@astrale-os/sdk 0.5.0-beta.67 → 0.5.0-beta.69

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.5.0-beta.69](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.68...sdk-v0.5.0-beta.69) (2026-08-28)
+
+
+### Features
+
+* add coordinated Domain development sessions ([#300](https://github.com/astrale-os/sdk/issues/300)) ([102104f](https://github.com/astrale-os/sdk/commit/102104f1ed55333f5892db23c036578aa0ffd2e1))
+* **tooling:** keep frontend composition application-owned ([#310](https://github.com/astrale-os/sdk/issues/310)) ([31e9bb6](https://github.com/astrale-os/sdk/commit/31e9bb6de256ef9cdbcdb0296abb973086f11ff0))
+
+
+### Bug Fixes
+
+* **adapter-astrale:** preserve explicit Services installation ownership ([#305](https://github.com/astrale-os/sdk/issues/305)) ([1b9dd64](https://github.com/astrale-os/sdk/commit/1b9dd6422e5d80a552ec5a70b5d262b8413dd6bc))
+* **cli:** skip unused secrets files ([3a1c534](https://github.com/astrale-os/sdk/commit/3a1c53439d5172add9c2c724060daaffc0a517bb))
+
+## [0.5.0-beta.68](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.67...sdk-v0.5.0-beta.68) (2026-08-28)
+
+
+### Performance Improvements
+
+* **execution:** cache issuer verification basis ([#307](https://github.com/astrale-os/sdk/issues/307)) ([a88f227](https://github.com/astrale-os/sdk/commit/a88f22700e61f5c5926621f95fc66638b462fbf5))
+
 ## [0.5.0-beta.67](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.66...sdk-v0.5.0-beta.67) (2026-08-28)
 
 

package/dist/deployment/adapter/adapter.d.ts

@@ -1,13 +1,13 @@
 import type { DeployContext, DeployResult } from './deploy/index.js';
+import type { DevelopmentContext, DevelopmentSession } from './development/index.js';
 import type { ArtifactSource, PrepareContext } from './prepare/index.js';
-import type { WatchContext, WatchHandle } from './watch/index.js';
 export interface Adapter<Parameters = unknown> {
     readonly kind: 'adapter';
     readonly name: string;
     readonly version: string;
     parameters(environment: string): Parameters;
     prepare(parameters: Parameters, context: PrepareContext): Promise<ArtifactSource>;
-    watch(parameters: Parameters, context: WatchContext): Promise<WatchHandle>;
+    develop(parameters: Parameters, context: DevelopmentContext): Promise<DevelopmentSession>;
     deploy(parameters: Parameters, context: DeployContext): Promise<DeployResult>;
     readonly secretsFile?: (parameters: Parameters) => string | undefined;
 }
@@ -16,7 +16,7 @@ export interface AdapterInput<Parameters> {
     readonly version: string;
     readonly environments: Readonly<Record<string, Parameters>>;
     prepare(parameters: Parameters, context: PrepareContext): Promise<ArtifactSource>;
-    watch(parameters: Parameters, context: WatchContext): Promise<WatchHandle>;
+    develop(parameters: Parameters, context: DevelopmentContext): Promise<DevelopmentSession>;
     deploy(parameters: Parameters, context: DeployContext): Promise<DeployResult>;
     readonly secretsFile?: (parameters: Parameters) => string | undefined;
 }

package/dist/deployment/adapter/define.js

@@ -2,7 +2,7 @@ const admittedAdapters = new WeakSet();
 /** Capture one receiver-bound provider adapter and its environment parameters. */
 export function defineAdapter(input) {
     const value = record(input, 'Adapter definition');
-    exact(value, ['name', 'version', 'environments', 'prepare', 'watch', 'deploy'], ['secretsFile']);
+    exact(value, ['name', 'version', 'environments', 'prepare', 'develop', 'deploy'], ['secretsFile']);
     const name = stableName(input.name);
     const version = stableName(input.version);
     const environments = record(input.environments, 'Adapter environments');
@@ -13,7 +13,7 @@ export function defineAdapter(input) {
     const names = Object.keys(capturedEnvironments).sort();
     const receiver = Object.freeze({ ...input, environments: capturedEnvironments });
     const prepare = capture(receiver, 'prepare');
-    const watch = capture(receiver, 'watch');
+    const develop = capture(receiver, 'develop');
     const deploy = capture(receiver, 'deploy');
     const secretsFile = optional(receiver, 'secretsFile');
     const adapter = Object.freeze({
@@ -27,7 +27,7 @@ export function defineAdapter(input) {
             throw new TypeError(`Adapter ${name} has no environment ${environment}; known environments: ${names.length === 0 ? '(none)' : names.join(', ')}.`);
         },
         prepare,
-        watch,
+        develop,
         deploy,
         ...(secretsFile === undefined ? {} : { secretsFile }),
     });

package/dist/deployment/adapter/development/context.d.ts

@@ -0,0 +1,14 @@
+import type { DevelopmentInput } from './input.js';
+import type { DevelopmentPlacement } from './placement.js';
+export interface DevelopmentOverrides {
+    readonly publicUrl?: string;
+    readonly localPort?: number;
+}
+/** Provider-neutral inputs retained for one complete development session. */
+export interface DevelopmentContext extends DevelopmentInput {
+    readonly projectDir: string;
+    readonly environment: string;
+    readonly overrides: DevelopmentOverrides;
+    readonly signal: AbortSignal;
+    onPlacement(placement: DevelopmentPlacement): Promise<void>;
+}

package/dist/deployment/adapter/development/index.d.ts

@@ -0,0 +1,4 @@
+export type { DevelopmentContext, DevelopmentOverrides } from './context.js';
+export type { DevelopmentInput } from './input.js';
+export type { DevelopmentPlacement } from './placement.js';
+export type { DevelopmentSession } from './session.js';

package/dist/deployment/adapter/{watch/context.d.ts → development/input.d.ts}

@@ -1,8 +1,6 @@
 import type { PreparedArtifact } from '../prepare/index.js';
-export interface WatchContext {
-    readonly projectDir: string;
-    readonly environment: string;
-    readonly secrets: Readonly<Record<string, string>>;
+/** One admitted application artifact and its declared provider secrets. */
+export interface DevelopmentInput {
     readonly artifact: PreparedArtifact;
-    onReload(): void;
+    readonly secrets: Readonly<Record<string, string>>;
 }

package/dist/deployment/adapter/development/placement.d.ts

@@ -0,0 +1,5 @@
+/** Exact serving coordinates committed by one development placement generation. */
+export interface DevelopmentPlacement {
+    readonly releaseUrl: string;
+    readonly localUrl?: string;
+}

package/dist/deployment/adapter/development/placement.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/development/session.d.ts

@@ -0,0 +1,9 @@
+import type { DevelopmentInput } from './input.js';
+import type { DevelopmentPlacement } from './placement.js';
+/** Lifecycle capability for one ready development placement. */
+export interface DevelopmentSession {
+    current(): DevelopmentPlacement;
+    update(input: DevelopmentInput): Promise<void>;
+    readonly finished: Promise<void>;
+    stop(): Promise<void>;
+}

package/dist/deployment/adapter/development/session.js

@@ -0,0 +1 @@
+export {};

package/dist/deployment/adapter/index.d.ts

@@ -1,5 +1,5 @@
 export type { Adapter, AdapterInput } from './adapter.js';
 export { defineAdapter, isAdapter } from './define.js';
 export type * from './prepare/index.js';
-export type * from './watch/index.js';
+export type * from './development/index.js';
 export type * from './deploy/index.js';

package/dist/deployment/adapter/prepare/context.d.ts

@@ -3,6 +3,13 @@ import type { ResolvedRuntimeReference } from '../../runtime/index.js';
 export interface PrepareContext<BuildValue extends Build = Build> {
     readonly projectDir: string;
     readonly environment: string;
+    /**
+     * Preparation purpose. Development may omit immutable frontend output because
+     * the live provider serves the declared frontend source directly; release
+     * preparation must remain complete. Omitted by older custom callers means
+     * release for compatibility.
+     */
+    readonly mode?: 'development' | 'release';
     readonly build: BuildValue;
     readonly runtime: ResolvedRuntimeReference;
 }

package/dist/deployment/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAdapter, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, WatchContext, WatchHandle, } from './adapter/index.js';
+export type { Adapter, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DevelopmentContext, DevelopmentInput, DevelopmentOverrides, DevelopmentPlacement, DevelopmentSession, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildSchema } from './build/index.js';
 export { deploy, isDeployment } from './deploy.js';

package/dist/execution/identity/authentication.d.ts

@@ -2,7 +2,7 @@ import type { Fetch } from '@astrale-os/kernel-client';
 import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
 import type { AuthenticatedInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
-import type { IdentityNetworkPolicy, VerificationBasis } from './jwks.js';
+import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
@@ -11,6 +11,7 @@ export interface AuthenticationConfiguration {
     readonly signing: SigningMaterial;
     readonly fetch: Fetch;
     readonly policy: IdentityNetworkPolicy;
+    readonly verification: VerificationBasisResolver;
 }
 export declare function authenticate(credentialInput: CredentialInput, expectedKernel: IssuerId, execution: {
     readonly deadline: number;

package/dist/execution/identity/authentication.js

@@ -48,7 +48,7 @@ export async function admit(request, configuration) {
     }
 }
 export async function authenticate(credentialInput, expectedKernel, execution, configuration) {
-    const established = await establishCaller(credentialInput, configuration.issuer, configuration.fetch, execution, configuration.policy);
+    const established = await establishCaller(credentialInput, configuration.issuer, configuration.verification, execution, configuration.policy);
     if (established.verified.iss !== expectedKernel) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
@@ -104,10 +104,10 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         });
     }
 }
-async function establishCaller(input, audience, fetch, execution, policy) {
+async function establishCaller(input, audience, verification, execution, policy) {
     requireLive(execution);
     try {
-        const context = await verifyCredential(input, audience, fetch, execution.signal, policy);
+        const context = await verifyCredential(input, audience, verification, execution.signal, policy);
         const carried = delegation.accept(context.verified.claims.delegation);
         if (typeof carried.credential !== 'string') {
             throw new CredentialRejected('Destination carrier has no Kernel authority proof.');

package/dist/execution/identity/exchange.d.ts

@@ -1,10 +1,9 @@
-import type { Fetch } from '@astrale-os/kernel-client';
 import type { exchange } from '@astrale-os/kernel-server';
 import type { IssuerId } from '../../platform/auth/index.js';
-import type { IdentityNetworkPolicy } from './jwks.js';
+import type { IdentityNetworkPolicy, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 export interface ExchangeOptions {
     readonly maximumTtlSeconds?: number;
 }
 export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;
-export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, fetch: Fetch, policy: IdentityNetworkPolicy, maximumTtlSeconds: number): exchange.Provider;
+export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, policy: IdentityNetworkPolicy, verification: VerificationBasisResolver, maximumTtlSeconds: number): exchange.Provider;

package/dist/execution/identity/exchange.js

@@ -22,19 +22,22 @@ export function maximumExchangeTtl(input) {
     }
     return value;
 }
-export function tokenExchange(issuer, subject, signing, fetch, policy, maximumTtlSeconds) {
+export function tokenExchange(issuer, subject, signing, policy, verification, maximumTtlSeconds) {
     return Object.freeze({
         async exchange(request, context) {
             try {
-                const outer = await verifyCredential(request.token, issuer, fetch, context.signal, policy);
+                context.signal.throwIfAborted();
+                const outer = await verifyCredential(request.token, issuer, verification, context.signal, policy);
                 requireProfile(outer.verified, 'outer');
                 const carried = delegation.accept(outer.verified.claims.delegation);
                 if (typeof carried.credential !== 'string')
                     invalid();
+                context.signal.throwIfAborted();
                 const inner = await verifyCredentialAgainst(carried.credential, outer.verified.iss, outer.basis);
                 requireProfile(inner.verified, 'inner');
                 requireCoherence(outer.verified, inner.verified);
                 acceptResolvedDelegation(inner.verified.claims.delegation);
+                context.signal.throwIfAborted();
                 const now = Math.floor(Date.now() / 1_000);
                 const expiresAt = Math.min(outer.verified.exp, inner.verified.exp, now + maximumTtlSeconds);
                 if (expiresAt <= now)
@@ -55,6 +58,7 @@ export function tokenExchange(issuer, subject, signing, fetch, policy, maximumTt
                     .setIssuedAt(now)
                     .setExpirationTime(expiresAt)
                     .sign(await signing.privateKey);
+                context.signal.throwIfAborted();
                 return issuerExchange.response(token, expiresAt);
             }
             catch (cause) {

package/dist/execution/identity/identity.js

@@ -2,6 +2,7 @@ import { admit, authenticate } from './authentication.js';
 import { publicationDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
+import { createVerificationBasisResolver } from './jwks.js';
 import { signing } from './signing.js';
 /** Create one stateless execution identity backed by an asymmetric private JWK. */
 export function createIdentity(input) {
@@ -25,16 +26,18 @@ export function createIdentity(input) {
         ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
         ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
     });
+    const verification = createVerificationBasisResolver(fetch, policy);
     const configuration = Object.freeze({
         issuer,
         subject: input.subject,
         signing: material,
         fetch,
         policy,
+        verification,
     });
     const exchangeProvider = input.tokenExchange === false
         ? undefined
-        : tokenExchange(issuer, input.subject, material, fetch, policy, maximumExchangeTtl(input.tokenExchange));
+        : tokenExchange(issuer, input.subject, material, policy, verification, maximumExchangeTtl(input.tokenExchange));
     return identity({
         issuer,
         subject: input.subject,

package/dist/execution/identity/jwks.d.ts

@@ -10,7 +10,15 @@ export interface VerificationBasis {
     readonly algorithms: readonly [string, ...string[]];
     readonly keys: readonly JsonWebKey[];
 }
-export declare function verifyCredential(input: CredentialInput, audience: IssuerId, fetch: Fetch, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
+export interface VerificationBasisResolver {
+    resolve(issuer: IssuerId, keyId: string | undefined, signal: AbortSignal): Promise<VerificationBasis>;
+}
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export declare function createVerificationBasisResolver(fetch: Fetch, policy: IdentityNetworkPolicy, now?: () => number): VerificationBasisResolver;
+export declare function verifyCredential(input: CredentialInput, audience: IssuerId, bases: VerificationBasisResolver, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
     readonly raw: CredentialInput;
     readonly verified: VerifiedCredential;
     readonly basis: VerificationBasis;

package/dist/execution/identity/jwks.js

@@ -5,7 +5,94 @@ import { errors as joseErrors, importJWK, jwtVerify } from 'jose';
 import { credential } from '../../platform/auth/index.js';
 import { CredentialRejected, IssuerUnavailable, admitEndpoint, httpIssuer } from './errors.js';
 const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
-export async function verifyCredential(input, audience, fetch, signal, policy) {
+const MAXIMUM_VERIFICATION_BASES = 64;
+const VERIFICATION_BASIS_TTL_MS = 60_000;
+const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export function createVerificationBasisResolver(fetch, policy, now = Date.now) {
+    const bases = new Map();
+    const pending = new Map();
+    return Object.freeze({
+        async resolve(issuer, keyId, signal) {
+            signal.throwIfAborted();
+            const cached = bases.get(issuer);
+            const observedAt = now();
+            const age = cached === undefined ? Number.POSITIVE_INFINITY : observedAt - cached.refreshedAt;
+            const fresh = cached !== undefined && age >= 0 && age < VERIFICATION_BASIS_TTL_MS;
+            const knownKey = keyId === undefined ||
+                cached?.basis.keys.some((candidate) => candidate.kid === keyId) === true;
+            const unknownKeyCooldown = cached?.unknownKeyRefreshedAt !== undefined &&
+                observedAt - cached.unknownKeyRefreshedAt >= 0 &&
+                observedAt - cached.unknownKeyRefreshedAt < UNKNOWN_KEY_REFRESH_COOLDOWN_MS;
+            if (fresh && knownKey) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            const unknownKeyRefresh = cached !== undefined && !knownKey;
+            let refresh = pending.get(issuer);
+            if (refresh === undefined && fresh && unknownKeyCooldown) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            if (refresh === undefined && unknownKeyRefresh && cached !== undefined) {
+                bases.set(issuer, Object.freeze({ ...cached, unknownKeyRefreshedAt: observedAt }));
+            }
+            if (refresh === undefined) {
+                const controller = new AbortController();
+                refresh = {
+                    controller,
+                    operation: undefined,
+                    subscribers: 0,
+                    settled: false,
+                    unknownKeyRefresh,
+                    requestedKeyIds: new Set(keyId === undefined ? [] : [keyId]),
+                };
+                const owned = refresh;
+                owned.operation = discover(issuer, fetch, controller.signal, policy)
+                    .then((basis) => {
+                    controller.signal.throwIfAborted();
+                    const refreshedAt = now();
+                    if (bases.size >= MAXIMUM_VERIFICATION_BASES && !bases.has(issuer)) {
+                        const oldest = bases.keys().next().value;
+                        if (oldest !== undefined)
+                            bases.delete(oldest);
+                    }
+                    bases.delete(issuer);
+                    bases.set(issuer, Object.freeze({
+                        basis,
+                        refreshedAt,
+                        ...(owned.unknownKeyRefresh ||
+                            [...owned.requestedKeyIds].some((requested) => !basis.keys.some((candidate) => candidate.kid === requested))
+                            ? { unknownKeyRefreshedAt: refreshedAt }
+                            : {}),
+                    }));
+                    return basis;
+                })
+                    .finally(() => {
+                    owned.settled = true;
+                    if (pending.get(issuer) === owned)
+                        pending.delete(issuer);
+                });
+                pending.set(issuer, owned);
+            }
+            else if (unknownKeyRefresh) {
+                refresh.unknownKeyRefresh = true;
+            }
+            if (keyId !== undefined)
+                refresh.requestedKeyIds.add(keyId);
+            const basis = await subscribe(refresh, issuer, pending, signal);
+            signal.throwIfAborted();
+            return basis;
+        },
+    });
+}
+export async function verifyCredential(input, audience, bases, signal, policy) {
+    signal.throwIfAborted();
     let inspected;
     try {
         inspected = credential.inspect(input);
@@ -22,11 +109,48 @@ export async function verifyCredential(input, audience, fetch, signal, policy) {
     catch (cause) {
         throw new CredentialRejected('Credential issuer is invalid.', cause);
     }
-    const basis = await discover(admittedIssuer, fetch, signal, policy);
+    const basis = await bases.resolve(admittedIssuer, inspected.kid, signal);
+    signal.throwIfAborted();
     const verified = await verifyCredentialAgainst(input, audience, basis, inspected);
+    signal.throwIfAborted();
     admitEndpoint(`${admittedIssuer.replace(/\/+$/u, '')}/invoke`, policy);
     return Object.freeze({ raw: input, verified: verified.verified, basis });
 }
+function subscribe(refresh, issuer, pending, signal) {
+    signal.throwIfAborted();
+    refresh.subscribers += 1;
+    return new Promise((resolve, reject) => {
+        let complete = false;
+        const finish = () => {
+            if (complete)
+                return false;
+            complete = true;
+            signal.removeEventListener('abort', cancel);
+            refresh.subscribers -= 1;
+            if (!refresh.settled && refresh.subscribers === 0) {
+                if (pending.get(issuer) === refresh)
+                    pending.delete(issuer);
+                refresh.controller.abort(new DOMException('Issuer discovery was cancelled.', 'AbortError'));
+            }
+            return true;
+        };
+        const cancel = () => {
+            if (!finish())
+                return;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', cancel, { once: true });
+        refresh.operation.then((basis) => {
+            if (!finish())
+                return;
+            resolve(basis);
+        }, (cause) => {
+            if (!finish())
+                return;
+            reject(cause);
+        });
+    });
+}
 export async function verifyCredentialAgainst(input, audience, basis, preinspected) {
     let inspected;
     try {

package/dist/tooling/cli/arguments.d.ts

@@ -2,7 +2,6 @@ import type { LintReportFormat } from '../linter/index.js';
 export interface ParsedArgs {
     readonly command: 'dev' | 'build' | 'deploy' | 'lint' | 'package';
     readonly env: string;
-    readonly watch: boolean;
     readonly fix?: boolean;
     readonly format?: LintReportFormat;
     readonly port?: number;

package/dist/tooling/cli/arguments.js

@@ -1,7 +1,7 @@
+import { isIP } from 'node:net';
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export function parseArgs(argv) {
     const [command, ...rest] = argv;
-    const watch = rest.includes('--watch');
     const fix = rest.includes('--fix');
     let port;
     let host;
@@ -13,13 +13,13 @@ export function parseArgs(argv) {
         if (argument === '--port') {
             const value = rest[++index];
             port = Number(value);
-            if (!Number.isInteger(port) || port <= 0) {
+            if (!Number.isInteger(port) || port <= 0 || port > 65_535) {
                 throw new Error(`--port needs a port number, got "${value}"`);
             }
         }
         else if (argument.startsWith('--port=')) {
             port = Number(argument.slice('--port='.length));
-            if (!Number.isInteger(port) || port <= 0) {
+            if (!Number.isInteger(port) || port <= 0 || port > 65_535) {
                 throw new Error(`--port needs a port number, got "${argument}"`);
             }
         }
@@ -41,7 +41,7 @@ export function parseArgs(argv) {
         else if (argument.startsWith('--environment=')) {
             environment = requiredValue('--environment', argument.slice('--environment='.length));
         }
-        else if (argument === '--watch' || argument === '--fix') {
+        else if (argument === '--fix') {
             continue;
         }
         else if (argument.startsWith('-')) {
@@ -56,9 +56,6 @@ export function parseArgs(argv) {
     if (format !== undefined && command !== 'lint') {
         throw new Error('`--format` is only valid for `lint`.');
     }
-    if (watch && !['dev', 'deploy'].includes(command ?? '')) {
-        throw new Error('`--watch` is only valid for the dev / deploy commands.');
-    }
     if ((port !== undefined || host !== undefined) && command !== 'dev') {
         throw new Error('`--port` and `--host` are only valid for `dev`.');
     }
@@ -76,7 +73,6 @@ export function parseArgs(argv) {
             return {
                 command: 'dev',
                 env: environment ?? positionals[0] ?? 'dev',
-                watch: true,
                 ...(port !== undefined ? { port } : {}),
                 ...(host !== undefined ? { host } : {}),
             };
@@ -89,24 +85,22 @@ export function parseArgs(argv) {
             return {
                 command: 'deploy',
                 env,
-                watch,
             };
         }
         case 'build':
             if (positionals.length > 0)
                 throw new Error('`build` does not accept positional arguments.');
-            return { command: 'build', env: 'dev', watch: false };
+            return { command: 'build', env: 'dev' };
         case 'package':
             if (positionals.length > 0)
                 throw new Error('`package` does not accept positional arguments.');
-            return { command: 'package', env: 'dev', watch: false };
+            return { command: 'package', env: 'dev' };
         case 'lint':
             if (positionals.length > 0)
                 throw new Error('`lint` does not accept positional arguments.');
             return {
                 command: 'lint',
                 env: 'dev',
-                watch: false,
                 ...(fix ? { fix: true } : {}),
                 ...(format ? { format } : {}),
             };
@@ -119,12 +113,46 @@ function normalizeHost(input) {
         throw new Error(`--host needs a public URL, got "${input ?? ''}"`);
     }
     try {
-        return new URL(/^https?:\/\//u.test(input) ? input : `https://${input}`).origin;
+        const url = new URL(input);
+        if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+            url.username !== '' ||
+            url.password !== '' ||
+            url.pathname !== '/' ||
+            url.search !== '' ||
+            url.hash !== '' ||
+            privateHostname(url.hostname))
+            throw new Error('invalid');
+        return url.origin;
     }
     catch {
         throw new Error(`--host needs a valid URL, got "${input}"`);
     }
 }
+function privateHostname(input) {
+    const host = input
+        .toLowerCase()
+        .replace(/^\[|\]$/gu, '')
+        .replace(/\.$/u, '');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (isIP(host) === 4) {
+        const parts = host.split('.').map(Number);
+        return (parts[0] === 0 ||
+            parts[0] === 10 ||
+            parts[0] === 127 ||
+            (parts[0] === 169 && parts[1] === 254) ||
+            (parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31) ||
+            (parts[0] === 192 && parts[1] === 168));
+    }
+    if (isIP(host) !== 6)
+        return false;
+    return (host === '::' ||
+        host === '::1' ||
+        host.startsWith('fc') ||
+        host.startsWith('fd') ||
+        /^fe[89ab]/u.test(host) ||
+        /^::ffff:(?:0|10|127|169\.254|172\.(?:1[6-9]|2\d|3[01])|192\.168)\./u.test(host));
+}
 function lintFormat(input) {
     if (input !== 'stylish' && input !== 'json') {
         throw new Error(`--format must be "stylish" or "json", got "${input ?? ''}"`);

package/dist/tooling/cli/bun.d.ts

@@ -10,5 +10,6 @@ export type BunOutcome = {
 };
 /** Re-enter the published executable under Bun only when authored TypeScript must be imported. */
 export declare function runWithBun(executable: string, argv: readonly string[]): Promise<BunOutcome>;
+export declare function isolateDevelopmentProcessGroup(argv: readonly string[], platform?: NodeJS.Platform): boolean;
 /** Prefer the generated project's exact Bun package binary over an ambient executable or shim. */
 export declare function resolveBunExecutable(cwd: string): string;

package/dist/tooling/cli/bun.js

@@ -14,6 +14,10 @@ export function runWithBun(executable, argv) {
     return new Promise((resolve, reject) => {
         const child = spawn(resolveBunExecutable(process.cwd()), [executable, ...argv], {
             stdio: 'inherit',
+            // Keep a long-lived development runtime outside the launcher's terminal
+            // process group. The launcher receives Ctrl-C, forwards it exactly once,
+            // and remains alive until Bun finishes provider and Kernel cleanup.
+            detached: isolateDevelopmentProcessGroup(argv),
         });
         const handlers = FORWARDED_SIGNALS.map((signal) => [signal, () => child.kill(signal)]);
         for (const [signal, handler] of handlers)
@@ -40,6 +44,9 @@ export function runWithBun(executable, argv) {
         });
     });
 }
+export function isolateDevelopmentProcessGroup(argv, platform = process.platform) {
+    return platform !== 'win32' && argv[0] === 'dev';
+}
 /** Prefer the generated project's exact Bun package binary over an ambient executable or shim. */
 export function resolveBunExecutable(cwd) {
     const projectRequire = createRequire(join(cwd, 'package.json'));

package/dist/tooling/cli/development/develop.d.ts

@@ -0,0 +1,8 @@
+import type { DevelopmentOverrides } from '../../../deployment/adapter/index.js';
+/** Run one complete provider-neutral development session until interruption. */
+export declare function develop(input: {
+    readonly configPath: string;
+    readonly projectDir: string;
+    readonly environment: string;
+    readonly overrides: DevelopmentOverrides;
+}): Promise<number>;