.envVars).length === 0) {
+      lines.push("    envVars:");
+    }
+    for (const group of opts.envVarsFromGroup) {
+      lines.push(`      - fromGroup: ${group}`);
+    }
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+export type RenderDeployRecord = {
+  readonly serviceId: string;
+  readonly deployId: string;
+  readonly url?: string;
+  readonly status: string;
+};
+
+export type DeployToRenderOptions = {
+  readonly blueprintYaml: string;
+  readonly serviceName: string;
+  /** Render API key. Defaults to `process.env.RENDER_API_KEY`. */
+  readonly apiKey?: string;
+  /** Default `https://api.render.com/v1`. Override for VCR-style tests. */
+  readonly apiBaseUrl?: string;
+  /** Owner id (team or user) the service belongs to. */
+  readonly ownerId?: string;
+  /** Test seam — override fetch. */
+  readonly fetchImpl?: typeof fetch;
+};
+
+export const RENDER_DEFAULT_API_BASE = "https://api.render.com/v1";
+
+function resolveApiKey(provided: string | undefined): string {
+  const key = provided ?? process.env["RENDER_API_KEY"];
+  if (key === undefined || key.length === 0) {
+    throw new RenderAdapterError(
+      "RENDER_API_KEY is required. Pass `apiKey` explicitly or set the env var.",
+    );
+  }
+  return key;
+}
+
+/**
+ * Scrub the API key out of an arbitrary string. Mirrors the
+ * §37 `exporter-datadog` helper. Keys shorter than 8 chars are not
+ * scrubbed (would match too aggressively against ordinary text).
+ */
+export function scrubApiKey(message: string, apiKey: string | undefined): string {
+  if (apiKey === undefined || apiKey.length < 8) return message;
+  return message.split(apiKey).join("[REDACTED:RENDER_API_KEY]");
+}
+
+/**
+ * POST the blueprint at Render and return the deploy record. Throws a
+ * `RenderAdapterError` whose `.message` is guaranteed scrubbed.
+ */
+export async function deployToRender(opts: DeployToRenderOptions): Promise<RenderDeployRecord> {
+  const apiKey = resolveApiKey(opts.apiKey);
+  const baseUrl = opts.apiBaseUrl ?? RENDER_DEFAULT_API_BASE;
+  const fetchFn = opts.fetchImpl ?? fetch;
+  assertServiceName(opts.serviceName);
+
+  let response: Response;
+  try {
+    response = await fetchFn(`${baseUrl}/services`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/yaml",
+        Accept: "application/json",
+      },
+      body: opts.blueprintYaml,
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new RenderAdapterError(`Render API request failed: ${scrubApiKey(msg, apiKey)}`, err);
+  }
+
+  const text = await response.text();
+  const scrubbed = scrubApiKey(text, apiKey);
+  if (!response.ok) {
+    throw new RenderAdapterError(
+      `Render API returned ${response.status} ${response.statusText}: ${scrubbed}`,
+    );
+  }
+
+  let parsed: {
+    id?: string;
+    service?: { id?: string };
+    deploy?: { id?: string; status?: string };
+    serviceDetails?: { url?: string };
+  };
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new RenderAdapterError(`Render API returned non-JSON body: ${scrubbed}`, err);
+  }
+
+  const serviceId = parsed.service?.id ?? parsed.id;
+  if (typeof serviceId !== "string") {
+    throw new RenderAdapterError(`Render API response missing service id: ${scrubbed}`);
+  }
+  return {
+    serviceId,
+    deployId: parsed.deploy?.id ?? "",
+    url: parsed.serviceDetails?.url,
+    status: parsed.deploy?.status ?? "pending",
+  };
+}