@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.14

package/dist/tooling/cli/legacy/stable-target-deploy.js

@@ -0,0 +1,104 @@
+import { verifyDeployment, verifyPreflight } from '../../../deployment/index.js';
+import { bundleBuild } from '../build.js';
+import { error, warn } from '../log.js';
+import { environmentSecrets } from '../secrets.js';
+import { stableTargetDeployResult } from './deploy-result.js';
+import { stableTargetAdapter } from './stable-target-adapter.js';
+import { stableTargetBuildWarning } from './uploaded-build.js';
+/**
+ * What a direct-mode deploy prints on stderr before any effect (AM-59): its Environment replaces
+ * one stable target in place and serves a v3 Publication only, which the deployment model
+ * replaces with one immutable deployment per release.
+ *
+ * @deprecated Stable-target deploy path only; see `deployStableTarget`.
+ */
+export function directModeDeprecation(environment, reasons) {
+    const selected = reasons.map((reason) => {
+        if (reason.reason === 'direct-parameter')
+            return reason.parameter;
+        return reason.reason === 'no-namespace' ? 'no namespace' : 'no deployRelease';
+    });
+    return (`Environment ${environment} deploys in direct mode (${selected.join(', ')}), which is ` +
+        'deprecated and will be removed: it replaces one stable target in place and serves a v3 ' +
+        'Publication only. Its replacement deploys one immutable deployment per release, through an ' +
+        'adapter that implements deployRelease.');
+}
+/**
+ * Deploy one Environment on the legacy direct-mode path (CT33): bundle exactly as
+ * `astrale-domain build` does, let `prepare` place that Bundle at the Environment's stable target
+ * and `deploy` replace the code it runs, then verify the v3 Publication it serves. It warns first,
+ * then behaves exactly as before. The SDK never installs the deployed Domain here and makes no
+ * Kernel call of its own; adapter-astrale's instance mode still calls the Services of its instance
+ * through that instance's Kernel, and installs the Services Domain there when it is missing.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ *
+ * @deprecated Stable-target deploy path only. Replacement: `deployImmutable`, the immutable
+ * deployment of one sealed release through `deployRelease`. Consumers: the direct-mode
+ * configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15), domains
+ * organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until SV12),
+ * `development` (until SV9) and frozen `admin-beta` (until D19) environments, shell (until SH2)
+ * and its frozen `legacy-v3` (until D22), ui:domain (until UI1), and adapter-astrale's instance
+ * mode until adapter-astrale implements deployRelease (S8). Deleted with the legacy deploy path
+ * (D10), once no configuration on any repository's main selects it (CT33, AM-147).
+ */
+export async function deployStableTarget(input) {
+    const { build, signal, report } = input;
+    warn(directModeDeprecation(input.environment, input.reasons));
+    const adapter = stableTargetAdapter(input.definition.deployment.adapter);
+    const parameters = input.definition.deployment.parameters;
+    // `deploy` rebuilds exactly as `build` does; preparation then only places that Bundle.
+    const bundle = await bundleBuild({
+        bundler: adapter.bundler,
+        projectDir: input.projectDir,
+        build,
+        runtime: input.runtime,
+        signal,
+    });
+    const source = await adapter.prepare(parameters, {
+        projectDir: input.projectDir,
+        environment: input.environment,
+        mode: 'release',
+        signal,
+        build,
+        runtime: input.runtime,
+        bundle,
+    });
+    const artifact = verifyPreflight({ build, runtime: input.runtime, source });
+    const secrets = environmentSecrets(adapter, parameters, input.projectDir, input.runtime.runtime);
+    const deployed = await adapter.deploy(parameters, {
+        projectDir: input.projectDir,
+        environment: input.environment,
+        ...(input.identity === undefined ? {} : { identity: input.identity }),
+        secrets,
+        artifact,
+        signal,
+    });
+    const result = verifyDeployment(artifact, deployed);
+    if (result.status === 'failed') {
+        error(`Deployment failed during ${result.phase}: ${result.error.message}`);
+        return undefined;
+    }
+    const uploaded = result.progress.provider.evidence.build;
+    if (uploaded !== undefined) {
+        // prepare/deploy places a stable target: a differing upload only warns.
+        const warning = stableTargetBuildWarning(bundle, uploaded);
+        if (warning !== undefined)
+            warn(warning);
+    }
+    report(`Domain: ${result.release.publication.origin}`);
+    report(`Environment: ${input.environment}`);
+    report(`Adapter: ${adapter.name}@${adapter.version}`);
+    report(`Deployment: ${result.progress.provider.evidence.deployment}`);
+    if (result.progress.provider.evidence.preflight !== undefined) {
+        report(`Preflight: ${result.progress.provider.evidence.preflight}; public readiness verified`);
+    }
+    report(`Public: ${result.release.addressing.publicUrl}`);
+    report(`Publication: ${result.release.publication.schema.revision} · ${result.release.publication.etag}`);
+    report('Ready: deployment verified');
+    return stableTargetDeployResult({
+        environment: input.environment,
+        adapter,
+        deployment: result,
+    });
+}

package/dist/tooling/cli/orchestrate.js

@@ -1,19 +1,16 @@
 import { existsSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { admitRuntime, compile, resolveRuntime, verifyDeployment, verifyPreflight, } from '../../deployment/index.js';
+import { dirname, join, resolve } from 'node:path';
+import { admitRuntime, compile, resolveRuntime } from '../../deployment/index.js';
 import { packageDomain } from '../packaging/index.js';
 import { parseArgs } from './arguments.js';
-import { resolveCompatibleAstrale } from './astrale/version.js';
 import { buildResult, bundleBuild, bundlerCopyWarnings, projectBundlers } from './build.js';
 import { BunRequiredError } from './bun.js';
+import { selectDeployMode } from './deploy-mode.js';
 import { deprecationWarnings } from './deprecations.js';
 import { develop } from './development/develop.js';
-import { loadDeclaredSecrets } from './dotenv.js';
-import { reconcileEnvironmentRelease } from './environment-release.js';
 import { ERROR_USAGE, helpRequest, helpText } from './help.js';
-import { stableTargetDeployResult } from './legacy/deploy-result.js';
-import { stableTargetAdapter } from './legacy/stable-target-adapter.js';
-import { stableTargetBuildWarning } from './legacy/uploaded-build.js';
+import { deployImmutable } from './immutable-deployment.js';
+import { deployStableTarget } from './legacy/stable-target-deploy.js';
 import { error, info, progress, warn } from './log.js';
 import { importModule, loadProject, runtimeEntrypoint, selectEnvironment } from './project.js';
 import { executeTests } from './test.js';
@@ -60,10 +57,18 @@ export async function run(argv) {
         error(`No astrale.config.ts found in ${projectDir}.`);
         return 1;
     }
+    const project = await loadProject(configPath);
     if (parsed.command === 'dev') {
+        // `dev` deploys only legacy direct-mode Environments; any other is refused before any effect.
+        const mode = selectDeployMode({
+            command: 'dev',
+            environment: parsed.env,
+            definition: selectEnvironment(project, parsed.env),
+        });
+        if (refused(mode))
+            return 1;
         return executeDevelopmentCommand(parsed, { configPath, projectDir });
     }
-    const project = await loadProject(configPath);
     if (parsed.command === 'test') {
         selectEnvironment(project, parsed.env);
         return executeTests({
@@ -111,97 +116,56 @@ export async function run(argv) {
         }
     }
     const environment = selectEnvironment(project, parsed.env);
+    // The configuration selects the deploy mode, before any effect (CT33).
+    const mode = selectDeployMode({
+        command: 'deploy',
+        environment: parsed.env,
+        definition: environment,
+    });
+    if (refused(mode))
+        return 1;
     // With `--json`, stdout carries only the DeployResultV1; progress goes to stderr.
     const report = progress(parsed.json === true);
-    const adapter = stableTargetAdapter(environment.deployment.adapter);
-    const parameters = environment.deployment.parameters;
     const lifecycle = deploymentLifecycle();
     try {
-        // `deploy` rebuilds exactly as `build` does; preparation then only places that Bundle.
-        const bundle = await bundleBuild({
-            bundler: adapter.bundler,
-            projectDir,
-            build,
-            runtime: resolved,
-            signal: lifecycle.signal,
-        });
-        const source = await adapter.prepare(parameters, {
+        const deployment = {
             projectDir,
             environment: parsed.env,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
-            mode: 'release',
-            signal: lifecycle.signal,
             build,
             runtime: resolved,
-            bundle,
-        });
-        const artifact = verifyPreflight({ build, runtime: resolved, source });
-        const secrets = secretsFor(adapter, parameters, projectDir, resolved.runtime);
-        const installationExecutable = environment.installation === undefined || parsed.deployOnly
-            ? undefined
-            : await resolveCompatibleAstrale({ projectDir, signal: lifecycle.signal });
-        const deployed = await adapter.deploy(parameters, {
-            projectDir,
-            environment: parsed.env,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
             ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
-            secrets,
-            artifact,
             signal: lifecycle.signal,
-        });
-        const result = verifyDeployment(artifact, deployed);
-        if (result.status === 'failed') {
-            error(`Deployment failed during ${result.phase}: ${result.error.message}`);
-            return 1;
-        }
-        const uploaded = result.progress.provider.evidence.build;
-        if (uploaded !== undefined) {
-            // prepare/deploy places a stable target: a differing upload only warns.
-            const warning = stableTargetBuildWarning(bundle, uploaded);
-            if (warning !== undefined)
-                warn(warning);
-        }
-        report(`Domain: ${result.release.publication.origin}`);
-        report(`Environment: ${parsed.env}`);
-        report(`Adapter: ${adapter.name}@${adapter.version}`);
-        report(`Deployment: ${result.progress.provider.evidence.deployment}`);
-        if (result.progress.provider.evidence.preflight !== undefined) {
-            report(`Preflight: ${result.progress.provider.evidence.preflight}; public readiness verified`);
-        }
-        report(`Public: ${result.release.addressing.publicUrl}`);
-        report(`Publication: ${result.release.publication.schema.revision} · ${result.release.publication.etag}`);
-        const installed = await reconcileEnvironmentRelease({
-            projectDir,
-            environment: parsed.env,
-            adapter,
-            deployment: result,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
-            deployOnly: parsed.deployOnly ?? false,
-            ...(installationExecutable === undefined ? {} : { installationExecutable }),
-            ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
-            signal: lifecycle.signal,
-        });
-        if (installed === undefined) {
-            report('Installation: skipped');
-        }
-        else {
-            report(`Installation: ${installed.instance} · ${installed.status}`);
-        }
-        report('Ready: deployment verified');
-        if (parsed.json === true) {
-            const deployed = stableTargetDeployResult({
-                environment: parsed.env,
-                adapter,
-                deployment: result,
+            report,
+        };
+        const deployed = mode.kind === 'canonical'
+            ? await deployImmutable({
+                ...deployment,
+                adapter: environment.deployment.adapter,
+                parameters: environment.deployment.parameters,
+            })
+            : await deployStableTarget({
+                ...deployment,
+                definition: environment,
+                reasons: mode.reasons,
             });
+        if (deployed === undefined)
+            return 1;
+        if (parsed.json === true)
             process.stdout.write(`${JSON.stringify(deployed, null, 2)}\n`);
-        }
         return 0;
     }
     finally {
         lifecycle.dispose();
     }
 }
+/** Report every refusal of a refused deploy mode, each with what to write instead. */
+function refused(mode) {
+    if (mode.kind !== 'refused')
+        return false;
+    for (const refusal of mode.refusals)
+        error(refusal.guidance);
+    return true;
+}
 export function executeDevelopmentCommand(parsed, input, execute = develop) {
     if (parsed.command !== 'dev')
         throw new TypeError('Development execution requires the dev command.');
@@ -209,10 +173,8 @@ export function executeDevelopmentCommand(parsed, input, execute = develop) {
         configPath: input.configPath,
         projectDir: input.projectDir,
         environment: parsed.env,
-        deployOnly: parsed.deployOnly ?? false,
         ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
         ...(parsed.credentialFile === undefined ? {} : { credentialFile: parsed.credentialFile }),
-        ...(parsed.sessionFile === undefined ? {} : { sessionFile: parsed.sessionFile }),
         ...(parsed.secretsFile === undefined ? {} : { secretsFile: parsed.secretsFile }),
     });
 }
@@ -234,19 +196,6 @@ async function lint(parsed) {
         throw cause;
     }
 }
-function secretsFor(adapter, parameters, projectDir, runtime) {
-    const file = adapter.secretsFile?.(parameters);
-    if (file === undefined)
-        return Object.freeze({});
-    const path = isAbsolute(file) ? file : join(projectDir, file);
-    // An Integration-free Runtime has no Providers and therefore no author-owned
-    // environment secrets. Adapter-owned secrets, such as the signing identity,
-    // are resolved separately by the adapter and must not make this file required.
-    if (Object.keys(runtime.integrations).length === 0 && !existsSync(path)) {
-        return Object.freeze({});
-    }
-    return Object.freeze(loadDeclaredSecrets(path, file));
-}
 function findConfig(projectDir) {
     return CONFIG_NAMES.map((name) => join(projectDir, name)).find(existsSync);
 }

package/dist/tooling/cli/secrets.d.ts

@@ -0,0 +1,9 @@
+import type { Runtime } from '../../application/runtime/index.js';
+import type { Adapter, LegacyAdapter } from '../../deployment/adapter/index.js';
+/**
+ * The secrets one Environment's deployment binds: the values of the secrets file its adapter
+ * declares. An Integration-free Runtime has no Providers and therefore no author-owned secrets, so
+ * its file may be absent; adapter-owned secrets, such as a signing identity, are the adapter's to
+ * resolve and never make this file required.
+ */
+export declare function environmentSecrets(adapter: Adapter<object> | LegacyAdapter<object>, parameters: object, projectDir: string, runtime: Runtime): Readonly<Record<string, string>>;

package/dist/tooling/cli/secrets.js

@@ -0,0 +1,19 @@
+import { existsSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { loadDeclaredSecrets } from './dotenv.js';
+/**
+ * The secrets one Environment's deployment binds: the values of the secrets file its adapter
+ * declares. An Integration-free Runtime has no Providers and therefore no author-owned secrets, so
+ * its file may be absent; adapter-owned secrets, such as a signing identity, are the adapter's to
+ * resolve and never make this file required.
+ */
+export function environmentSecrets(adapter, parameters, projectDir, runtime) {
+    const file = adapter.secretsFile?.(parameters);
+    if (file === undefined)
+        return Object.freeze({});
+    const path = isAbsolute(file) ? file : join(projectDir, file);
+    if (Object.keys(runtime.integrations).length === 0 && !existsSync(path)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(loadDeclaredSecrets(path, file));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.13",
+  "version": "0.6.0-beta.14",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",

package/dist/deployment/verify/readiness/publication.d.ts

@@ -1,11 +0,0 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
-import type { Release } from '../../release/legacy/index.js';
-export type ReadinessFetch = (input: string, init: {
-    readonly redirect: 'error';
-    readonly signal?: AbortSignal;
-}) => Promise<Response>;
-/** Fetch and verify the exact live Publication and Bundle for one Release. */
-export declare function verifyPublication(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/publication.js

@@ -1,41 +0,0 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
-const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024;
-const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
-/** Fetch and verify the exact live Publication and Bundle for one Release. */
-export async function verifyPublication(release, options = {}) {
-    const fetcher = options.fetch ?? globalThis.fetch;
-    const publicationUrl = publication.url(release.addressing.publicUrl);
-    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
-    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_PUBLICATION_BYTES)));
-    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
-        throw new Error('Live Publication differs from the expected Release.');
-    }
-    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
-    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
-    publication.decodeBundle(deployed, bytes);
-    return deployed;
-}
-async function fetchRequired(fetcher, url, signal) {
-    const response = await fetcher(url, {
-        redirect: 'error',
-        ...(signal === undefined ? {} : { signal }),
-    });
-    if (!response.ok)
-        throw new Error(`GET ${url} returned ${response.status}.`);
-    return response;
-}
-async function bounded(response, url, maximum) {
-    const bytes = await response.arrayBuffer();
-    if (bytes.byteLength > maximum)
-        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
-    return bytes;
-}
-async function text(response, url, maximum) {
-    const bytes = await bounded(response, url, maximum);
-    try {
-        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
-    }
-    catch (cause) {
-        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
-    }
-}

package/dist/execution/service/publication/delivery.d.ts

@@ -1,2 +0,0 @@
-import type { publication } from '@astrale-os/kernel-server';
-export declare function delivery(input: publication.delivery.Provider | undefined): publication.delivery.Provider | undefined;

package/dist/execution/service/publication/installation.d.ts

@@ -1,3 +0,0 @@
-import type { publication } from '@astrale-os/kernel-server';
-import type { Release } from '../../../deployment/release/legacy/index.js';
-export declare function installation(release: Release, provider: publication.delivery.Provider | undefined): void;

package/dist/execution/service/publication/installation.js

@@ -1,8 +0,0 @@
-export function installation(release, provider) {
-    const advertised = release.publication.delivery !== undefined;
-    if (advertised !== (provider !== undefined)) {
-        throw new TypeError(advertised
-            ? 'Release advertises Publication delivery without a Provider.'
-            : 'Publication delivery Provider has no Release endpoint.');
-    }
-}

package/dist/execution/service/publication/source.d.ts

@@ -1,3 +0,0 @@
-import type { PublicationSource } from '@astrale-os/kernel-server';
-import type { LoadedRuntime } from '../../runtime/index.js';
-export declare function source(runtime: LoadedRuntime): PublicationSource;

package/dist/execution/service/publication/source.js

@@ -1,11 +0,0 @@
-import { preparePublicationSnapshot } from '@astrale-os/kernel-server';
-export function source(runtime) {
-    const release = runtime.release;
-    const snapshot = preparePublicationSnapshot({
-        publication: release.publication,
-        bundle: release.build.schema.bundle.bytes(),
-        table: release.routes,
-        domain: runtime.domain,
-    });
-    return Object.freeze({ current: () => snapshot });
-}

package/dist/tooling/cli/astrale/authority.d.ts

@@ -1,5 +0,0 @@
-/** Build one mutually exclusive authority argument set for an Astrale CLI operation. */
-export declare function astraleAuthorityArguments(input: {
-    readonly identity?: string;
-    readonly credential?: string;
-}): readonly string[];

package/dist/tooling/cli/astrale/authority.js

@@ -1,11 +0,0 @@
-/** Build one mutually exclusive authority argument set for an Astrale CLI operation. */
-export function astraleAuthorityArguments(input) {
-    if (input.identity !== undefined && input.credential !== undefined) {
-        throw new TypeError('Astrale authority cannot combine an identity and a credential.');
-    }
-    return input.credential === undefined
-        ? input.identity === undefined
-            ? Object.freeze([])
-            : Object.freeze(['--as', input.identity])
-        : Object.freeze(['--creds', input.credential]);
-}

package/dist/tooling/cli/astrale/executable.d.ts

@@ -1,2 +0,0 @@
-/** Resolve one exact executable for a complete sequence of Kernel CLI operations. */
-export declare function resolveAstraleExecutable(input?: string): Promise<string>;

package/dist/tooling/cli/astrale/executable.js

@@ -1,47 +0,0 @@
-import { constants } from 'node:fs';
-import { access, readFile, realpath } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { delimiter, isAbsolute, join } from 'node:path';
-/** Resolve one exact executable for a complete sequence of Kernel CLI operations. */
-export async function resolveAstraleExecutable(input = 'astrale') {
-    const candidates = isAbsolute(input) ? [input] : await executableCandidates(input);
-    for (const candidate of candidates) {
-        try {
-            await access(candidate, constants.X_OK);
-            return await realpath(candidate);
-        }
-        catch {
-            // Continue through the bounded recorded-install and PATH candidates.
-        }
-    }
-    throw new TypeError('Astrale CLI is unavailable. Install it with the official Astrale installer.');
-}
-async function executableCandidates(input) {
-    const path = (process.env.PATH ?? '')
-        .split(delimiter)
-        .filter(Boolean)
-        .map((directory) => join(directory, input));
-    if (input !== 'astrale')
-        return path;
-    const installed = await recordedInstallation();
-    return installed === undefined ? path : [installed, ...path];
-}
-async function recordedInstallation() {
-    const home = process.env.ASTRALE_HOME ?? join(homedir(), '.astrale');
-    try {
-        const decoded = JSON.parse(await readFile(join(home, 'install.json'), 'utf8'));
-        if (typeof decoded !== 'object' ||
-            decoded === null ||
-            !('method' in decoded) ||
-            decoded.method !== 'script' ||
-            !('bin' in decoded) ||
-            typeof decoded.bin !== 'string' ||
-            !isAbsolute(decoded.bin)) {
-            return undefined;
-        }
-        return decoded.bin;
-    }
-    catch {
-        return undefined;
-    }
-}

package/dist/tooling/cli/astrale/failure.d.ts

@@ -1,6 +0,0 @@
-import type { AstraleProcessResult } from './process.js';
-/** Only sanitized CLI diagnostics may be promoted through installation failures. */
-export declare class AstraleCliError extends Error {
-}
-export declare function astraleFailure(command: string, result: AstraleProcessResult): Error;
-export declare function isDomainNotInstalledFailure(stderr: string): boolean;

package/dist/tooling/cli/astrale/failure.js

@@ -1,48 +0,0 @@
-/** Only sanitized CLI diagnostics may be promoted through installation failures. */
-export class AstraleCliError extends Error {
-}
-export function astraleFailure(command, result) {
-    let diagnostic;
-    try {
-        const failure = record(JSON.parse(result.stderr));
-        const error = admittedCode(failure.error);
-        const reason = recordOrUndefined(failure.reason);
-        const reasonCode = admittedCode(reason?.code);
-        diagnostic =
-            error === undefined ? undefined : reasonCode === undefined ? error : `${error}/${reasonCode}`;
-    }
-    catch {
-        // Never forward raw stderr because a credential-bearing command owns it.
-    }
-    return new AstraleCliError(`Astrale CLI ${command} failed${diagnostic === undefined ? '' : ` (${diagnostic})`}.`);
-}
-function admittedCode(input) {
-    return typeof input === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/u.test(input) ? input : undefined;
-}
-function recordOrUndefined(input) {
-    return input !== null && typeof input === 'object' && !Array.isArray(input)
-        ? input
-        : undefined;
-}
-export function isDomainNotInstalledFailure(stderr) {
-    try {
-        const failure = record(JSON.parse(stderr));
-        if (failure.error === 'DOMAIN_NOT_INSTALLED')
-            return true;
-        const reason = failure.reason;
-        return (failure.error === 'RESPONSE_ERROR' &&
-            reason !== null &&
-            typeof reason === 'object' &&
-            !Array.isArray(reason) &&
-            Reflect.get(reason, 'code') === 'SCHEMA_NOT_FOUND');
-    }
-    catch {
-        return false;
-    }
-}
-function record(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-        throw new TypeError('Expected an object response.');
-    }
-    return input;
-}

package/dist/tooling/cli/astrale/instance.d.ts

@@ -1,11 +0,0 @@
-import { runAstrale } from './process.js';
-/** Resolve and probe a bookmark through the pinned CLI, preserving its TLS trust. */
-export declare function resolveAstraleInstanceIssuer(input: {
-    readonly executable: string;
-    readonly projectDir: string;
-    readonly instance: string;
-    readonly expectedIssuer?: string;
-    readonly signal: AbortSignal;
-}, dependencies?: {
-    readonly run: typeof runAstrale;
-}): Promise<string>;

package/dist/tooling/cli/astrale/instance.js

@@ -1,52 +0,0 @@
-import { astraleFailure } from './failure.js';
-import { runAstrale } from './process.js';
-/** Resolve and probe a bookmark through the pinned CLI, preserving its TLS trust. */
-export async function resolveAstraleInstanceIssuer(input, dependencies = { run: runAstrale }) {
-    const result = await dependencies.run({
-        executable: input.executable,
-        projectDir: input.projectDir,
-        signal: input.signal,
-        timeoutMs: 30_000,
-        args: ['--ci', '--no-prompt', 'instance', 'status', input.instance, '--bookmarked', '--json'],
-    });
-    if (result.code !== 0)
-        throw astraleFailure('instance status', result);
-    let value;
-    try {
-        value = JSON.parse(result.stdout);
-    }
-    catch {
-        throw new TypeError('Astrale instance status did not return one JSON value.');
-    }
-    if (value === null ||
-        typeof value !== 'object' ||
-        Array.isArray(value) ||
-        !('kind' in value) ||
-        value.kind !== 'bookmark' ||
-        !('state' in value) ||
-        value.state !== 'ready' ||
-        !('issuer' in value) ||
-        typeof value.issuer !== 'string') {
-        throw new TypeError('Astrale instance status returned invalid Kernel identity evidence.');
-    }
-    let issuer;
-    try {
-        issuer = new URL(value.issuer);
-    }
-    catch {
-        throw new TypeError('Astrale instance status returned an invalid Kernel issuer.');
-    }
-    if (!['https:', 'http:'].includes(issuer.protocol) ||
-        issuer.username ||
-        issuer.password ||
-        issuer.search ||
-        issuer.hash) {
-        throw new TypeError('Astrale instance status returned an invalid Kernel issuer.');
-    }
-    // Child Kernels share an origin, but their path-qualified identities remain distinct.
-    const canonical = issuer.href.replace(/\/$/u, '');
-    if (input.expectedIssuer !== undefined && canonical !== input.expectedIssuer) {
-        throw new Error('Installation bookmark changed Kernel; restart pnpm dev to apply it.');
-    }
-    return canonical;
-}

package/dist/tooling/cli/astrale/process.d.ts

@@ -1,13 +0,0 @@
-export interface AstraleProcessResult {
-    readonly code: number;
-    readonly stdout: string;
-    readonly stderr: string;
-}
-/** Run one exact Kernel CLI executable with bounded output, time, and termination. */
-export declare function runAstrale(input: {
-    readonly executable: string;
-    readonly args: readonly string[];
-    readonly projectDir: string;
-    readonly signal: AbortSignal;
-    readonly timeoutMs: number;
-}): Promise<AstraleProcessResult>;