@astrale-os/sdk 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/tooling/cli/arguments.js

@@ -0,0 +1,223 @@
+/** Parse the frozen `astrale-domain` command grammar without performing effects. */
+export function parseArgs(argv) {
+    const [command, ...rest] = argv;
+    const watch = rest.includes('--watch');
+    const fix = rest.includes('--fix');
+    const publish = rest.includes('--publish');
+    const installByDefault = rest.includes('--install-by-default');
+    const dryRun = rest.includes('--dry-run');
+    const schemaOnly = rest.includes('--schema');
+    const skipSchema = rest.includes('--skip-schema');
+    let port;
+    let host;
+    let name;
+    let publicUrl;
+    let otp;
+    let format;
+    let environment;
+    const cleaned = [];
+    for (let index = 0; index < rest.length; index += 1) {
+        const argument = rest[index];
+        if (argument === '--port') {
+            const value = rest[++index];
+            port = Number(value);
+            if (!Number.isInteger(port) || port <= 0) {
+                throw new Error(`--port needs a port number, got "${value}"`);
+            }
+        }
+        else if (argument.startsWith('--port=')) {
+            port = Number(argument.slice('--port='.length));
+            if (!Number.isInteger(port) || port <= 0) {
+                throw new Error(`--port needs a port number, got "${argument}"`);
+            }
+        }
+        else if (argument === '--host') {
+            host = normalizeHost(rest[++index]);
+        }
+        else if (argument.startsWith('--host=')) {
+            host = normalizeHost(argument.slice('--host='.length));
+        }
+        else if (argument === '--name') {
+            name = requiredValue('--name', rest[++index]);
+        }
+        else if (argument.startsWith('--name=')) {
+            name = requiredValue('--name', argument.slice('--name='.length));
+        }
+        else if (argument === '--public-url') {
+            publicUrl = requiredValue('--public-url', rest[++index]);
+        }
+        else if (argument.startsWith('--public-url=')) {
+            publicUrl = requiredValue('--public-url', argument.slice('--public-url='.length));
+        }
+        else if (argument === '--otp') {
+            otp = requiredValue('--otp', rest[++index]);
+        }
+        else if (argument.startsWith('--otp=')) {
+            otp = requiredValue('--otp', argument.slice('--otp='.length));
+        }
+        else if (argument === '--format') {
+            format = lintFormat(rest[++index]);
+        }
+        else if (argument.startsWith('--format=')) {
+            format = lintFormat(argument.slice('--format='.length));
+        }
+        else if (argument === '--environment') {
+            environment = requiredValue('--environment', rest[++index]);
+        }
+        else if (argument.startsWith('--environment=')) {
+            environment = requiredValue('--environment', argument.slice('--environment='.length));
+        }
+        else if (argument === '--watch' ||
+            argument === '--fix' ||
+            argument === '--publish' ||
+            argument === '--install-by-default' ||
+            argument === '--dry-run' ||
+            argument === '--schema' ||
+            argument === '--skip-schema') {
+            continue;
+        }
+        else if (argument.startsWith('-')) {
+            throw new Error(`Unknown flag "${argument}".`);
+        }
+        else {
+            cleaned.push(argument);
+        }
+    }
+    if (dryRun && command !== 'publish') {
+        throw new Error('`--dry-run` is only valid for `publish`.');
+    }
+    if (otp !== undefined && !['publish', 'deploy', 'prod'].includes(command ?? '')) {
+        throw new Error('`--otp` is only valid for the publish / deploy commands.');
+    }
+    if (schemaOnly && command !== 'publish') {
+        throw new Error('`--schema` is only valid for `publish`.');
+    }
+    if (schemaOnly && skipSchema) {
+        throw new Error('`--schema` (schema only) and `--skip-schema` (catalog only) are mutually exclusive.');
+    }
+    if (fix && command !== 'lint')
+        throw new Error('`--fix` is only valid for `lint`.');
+    if (format !== undefined && command !== 'lint') {
+        throw new Error('`--format` is only valid for `lint`.');
+    }
+    if (watch && !['dev', 'deploy', 'prod'].includes(command ?? '')) {
+        throw new Error('`--watch` is only valid for the dev / deploy commands.');
+    }
+    if ((port !== undefined || host !== undefined) && command !== 'dev') {
+        throw new Error('`--port` and `--host` are only valid for `dev`.');
+    }
+    if (publish && !['deploy', 'prod'].includes(command ?? '')) {
+        throw new Error('`--publish` is only valid for the deploy commands.');
+    }
+    if (publicUrl !== undefined && command !== 'publish') {
+        throw new Error('`--public-url` is only valid for `publish`.');
+    }
+    if (environment !== undefined && !['dev', 'deploy', 'publish'].includes(command ?? '')) {
+        throw new Error('`--environment` is only valid for dev, deploy, or publish.');
+    }
+    if ((name !== undefined || installByDefault || skipSchema || otp !== undefined) &&
+        command !== 'publish' &&
+        !(['deploy', 'prod'].includes(command ?? '') && publish)) {
+        throw new Error('Publish options require `publish` or a deploy command with `--publish`.');
+    }
+    const positionals = cleaned.filter((argument) => !argument.startsWith('-'));
+    if (environment !== undefined && positionals.length > 0) {
+        throw new Error('Choose either a positional environment or `--environment`, not both.');
+    }
+    const publication = {
+        ...(name !== undefined ? { name } : {}),
+        ...(installByDefault ? { installByDefault } : {}),
+        ...(otp !== undefined ? { otp } : {}),
+        ...(skipSchema ? { skipSchema } : {}),
+    };
+    switch (command) {
+        case 'dev':
+            if (positionals.length > 1)
+                throw new Error('`dev` accepts at most one environment.');
+            return {
+                command: 'dev',
+                env: environment ?? positionals[0] ?? 'dev',
+                watch: true,
+                ...(port !== undefined ? { port } : {}),
+                ...(host !== undefined ? { host } : {}),
+            };
+        case 'prod':
+            if (positionals.length > 0)
+                throw new Error('`prod` does not accept an environment.');
+            return {
+                command: 'deploy',
+                env: 'prod',
+                watch,
+                ...(publish ? { publish } : {}),
+                ...publication,
+            };
+        case 'deploy': {
+            if (positionals.length > 1)
+                throw new Error('`deploy` accepts exactly one environment.');
+            const env = environment ?? positionals[0];
+            if (!env)
+                throw new Error('`deploy` requires an env key, e.g. `deploy prod`.');
+            return {
+                command: 'deploy',
+                env,
+                watch,
+                ...(publish ? { publish } : {}),
+                ...publication,
+            };
+        }
+        case 'publish':
+            if (positionals.length > 1)
+                throw new Error('`publish` accepts at most one environment.');
+            return {
+                command: 'publish',
+                env: environment ?? positionals[0] ?? 'prod',
+                watch: false,
+                ...publication,
+                ...(publicUrl !== undefined ? { publicUrl } : {}),
+                ...(dryRun ? { dryRun } : {}),
+                ...(schemaOnly ? { schemaOnly } : {}),
+            };
+        case 'build':
+            if (positionals.length > 0)
+                throw new Error('`build` does not accept positional arguments.');
+            return { command: 'build', env: 'dev', watch: false };
+        case 'package':
+            if (positionals.length > 0)
+                throw new Error('`package` does not accept positional arguments.');
+            return { command: 'package', env: 'dev', watch: false };
+        case 'lint':
+            if (positionals.length > 0)
+                throw new Error('`lint` does not accept positional arguments.');
+            return {
+                command: 'lint',
+                env: 'dev',
+                watch: false,
+                ...(fix ? { fix: true } : {}),
+                ...(format ? { format } : {}),
+            };
+        default:
+            throw new Error(command ? `Unknown command "${command}".` : 'Missing command.');
+    }
+}
+function normalizeHost(input) {
+    if (!input || input.startsWith('-')) {
+        throw new Error(`--host needs a public URL, got "${input ?? ''}"`);
+    }
+    try {
+        return new URL(/^https?:\/\//u.test(input) ? input : `https://${input}`).origin;
+    }
+    catch {
+        throw new Error(`--host needs a valid URL, got "${input}"`);
+    }
+}
+function lintFormat(input) {
+    if (input !== 'stylish' && input !== 'json') {
+        throw new Error(`--format must be "stylish" or "json", got "${input ?? ''}"`);
+    }
+    return input;
+}
+function requiredValue(flag, input) {
+    if (!input || input.startsWith('-'))
+        throw new Error(`${flag} needs a value.`);
+    return input;
+}

package/dist/tooling/cli/bin.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * Published executable boundary. Configuration-free commands remain in Node;
+ * authored TypeScript Runtime commands are supervised through Bun.
+ */
+export {};

package/dist/tooling/cli/bin.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+/**
+ * Published executable boundary. Configuration-free commands remain in Node;
+ * authored TypeScript Runtime commands are supervised through Bun.
+ */
+import { fileURLToPath } from 'node:url';
+import { BunRequiredError, runWithBun } from './bun.js';
+import { failureMessage, failureStack } from './failure.js';
+import { run } from './run.js';
+const argv = process.argv.slice(2);
+try {
+    await execute(argv);
+}
+catch (cause) {
+    process.stderr.write(`\x1b[31m✗\x1b[0m ${failureMessage(cause)}\n`);
+    const stack = failureStack(cause);
+    if (process.env.DEBUG && stack !== undefined)
+        process.stderr.write(`${stack}\n`);
+    process.exitCode = 1;
+}
+async function execute(argv) {
+    try {
+        process.exitCode = await run(argv);
+    }
+    catch (cause) {
+        if (!(cause instanceof BunRequiredError))
+            throw cause;
+        const outcome = await runWithBun(fileURLToPath(import.meta.url), argv);
+        if (outcome.status === 'exited') {
+            process.exitCode = outcome.code;
+        }
+        else {
+            process.kill(process.pid, outcome.signal);
+        }
+    }
+}

package/dist/tooling/cli/bun.d.ts

@@ -0,0 +1,12 @@
+export declare class BunRequiredError extends Error {
+    constructor(options?: ErrorOptions);
+}
+export type BunOutcome = {
+    readonly status: 'exited';
+    readonly code: number;
+} | {
+    readonly status: 'signaled';
+    readonly signal: NodeJS.Signals;
+};
+/** Re-enter the published executable under Bun only when authored TypeScript must be imported. */
+export declare function runWithBun(executable: string, argv: readonly string[]): Promise<BunOutcome>;

package/dist/tooling/cli/bun.js

@@ -0,0 +1,37 @@
+import { spawn } from 'node:child_process';
+const FORWARDED_SIGNALS = ['SIGINT', 'SIGTERM'];
+export class BunRequiredError extends Error {
+    constructor(options) {
+        super('astrale-domain requires Bun to import astrale.config.ts and its Runtime module.', options);
+        this.name = 'BunRequiredError';
+    }
+}
+/** Re-enter the published executable under Bun only when authored TypeScript must be imported. */
+export function runWithBun(executable, argv) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('bun', [executable, ...argv], { stdio: 'inherit' });
+        const handlers = FORWARDED_SIGNALS.map((signal) => [signal, () => child.kill(signal)]);
+        for (const [signal, handler] of handlers)
+            process.on(signal, handler);
+        const cleanup = () => {
+            for (const [signal, handler] of handlers)
+                process.off(signal, handler);
+        };
+        child.once('error', (cause) => {
+            cleanup();
+            reject(new BunRequiredError({ cause }));
+        });
+        child.once('close', (code, signal) => {
+            cleanup();
+            if (signal !== null) {
+                resolve({ status: 'signaled', signal });
+            }
+            else if (code !== null) {
+                resolve({ status: 'exited', code });
+            }
+            else {
+                reject(new Error('Bun closed without an exit code or signal.'));
+            }
+        });
+    });
+}

package/dist/tooling/cli/dotenv.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Minimal dotenv parser — the secrets-file boundary.
+ *
+ * `secrets: '.env.<env>'` in an adapter's params points a gitignored file whose
+ * entire contents are secrets. `loadDeclaredSecrets` reads it into a flat
+ * `Record<string,string>` the CLI hands the adapter (injected into the local
+ * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
+ * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
+ */
+/**
+ * Read + parse a dotenv file the preset explicitly DECLARED (`secrets:`).
+ * Declared-but-absent is a wiring error (the gitignored file was never created
+ * on this machine), so it throws instead of loading `{}` — silently forwarding
+ * nothing surfaces much later as an empty credential at the provider. A file
+ * that exists but holds no keys is legitimate (a domain with no secrets yet).
+ */
+export declare function loadDeclaredSecrets(path: string, declaration: string): Record<string, string>;

package/dist/tooling/cli/dotenv.js

@@ -0,0 +1,54 @@
+/**
+ * Minimal dotenv parser — the secrets-file boundary.
+ *
+ * `secrets: '.env.<env>'` in an adapter's params points a gitignored file whose
+ * entire contents are secrets. `loadDeclaredSecrets` reads it into a flat
+ * `Record<string,string>` the CLI hands the adapter (injected into the local
+ * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
+ * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
+ */
+import { readFileSync } from 'node:fs';
+function parseDotenv(contents) {
+    const out = {};
+    for (const raw of contents.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const match = /^(?:export\s+)?([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line);
+        if (!match)
+            continue;
+        const [, key, rawValue] = match;
+        let value = rawValue.trim();
+        // Single quotes mean a LITERAL value (standard dotenv): no `${VAR}`
+        // interpolation, so a secret that legitimately contains a literal `${...}`
+        // (e.g. a password) survives intact instead of being silently blanked.
+        const singleQuoted = value.length >= 2 && value.startsWith("'") && value.endsWith("'");
+        if ((value.length >= 2 && value.startsWith('"') && value.endsWith('"')) || singleQuoted) {
+            value = value.slice(1, -1);
+        }
+        out[key] = singleQuoted
+            ? value
+            : value.replace(/\$\{(\w+)\}/g, (_, name) => out[name] ?? '');
+    }
+    return out;
+}
+/**
+ * Read + parse a dotenv file the preset explicitly DECLARED (`secrets:`).
+ * Declared-but-absent is a wiring error (the gitignored file was never created
+ * on this machine), so it throws instead of loading `{}` — silently forwarding
+ * nothing surfaces much later as an empty credential at the provider. A file
+ * that exists but holds no keys is legitimate (a domain with no secrets yet).
+ */
+export function loadDeclaredSecrets(path, declaration) {
+    let contents;
+    try {
+        contents = readFileSync(path, 'utf-8');
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'ENOENT'))
+            throw cause;
+        throw new Error(`Secrets file '${declaration}' is declared in the preset but missing at ${path}. ` +
+            `Create it (it may be empty) or remove 'secrets:' from the preset.`, { cause });
+    }
+    return parseDotenv(contents);
+}

package/dist/tooling/cli/failure.d.ts

@@ -0,0 +1,2 @@
+export declare function failureMessage(cause: unknown): string;
+export declare function failureStack(cause: unknown): string | undefined;

package/dist/tooling/cli/failure.js

@@ -0,0 +1,13 @@
+export function failureMessage(cause) {
+    if (cause instanceof Error)
+        return cause.message;
+    try {
+        return String(cause);
+    }
+    catch {
+        return 'Unknown error';
+    }
+}
+export function failureStack(cause) {
+    return cause instanceof Error ? cause.stack : undefined;
+}

package/dist/tooling/cli/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
+ * (dev | build | deploy | publish | lint) and its explicit dotenv boundary.
+ *
+ * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
+ * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
+ * deliberately NOT re-exported from the package barrel — pulling it into the
+ * isomorphic `.` entry would poison browser/worker bundlers that traverse every
+ * re-export (the same rule that keeps `./server` and `./deploy` off the barrel).
+ * The bin lives at `./bin`.
+ */
+export { run } from './run.js';
+export { loadDeclaredSecrets } from './dotenv.js';

package/dist/tooling/cli/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
+ * (dev | build | deploy | publish | lint) and its explicit dotenv boundary.
+ *
+ * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
+ * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
+ * deliberately NOT re-exported from the package barrel — pulling it into the
+ * isomorphic `.` entry would poison browser/worker bundlers that traverse every
+ * re-export (the same rule that keeps `./server` and `./deploy` off the barrel).
+ * The bin lives at `./bin`.
+ */
+export { run } from './run.js';
+export { loadDeclaredSecrets } from './dotenv.js';

package/dist/tooling/cli/log.d.ts

@@ -0,0 +1,10 @@
+/** CLI output helpers + ANSI colours, shared by run.ts and publish.ts. */
+export declare const GREEN = "\u001B[32m";
+export declare const DIM = "\u001B[2m";
+export declare const BOLD = "\u001B[1m";
+export declare const YELLOW = "\u001B[33m";
+export declare const RED = "\u001B[31m";
+export declare const RESET = "\u001B[0m";
+export declare function info(msg: string): void;
+export declare function warn(msg: string): void;
+export declare function error(msg: string): void;

package/dist/tooling/cli/log.js

@@ -0,0 +1,16 @@
+/** CLI output helpers + ANSI colours, shared by run.ts and publish.ts. */
+export const GREEN = '\x1b[32m';
+export const DIM = '\x1b[2m';
+export const BOLD = '\x1b[1m';
+export const YELLOW = '\x1b[33m';
+export const RED = '\x1b[31m';
+export const RESET = '\x1b[0m';
+export function info(msg) {
+    process.stdout.write(`${DIM}›${RESET} ${msg}\n`);
+}
+export function warn(msg) {
+    process.stderr.write(`${YELLOW}!${RESET} ${msg}\n`);
+}
+export function error(msg) {
+    process.stderr.write(`${RED}✗${RESET} ${msg}\n`);
+}

package/dist/tooling/cli/orchestrate.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: readonly string[]): Promise<number>;

package/dist/tooling/cli/orchestrate.js

@@ -0,0 +1,206 @@
+import { existsSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { admitRuntime, addressing, assemble, compile, isDeployment, resolveRuntime, verifyDeployment, verifyPreflight, verifyReadiness, } from '../../deployment/index.js';
+import { packageDomain } from '../packaging/index.js';
+import { parseArgs } from './arguments.js';
+import { BunRequiredError } from './bun.js';
+import { loadDeclaredSecrets } from './dotenv.js';
+import { error, info } from './log.js';
+import { publishSchema, runRelease, runReleaseAfterDeploy } from './publish.js';
+const CONFIG_NAMES = ['astrale.config.ts', 'astrale.config.js', 'astrale.config.mjs'];
+export async function run(argv) {
+    if (argv.includes('--help') || argv.includes('-h')) {
+        usage();
+        return 0;
+    }
+    let parsed;
+    try {
+        parsed = parseArgs(argv);
+    }
+    catch (cause) {
+        usage(cause instanceof Error ? cause.message : String(cause));
+        return 2;
+    }
+    if (parsed.command === 'lint')
+        return lint(parsed);
+    if (parsed.command === 'package') {
+        const result = await packageDomain({ projectDir: process.cwd() });
+        info(`Packaged ${result.declarations} public declarations (${result.replacements} facade references normalized).`);
+        return 0;
+    }
+    if (parsed.command === 'publish' && parsed.schemaOnly) {
+        return publishSchema({
+            projectDir: process.cwd(),
+            dryRun: parsed.dryRun ?? false,
+            ...(parsed.otp === undefined ? {} : { otp: parsed.otp }),
+        });
+    }
+    if (!process.versions.bun) {
+        throw new BunRequiredError();
+    }
+    const projectDir = process.cwd();
+    const configPath = findConfig(projectDir);
+    if (configPath === undefined) {
+        error(`No astrale.config.ts found in ${projectDir}.`);
+        return 1;
+    }
+    const deployment = await loadDeployment(configPath);
+    if (parsed.command === 'publish') {
+        return runRelease({
+            projectDir,
+            origin: deployment.application.schema.origin,
+            skipSchema: parsed.skipSchema ?? false,
+            dryRun: parsed.dryRun ?? false,
+            ...(parsed.name === undefined ? {} : { name: parsed.name }),
+            ...(parsed.publicUrl === undefined ? {} : { publicUrl: parsed.publicUrl }),
+            ...(parsed.otp === undefined ? {} : { otp: parsed.otp }),
+            ...(parsed.installByDefault ? { installByDefault: true } : {}),
+        });
+    }
+    const adapter = deployment.adapter;
+    const build = compile(deployment.application);
+    const resolved = await resolveRuntime(deployment.entrypoint, (path) => importModule(resolve(dirname(configPath), path)));
+    admitRuntime({ runtime: build.runtime }, resolved);
+    const parameters = overrides(adapter.parameters(parsed.env), parsed);
+    const source = await adapter.prepare(parameters, {
+        projectDir,
+        environment: parsed.env,
+        build,
+        runtime: resolved,
+    });
+    const artifact = verifyPreflight({ build, runtime: resolved, source });
+    if (parsed.command === 'build') {
+        info(`Built ${build.schema.compiled.root.origin} (${artifact.digest}).`);
+        return 0;
+    }
+    const secrets = secretsFor(adapter, parameters, projectDir);
+    if (parsed.command === 'dev' || parsed.watch) {
+        return watch(adapter, parameters, artifact, secrets, parsed, projectDir);
+    }
+    const result = verifyDeployment(artifact, await adapter.deploy(parameters, {
+        projectDir,
+        environment: parsed.env,
+        secrets,
+        artifact,
+    }));
+    if (result.status === 'failed') {
+        error(`Deployment failed during ${result.phase}: ${result.error.message}`);
+        return 1;
+    }
+    info(`Ready: ${result.release.addressing.issuer}`);
+    if (!parsed.publish)
+        return 0;
+    return runReleaseAfterDeploy({
+        projectDir,
+        origin: result.release.publication.origin,
+        deployedUrl: result.release.addressing.issuer,
+        skipSchema: parsed.skipSchema ?? false,
+        ...(parsed.name === undefined ? {} : { name: parsed.name }),
+        ...(parsed.otp === undefined ? {} : { otp: parsed.otp }),
+        ...(parsed.installByDefault ? { installByDefault: true } : {}),
+    });
+}
+async function watch(adapter, parameters, artifact, secrets, parsed, projectDir) {
+    const handle = await adapter.watch(parameters, {
+        projectDir,
+        environment: parsed.env,
+        secrets,
+        artifact,
+        onReload: () => info('Reloaded.'),
+    });
+    const observed = addressing(handle.url);
+    if (artifact.addressing.kind === 'configured' &&
+        artifact.addressing.addressing.issuer !== observed.issuer) {
+        throw new TypeError('Development server URL differs from configured Addressing.');
+    }
+    const release = assemble(artifact.build, artifact.addressing.kind === 'configured' ? artifact.addressing.addressing : observed);
+    try {
+        await retryReadiness(release);
+        info(`Ready: ${handle.url}`);
+        await signals();
+        return 0;
+    }
+    finally {
+        await handle.stop();
+    }
+}
+async function retryReadiness(release) {
+    const deadline = Date.now() + 30_000;
+    let last;
+    while (Date.now() < deadline) {
+        try {
+            await verifyReadiness(release, { signal: AbortSignal.timeout(2_000) });
+            return;
+        }
+        catch (cause) {
+            last = cause;
+            await new Promise((resolve) => setTimeout(resolve, 250));
+        }
+    }
+    throw last instanceof Error ? last : new Error('Development Release is not ready.');
+}
+async function lint(parsed) {
+    const { formatLintResult, lintDomain, LinterToolError } = await import('../linter/index.js');
+    try {
+        const result = await lintDomain({
+            root: process.cwd(),
+            fix: parsed.fix ?? false,
+        });
+        process.stdout.write(formatLintResult(result, parsed.format));
+        return result.exitCode;
+    }
+    catch (cause) {
+        if (cause instanceof LinterToolError) {
+            error(cause.message);
+            return cause.exitCode;
+        }
+        throw cause;
+    }
+}
+function overrides(parameters, parsed) {
+    return Object.freeze({
+        ...parameters,
+        ...(parsed.port === undefined ? {} : { port: parsed.port }),
+        ...(parsed.host === undefined ? {} : { host: parsed.host }),
+    });
+}
+function secretsFor(adapter, parameters, projectDir) {
+    const file = adapter.secretsFile?.(parameters);
+    if (file === undefined)
+        return Object.freeze({});
+    const path = isAbsolute(file) ? file : join(projectDir, file);
+    return Object.freeze(loadDeclaredSecrets(path, file));
+}
+async function loadDeployment(path) {
+    const loaded = (await importModule(path));
+    if (Object.keys(loaded).length !== 1 || !Object.hasOwn(loaded, 'default')) {
+        throw new TypeError('astrale.config.ts must export exactly one default Deployment.');
+    }
+    const deployment = loaded.default;
+    if (!isDeployment(deployment))
+        throw new TypeError('Default export must be created by deploy().');
+    return deployment;
+}
+function importModule(path) {
+    return import(`${pathToFileURL(path).href}?sdk=${Date.now()}`);
+}
+function findConfig(projectDir) {
+    return CONFIG_NAMES.map((name) => join(projectDir, name)).find(existsSync);
+}
+function signals() {
+    return new Promise((resolve) => {
+        const stop = () => {
+            process.off('SIGINT', stop);
+            process.off('SIGTERM', stop);
+            resolve();
+        };
+        process.once('SIGINT', stop);
+        process.once('SIGTERM', stop);
+    });
+}
+function usage(message) {
+    if (message !== undefined)
+        error(message);
+    process.stderr.write('Usage: astrale-domain <dev|build|deploy|publish|lint|package> [environment]\n');
+}