@astrale-os/sdk 0.5.0-beta.90 → 0.5.0-beta.92

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.5.0-beta.92](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.91...sdk-v0.5.0-beta.92) (2026-08-30)
+
+
+### Features
+
+* **cli:** support supervised development secrets ([#364](https://github.com/astrale-os/sdk/issues/364)) ([2126070](https://github.com/astrale-os/sdk/commit/21260705b059165015238a09abfdeffaf2f7b757))
+
+## [0.5.0-beta.91](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.90...sdk-v0.5.0-beta.91) (2026-08-30)
+
+
+### Bug Fixes
+
+* **deps:** expose endpoint-selective edge policies ([#362](https://github.com/astrale-os/sdk/issues/362)) ([c41a8da](https://github.com/astrale-os/sdk/commit/c41a8da7bfe05eba5a5e59320c6ddedf655f6215))
+
 ## [0.5.0-beta.90](https://github.com/astrale-os/sdk/compare/sdk-v0.5.0-beta.89...sdk-v0.5.0-beta.90) (2026-08-30)
 
 

package/dist/tooling/cli/arguments.d.ts

@@ -10,6 +10,7 @@ export interface ParsedArgs {
     readonly host?: string;
     readonly sessionFile?: string;
     readonly credentialFile?: string;
+    readonly secretsFile?: string;
 }
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/tooling/cli/arguments.js

@@ -9,6 +9,7 @@ export function parseArgs(argv) {
     let host;
     let sessionFile;
     let credentialFile;
+    let secretsFile;
     let format;
     let environment;
     const cleaned = [];
@@ -45,6 +46,12 @@ export function parseArgs(argv) {
         else if (argument.startsWith('--credential-file=')) {
             credentialFile = absoluteFilePath('--credential-file', argument.slice('--credential-file='.length));
         }
+        else if (argument === '--secrets-file') {
+            secretsFile = absoluteFilePath('--secrets-file', rest[++index]);
+        }
+        else if (argument.startsWith('--secrets-file=')) {
+            secretsFile = absoluteFilePath('--secrets-file', argument.slice('--secrets-file='.length));
+        }
         else if (argument === '--format') {
             format = lintFormat(rest[++index]);
         }
@@ -75,9 +82,10 @@ export function parseArgs(argv) {
     if ((port !== undefined ||
         host !== undefined ||
         sessionFile !== undefined ||
-        credentialFile !== undefined) &&
+        credentialFile !== undefined ||
+        secretsFile !== undefined) &&
         command !== 'dev') {
-        throw new Error('`--port`, `--host`, `--session-file`, and `--credential-file` are only valid for `dev`.');
+        throw new Error('`--port`, `--host`, `--session-file`, `--credential-file`, and `--secrets-file` are only valid for `dev`.');
     }
     if (environment !== undefined && !['dev', 'deploy'].includes(command ?? '')) {
         throw new Error('`--environment` is only valid for dev or deploy.');
@@ -97,6 +105,7 @@ export function parseArgs(argv) {
                 ...(host !== undefined ? { host } : {}),
                 ...(sessionFile !== undefined ? { sessionFile } : {}),
                 ...(credentialFile !== undefined ? { credentialFile } : {}),
+                ...(secretsFile !== undefined ? { secretsFile } : {}),
             };
         case 'deploy': {
             if (positionals.length > 1)

package/dist/tooling/cli/development/develop.d.ts

@@ -6,4 +6,5 @@ export declare function develop(input: {
     readonly environment: string;
     readonly overrides: DevelopmentOverrides;
     readonly sessionFile?: string;
+    readonly secretsFile?: string;
 }): Promise<number>;

package/dist/tooling/cli/development/develop.js

@@ -4,7 +4,7 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { admitRuntime, compile, isDeployment, resolveRuntime, verifyPreflight, } from '../../../deployment/index.js';
 import { addressing, assemble } from '../../../deployment/release/index.js';
-import { loadDeclaredSecrets } from '../dotenv.js';
+import { loadDeclaredSecrets, loadPrivateSecretsFile } from '../dotenv.js';
 import { error, info } from '../log.js';
 import { DevelopmentLifecycle } from './lifecycle.js';
 import { acquireProjectLock } from './project-lock.js';
@@ -30,8 +30,11 @@ export async function develop(input) {
             projectRoot: input.projectDir,
             environment: input.environment,
         });
+        const overrideSecrets = input.secretsFile === undefined
+            ? undefined
+            : Object.freeze(loadPrivateSecretsFile(input.secretsFile));
         const runtimePath = await discoverRuntimePath(input.configPath);
-        const builder = new ProjectBuilder({ ...input, runtimePath });
+        const builder = new ProjectBuilder({ ...input, runtimePath, overrideSecrets });
         let current = await builder.prepare(lifecycle.signal);
         let sessionEvidence;
         let placementReady = false;
@@ -261,12 +264,14 @@ class ProjectBuilder {
     #projectDir;
     #environment;
     #runtimePath;
+    #overrideSecrets;
     #generation = 0;
     constructor(input) {
         this.#configPath = input.configPath;
         this.#projectDir = input.projectDir;
         this.#environment = input.environment;
         this.#runtimePath = input.runtimePath;
+        this.#overrideSecrets = input.overrideSecrets;
     }
     async prepare(signal) {
         throwIfAborted(signal);
@@ -320,7 +325,9 @@ class ProjectBuilder {
                 runtime: resolved,
             });
             const artifact = verifyPreflight({ build, runtime: resolved, source });
-            const declared = secretsFor(adapter, parameters, this.#projectDir, resolved.runtime);
+            const declared = this.#overrideSecrets === undefined
+                ? secretsFor(adapter, parameters, this.#projectDir, resolved.runtime)
+                : { values: this.#overrideSecrets };
             const sources = new Set();
             for (const path of Object.keys(built.metafile?.inputs ?? {})) {
                 const absolute = isAbsolute(path) ? path : resolve(this.#projectDir, path);

package/dist/tooling/cli/dotenv.d.ts

@@ -15,3 +15,5 @@
  * that exists but holds no keys is legitimate (a domain with no secrets yet).
  */
 export declare function loadDeclaredSecrets(path: string, declaration: string): Record<string, string>;
+/** Load one explicit development-session secret snapshot without following a leaf symlink. */
+export declare function loadPrivateSecretsFile(path: string, platform?: NodeJS.Platform): Record<string, string>;

package/dist/tooling/cli/dotenv.js

@@ -7,7 +7,7 @@
  * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
  * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
  */
-import { readFileSync } from 'node:fs';
+import { closeSync, constants, fstatSync, openSync, readFileSync } from 'node:fs';
 function parseDotenv(contents) {
     const out = {};
     for (const raw of contents.split('\n')) {
@@ -52,3 +52,34 @@ export function loadDeclaredSecrets(path, declaration) {
     }
     return parseDotenv(contents);
 }
+/** Load one explicit development-session secret snapshot without following a leaf symlink. */
+export function loadPrivateSecretsFile(path, platform = process.platform) {
+    if (platform === 'win32') {
+        throw new Error('--secrets-file is unavailable on Windows until private no-reparse file admission is supported.');
+    }
+    let descriptor;
+    try {
+        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (cause) {
+        if (cause instanceof Error && 'code' in cause && cause.code === 'ENOENT') {
+            throw new Error(`Secrets file '${path}' is missing.`, { cause });
+        }
+        if (cause instanceof Error && 'code' in cause && cause.code === 'ELOOP') {
+            throw new Error(`Secrets file '${path}' must be a regular file and not a symlink.`, { cause });
+        }
+        throw cause;
+    }
+    try {
+        const info = fstatSync(descriptor);
+        if (!info.isFile())
+            throw new Error(`Secrets file '${path}' must be a regular file.`);
+        if ((info.mode & 0o077) !== 0) {
+            throw new Error(`Secrets file '${path}' must not be accessible by group or other users.`);
+        }
+        return parseDotenv(readFileSync(descriptor, 'utf8'));
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}

package/dist/tooling/cli/help.js

@@ -48,6 +48,8 @@ Options:
   --credential-file <path>
                           Use one private operator credential for adapter-owned Kernel
                           calls without exposing it in project configuration.
+  --secrets-file <path>   Load one private, absolute secrets file for this development
+                          session instead of the adapter-declared secrets file.
   -h, --help              Show help for dev.
 
 Behavior:
@@ -61,6 +63,9 @@ Behavior:
   installed Release evidence.
   A credential file is read only by the installation-owning adapter. Its value is
   never forwarded to the Domain runtime or written to the session file.
+  A secrets-file override is read once, passed to the Domain runtime as secrets,
+  never mutates the authored project, and is not watched for later changes. It is
+  currently unavailable on Windows because private no-reparse admission is absent.
 
 Adapters:
   cloudflare              Runs the local Worker and optional Vite frontend only;

package/dist/tooling/cli/orchestrate.js

@@ -97,6 +97,7 @@ export function executeDevelopmentCommand(parsed, input, execute = develop) {
             ...(parsed.credentialFile === undefined ? {} : { credentialFile: parsed.credentialFile }),
         }),
         ...(parsed.sessionFile === undefined ? {} : { sessionFile: parsed.sessionFile }),
+        ...(parsed.secretsFile === undefined ? {} : { secretsFile: parsed.secretsFile }),
     });
 }
 async function lint(parsed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.90",
+  "version": "0.5.0-beta.92",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -217,11 +217,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.33",
-    "@astrale-os/kernel-core": "0.9.0-beta.25",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.18",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.26",
-    "@astrale-os/kernel-server": "0.5.0-beta.28",
+    "@astrale-os/kernel-client": "0.6.0-beta.35",
+    "@astrale-os/kernel-core": "0.9.0-beta.27",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.20",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.28",
+    "@astrale-os/kernel-server": "0.5.0-beta.30",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "hono": "^4.13.2",
     "jose": "^6.2.9",