@crewhaus/cloud-adapter-render 0.1.4 → 0.1.5

package/dist/index.d.ts

@@ -0,0 +1,115 @@
+import { type TargetShape } from "@crewhaus/docker-images";
+import { CrewhausError } from "@crewhaus/errors";
+/**
+ * Section 44 — `@crewhaus/cloud-adapter-render`
+ *
+ * One-click deploy adapter for [Render](https://render.com). Three surfaces:
+ *
+ *   - `renderBlueprintFor({target, serviceName, imageTag, …})` —
+ *     emits a deterministic `render.yaml` Infrastructure-as-Code blueprint
+ *     that points Render at the §32 docker-images Dockerfile for the
+ *     given target shape. Render reads this at the repo root.
+ *
+ *   - `renderDockerfileFor({target, …})` — wraps the §32 docker-images
+ *     Dockerfile with a Render-tuned final stage: listens on `$PORT`
+ *     (Render injects this), no fixed EXPOSE, healthcheck honors
+ *     RENDER's hosted load-balancer probe.
+ *
+ *   - `deployToRender({apiKey, blueprintYaml, …})` — POSTs the blueprint
+ *     against the Render Deploy API. Live API calls are gated on the
+ *     `RENDER_API_KEY` env (or explicit `apiKey`) plus an injectable
+ *     `fetchImpl` test seam.
+ *
+ * SECURITY (T8 credential-leak guard): the API key never appears in
+ * adapter logs / errors / deploy records. Every error path runs through
+ * `scrubApiKey()` before surfacing to the caller — same approach as the
+ * §37 `exporter-datadog` `scrubApiKey` helper.
+ *
+ * Targets: daemon-shape bundles (channel, managed, batch, voice, browser).
+ * CLI/workflow/eval shapes are one-shot and don't fit Render's
+ * always-on service model — passing them throws `RenderAdapterError`.
+ */
+export declare class RenderAdapterError extends CrewhausError {
+    readonly name = "RenderAdapterError";
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * Render-deployable target shapes. CLI/workflow/eval are one-shot;
+ * Render's "web service" / "background worker" primitives are for
+ * long-running daemons. This is the canonical list for §44.
+ */
+export declare const RENDER_TARGET_SHAPES: readonly ["channel", "managed", "batch", "voice", "browser"];
+export type RenderTargetShape = (typeof RENDER_TARGET_SHAPES)[number];
+export declare function isRenderTargetShape(value: unknown): value is RenderTargetShape;
+export declare const RENDER_REGIONS: readonly ["oregon", "frankfurt", "singapore", "ohio", "virginia"];
+export type RenderRegion = (typeof RENDER_REGIONS)[number];
+export declare const RENDER_PLANS: readonly ["starter", "standard", "pro", "pro plus", "pro max"];
+export type RenderPlan = (typeof RENDER_PLANS)[number];
+export type RenderBlueprintOptions = {
+    readonly target: TargetShape;
+    /** Render service id; doubles as DNS prefix. Lowercase letters, digits, hyphens. */
+    readonly serviceName: string;
+    /** Image registry coordinate or `auto` to let Render build from Dockerfile. */
+    readonly imageTag?: string;
+    readonly region?: RenderRegion;
+    readonly plan?: RenderPlan;
+    /** Plain-text env vars merged into the blueprint. Secret values must use `envVarsFromGroup`. */
+    readonly envVars?: Readonly<Record<string, string>>;
+    /** Reference an existing Render env-var-group for shared secrets. */
+    readonly envVarsFromGroup?: ReadonlyArray<string>;
+    /** Path to the Dockerfile inside the repo. Defaults to `./Dockerfile.render`. */
+    readonly dockerfilePath?: string;
+};
+/**
+ * Render-tuned Dockerfile final stage. Wraps the §32 base image with:
+ *   - `ENV PORT=10000` default; Render overrides at runtime.
+ *   - No fixed `EXPOSE` (Render reads `$PORT`).
+ *   - `HEALTHCHECK` curling `localhost:$PORT/healthz` — matches the
+ *     gateway-server convention used by `channel-bot` / `managed`.
+ *
+ * The caller is responsible for ensuring the base image (built by
+ * `docker-images.buildImage`) exposes a `/healthz` endpoint. The browser
+ * shape ships a stub `/healthz` in `target-browser-driver`; batch shapes
+ * don't need one because Render's worker type doesn't health-probe.
+ */
+export type RenderDockerfileOptions = {
+    readonly target: TargetShape;
+    /** Base image tag emitted by `docker-images.buildImage` (e.g. `crewhaus/channel:0.1.0`). */
+    readonly baseImage: string;
+};
+export declare function renderDockerfileFor(opts: RenderDockerfileOptions): string;
+/**
+ * Render Blueprint spec — minimal subset of the [Render Blueprint schema](https://render.com/docs/blueprint-spec).
+ * Emitted YAML is deterministic: stable key order, no trailing whitespace.
+ */
+export declare function renderBlueprintFor(opts: RenderBlueprintOptions): string;
+export type RenderDeployRecord = {
+    readonly serviceId: string;
+    readonly deployId: string;
+    readonly url?: string;
+    readonly status: string;
+};
+export type DeployToRenderOptions = {
+    readonly blueprintYaml: string;
+    readonly serviceName: string;
+    /** Render API key. Defaults to `process.env.RENDER_API_KEY`. */
+    readonly apiKey?: string;
+    /** Default `https://api.render.com/v1`. Override for VCR-style tests. */
+    readonly apiBaseUrl?: string;
+    /** Owner id (team or user) the service belongs to. */
+    readonly ownerId?: string;
+    /** Test seam — override fetch. */
+    readonly fetchImpl?: typeof fetch;
+};
+export declare const RENDER_DEFAULT_API_BASE = "https://api.render.com/v1";
+/**
+ * Scrub the API key out of an arbitrary string. Mirrors the
+ * §37 `exporter-datadog` helper. Keys shorter than 8 chars are not
+ * scrubbed (would match too aggressively against ordinary text).
+ */
+export declare function scrubApiKey(message: string, apiKey: string | undefined): string;
+/**
+ * POST the blueprint at Render and return the deploy record. Throws a
+ * `RenderAdapterError` whose `.message` is guaranteed scrubbed.
+ */
+export declare function deployToRender(opts: DeployToRenderOptions): Promise<RenderDeployRecord>;

package/dist/index.js

@@ -0,0 +1,207 @@
+import { isTargetShape } from "@crewhaus/docker-images";
+import { CrewhausError } from "@crewhaus/errors";
+/**
+ * Section 44 — `@crewhaus/cloud-adapter-render`
+ *
+ * One-click deploy adapter for [Render](https://render.com). Three surfaces:
+ *
+ *   - `renderBlueprintFor({target, serviceName, imageTag, …})` —
+ *     emits a deterministic `render.yaml` Infrastructure-as-Code blueprint
+ *     that points Render at the §32 docker-images Dockerfile for the
+ *     given target shape. Render reads this at the repo root.
+ *
+ *   - `renderDockerfileFor({target, …})` — wraps the §32 docker-images
+ *     Dockerfile with a Render-tuned final stage: listens on `$PORT`
+ *     (Render injects this), no fixed EXPOSE, healthcheck honors
+ *     RENDER's hosted load-balancer probe.
+ *
+ *   - `deployToRender({apiKey, blueprintYaml, …})` — POSTs the blueprint
+ *     against the Render Deploy API. Live API calls are gated on the
+ *     `RENDER_API_KEY` env (or explicit `apiKey`) plus an injectable
+ *     `fetchImpl` test seam.
+ *
+ * SECURITY (T8 credential-leak guard): the API key never appears in
+ * adapter logs / errors / deploy records. Every error path runs through
+ * `scrubApiKey()` before surfacing to the caller — same approach as the
+ * §37 `exporter-datadog` `scrubApiKey` helper.
+ *
+ * Targets: daemon-shape bundles (channel, managed, batch, voice, browser).
+ * CLI/workflow/eval shapes are one-shot and don't fit Render's
+ * always-on service model — passing them throws `RenderAdapterError`.
+ */
+export class RenderAdapterError extends CrewhausError {
+    name = "RenderAdapterError";
+    constructor(message, cause) {
+        super("config", message, cause);
+    }
+}
+/**
+ * Render-deployable target shapes. CLI/workflow/eval are one-shot;
+ * Render's "web service" / "background worker" primitives are for
+ * long-running daemons. This is the canonical list for §44.
+ */
+export const RENDER_TARGET_SHAPES = [
+    "channel",
+    "managed",
+    "batch",
+    "voice",
+    "browser",
+];
+export function isRenderTargetShape(value) {
+    return typeof value === "string" && RENDER_TARGET_SHAPES.includes(value);
+}
+export const RENDER_REGIONS = ["oregon", "frankfurt", "singapore", "ohio", "virginia"];
+export const RENDER_PLANS = ["starter", "standard", "pro", "pro plus", "pro max"];
+const SERVICE_TYPE_FOR_TARGET = {
+    channel: "web",
+    managed: "web",
+    voice: "web",
+    browser: "web",
+    batch: "worker",
+};
+const SERVICE_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function assertRenderTarget(target) {
+    if (!isRenderTargetShape(target)) {
+        throw new RenderAdapterError(`target shape "${target}" is not supported by Render. ` +
+            `Supported daemon shapes: ${RENDER_TARGET_SHAPES.join(", ")}.`);
+    }
+}
+function assertServiceName(name) {
+    if (!SERVICE_NAME_PATTERN.test(name)) {
+        throw new RenderAdapterError(`service name "${name}" is invalid. Must be lowercase alphanumerics + hyphens, 1-63 chars, no leading/trailing hyphen.`);
+    }
+}
+export function renderDockerfileFor(opts) {
+    if (!isTargetShape(opts.target)) {
+        throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
+    }
+    assertRenderTarget(opts.target);
+    const isWeb = SERVICE_TYPE_FOR_TARGET[opts.target] === "web";
+    const lines = [
+        `# Render-tuned wrapper around ${opts.baseImage}`,
+        `FROM ${opts.baseImage}`,
+        "ENV PORT=10000",
+    ];
+    if (isWeb) {
+        lines.push(
+        // Use shell form so `$PORT` is expanded against Render's runtime value.
+        "HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \\", '  CMD curl --silent --fail "http://localhost:$PORT/healthz" || exit 1');
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Render Blueprint spec — minimal subset of the [Render Blueprint schema](https://render.com/docs/blueprint-spec).
+ * Emitted YAML is deterministic: stable key order, no trailing whitespace.
+ */
+export function renderBlueprintFor(opts) {
+    if (!isTargetShape(opts.target)) {
+        throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
+    }
+    assertRenderTarget(opts.target);
+    assertServiceName(opts.serviceName);
+    const serviceType = SERVICE_TYPE_FOR_TARGET[opts.target];
+    const region = opts.region ?? "oregon";
+    const plan = opts.plan ?? "starter";
+    const dockerfilePath = opts.dockerfilePath ?? "./Dockerfile.render";
+    const lines = [
+        "# Generated by @crewhaus/cloud-adapter-render — do not edit by hand",
+        "services:",
+    ];
+    lines.push(`  - type: ${serviceType}`);
+    lines.push(`    name: ${opts.serviceName}`);
+    lines.push("    runtime: docker");
+    lines.push(`    dockerfilePath: ${dockerfilePath}`);
+    lines.push(`    region: ${region}`);
+    lines.push(`    plan: ${plan}`);
+    if (serviceType === "web") {
+        lines.push("    healthCheckPath: /healthz");
+    }
+    if (opts.imageTag !== undefined && opts.imageTag !== "auto") {
+        lines.push(`    image: ${opts.imageTag}`);
+    }
+    if (opts.envVars && Object.keys(opts.envVars).length > 0) {
+        lines.push("    envVars:");
+        for (const key of Object.keys(opts.envVars).sort()) {
+            const value = opts.envVars[key];
+            if (value === undefined)
+                continue;
+            lines.push(`      - key: ${key}`);
+            lines.push(`        value: ${JSON.stringify(value)}`);
+        }
+    }
+    if (opts.envVarsFromGroup && opts.envVarsFromGroup.length > 0) {
+        if (!opts.envVars || Object.keys(opts.envVars).length === 0) {
+            lines.push("    envVars:");
+        }
+        for (const group of opts.envVarsFromGroup) {
+            lines.push(`      - fromGroup: ${group}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+export const RENDER_DEFAULT_API_BASE = "https://api.render.com/v1";
+function resolveApiKey(provided) {
+    const key = provided ?? process.env["RENDER_API_KEY"];
+    if (key === undefined || key.length === 0) {
+        throw new RenderAdapterError("RENDER_API_KEY is required. Pass `apiKey` explicitly or set the env var.");
+    }
+    return key;
+}
+/**
+ * Scrub the API key out of an arbitrary string. Mirrors the
+ * §37 `exporter-datadog` helper. Keys shorter than 8 chars are not
+ * scrubbed (would match too aggressively against ordinary text).
+ */
+export function scrubApiKey(message, apiKey) {
+    if (apiKey === undefined || apiKey.length < 8)
+        return message;
+    return message.split(apiKey).join("[REDACTED:RENDER_API_KEY]");
+}
+/**
+ * POST the blueprint at Render and return the deploy record. Throws a
+ * `RenderAdapterError` whose `.message` is guaranteed scrubbed.
+ */
+export async function deployToRender(opts) {
+    const apiKey = resolveApiKey(opts.apiKey);
+    const baseUrl = opts.apiBaseUrl ?? RENDER_DEFAULT_API_BASE;
+    const fetchFn = opts.fetchImpl ?? fetch;
+    assertServiceName(opts.serviceName);
+    let response;
+    try {
+        response = await fetchFn(`${baseUrl}/services`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/yaml",
+                Accept: "application/json",
+            },
+            body: opts.blueprintYaml,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new RenderAdapterError(`Render API request failed: ${scrubApiKey(msg, apiKey)}`, err);
+    }
+    const text = await response.text();
+    const scrubbed = scrubApiKey(text, apiKey);
+    if (!response.ok) {
+        throw new RenderAdapterError(`Render API returned ${response.status} ${response.statusText}: ${scrubbed}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new RenderAdapterError(`Render API returned non-JSON body: ${scrubbed}`, err);
+    }
+    const serviceId = parsed.service?.id ?? parsed.id;
+    if (typeof serviceId !== "string") {
+        throw new RenderAdapterError(`Render API response missing service id: ${scrubbed}`);
+    }
+    return {
+        serviceId,
+        deployId: parsed.deploy?.id ?? "",
+        url: parsed.serviceDetails?.url,
+        status: parsed.deploy?.status ?? "pending",
+    };
+}

package/package.json

@@ -1,19 +1,22 @@
 {
   "name": "@crewhaus/cloud-adapter-render",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "One-click deploy adapter for Render — generates a render.yaml blueprint + a Render-tuned Dockerfile and wraps the Render Deploy API for daemon target shapes (Section 44)",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/docker-images": "0.1.4",
-    "@crewhaus/errors": "0.1.4"
+    "@crewhaus/docker-images": "0.1.5",
+    "@crewhaus/errors": "0.1.5"
   },
   "license": "Apache-2.0",
   "author": {
@@ -33,5 +36,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
 }

package/src/branches.test.ts

@@ -1,323 +0,0 @@
-// Supplementary branch/edge coverage for @crewhaus/cloud-adapter-render.
-// The primary behavioural contract lives in ./index.test.ts; this file
-// drives the error, fallback, and combinatorial branches that the happy-path
-// suite does not exercise explicitly (network failure, non-JSON bodies,
-// response-shape fallbacks, and the env-var/group merge matrix), with a
-// strong focus on the T8 credential-leak guarantee on every error surface.
-
-import { afterEach, describe, expect, test } from "bun:test";
-import {
-  RENDER_DEFAULT_API_BASE,
-  RenderAdapterError,
-  deployToRender,
-  isRenderTargetShape,
-  renderBlueprintFor,
-  renderDockerfileFor,
-  scrubApiKey,
-} from "./index";
-
-const API_KEY_ENV = "RENDER_API_KEY";
-
-/** Build a fetch test seam returning a fixed body/status. */
-function fakeFetch(body: string, init?: ResponseInit): typeof fetch {
-  return (async () => new Response(body, init)) as unknown as typeof fetch;
-}
-
-describe("renderBlueprintFor — env var branches", () => {
-  test("merges envVars and envVarsFromGroup under a single envVars block", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVars: { FOO: "bar" },
-      envVarsFromGroup: ["secrets-prod", "secrets-shared"],
-    });
-    // The `envVars:` header must appear exactly once (not re-emitted for the group).
-    const headerCount = yaml.split("\n").filter((l) => l === "    envVars:").length;
-    expect(headerCount).toBe(1);
-    expect(yaml).toContain("      - key: FOO");
-    expect(yaml).toContain('        value: "bar"');
-    expect(yaml).toContain("      - fromGroup: secrets-prod");
-    expect(yaml).toContain("      - fromGroup: secrets-shared");
-  });
-
-  test("empty envVars object emits no envVars block", () => {
-    const yaml = renderBlueprintFor({ target: "channel", serviceName: "svc", envVars: {} });
-    expect(yaml).not.toContain("envVars:");
-  });
-
-  test("empty envVarsFromGroup array emits no envVars block", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVarsFromGroup: [],
-    });
-    expect(yaml).not.toContain("envVars:");
-  });
-
-  test("skips env entries whose value is undefined", () => {
-    // Defends the `if (value === undefined) continue` guard against callers
-    // who pass a partial record at runtime despite the string-typed signature.
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVars: { KEEP: "yes", DROP: undefined } as unknown as Record<string, string>,
-    });
-    expect(yaml).toContain("      - key: KEEP");
-    expect(yaml).not.toContain("DROP");
-  });
-
-  test("env values are JSON-escaped (YAML-injection defense)", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVars: { TOKEN: 'a"b\nc: pwned' },
-    });
-    // JSON.stringify keeps the value on one quoted line with escapes — the
-    // newline and quote cannot break out into a new YAML node.
-    expect(yaml).toContain('        value: "a\\"b\\nc: pwned"');
-    expect(yaml).not.toContain("\nc: pwned");
-  });
-
-  test("explicit undefined imageTag falls through to build-from-Dockerfile", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      imageTag: undefined,
-    });
-    expect(yaml).not.toContain("\n    image:");
-  });
-
-  test("honors a custom dockerfilePath", () => {
-    const yaml = renderBlueprintFor({
-      target: "batch",
-      serviceName: "svc",
-      dockerfilePath: "./docker/Dockerfile.batch",
-    });
-    expect(yaml).toContain("dockerfilePath: ./docker/Dockerfile.batch");
-  });
-
-  test("accepts a 63-char service name but rejects a 64-char one", () => {
-    const name63 = "a".repeat(63);
-    const name64 = "a".repeat(64);
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: name63 })).not.toThrow();
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: name64 })).toThrow(
-      RenderAdapterError,
-    );
-  });
-});
-
-describe("renderDockerfileFor — every web shape", () => {
-  test("all web-typed shapes emit a HEALTHCHECK", () => {
-    for (const shape of ["channel", "managed", "voice", "browser"] as const) {
-      const df = renderDockerfileFor({ target: shape, baseImage: `crewhaus/${shape}:0.1.0` });
-      expect(df).toContain("HEALTHCHECK");
-      expect(df).toContain("http://localhost:$PORT/healthz");
-    }
-  });
-
-  test("output ends with exactly one trailing newline", () => {
-    const df = renderDockerfileFor({ target: "batch", baseImage: "crewhaus/batch:0.1.0" });
-    expect(df.endsWith("\n")).toBe(true);
-    expect(df.endsWith("\n\n")).toBe(false);
-  });
-});
-
-describe("scrubApiKey — boundary lengths", () => {
-  test("scrubs at exactly 8 chars (inclusive lower bound)", () => {
-    expect(scrubApiKey("x 12345678 y", "12345678")).toBe("x [REDACTED:RENDER_API_KEY] y");
-  });
-
-  test("does not scrub at 7 chars (just below bound)", () => {
-    expect(scrubApiKey("x 1234567 y", "1234567")).toBe("x 1234567 y");
-  });
-
-  test("empty-string key is treated as too short and left untouched", () => {
-    expect(scrubApiKey("nothing to scrub", "")).toBe("nothing to scrub");
-  });
-});
-
-describe("isRenderTargetShape — extra negatives", () => {
-  test("rejects objects and arrays", () => {
-    expect(isRenderTargetShape({})).toBe(false);
-    expect(isRenderTargetShape([])).toBe(false);
-    expect(isRenderTargetShape("")).toBe(false);
-  });
-});
-
-describe("deployToRender — error & fallback branches", () => {
-  const ORIGINAL_KEY = process.env[API_KEY_ENV];
-  afterEach(() => {
-    if (ORIGINAL_KEY === undefined) delete process.env[API_KEY_ENV];
-    else process.env[API_KEY_ENV] = ORIGINAL_KEY;
-  });
-
-  test("wraps a thrown network error and scrubs the key from it", async () => {
-    const key = "rnd_network_failure_key_long";
-    const fetchImpl = (async () => {
-      throw new Error(`connect ECONNREFUSED while using ${key}`);
-    }) as unknown as typeof fetch;
-    let caught: RenderAdapterError | undefined;
-    try {
-      await deployToRender({
-        apiKey: key,
-        blueprintYaml: "services: []\n",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as RenderAdapterError;
-    }
-    expect(caught).toBeInstanceOf(RenderAdapterError);
-    expect(caught?.message).toContain("Render API request failed");
-    expect(caught?.message).not.toContain(key);
-    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
-  });
-
-  test("handles a non-Error thrown value from fetch (String(err) branch)", async () => {
-    const fetchImpl = (async () => {
-      // eslint-disable-next-line no-throw-literal
-      throw "raw string failure";
-    }) as unknown as typeof fetch;
-    let caught: RenderAdapterError | undefined;
-    try {
-      await deployToRender({
-        apiKey: "rnd_key_nonerror_throw",
-        blueprintYaml: "x",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as RenderAdapterError;
-    }
-    expect(caught).toBeInstanceOf(RenderAdapterError);
-    expect(caught?.message).toContain("raw string failure");
-  });
-
-  test("throws scrubbed error on non-2xx response", async () => {
-    const key = "rnd_status500_key_longenough";
-    const fetchImpl = fakeFetch(`upstream blew up with ${key}`, {
-      status: 500,
-      statusText: "Internal Server Error",
-    });
-    let caught: RenderAdapterError | undefined;
-    try {
-      await deployToRender({
-        apiKey: key,
-        blueprintYaml: "x",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as RenderAdapterError;
-    }
-    expect(caught?.message).toContain("Render API returned 500 Internal Server Error");
-    expect(caught?.message).not.toContain(key);
-    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
-  });
-
-  test("throws scrubbed error when a 2xx body is not JSON", async () => {
-    const key = "rnd_nonjson_body_key_longxx";
-    const fetchImpl = fakeFetch(`<html>not json ${key}</html>`, { status: 200 });
-    let caught: RenderAdapterError | undefined;
-    try {
-      await deployToRender({
-        apiKey: key,
-        blueprintYaml: "x",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as RenderAdapterError;
-    }
-    expect(caught?.message).toContain("Render API returned non-JSON body");
-    expect(caught?.message).not.toContain(key);
-    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
-  });
-
-  test("throws scrubbed error when the JSON body has no service id", async () => {
-    const key = "rnd_missing_id_key_longenough";
-    const fetchImpl = fakeFetch(JSON.stringify({ deploy: { id: "d-1" }, hint: key }), {
-      status: 201,
-    });
-    let caught: RenderAdapterError | undefined;
-    try {
-      await deployToRender({
-        apiKey: key,
-        blueprintYaml: "x",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as RenderAdapterError;
-    }
-    expect(caught?.message).toContain("missing service id");
-    expect(caught?.message).not.toContain(key);
-    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
-  });
-
-  test("falls back to top-level `id` when `service.id` is absent", async () => {
-    const fetchImpl = fakeFetch(
-      JSON.stringify({ id: "srv-top-level", deploy: { id: "d-9", status: "live" } }),
-      { status: 201 },
-    );
-    const result = await deployToRender({
-      apiKey: "rnd_toplevel_id_key_long",
-      blueprintYaml: "x",
-      serviceName: "svc",
-      fetchImpl,
-    });
-    expect(result.serviceId).toBe("srv-top-level");
-  });
-
-  test("applies default deployId/status/url when those fields are absent", async () => {
-    const fetchImpl = fakeFetch(JSON.stringify({ service: { id: "srv-min" } }), { status: 201 });
-    const result = await deployToRender({
-      apiKey: "rnd_defaults_key_longenough",
-      blueprintYaml: "x",
-      serviceName: "svc",
-      fetchImpl,
-    });
-    expect(result.serviceId).toBe("srv-min");
-    expect(result.deployId).toBe("");
-    expect(result.status).toBe("pending");
-    expect(result.url).toBeUndefined();
-  });
-
-  test("surfaces serviceDetails.url when present", async () => {
-    const fetchImpl = fakeFetch(
-      JSON.stringify({
-        service: { id: "srv-u" },
-        deploy: { id: "d-u", status: "live" },
-        serviceDetails: { url: "https://svc-u.onrender.com" },
-      }),
-      { status: 201 },
-    );
-    const result = await deployToRender({
-      apiKey: "rnd_url_present_key_long",
-      blueprintYaml: "x",
-      serviceName: "svc",
-      fetchImpl,
-    });
-    expect(result.url).toBe("https://svc-u.onrender.com");
-  });
-
-  test("honors a custom apiBaseUrl (VCR-style override)", async () => {
-    let observedUrl: string | undefined;
-    const fetchImpl = (async (url: string | URL) => {
-      observedUrl = String(url);
-      return new Response(
-        JSON.stringify({ service: { id: "srv-vcr" }, deploy: { id: "d", status: "ok" } }),
-        { status: 201 },
-      );
-    }) as unknown as typeof fetch;
-    await deployToRender({
-      apiKey: "rnd_custom_base_key_long",
-      blueprintYaml: "x",
-      serviceName: "svc",
-      apiBaseUrl: "http://localhost:9999/mock",
-      fetchImpl,
-    });
-    expect(observedUrl).toBe("http://localhost:9999/mock/services");
-    expect(observedUrl).not.toBe(`${RENDER_DEFAULT_API_BASE}/services`);
-  });
-});

package/src/index.test.ts

@@ -1,284 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import {
-  RENDER_DEFAULT_API_BASE,
-  RENDER_TARGET_SHAPES,
-  RenderAdapterError,
-  deployToRender,
-  isRenderTargetShape,
-  renderBlueprintFor,
-  renderDockerfileFor,
-  scrubApiKey,
-} from "./index";
-
-describe("isRenderTargetShape", () => {
-  test("accepts the daemon shapes", () => {
-    for (const shape of RENDER_TARGET_SHAPES) {
-      expect(isRenderTargetShape(shape)).toBe(true);
-    }
-  });
-  test("rejects one-shot shapes", () => {
-    for (const shape of ["cli", "workflow", "eval", "graph", "pipeline", "crew", "research"]) {
-      expect(isRenderTargetShape(shape)).toBe(false);
-    }
-  });
-  test("rejects non-strings", () => {
-    expect(isRenderTargetShape(42)).toBe(false);
-    expect(isRenderTargetShape(undefined)).toBe(false);
-    expect(isRenderTargetShape(null)).toBe(false);
-  });
-});
-
-describe("renderBlueprintFor", () => {
-  test("emits a web-service blueprint for channel", () => {
-    const yaml = renderBlueprintFor({ target: "channel", serviceName: "my-bot" });
-    expect(yaml).toContain("services:");
-    expect(yaml).toContain("- type: web");
-    expect(yaml).toContain("name: my-bot");
-    expect(yaml).toContain("runtime: docker");
-    expect(yaml).toContain("dockerfilePath: ./Dockerfile.render");
-    expect(yaml).toContain("region: oregon");
-    expect(yaml).toContain("plan: starter");
-    expect(yaml).toContain("healthCheckPath: /healthz");
-  });
-
-  test("emits a worker blueprint for batch (no healthCheckPath)", () => {
-    const yaml = renderBlueprintFor({ target: "batch", serviceName: "my-worker" });
-    expect(yaml).toContain("- type: worker");
-    expect(yaml).not.toContain("healthCheckPath");
-  });
-
-  test("env vars are sorted deterministically", () => {
-    const a = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVars: { ZETA: "1", ALPHA: "2", MIDDLE: "3" },
-    });
-    const b = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      envVars: { MIDDLE: "3", ZETA: "1", ALPHA: "2" },
-    });
-    expect(a).toBe(b);
-    const alpha = a.indexOf("key: ALPHA");
-    const middle = a.indexOf("key: MIDDLE");
-    const zeta = a.indexOf("key: ZETA");
-    expect(alpha).toBeLessThan(middle);
-    expect(middle).toBeLessThan(zeta);
-  });
-
-  test("renders envVarsFromGroup references", () => {
-    const yaml = renderBlueprintFor({
-      target: "managed",
-      serviceName: "svc",
-      envVarsFromGroup: ["secrets-prod"],
-    });
-    expect(yaml).toContain("- fromGroup: secrets-prod");
-  });
-
-  test("respects region + plan overrides", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      region: "frankfurt",
-      plan: "standard",
-    });
-    expect(yaml).toContain("region: frankfurt");
-    expect(yaml).toContain("plan: standard");
-  });
-
-  test("includes image tag when provided", () => {
-    const yaml = renderBlueprintFor({
-      target: "channel",
-      serviceName: "svc",
-      imageTag: "ghcr.io/me/img:0.1.0",
-    });
-    expect(yaml).toContain("image: ghcr.io/me/img:0.1.0");
-  });
-
-  test("omits image when imageTag is 'auto' (build from Dockerfile)", () => {
-    const yaml = renderBlueprintFor({ target: "channel", serviceName: "svc", imageTag: "auto" });
-    expect(yaml).not.toContain("\n    image:");
-  });
-
-  test("rejects invalid service names", () => {
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: "MyBot" })).toThrow(
-      RenderAdapterError,
-    );
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: "-leading" })).toThrow(
-      RenderAdapterError,
-    );
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: "trailing-" })).toThrow(
-      RenderAdapterError,
-    );
-    expect(() => renderBlueprintFor({ target: "channel", serviceName: "" })).toThrow(
-      RenderAdapterError,
-    );
-  });
-
-  test("rejects unsupported target shapes", () => {
-    expect(() => renderBlueprintFor({ target: "cli", serviceName: "svc" })).toThrow(
-      RenderAdapterError,
-    );
-    expect(() => renderBlueprintFor({ target: "workflow", serviceName: "svc" })).toThrow(
-      RenderAdapterError,
-    );
-    expect(() => renderBlueprintFor({ target: "eval", serviceName: "svc" })).toThrow(
-      RenderAdapterError,
-    );
-  });
-});
-
-describe("renderDockerfileFor", () => {
-  test("web shape gets healthcheck against \\$PORT", () => {
-    const df = renderDockerfileFor({ target: "channel", baseImage: "crewhaus/channel:0.1.0" });
-    expect(df).toContain("FROM crewhaus/channel:0.1.0");
-    expect(df).toContain("ENV PORT=10000");
-    expect(df).toContain("HEALTHCHECK");
-    expect(df).toContain("http://localhost:$PORT/healthz");
-  });
-
-  test("worker shape skips HEALTHCHECK", () => {
-    const df = renderDockerfileFor({ target: "batch", baseImage: "crewhaus/batch:0.1.0" });
-    expect(df).toContain("FROM crewhaus/batch:0.1.0");
-    expect(df).not.toContain("HEALTHCHECK");
-  });
-
-  test("rejects one-shot target shapes", () => {
-    expect(() => renderDockerfileFor({ target: "cli", baseImage: "crewhaus/cli:0.1.0" })).toThrow(
-      RenderAdapterError,
-    );
-  });
-
-  test("rejects unknown target shapes", () => {
-    expect(() => renderDockerfileFor({ target: "mystery" as never, baseImage: "x" })).toThrow(
-      RenderAdapterError,
-    );
-  });
-});
-
-describe("scrubApiKey", () => {
-  test("redacts the key", () => {
-    const out = scrubApiKey("Auth failed for key rnd_abcdef1234567890", "rnd_abcdef1234567890");
-    expect(out).toBe("Auth failed for key [REDACTED:RENDER_API_KEY]");
-  });
-
-  test("redacts multiple occurrences", () => {
-    const out = scrubApiKey("key rnd_xyzlong used twice rnd_xyzlong", "rnd_xyzlong");
-    expect(out).toBe("key [REDACTED:RENDER_API_KEY] used twice [REDACTED:RENDER_API_KEY]");
-  });
-
-  test("returns input unchanged when key is short", () => {
-    expect(scrubApiKey("foo bar baz", "abc")).toBe("foo bar baz");
-  });
-
-  test("returns input unchanged when key is undefined", () => {
-    expect(scrubApiKey("foo bar baz", undefined)).toBe("foo bar baz");
-  });
-});
-
-const API_KEY_ENV = "RENDER_API_KEY";
-
-describe("deployToRender", () => {
-  const ORIGINAL_KEY = process.env[API_KEY_ENV];
-  afterEach(() => {
-    if (ORIGINAL_KEY === undefined) delete process.env[API_KEY_ENV];
-    else process.env[API_KEY_ENV] = ORIGINAL_KEY;
-  });
-
-  test("posts to the default Render base URL with Bearer auth", async () => {
-    let observed: { url: string; init: RequestInit } | undefined;
-    const fetchImpl = (async (url: string | URL, init?: RequestInit) => {
-      observed = { url: String(url), init: init ?? {} };
-      return new Response(
-        JSON.stringify({
-          service: { id: "srv-123" },
-          deploy: { id: "dep-456", status: "created" },
-        }),
-        { status: 201 },
-      );
-    }) as unknown as typeof fetch;
-    const result = await deployToRender({
-      apiKey: "rnd_testkey_abcdef",
-      blueprintYaml: "services: []\n",
-      serviceName: "svc",
-      fetchImpl,
-    });
-    expect(observed?.url).toBe(`${RENDER_DEFAULT_API_BASE}/services`);
-    expect(observed?.init.method).toBe("POST");
-    const headers = observed?.init.headers as Record<string, string>;
-    expect(headers["Authorization"]).toBe("Bearer rnd_testkey_abcdef");
-    expect(headers["Content-Type"]).toBe("application/yaml");
-    expect(result.serviceId).toBe("srv-123");
-    expect(result.deployId).toBe("dep-456");
-    expect(result.status).toBe("created");
-  });
-
-  test("scrubs the API key out of error messages", async () => {
-    const fetchImpl = (async () =>
-      new Response("forbidden — key rnd_leakingkey_full was rejected", {
-        status: 403,
-        statusText: "Forbidden",
-      })) as unknown as typeof fetch;
-    let caught: Error | undefined;
-    try {
-      await deployToRender({
-        apiKey: "rnd_leakingkey_full",
-        blueprintYaml: "services: []\n",
-        serviceName: "svc",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as Error;
-    }
-    expect(caught).toBeInstanceOf(RenderAdapterError);
-    expect(caught?.message).not.toContain("rnd_leakingkey_full");
-    expect(caught?.message).toContain("[REDACTED:RENDER_API_KEY]");
-  });
-
-  test("throws clearly when no API key is configured", async () => {
-    delete process.env[API_KEY_ENV];
-    let caught: Error | undefined;
-    try {
-      await deployToRender({ blueprintYaml: "x", serviceName: "svc" });
-    } catch (err) {
-      caught = err as Error;
-    }
-    expect(caught).toBeInstanceOf(RenderAdapterError);
-    expect(caught?.message).toContain("RENDER_API_KEY is required");
-  });
-
-  test("resolves the API key from the env var when apiKey omitted", async () => {
-    process.env[API_KEY_ENV] = "rnd_env_provided_key_long";
-    let seen: string | undefined;
-    const fetchImpl = (async (_url: string | URL, init?: RequestInit) => {
-      seen = (init?.headers as Record<string, string>)["Authorization"];
-      return new Response(
-        JSON.stringify({ service: { id: "srv-x" }, deploy: { id: "d-x", status: "live" } }),
-        { status: 201 },
-      );
-    }) as unknown as typeof fetch;
-    await deployToRender({ blueprintYaml: "services: []\n", serviceName: "svc", fetchImpl });
-    expect(seen).toBe("Bearer rnd_env_provided_key_long");
-  });
-
-  test("validates service name before the network call", async () => {
-    let called = false;
-    const fetchImpl = (async () => {
-      called = true;
-      return new Response("", { status: 200 });
-    }) as unknown as typeof fetch;
-    let caught: Error | undefined;
-    try {
-      await deployToRender({
-        apiKey: "rnd_key_for_test_only",
-        blueprintYaml: "x",
-        serviceName: "BadCaps",
-        fetchImpl,
-      });
-    } catch (err) {
-      caught = err as Error;
-    }
-    expect(caught).toBeInstanceOf(RenderAdapterError);
-    expect(called).toBe(false);
-  });
-});

package/src/index.ts

@@ -1,298 +0,0 @@
-import { type TargetShape, isTargetShape } from "@crewhaus/docker-images";
-import { CrewhausError } from "@crewhaus/errors";
-
-/**
- * Section 44 — `@crewhaus/cloud-adapter-render`
- *
- * One-click deploy adapter for [Render](https://render.com). Three surfaces:
- *
- *   - `renderBlueprintFor({target, serviceName, imageTag, …})` —
- *     emits a deterministic `render.yaml` Infrastructure-as-Code blueprint
- *     that points Render at the §32 docker-images Dockerfile for the
- *     given target shape. Render reads this at the repo root.
- *
- *   - `renderDockerfileFor({target, …})` — wraps the §32 docker-images
- *     Dockerfile with a Render-tuned final stage: listens on `$PORT`
- *     (Render injects this), no fixed EXPOSE, healthcheck honors
- *     RENDER's hosted load-balancer probe.
- *
- *   - `deployToRender({apiKey, blueprintYaml, …})` — POSTs the blueprint
- *     against the Render Deploy API. Live API calls are gated on the
- *     `RENDER_API_KEY` env (or explicit `apiKey`) plus an injectable
- *     `fetchImpl` test seam.
- *
- * SECURITY (T8 credential-leak guard): the API key never appears in
- * adapter logs / errors / deploy records. Every error path runs through
- * `scrubApiKey()` before surfacing to the caller — same approach as the
- * §37 `exporter-datadog` `scrubApiKey` helper.
- *
- * Targets: daemon-shape bundles (channel, managed, batch, voice, browser).
- * CLI/workflow/eval shapes are one-shot and don't fit Render's
- * always-on service model — passing them throws `RenderAdapterError`.
- */
-
-export class RenderAdapterError extends CrewhausError {
-  override readonly name = "RenderAdapterError";
-  constructor(message: string, cause?: unknown) {
-    super("config", message, cause);
-  }
-}
-
-/**
- * Render-deployable target shapes. CLI/workflow/eval are one-shot;
- * Render's "web service" / "background worker" primitives are for
- * long-running daemons. This is the canonical list for §44.
- */
-export const RENDER_TARGET_SHAPES = [
-  "channel",
-  "managed",
-  "batch",
-  "voice",
-  "browser",
-] as const satisfies readonly TargetShape[];
-
-export type RenderTargetShape = (typeof RENDER_TARGET_SHAPES)[number];
-
-export function isRenderTargetShape(value: unknown): value is RenderTargetShape {
-  return typeof value === "string" && (RENDER_TARGET_SHAPES as readonly string[]).includes(value);
-}
-
-export const RENDER_REGIONS = ["oregon", "frankfurt", "singapore", "ohio", "virginia"] as const;
-export type RenderRegion = (typeof RENDER_REGIONS)[number];
-
-export const RENDER_PLANS = ["starter", "standard", "pro", "pro plus", "pro max"] as const;
-export type RenderPlan = (typeof RENDER_PLANS)[number];
-
-export type RenderBlueprintOptions = {
-  readonly target: TargetShape;
-  /** Render service id; doubles as DNS prefix. Lowercase letters, digits, hyphens. */
-  readonly serviceName: string;
-  /** Image registry coordinate or `auto` to let Render build from Dockerfile. */
-  readonly imageTag?: string;
-  readonly region?: RenderRegion;
-  readonly plan?: RenderPlan;
-  /** Plain-text env vars merged into the blueprint. Secret values must use `envVarsFromGroup`. */
-  readonly envVars?: Readonly<Record<string, string>>;
-  /** Reference an existing Render env-var-group for shared secrets. */
-  readonly envVarsFromGroup?: ReadonlyArray<string>;
-  /** Path to the Dockerfile inside the repo. Defaults to `./Dockerfile.render`. */
-  readonly dockerfilePath?: string;
-};
-
-const SERVICE_TYPE_FOR_TARGET: Readonly<Record<RenderTargetShape, "web" | "worker">> = {
-  channel: "web",
-  managed: "web",
-  voice: "web",
-  browser: "web",
-  batch: "worker",
-};
-
-const SERVICE_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-
-function assertRenderTarget(target: TargetShape): asserts target is RenderTargetShape {
-  if (!isRenderTargetShape(target)) {
-    throw new RenderAdapterError(
-      `target shape "${target}" is not supported by Render. ` +
-        `Supported daemon shapes: ${RENDER_TARGET_SHAPES.join(", ")}.`,
-    );
-  }
-}
-
-function assertServiceName(name: string): void {
-  if (!SERVICE_NAME_PATTERN.test(name)) {
-    throw new RenderAdapterError(
-      `service name "${name}" is invalid. Must be lowercase alphanumerics + hyphens, 1-63 chars, no leading/trailing hyphen.`,
-    );
-  }
-}
-
-/**
- * Render-tuned Dockerfile final stage. Wraps the §32 base image with:
- *   - `ENV PORT=10000` default; Render overrides at runtime.
- *   - No fixed `EXPOSE` (Render reads `$PORT`).
- *   - `HEALTHCHECK` curling `localhost:$PORT/healthz` — matches the
- *     gateway-server convention used by `channel-bot` / `managed`.
- *
- * The caller is responsible for ensuring the base image (built by
- * `docker-images.buildImage`) exposes a `/healthz` endpoint. The browser
- * shape ships a stub `/healthz` in `target-browser-driver`; batch shapes
- * don't need one because Render's worker type doesn't health-probe.
- */
-export type RenderDockerfileOptions = {
-  readonly target: TargetShape;
-  /** Base image tag emitted by `docker-images.buildImage` (e.g. `crewhaus/channel:0.1.0`). */
-  readonly baseImage: string;
-};
-
-export function renderDockerfileFor(opts: RenderDockerfileOptions): string {
-  if (!isTargetShape(opts.target)) {
-    throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
-  }
-  assertRenderTarget(opts.target);
-  const isWeb = SERVICE_TYPE_FOR_TARGET[opts.target] === "web";
-  const lines = [
-    `# Render-tuned wrapper around ${opts.baseImage}`,
-    `FROM ${opts.baseImage}`,
-    "ENV PORT=10000",
-  ];
-  if (isWeb) {
-    lines.push(
-      // Use shell form so `$PORT` is expanded against Render's runtime value.
-      "HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \\",
-      '  CMD curl --silent --fail "http://localhost:$PORT/healthz" || exit 1',
-    );
-  }
-  return `${lines.join("\n")}\n`;
-}
-
-/**
- * Render Blueprint spec — minimal subset of the [Render Blueprint schema](https://render.com/docs/blueprint-spec).
- * Emitted YAML is deterministic: stable key order, no trailing whitespace.
- */
-export function renderBlueprintFor(opts: RenderBlueprintOptions): string {
-  if (!isTargetShape(opts.target)) {
-    throw new RenderAdapterError(`unknown target shape "${opts.target}"`);
-  }
-  assertRenderTarget(opts.target);
-  assertServiceName(opts.serviceName);
-
-  const serviceType = SERVICE_TYPE_FOR_TARGET[opts.target];
-  const region = opts.region ?? "oregon";
-  const plan = opts.plan ?? "starter";
-  const dockerfilePath = opts.dockerfilePath ?? "./Dockerfile.render";
-
-  const lines: string[] = [
-    "# Generated by @crewhaus/cloud-adapter-render — do not edit by hand",
-    "services:",
-  ];
-  lines.push(`  - type: ${serviceType}`);
-  lines.push(`    name: ${opts.serviceName}`);
-  lines.push("    runtime: docker");
-  lines.push(`    dockerfilePath: ${dockerfilePath}`);
-  lines.push(`    region: ${region}`);
-  lines.push(`    plan: ${plan}`);
-  if (serviceType === "web") {
-    lines.push("    healthCheckPath: /healthz");
-  }
-  if (opts.imageTag !== undefined && opts.imageTag !== "auto") {
-    lines.push(`    image: ${opts.imageTag}`);
-  }
-  if (opts.envVars && Object.keys(opts.envVars).length > 0) {
-    lines.push("    envVars:");
-    for (const key of Object.keys(opts.envVars).sort()) {
-      const value = opts.envVars[key];
-      if (value === undefined) continue;
-      lines.push(`      - key: ${key}`);
-      lines.push(`        value: ${JSON.stringify(value)}`);
-    }
-  }
-  if (opts.envVarsFromGroup && opts.envVarsFromGroup.length > 0) {
-    if (!opts.envVars || Object.keys(opts.envVars).length === 0) {
-      lines.push("    envVars:");
-    }
-    for (const group of opts.envVarsFromGroup) {
-      lines.push(`      - fromGroup: ${group}`);
-    }
-  }
-  return `${lines.join("\n")}\n`;
-}
-
-export type RenderDeployRecord = {
-  readonly serviceId: string;
-  readonly deployId: string;
-  readonly url?: string;
-  readonly status: string;
-};
-
-export type DeployToRenderOptions = {
-  readonly blueprintYaml: string;
-  readonly serviceName: string;
-  /** Render API key. Defaults to `process.env.RENDER_API_KEY`. */
-  readonly apiKey?: string;
-  /** Default `https://api.render.com/v1`. Override for VCR-style tests. */
-  readonly apiBaseUrl?: string;
-  /** Owner id (team or user) the service belongs to. */
-  readonly ownerId?: string;
-  /** Test seam — override fetch. */
-  readonly fetchImpl?: typeof fetch;
-};
-
-export const RENDER_DEFAULT_API_BASE = "https://api.render.com/v1";
-
-function resolveApiKey(provided: string | undefined): string {
-  const key = provided ?? process.env["RENDER_API_KEY"];
-  if (key === undefined || key.length === 0) {
-    throw new RenderAdapterError(
-      "RENDER_API_KEY is required. Pass `apiKey` explicitly or set the env var.",
-    );
-  }
-  return key;
-}
-
-/**
- * Scrub the API key out of an arbitrary string. Mirrors the
- * §37 `exporter-datadog` helper. Keys shorter than 8 chars are not
- * scrubbed (would match too aggressively against ordinary text).
- */
-export function scrubApiKey(message: string, apiKey: string | undefined): string {
-  if (apiKey === undefined || apiKey.length < 8) return message;
-  return message.split(apiKey).join("[REDACTED:RENDER_API_KEY]");
-}
-
-/**
- * POST the blueprint at Render and return the deploy record. Throws a
- * `RenderAdapterError` whose `.message` is guaranteed scrubbed.
- */
-export async function deployToRender(opts: DeployToRenderOptions): Promise<RenderDeployRecord> {
-  const apiKey = resolveApiKey(opts.apiKey);
-  const baseUrl = opts.apiBaseUrl ?? RENDER_DEFAULT_API_BASE;
-  const fetchFn = opts.fetchImpl ?? fetch;
-  assertServiceName(opts.serviceName);
-
-  let response: Response;
-  try {
-    response = await fetchFn(`${baseUrl}/services`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        "Content-Type": "application/yaml",
-        Accept: "application/json",
-      },
-      body: opts.blueprintYaml,
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new RenderAdapterError(`Render API request failed: ${scrubApiKey(msg, apiKey)}`, err);
-  }
-
-  const text = await response.text();
-  const scrubbed = scrubApiKey(text, apiKey);
-  if (!response.ok) {
-    throw new RenderAdapterError(
-      `Render API returned ${response.status} ${response.statusText}: ${scrubbed}`,
-    );
-  }
-
-  let parsed: {
-    id?: string;
-    service?: { id?: string };
-    deploy?: { id?: string; status?: string };
-    serviceDetails?: { url?: string };
-  };
-  try {
-    parsed = JSON.parse(text);
-  } catch (err) {
-    throw new RenderAdapterError(`Render API returned non-JSON body: ${scrubbed}`, err);
-  }
-
-  const serviceId = parsed.service?.id ?? parsed.id;
-  if (typeof serviceId !== "string") {
-    throw new RenderAdapterError(`Render API response missing service id: ${scrubbed}`);
-  }
-  return {
-    serviceId,
-    deployId: parsed.deploy?.id ?? "",
-    url: parsed.serviceDetails?.url,
-    status: parsed.deploy?.status ?? "pending",
-  };
-}