@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.14

package/dist/tooling/cli/development/develop.js

@@ -1,7 +1,5 @@
 import { rm, rmdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import { resolveAstraleInstanceIssuer } from '../astrale/instance.js';
-import { resolveCompatibleAstrale } from '../astrale/version.js';
 import { loadPrivateCredentialFile } from '../credential.js';
 import { deprecationWarnings } from '../deprecations.js';
 import { loadPrivateSecretsFile } from '../dotenv.js';
@@ -11,31 +9,21 @@ import { deployDevelopmentCandidate } from './deployment.js';
 import { DevelopmentLifecycle } from './lifecycle.js';
 import { acquireProjectLock } from './project-lock.js';
 import { LatestRebuild } from './rebuild.js';
-import { developmentReleaseEvidence } from './release-evidence.js';
 import { reportDevelopmentDeployment } from './report.js';
-import { DevelopmentSessionFileWriter } from './session-file.js';
 import { watchSources } from './source-watch.js';
-import { acquireDevelopmentTargetLock } from './target-lock.js';
-import { DevelopmentView } from './view.js';
-/** Watch one Project Environment and serialize complete remote deployment generations. */
+/**
+ * Watch one Project Environment and serialize complete remote deployment generations. Each
+ * generation replaces the Environment's stable target in place; none installs anything.
+ */
 export async function develop(input) {
     const lifecycle = new DevelopmentLifecycle();
-    let sessionFile;
     let lock;
-    let targetLock;
-    let view;
-    let installationExecutable;
-    let installationIssuer;
     let sourceWatch;
     let rebuild;
     let current;
-    let lastEvidence;
     let failure;
     const cleanup = [];
     try {
-        if (input.sessionFile !== undefined) {
-            sessionFile = await DevelopmentSessionFileWriter.create(input.sessionFile);
-        }
         lock = await acquireProjectLock({
             projectRoot: input.projectDir,
             environment: input.environment,
@@ -53,53 +41,15 @@ export async function develop(input) {
             overrideSecrets,
         });
         current = await builder.prepare(lifecycle.signal);
-        if (credential !== undefined && current.installation?.identity !== undefined) {
-            throw new TypeError('--credential-file cannot be combined with the Environment installation identity.');
-        }
-        if (sessionFile !== undefined && (current.installation === undefined || input.deployOnly)) {
-            throw new TypeError('--session-file requires an Environment installation that is active for this development session.');
-        }
         info(`Domain: ${current.artifact.build.schema.compiled.root.origin}`);
         for (const warning of deprecationWarnings(current.artifact.build))
             warn(warning);
-        if (current.installation !== undefined && !input.deployOnly) {
-            installationExecutable = await resolveCompatibleAstrale({
-                projectDir: input.projectDir,
-                signal: lifecycle.signal,
-            });
-            installationIssuer = await resolveAstraleInstanceIssuer({
-                executable: installationExecutable,
-                projectDir: input.projectDir,
-                instance: current.installation.instance,
-                signal: lifecycle.signal,
-            });
-            targetLock = await acquireDevelopmentTargetLock({
-                issuer: installationIssuer,
-                origin: current.artifact.build.schema.compiled.root.origin,
-            });
-            view = new DevelopmentView({
-                executable: installationExecutable,
-                projectDir: input.projectDir,
-                instance: current.installation.instance,
-                ...(credential === undefined
-                    ? { identity: input.identity ?? current.installation.identity }
-                    : { credential }),
-            });
-            if (current.artifact.build.frontend !== undefined)
-                await view.prepare(lifecycle.signal);
-        }
-        const first = await deployDevelopmentCandidate(current, { ...input, credential, installationExecutable }, lifecycle.signal);
-        lastEvidence =
-            first.installation === undefined ? undefined : developmentReleaseEvidence(first.installation);
-        await sessionFile?.transition('ready', lastEvidence);
-        reportDevelopmentDeployment(first.deployment, first.installation, current.adapter, input);
-        await refreshView(view, first.deployment.release, lifecycle.signal);
+        const first = await deployDevelopmentCandidate(current, { ...input, ...(credential === undefined ? {} : { credential }) }, lifecycle.signal);
+        reportDevelopmentDeployment(first, current.adapter, input);
         let restartReported = false;
         rebuild = new LatestRebuild({
             async prepare(_ignored, signal) {
                 info(`Rebuilding: ${input.environment}`);
-                if (lastEvidence !== undefined)
-                    await sessionFile?.transition('updating', lastEvidence);
                 return builder.prepare(signal);
             },
             async commit(candidate, signal) {
@@ -109,45 +59,17 @@ export async function develop(input) {
                 }
                 if (sameDeploymentCandidate(current, candidate)) {
                     current = candidate;
-                    await sessionFile?.transition('ready', lastEvidence);
                     sourceWatch?.update(candidate.sources);
                     return;
                 }
-                if (installationIssuer !== undefined && candidate.installation !== undefined) {
-                    await resolveAstraleInstanceIssuer({
-                        executable: installationExecutable,
-                        projectDir: input.projectDir,
-                        instance: candidate.installation.instance,
-                        expectedIssuer: installationIssuer,
-                        signal,
-                    });
-                }
-                if (candidate.artifact.build.frontend !== undefined)
-                    await view?.prepare(signal);
-                const deployed = await deployDevelopmentCandidate(candidate, { ...input, credential, installationExecutable }, signal);
+                const deployed = await deployDevelopmentCandidate(candidate, { ...input, ...(credential === undefined ? {} : { credential }) }, signal);
                 current = candidate;
-                lastEvidence =
-                    deployed.installation === undefined
-                        ? undefined
-                        : developmentReleaseEvidence(deployed.installation);
-                await sessionFile?.transition('ready', lastEvidence);
                 sourceWatch?.update(candidate.sources);
                 info(`Updated: ${candidate.artifact.build.schema.compiled.root.revision}`);
-                reportDevelopmentDeployment(deployed.deployment, deployed.installation, candidate.adapter, input);
-                await refreshView(view, deployed.deployment.release, signal);
+                reportDevelopmentDeployment(deployed, candidate.adapter, input);
             },
             async failed(cause) {
                 error(cause instanceof Error ? cause.message : String(cause));
-                if (lastEvidence === undefined)
-                    return;
-                try {
-                    await sessionFile?.transition('recovering', lastEvidence);
-                }
-                catch (sessionCause) {
-                    const terminal = new AggregateError([cause, sessionCause], 'Development rebuild failed and session evidence could not be recovered.');
-                    failure ??= terminal;
-                    lifecycle.stop(terminal);
-                }
             },
         });
         sourceWatch = watchSources({
@@ -176,21 +98,13 @@ export async function develop(input) {
         failure = cause;
     }
     lifecycle.stop(failure);
-    try {
-        await sessionFile?.transition('stopping', lastEvidence);
-    }
-    catch (cause) {
-        failure ??= cause;
-    }
     for (const operation of [
         () => sourceWatch?.stop(),
         () => rebuild?.stop(failure),
-        () => view?.close(AbortSignal.timeout(30_000)),
         () => rm(join(input.projectDir, '.astrale', 'development', input.environment, 'source'), {
             recursive: true,
             force: true,
         }),
-        () => targetLock?.release(),
         () => lock?.release(),
     ]) {
         try {
@@ -213,12 +127,6 @@ export async function develop(input) {
                 cleanup.push(cause);
         }
     }
-    try {
-        await sessionFile?.transition(failure === undefined && cleanup.length === 0 ? 'stopped' : 'failed');
-    }
-    catch (cause) {
-        cleanup.push(cause);
-    }
     lifecycle.dispose();
     if (failure !== undefined) {
         if (cleanup.length > 0)
@@ -229,15 +137,3 @@ export async function develop(input) {
         throw new AggregateError(cleanup, 'Development cleanup failed.');
     return 0;
 }
-async function refreshView(view, release, signal) {
-    if (view === undefined)
-        return;
-    try {
-        const pageUrl = await view.refresh(release, signal);
-        if (pageUrl !== undefined)
-            info(`View: ${pageUrl}`);
-    }
-    catch (cause) {
-        error(`View unavailable: ${cause instanceof Error ? cause.message : String(cause)}`);
-    }
-}

package/dist/tooling/cli/development/report.d.ts

@@ -1,9 +1,7 @@
 import type { ReadyDeployResult } from '../../../deployment/adapter/index.js';
-import type { InstallationEvidence } from '../installation/index.js';
-export declare function reportDevelopmentDeployment(deployed: ReadyDeployResult, installation: InstallationEvidence | undefined, adapter: {
+export declare function reportDevelopmentDeployment(deployed: ReadyDeployResult, adapter: {
     readonly name: string;
     readonly version: string;
 }, input: {
     readonly environment: string;
-    readonly deployOnly: boolean;
 }): void;

package/dist/tooling/cli/development/report.js

@@ -1,5 +1,5 @@
 import { info } from '../log.js';
-export function reportDevelopmentDeployment(deployed, installation, adapter, input) {
+export function reportDevelopmentDeployment(deployed, adapter, input) {
     info(`Environment: ${input.environment}`);
     info(`Adapter: ${adapter.name}@${adapter.version}`);
     info(`Deployment: ${deployed.progress.provider.evidence.deployment}`);
@@ -8,7 +8,4 @@ export function reportDevelopmentDeployment(deployed, installation, adapter, inp
     }
     info(`Public: ${deployed.release.addressing.publicUrl}`);
     info(`Publication: ${deployed.release.publication.schema.revision} · ${deployed.release.publication.etag}`);
-    info(installation === undefined
-        ? `Installation: skipped${input.deployOnly ? ' (--deploy-only)' : ''}`
-        : `Installation: ${installation.instance} · ${installation.status}`);
 }

package/dist/tooling/cli/help.js

@@ -1,3 +1,4 @@
+import { installCommand } from '../../project/install-command.js';
 import { COMMANDS } from './arguments.js';
 /** Resolve help without parsing a project or performing any command effects. */
 export function helpRequest(argv) {
@@ -20,7 +21,7 @@ Usage:
 Commands:
   dev [environment]       Remotely deploy and watch one Project Environment.
   build                   Build, verify and print the build digest.
-  deploy <environment>    Deploy and optionally install one Environment.
+  deploy <environment>    Deploy one Environment; never installs.
   test                    Run Project tests, optionally against one Environment.
   lint                    Check Domain source and architecture.
   package                 Prepare public declarations for publication.
@@ -65,12 +66,9 @@ Arguments:
 
 Options:
   --environment <name>    Select the environment without a positional argument.
-  --deploy-only           Suppress this run's configured Kernel installation.
-  --as <identity>         Select the Astrale identity for Services and installation calls.
-  --session-file <path>   Write one retained DevelopmentSessionFileV1 snapshot at an
-                          absolute path in a caller-owned private directory.
+  --as <identity>         Select the Astrale identity for the adapter's provider calls.
   --credential-file <path>
-                          Use one private operator credential for provider and Kernel
+                          Use one private operator credential for the adapter's provider
                           calls without exposing it in Project configuration.
   --secrets-file <path>   Load one private, absolute secrets file for this development
                           session instead of the adapter-declared secrets file.
@@ -80,25 +78,23 @@ Behavior:
   The selected Environment must exist; no other Environment is chosen as a fallback.
   Builds and verifies the Domain, Runtime, frontend, and adapter artifact, then
   deploys it through the selected Environment. It never starts a local Worker,
-  Vite server, or tunnel. Imported source changes produce serialized remote updates;
-  configuration changes require restarting the command.
+  Vite server, or tunnel, and never installs the Domain: install the URL it prints with
+  ${installCommand()}. Imported source changes
+  produce serialized remote updates; configuration changes require restarting the
+  command. It serves only legacy direct-mode Environments; an Environment that
+  deploys immutable deployments is refused.
   A shared direct-provider target additionally requires an external single-writer
   boundary such as a CI/CD concurrency group.
-  The session file is machine-readable and authoritative when requested; human
-  stdout/stderr remains diagnostic. It requires an adapter that reports exact
-  installed Release evidence, so it is rejected for an Environment without an
-  installation and when --deploy-only suppresses installation.
   A credential file is admitted and read once. Its value is passed only to the
-  deployment adapter, configured Kernel installation, and default View; it never
-  enters Domain Runtime secrets, diagnostics, deployment evidence, or the session
-  file. It is currently unavailable on Windows because private no-reparse file
-  admission is absent.
+  deployment adapter; it never enters Domain Runtime secrets or diagnostics. It is
+  currently unavailable on Windows because private no-reparse file admission is
+  absent.
   A secrets-file override is read once, passed to the Domain runtime as secrets,
   never mutates the authored project, and is not watched for later changes. It is
   also unavailable on Windows because private no-reparse admission is absent.
 
   Stopping the watcher stops only local build orchestration. The remote deployment
-  and optional Kernel installation remain available.
+  remains available.
 `,
     build: `Build and verify a Domain without deploying it, and print its build digest.
 
@@ -129,20 +125,26 @@ Arguments:
 Options:
   --environment <name>    Select the environment without a positional argument.
   --json                  Print one DeployResultV1 on stdout; progress goes to stderr.
-  --deploy-only           Suppress this run's configured Kernel installation.
-  --as <identity>         Select the Astrale identity for Services and installation calls.
+  --as <identity>         Select the Astrale identity for the adapter's provider calls.
   -h, --help              Show help for deploy.
 
 Behavior:
-  Builds and verifies the Domain, Runtime, and provider artifact, loads declared
-  secrets, and invokes the selected adapter. It then verifies the resulting Release.
-  When the adapter has a bundler, deploy rebuilds the Bundle exactly as build does and
-  warns when the uploaded code has another build digest.
-  When the Environment declares installation, reconciles it after provider readiness.
-  An Environment without installation performs zero Kernel calls.
+  Builds and verifies the Domain and Runtime, rebuilds the Bundle exactly as build
+  does, loads declared secrets, and deploys through the selected adapter. It never
+  installs the Domain: install the URL it prints with
+  ${installCommand()}.
+  The Environment's configuration selects how it deploys. An adapter that implements
+  deployRelease makes one immutable deployment per release with no Kernel call: the
+  SDK seals the release for the deployment's URL, records the commit it was built
+  from, and the adapter creates that deployment or reuses it. Any other Environment
+  replaces its stable target in place (legacy direct mode, deprecated), warns on
+  stderr, serves a v3 Publication only, and warns when the uploaded code has another
+  build digest than the Bundle. Among those, adapter-astrale's instance mode still
+  calls the Services of its instance through that instance's Kernel, and installs
+  the Services Domain there when it is missing.
   With --json, stdout holds only one DeployResultV1: the deployment's URL, which
   astrale domain install takes, its digests, adapter and state. Exit status: 0 deployed,
-  1 failed, 2 usage error; a failed run prints nothing on stdout.
+  1 failed or refused, 2 usage error; a failed run prints nothing on stdout.
 `,
     test: `Run Project tests locally or against one selected Environment.
 

package/dist/tooling/cli/immutable-deployment.d.ts

@@ -0,0 +1,27 @@
+import type { Adapter, Build, LegacyAdapter, ResolvedRuntimeReference } from '../../deployment/index.js';
+import type { DeployResultV1 } from './deploy-result.js';
+/**
+ * Deploy one canonical Environment (CT33) as the immutable deployment of one sealed release.
+ *
+ * The SDK derives everything before the adapter's only effectful call: it bundles exactly as
+ * `astrale-domain build` does, asks the adapter to freeze the Environment's configuration and say
+ * where its host places deployments, derives the deployment label and URL from them (S3), seals
+ * the `DomainRelease` v4 the deployment serves at that URL (S4a), and reads the commit it is built
+ * from. `deployRelease` then creates that deployment or reuses it. The SDK makes no Kernel call,
+ * the deploy calls no instance and installs nothing: `astrale domain install <url>` installs the
+ * URL it prints.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ */
+export declare function deployImmutable(input: {
+    readonly projectDir: string;
+    readonly environment: string;
+    /** A canonical Environment's adapter (CT33), which implements adapter interface v2. */
+    readonly adapter: Adapter<object> | LegacyAdapter<object>;
+    readonly parameters: object;
+    readonly build: Build;
+    readonly runtime: ResolvedRuntimeReference;
+    readonly identity?: string;
+    readonly signal: AbortSignal;
+    readonly report: (line: string) => void;
+}): Promise<DeployResultV1 | undefined>;

package/dist/tooling/cli/immutable-deployment.js

@@ -0,0 +1,95 @@
+import { resolve } from 'node:path';
+import { deploymentContent, deploymentLabel, deploymentLine, deploymentUrl, } from '../../deployment/address/index.js';
+import { assemble } from '../../deployment/index.js';
+import { bundleBuild } from './build.js';
+import { deploymentCommit } from './commit.js';
+import { deployResult } from './deploy-result.js';
+import { error } from './log.js';
+import { environmentSecrets } from './secrets.js';
+/**
+ * Deploy one canonical Environment (CT33) as the immutable deployment of one sealed release.
+ *
+ * The SDK derives everything before the adapter's only effectful call: it bundles exactly as
+ * `astrale-domain build` does, asks the adapter to freeze the Environment's configuration and say
+ * where its host places deployments, derives the deployment label and URL from them (S3), seals
+ * the `DomainRelease` v4 the deployment serves at that URL (S4a), and reads the commit it is built
+ * from. `deployRelease` then creates that deployment or reuses it. The SDK makes no Kernel call,
+ * the deploy calls no instance and installs nothing: `astrale domain install <url>` installs the
+ * URL it prints.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ */
+export async function deployImmutable(input) {
+    const { parameters, environment, build, signal } = input;
+    const adapter = releaseAdapter(input.adapter);
+    const identity = input.identity === undefined ? {} : { identity: input.identity };
+    const bundle = await bundleBuild({
+        bundler: adapter.bundler,
+        projectDir: input.projectDir,
+        build,
+        runtime: input.runtime,
+        signal,
+    });
+    const secrets = environmentSecrets(adapter, parameters, input.projectDir, input.runtime.runtime);
+    const configuration = adapter.configure(parameters, {
+        environment,
+        secrets: Object.freeze(Object.keys(secrets).sort()),
+    });
+    const placement = await adapter.placement(parameters, { environment, signal, ...identity });
+    const origin = build.schema.compiled.root.origin;
+    const label = deploymentLabel(deploymentLine({ origin, environment, addressing: placement.addressing }), deploymentContent(bundle.digest, configuration));
+    const release = assemble(build, bundle.digest, deploymentUrl(label, placement.routingDomain));
+    const commit = await deploymentCommit({
+        projectDir: input.projectDir,
+        // The configuration sits in the Project directory, and names its runtime relative to it.
+        runtimeModule: resolve(input.projectDir, input.runtime.reference.path),
+        signal,
+    });
+    const deployed = await adapter.deployRelease(parameters, {
+        projectDir: input.projectDir,
+        environment,
+        ...identity,
+        secrets,
+        bundle,
+        configuration,
+        placement,
+        label,
+        release,
+        commit,
+        signal,
+    });
+    if (deployed.status !== 'ready') {
+        error(`Deployment failed during ${deployed.phase}: ${deployed.error.message}`);
+        return undefined;
+    }
+    const result = deployResult({ environment, adapter, release, deployment: deployed });
+    input.report(`Domain: ${result.origin}`);
+    input.report(`Environment: ${environment}`);
+    input.report(`Adapter: ${result.deployment.adapter}`);
+    input.report(`Deployment: ${label} · ${result.deployment.state}`);
+    input.report(`URL: ${result.url}`);
+    input.report(`Release: ${release.document.digest}`);
+    input.report(`Build: ${release.buildDigest}`);
+    input.report(secretsLine(label, result.secrets.state));
+    input.report('Ready: deployment verified');
+    return result;
+}
+/**
+ * What the deploy did to the secrets of the one deployment it made or reused: `bound` to the new
+ * deployment, or `updated` or left `unchanged` in place on the reused one. No other deployment's
+ * secrets are ever written. A value rewritten in place is served once the host propagated it,
+ * which is eventually consistent (about 4 s on Workers for Platforms, AM-114).
+ */
+function secretsLine(label, state) {
+    return state === 'updated'
+        ? `Secrets: updated in place on ${label}; the new values are served once propagated ` +
+            '(eventually consistent, about 4 s)'
+        : `Secrets: ${state}`;
+}
+/** The adapter of a canonical Environment: CT33 selects canonical only beside `deployRelease`. */
+function releaseAdapter(adapter) {
+    if (!('deployRelease' in adapter) || typeof adapter.deployRelease !== 'function') {
+        throw new TypeError(`Adapter ${adapter.name}@${adapter.version} implements no deployRelease and deploys no immutable deployment.`);
+    }
+    return adapter;
+}

package/dist/tooling/cli/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | test | lint | package), explicit dotenv boundary, and admitted
- * development-session file representation.
+ * (dev | build | deploy | test | lint | package), its JSON results, and the explicit dotenv
+ * boundary.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
@@ -14,5 +14,3 @@ export { run } from './run.js';
 export type { BuildResultV1 } from './build.js';
 export type { DeployResultV1, DeploymentSecretsState } from './deploy-result.js';
 export { loadDeclaredSecrets } from './dotenv.js';
-export { DEVELOPMENT_SESSION_FILE_VERSION, acceptDevelopmentSessionFileV1, } from './development/session-file.js';
-export type { DevelopmentSessionFileV1, DevelopmentSessionPhaseV1, DevelopmentSessionProjectV1, DevelopmentSessionReleaseV1, } from './development/session-file.js';

package/dist/tooling/cli/index.js

@@ -1,7 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | test | lint | package), explicit dotenv boundary, and admitted
- * development-session file representation.
+ * (dev | build | deploy | test | lint | package), its JSON results, and the explicit dotenv
+ * boundary.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
@@ -12,4 +12,3 @@
  */
 export { run } from './run.js';
 export { loadDeclaredSecrets } from './dotenv.js';
-export { DEVELOPMENT_SESSION_FILE_VERSION, acceptDevelopmentSessionFileV1, } from './development/session-file.js';

package/dist/tooling/cli/legacy/deploy-result.d.ts

@@ -12,9 +12,11 @@ import type { DeployResultV1 } from '../deploy-result.js';
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployResult`, the result of an
  * immutable deployment. Consumers: the direct-mode configurations of domains ai-gateway, closing,
- * grc, integrations and issues (until SV15), shell (until SH2), the Services `development`
- * environment (until SV9) and ui:domain (until UI1). Deleted with the legacy deploy path (D10),
- * once no supported configuration selects it (CT33).
+ * grc, integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ * AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ * `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until D22),
+ * and ui:domain (until UI1). Deleted with the legacy deploy path (D10), once no configuration on
+ * any repository's main selects it (CT33, AM-147).
  */
 export declare function stableTargetDeployResult(input: {
     readonly environment: string;

package/dist/tooling/cli/legacy/deploy-result.js

@@ -10,9 +10,11 @@
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployResult`, the result of an
  * immutable deployment. Consumers: the direct-mode configurations of domains ai-gateway, closing,
- * grc, integrations and issues (until SV15), shell (until SH2), the Services `development`
- * environment (until SV9) and ui:domain (until UI1). Deleted with the legacy deploy path (D10),
- * once no supported configuration selects it (CT33).
+ * grc, integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ * AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ * `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until D22),
+ * and ui:domain (until UI1). Deleted with the legacy deploy path (D10), once no configuration on
+ * any repository's main selects it (CT33, AM-147).
  */
 export function stableTargetDeployResult(input) {
     const { publication, addressing } = input.deployment.release;

package/dist/tooling/cli/legacy/stable-target-adapter.d.ts

@@ -5,9 +5,11 @@ import type { Adapter, LegacyAdapter } from '../../../deployment/adapter/index.j
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployRelease` of adapter interface
  * v2. Consumers: `astrale-domain deploy` and `astrale-domain dev` on the direct-mode
- * configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15), shell
- * (until SH2), the Services `development` environment (until SV9) and ui:domain (until UI1).
- * Deleted with the legacy deploy path (D10), once no supported configuration selects it (CT33).
+ * configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15), domains
+ * organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until SV12),
+ * `development` (until SV9) and frozen `admin-beta` (until D19) environments, shell (until SH2)
+ * and its frozen `legacy-v3` (until D22), and ui:domain (until UI1). Deleted with the legacy
+ * deploy path (D10), once no configuration on any repository's main selects it (CT33, AM-147).
  */
 export type StableTargetAdapter<Parameters extends object = object> = (Adapter<Parameters> | LegacyAdapter<Parameters>) & Pick<LegacyAdapter<Parameters>, 'prepare' | 'deploy'>;
 /**

package/dist/tooling/cli/legacy/stable-target-deploy.d.ts

@@ -0,0 +1,42 @@
+import type { Build, ResolvedRuntimeReference } from '../../../deployment/index.js';
+import type { LegacyDirectReason } from '../deploy-mode.js';
+import type { DeployResultV1 } from '../deploy-result.js';
+import type { LoadedEnvironment } from '../project.js';
+/**
+ * What a direct-mode deploy prints on stderr before any effect (AM-59): its Environment replaces
+ * one stable target in place and serves a v3 Publication only, which the deployment model
+ * replaces with one immutable deployment per release.
+ *
+ * @deprecated Stable-target deploy path only; see `deployStableTarget`.
+ */
+export declare function directModeDeprecation(environment: string, reasons: readonly LegacyDirectReason[]): string;
+/**
+ * Deploy one Environment on the legacy direct-mode path (CT33): bundle exactly as
+ * `astrale-domain build` does, let `prepare` place that Bundle at the Environment's stable target
+ * and `deploy` replace the code it runs, then verify the v3 Publication it serves. It warns first,
+ * then behaves exactly as before. The SDK never installs the deployed Domain here and makes no
+ * Kernel call of its own; adapter-astrale's instance mode still calls the Services of its instance
+ * through that instance's Kernel, and installs the Services Domain there when it is missing.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ *
+ * @deprecated Stable-target deploy path only. Replacement: `deployImmutable`, the immutable
+ * deployment of one sealed release through `deployRelease`. Consumers: the direct-mode
+ * configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15), domains
+ * organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until SV12),
+ * `development` (until SV9) and frozen `admin-beta` (until D19) environments, shell (until SH2)
+ * and its frozen `legacy-v3` (until D22), ui:domain (until UI1), and adapter-astrale's instance
+ * mode until adapter-astrale implements deployRelease (S8). Deleted with the legacy deploy path
+ * (D10), once no configuration on any repository's main selects it (CT33, AM-147).
+ */
+export declare function deployStableTarget(input: {
+    readonly projectDir: string;
+    readonly environment: string;
+    readonly definition: LoadedEnvironment;
+    readonly reasons: readonly LegacyDirectReason[];
+    readonly build: Build;
+    readonly runtime: ResolvedRuntimeReference;
+    readonly identity?: string;
+    readonly signal: AbortSignal;
+    readonly report: (line: string) => void;
+}): Promise<DeployResultV1 | undefined>;