@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/dist/tooling/cli/deploy-result.d.ts

@@ -6,9 +6,7 @@ export type { DeploymentSecretsState } from '../../deployment/index.js';
 /**
  * `astrale-domain deploy <environment> --json` on stdout: the one deployment the deploy made or
  * reused, which CI installs by its URL. Progress and warnings go to stderr. It names no instance
- * and no version: a deploy numbers nothing, and the deploy of an immutable deployment installs
- * nothing. A legacy environment that declares `installation` still installs while it deploys and
- * reports that outcome on stderr only.
+ * and no version: a deploy numbers nothing and installs nothing.
  */
 export interface DeployResultV1 {
     readonly format: 'astrale.deploy-result';
@@ -62,14 +60,19 @@ export interface DeployResultV1 {
     readonly secrets?: {
         readonly state: DeploymentSecretsState;
     };
-    /** The commit the deployment was built from, as its deployment record declares it. */
+    /**
+     * The commit the deployment was built from, as its deployment record declares it: the commit of
+     * the deploy that created it. A reused deployment keeps its record, so this can be an earlier
+     * commit than the one the deploy ran from; the label covers the release, never the commit.
+     */
     readonly commit: DeploymentCommitV1 | null;
 }
 /**
  * The deploy result of one immutable deployment, from the ready result of the adapter's
- * `deployRelease`. Its release, build, Schema revision and URL are those of the release the SDK
- * sealed before deploying; the deployment record the adapter returned must declare exactly that
- * release at that URL, so the result never names a release the deployment does not serve.
+ * `deployRelease`. Its release, build, Schema revision and URL are those the SDK sealed before
+ * deploying; the deployment record the adapter returned must declare exactly that release at that
+ * URL, so the result never names a release the deployment does not serve. Its commit is the
+ * record's, which a reused deployment kept from the deploy that created it.
  */
 export declare function deployResult(input: {
     readonly environment: string;

package/dist/tooling/cli/deploy-result.js

@@ -6,9 +6,10 @@ const SECRETS_BY_STATE = Object.freeze({
 });
 /**
  * The deploy result of one immutable deployment, from the ready result of the adapter's
- * `deployRelease`. Its release, build, Schema revision and URL are those of the release the SDK
- * sealed before deploying; the deployment record the adapter returned must declare exactly that
- * release at that URL, so the result never names a release the deployment does not serve.
+ * `deployRelease`. Its release, build, Schema revision and URL are those the SDK sealed before
+ * deploying; the deployment record the adapter returned must declare exactly that release at that
+ * URL, so the result never names a release the deployment does not serve. Its commit is the
+ * record's, which a reused deployment kept from the deploy that created it.
  */
 export function deployResult(input) {
     const { release, deployment } = input;

package/dist/tooling/cli/dotenv.d.ts

@@ -7,6 +7,8 @@
  * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
  * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
  */
+/** Parse one dotenv document into a flat record; `${VAR}` reads only earlier keys. */
+export declare function parseDotenv(contents: string): Record<string, string>;
 /**
  * Read + parse a dotenv file the preset explicitly DECLARED (`secrets:`).
  * Declared-but-absent is a wiring error (the gitignored file was never created
@@ -15,5 +17,3 @@
  * that exists but holds no keys is legitimate (a domain with no secrets yet).
  */
 export declare function loadDeclaredSecrets(path: string, declaration: string): Record<string, string>;
-/** Load one explicit development-session secret snapshot without following a leaf symlink. */
-export declare function loadPrivateSecretsFile(path: string, platform?: NodeJS.Platform): Record<string, string>;

package/dist/tooling/cli/dotenv.js

@@ -7,8 +7,9 @@
  * runtime in dev, pushed to a secret store in prod). No `process.env` mutation,
  * no interpolation magic beyond `${VAR}` against earlier keys in the same file.
  */
-import { closeSync, constants, fstatSync, openSync, readFileSync } from 'node:fs';
-function parseDotenv(contents) {
+import { readFileSync } from 'node:fs';
+/** Parse one dotenv document into a flat record; `${VAR}` reads only earlier keys. */
+export function parseDotenv(contents) {
     const out = {};
     for (const raw of contents.split('\n')) {
         const line = raw.trim();
@@ -52,34 +53,3 @@ export function loadDeclaredSecrets(path, declaration) {
     }
     return parseDotenv(contents);
 }
-/** Load one explicit development-session secret snapshot without following a leaf symlink. */
-export function loadPrivateSecretsFile(path, platform = process.platform) {
-    if (platform === 'win32') {
-        throw new Error('--secrets-file is unavailable on Windows until private no-reparse file admission is supported.');
-    }
-    let descriptor;
-    try {
-        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    }
-    catch (cause) {
-        if (cause instanceof Error && 'code' in cause && cause.code === 'ENOENT') {
-            throw new Error(`Secrets file '${path}' is missing.`, { cause });
-        }
-        if (cause instanceof Error && 'code' in cause && cause.code === 'ELOOP') {
-            throw new Error(`Secrets file '${path}' must be a regular file and not a symlink.`, { cause });
-        }
-        throw cause;
-    }
-    try {
-        const info = fstatSync(descriptor);
-        if (!info.isFile())
-            throw new Error(`Secrets file '${path}' must be a regular file.`);
-        if ((info.mode & 0o077) !== 0) {
-            throw new Error(`Secrets file '${path}' must not be accessible by group or other users.`);
-        }
-        return parseDotenv(readFileSync(descriptor, 'utf8'));
-    }
-    finally {
-        closeSync(descriptor);
-    }
-}

package/dist/tooling/cli/help.js

@@ -1,3 +1,4 @@
+import { installCommand } from '../../project/install-command.js';
 import { COMMANDS } from './arguments.js';
 /** Resolve help without parsing a project or performing any command effects. */
 export function helpRequest(argv) {
@@ -12,15 +13,16 @@ export function helpText(command) {
 export const ERROR_USAGE = `Usage: astrale-domain <command> [options]
 Run "astrale-domain --help" for available commands.
 `;
-const GLOBAL_HELP = `Build, develop, deploy, test, lint, and package Astrale Domains.
+const GLOBAL_HELP = `Build, develop, deploy, list, test, lint, and package Astrale Domains.
 
 Usage:
   astrale-domain <command> [options]
 
 Commands:
-  dev [environment]       Remotely deploy and watch one Project Environment.
+  dev [environment]       Deprecated: use deploy, then astrale domain install.
   build                   Build, verify and print the build digest.
-  deploy <environment>    Deploy and optionally install one Environment.
+  deploy <environment>    Deploy one Environment; never installs.
+  list                    List the deployments of the Project's Environments.
   test                    Run Project tests, optionally against one Environment.
   lint                    Check Domain source and architecture.
   package                 Prepare public declarations for publication.
@@ -55,22 +57,25 @@ Behavior:
   checks afterwards. Failed installations leave local changes available for repair.
   For an older SDK without this command: pnpm dlx @astrale-os/sdk@beta upgrade.
 `,
-    dev: `Build, verify, remotely deploy, and watch one Project Environment.
+    dev: `Build, verify, remotely deploy, and watch one Project Environment (deprecated).
 
 Usage:
   astrale-domain dev [environment] [options]
 
+Deprecated:
+  Development is not a command of the deployment model. Deploy the Environment with
+  astrale-domain deploy <environment>, then install the URL it prints with
+  astrale domain install <url> --direct -i <instance>. dev keeps its behavior until
+  it is removed and warns on every run.
+
 Arguments:
   environment             Project Environment name; defaults to development.
 
 Options:
   --environment <name>    Select the environment without a positional argument.
-  --deploy-only           Suppress this run's configured Kernel installation.
-  --as <identity>         Select the Astrale identity for Services and installation calls.
-  --session-file <path>   Write one retained DevelopmentSessionFileV1 snapshot at an
-                          absolute path in a caller-owned private directory.
+  --as <identity>         Select the Astrale identity for the adapter's provider calls.
   --credential-file <path>
-                          Use one private operator credential for provider and Kernel
+                          Use one private operator credential for the adapter's provider
                           calls without exposing it in Project configuration.
   --secrets-file <path>   Load one private, absolute secrets file for this development
                           session instead of the adapter-declared secrets file.
@@ -80,25 +85,23 @@ Behavior:
   The selected Environment must exist; no other Environment is chosen as a fallback.
   Builds and verifies the Domain, Runtime, frontend, and adapter artifact, then
   deploys it through the selected Environment. It never starts a local Worker,
-  Vite server, or tunnel. Imported source changes produce serialized remote updates;
-  configuration changes require restarting the command.
+  Vite server, or tunnel, and never installs the Domain: install the URL it prints with
+  ${installCommand()}. Imported source changes
+  produce serialized remote updates; configuration changes require restarting the
+  command. It serves only legacy direct-mode Environments; an Environment that
+  deploys immutable deployments is refused.
   A shared direct-provider target additionally requires an external single-writer
   boundary such as a CI/CD concurrency group.
-  The session file is machine-readable and authoritative when requested; human
-  stdout/stderr remains diagnostic. It requires an adapter that reports exact
-  installed Release evidence, so it is rejected for an Environment without an
-  installation and when --deploy-only suppresses installation.
   A credential file is admitted and read once. Its value is passed only to the
-  deployment adapter, configured Kernel installation, and default View; it never
-  enters Domain Runtime secrets, diagnostics, deployment evidence, or the session
-  file. It is currently unavailable on Windows because private no-reparse file
-  admission is absent.
+  deployment adapter; it never enters Domain Runtime secrets or diagnostics. It is
+  currently unavailable on Windows because private no-reparse file admission is
+  absent.
   A secrets-file override is read once, passed to the Domain runtime as secrets,
   never mutates the authored project, and is not watched for later changes. It is
   also unavailable on Windows because private no-reparse admission is absent.
 
   Stopping the watcher stops only local build orchestration. The remote deployment
-  and optional Kernel installation remain available.
+  remains available.
 `,
     build: `Build and verify a Domain without deploying it, and print its build digest.
 
@@ -129,20 +132,61 @@ Arguments:
 Options:
   --environment <name>    Select the environment without a positional argument.
   --json                  Print one DeployResultV1 on stdout; progress goes to stderr.
-  --deploy-only           Suppress this run's configured Kernel installation.
-  --as <identity>         Select the Astrale identity for Services and installation calls.
+  --as <identity>         Select the Astrale identity for the adapter's provider calls.
   -h, --help              Show help for deploy.
 
 Behavior:
-  Builds and verifies the Domain, Runtime, and provider artifact, loads declared
-  secrets, and invokes the selected adapter. It then verifies the resulting Release.
-  When the adapter has a bundler, deploy rebuilds the Bundle exactly as build does and
-  warns when the uploaded code has another build digest.
-  When the Environment declares installation, reconciles it after provider readiness.
-  An Environment without installation performs zero Kernel calls.
+  Builds and verifies the Domain and Runtime, rebuilds the Bundle exactly as build
+  does, loads declared secrets, and deploys through the selected adapter. It never
+  installs the Domain: install the URL it prints with
+  ${installCommand()}.
+  The Environment's configuration selects how it deploys. An adapter that implements
+  deployRelease makes one immutable deployment per release and calls no instance: the
+  SDK seals the release for the deployment's URL, records the commit it was built
+  from, and the adapter creates that deployment or reuses it (adapter-astrale on
+  Admin's Services, through astrale call --admin). A new deployment binds the
+  Environment's current secrets; a reused one has its own secrets updated in place,
+  served once propagated; no other deployment's secrets change. Any other Environment
+  replaces its stable target in place (legacy direct mode, deprecated), warns on
+  stderr, serves a v3 Publication only, and warns when the uploaded code has another
+  build digest than the Bundle.
   With --json, stdout holds only one DeployResultV1: the deployment's URL, which
   astrale domain install takes, its digests, adapter and state. Exit status: 0 deployed,
-  1 failed, 2 usage error; a failed run prints nothing on stdout.
+  1 failed or refused, 2 usage error; a failed run prints nothing on stdout.
+`,
+    list: `List the deployments of the Project's Environments that their hosts keep.
+
+Usage:
+  astrale-domain list [--environment <name>] [--json]
+
+Options:
+  --environment <name>    List one Environment instead of every Environment.
+  --json                  Print one ListResultV1 on stdout; notices go to stderr.
+  --as <identity>         Select the Astrale identity whose deployments the hosts list.
+  -h, --help              Show help for list.
+
+Behavior:
+  Asks the adapter of each Environment that deploys immutable deployments for the
+  deployments its host keeps for the caller, and prints each one's release, its name,
+  Environment and state, its last call and its expiry, and the URL
+  ${installCommand()} takes. A name is computed
+  from the deployment's record and never stored, such as 1.4.2 + 7 commits · a1b2c3d ·
+  staging.
+  A preview expires 30 days after its activation or its last call, whichever is
+  later; a published deployment never does. Last calls are read from the host as it
+  counts them, so a host whose last calls cannot be read is not listed. A platform
+  dispatch namespace reads them from its calls dataset, and without Account Analytics
+  Read lists its deployments without last calls or expiries.
+  Listing changes nothing, at any host or instance.
+  An Environment in legacy direct mode, refused by deploy, or whose adapter lists no
+  deployments is reported on stderr and, with --json, under unlisted. A deployment
+  whose record this SDK does not admit is still listed, from what its host knows.
+  With --json, each deployment carries its call target: the path of its node on
+  Admin's Services, for astrale call "<path>.method.setSecret" --admin, or the
+  namespace and script of a platform dispatch namespace, which its operator tooling
+  takes.
+  Exit status: 0 listed, 1 a host could not be listed (with --json, nothing on
+  stdout), 2 usage error.
 `,
     test: `Run Project tests locally or against one selected Environment.
 

package/dist/tooling/cli/immutable-deployment.d.ts

@@ -0,0 +1,27 @@
+import type { Adapter, Build, LegacyAdapter, ResolvedRuntimeReference } from '../../deployment/index.js';
+import type { DeployResultV1 } from './deploy-result.js';
+/**
+ * Deploy one canonical Environment (CT33) as the immutable deployment of one sealed release.
+ *
+ * The SDK derives everything before the adapter's only effectful call: it bundles exactly as
+ * `astrale-domain build` does, asks the adapter to freeze the Environment's configuration and say
+ * where its host places deployments, derives the deployment label and URL from them (S3), seals
+ * the `DomainRelease` v4 the deployment serves at that URL (S4a), and reads the commit it is built
+ * from. `deployRelease` then creates that deployment or reuses it. The SDK makes no Kernel call,
+ * the deploy calls no instance and installs nothing: `astrale domain install <url>` installs the
+ * URL it prints.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ */
+export declare function deployImmutable(input: {
+    readonly projectDir: string;
+    readonly environment: string;
+    /** A canonical Environment's adapter (CT33), which implements adapter interface v2. */
+    readonly adapter: Adapter<object> | LegacyAdapter<object>;
+    readonly parameters: object;
+    readonly build: Build;
+    readonly runtime: ResolvedRuntimeReference;
+    readonly identity?: string;
+    readonly signal: AbortSignal;
+    readonly report: (line: string) => void;
+}): Promise<DeployResultV1 | undefined>;

package/dist/tooling/cli/immutable-deployment.js

@@ -0,0 +1,95 @@
+import { resolve } from 'node:path';
+import { deploymentContent, deploymentLabel, deploymentLine, deploymentUrl, } from '../../deployment/address/index.js';
+import { assemble } from '../../deployment/index.js';
+import { bundleBuild } from './build.js';
+import { deploymentCommit } from './commit.js';
+import { deployResult } from './deploy-result.js';
+import { error } from './log.js';
+import { environmentSecrets } from './secrets.js';
+/**
+ * Deploy one canonical Environment (CT33) as the immutable deployment of one sealed release.
+ *
+ * The SDK derives everything before the adapter's only effectful call: it bundles exactly as
+ * `astrale-domain build` does, asks the adapter to freeze the Environment's configuration and say
+ * where its host places deployments, derives the deployment label and URL from them (S3), seals
+ * the `DomainRelease` v4 the deployment serves at that URL (S4a), and reads the commit it is built
+ * from. `deployRelease` then creates that deployment or reuses it. The SDK makes no Kernel call,
+ * the deploy calls no instance and installs nothing: `astrale domain install <url>` installs the
+ * URL it prints.
+ *
+ * Returns the deploy result, or nothing once a failure is reported on stderr.
+ */
+export async function deployImmutable(input) {
+    const { parameters, environment, build, signal } = input;
+    const adapter = releaseAdapter(input.adapter);
+    const identity = input.identity === undefined ? {} : { identity: input.identity };
+    const bundle = await bundleBuild({
+        bundler: adapter.bundler,
+        projectDir: input.projectDir,
+        build,
+        runtime: input.runtime,
+        signal,
+    });
+    const secrets = environmentSecrets(adapter, parameters, input.projectDir, input.runtime.runtime);
+    const configuration = adapter.configure(parameters, {
+        environment,
+        secrets: Object.freeze(Object.keys(secrets).sort()),
+    });
+    const placement = await adapter.placement(parameters, { environment, signal, ...identity });
+    const origin = build.schema.compiled.root.origin;
+    const label = deploymentLabel(deploymentLine({ origin, environment, addressing: placement.addressing }), deploymentContent(bundle.digest, configuration));
+    const release = assemble(build, bundle.digest, deploymentUrl(label, placement.routingDomain));
+    const commit = await deploymentCommit({
+        projectDir: input.projectDir,
+        // The configuration sits in the Project directory, and names its runtime relative to it.
+        runtimeModule: resolve(input.projectDir, input.runtime.reference.path),
+        signal,
+    });
+    const deployed = await adapter.deployRelease(parameters, {
+        projectDir: input.projectDir,
+        environment,
+        ...identity,
+        secrets,
+        bundle,
+        configuration,
+        placement,
+        label,
+        release,
+        commit,
+        signal,
+    });
+    if (deployed.status !== 'ready') {
+        error(`Deployment failed during ${deployed.phase}: ${deployed.error.message}`);
+        return undefined;
+    }
+    const result = deployResult({ environment, adapter, release, deployment: deployed });
+    input.report(`Domain: ${result.origin}`);
+    input.report(`Environment: ${environment}`);
+    input.report(`Adapter: ${result.deployment.adapter}`);
+    input.report(`Deployment: ${label} · ${result.deployment.state}`);
+    input.report(`URL: ${result.url}`);
+    input.report(`Release: ${release.document.digest}`);
+    input.report(`Build: ${release.buildDigest}`);
+    input.report(secretsLine(label, result.secrets.state));
+    input.report('Ready: deployment verified');
+    return result;
+}
+/**
+ * What the deploy did to the secrets of the one deployment it made or reused: `bound` to the new
+ * deployment, or `updated` or left `unchanged` in place on the reused one. No other deployment's
+ * secrets are ever written. A value rewritten in place is served once the host propagated it,
+ * which is eventually consistent (about 4 s on Workers for Platforms, AM-114).
+ */
+function secretsLine(label, state) {
+    return state === 'updated'
+        ? `Secrets: updated in place on ${label}; the new values are served once propagated ` +
+            '(eventually consistent, about 4 s)'
+        : `Secrets: ${state}`;
+}
+/** The adapter of a canonical Environment: CT33 selects canonical only beside `deployRelease`. */
+function releaseAdapter(adapter) {
+    if (!('deployRelease' in adapter) || typeof adapter.deployRelease !== 'function') {
+        throw new TypeError(`Adapter ${adapter.name}@${adapter.version} implements no deployRelease and deploys no immutable deployment.`);
+    }
+    return adapter;
+}

package/dist/tooling/cli/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | test | lint | package), explicit dotenv boundary, and admitted
- * development-session file representation.
+ * (dev | build | deploy | list | test | lint | package), its JSON results, and the explicit dotenv
+ * boundary. `dev` is deprecated and lives in `legacy/development/`.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
@@ -13,6 +13,5 @@
 export { run } from './run.js';
 export type { BuildResultV1 } from './build.js';
 export type { DeployResultV1, DeploymentSecretsState } from './deploy-result.js';
+export type { ListedDeploymentV1, ListResultV1, UnlistedEnvironmentV1 } from './list.js';
 export { loadDeclaredSecrets } from './dotenv.js';
-export { DEVELOPMENT_SESSION_FILE_VERSION, acceptDevelopmentSessionFileV1, } from './development/session-file.js';
-export type { DevelopmentSessionFileV1, DevelopmentSessionPhaseV1, DevelopmentSessionProjectV1, DevelopmentSessionReleaseV1, } from './development/session-file.js';

package/dist/tooling/cli/index.js

@@ -1,7 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | test | lint | package), explicit dotenv boundary, and admitted
- * development-session file representation.
+ * (dev | build | deploy | list | test | lint | package), its JSON results, and the explicit dotenv
+ * boundary. `dev` is deprecated and lives in `legacy/development/`.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is
@@ -12,4 +12,3 @@
  */
 export { run } from './run.js';
 export { loadDeclaredSecrets } from './dotenv.js';
-export { DEVELOPMENT_SESSION_FILE_VERSION, acceptDevelopmentSessionFileV1, } from './development/session-file.js';

package/dist/tooling/cli/legacy/deploy-result.d.ts

@@ -12,9 +12,11 @@ import type { DeployResultV1 } from '../deploy-result.js';
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployResult`, the result of an
  * immutable deployment. Consumers: the direct-mode configurations of domains ai-gateway, closing,
- * grc, integrations and issues (until SV15), shell (until SH2), the Services `development`
- * environment (until SV9) and ui:domain (until UI1). Deleted with the legacy deploy path (D10),
- * once no supported configuration selects it (CT33).
+ * grc, integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ * AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ * `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until D22),
+ * and ui:domain (until UI1). Deleted with the legacy deploy path (D10), once no configuration on
+ * any repository's main selects it (CT33, AM-147).
  */
 export declare function stableTargetDeployResult(input: {
     readonly environment: string;

package/dist/tooling/cli/legacy/deploy-result.js

@@ -10,9 +10,11 @@
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployResult`, the result of an
  * immutable deployment. Consumers: the direct-mode configurations of domains ai-gateway, closing,
- * grc, integrations and issues (until SV15), shell (until SH2), the Services `development`
- * environment (until SV9) and ui:domain (until UI1). Deleted with the legacy deploy path (D10),
- * once no supported configuration selects it (CT33).
+ * grc, integrations and issues (until SV15), domains organization (until it leaves direct mode,
+ * AM-147), the Services `beta` and `prod` (until SV12), `development` (until SV9) and frozen
+ * `admin-beta` (until D19) environments, shell (until SH2) and its frozen `legacy-v3` (until D22),
+ * and ui:domain (until UI1). Deleted with the legacy deploy path (D10), once no configuration on
+ * any repository's main selects it (CT33, AM-147).
  */
 export function stableTargetDeployResult(input) {
     const { publication, addressing } = input.deployment.release;

package/dist/tooling/cli/{development → legacy/development}/candidate.d.ts

@@ -1,9 +1,8 @@
-import type { InstallationTarget, PreparedArtifact } from '../../../deployment/adapter/index.js';
-import type { StableTargetAdapter } from '../legacy/stable-target-adapter.js';
+import type { PreparedArtifact } from '../../../../deployment/adapter/index.js';
+import type { StableTargetAdapter } from '../stable-target-adapter.js';
 export interface DevelopmentCandidate {
     readonly adapter: StableTargetAdapter<object>;
     readonly parameters: object;
-    readonly installation?: InstallationTarget;
     readonly artifact: PreparedArtifact;
     readonly secrets: Readonly<Record<string, string>>;
     readonly sources: ReadonlySet<string>;
@@ -22,5 +21,5 @@ export declare class DevelopmentCandidateBuilder {
 }
 export declare function discoverRuntimePath(configPath: string): Promise<string>;
 export declare function sameEnvironment(current: DevelopmentCandidate, candidate: DevelopmentCandidate): boolean;
-/** Identify a rebuilt candidate that cannot change provider or installation state. */
+/** Identify a rebuilt candidate that cannot change provider state. */
 export declare function sameDeploymentCandidate(current: DevelopmentCandidate, candidate: DevelopmentCandidate): boolean;

package/dist/tooling/cli/{development → legacy/development}/candidate.js

@@ -2,11 +2,11 @@ import { existsSync } from 'node:fs';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { admitRuntime, compile, resolveRuntime, runtime, verifyPreflight, } from '../../../deployment/index.js';
-import { admitProjectModule } from '../../../project/index.js';
-import { loadDeclaredSecrets } from '../dotenv.js';
-import { stableTargetAdapter } from '../legacy/stable-target-adapter.js';
-import { selectEnvironment } from '../project.js';
+import { admitRuntime, compile, resolveRuntime, runtime, verifyPreflight, } from '../../../../deployment/index.js';
+import { admitProjectModule } from '../../../../project/index.js';
+import { loadDeclaredSecrets } from '../../dotenv.js';
+import { selectEnvironment } from '../../project.js';
+import { stableTargetAdapter } from '../stable-target-adapter.js';
 import { projectImportPlugin } from './project-imports.js';
 import { DevelopmentSources } from './sources.js';
 /** Rebuild one complete, isolated Environment candidate from authored sources. */
@@ -84,9 +84,6 @@ export class DevelopmentCandidateBuilder {
             const source = await adapter.prepare(parameters, {
                 projectDir: this.#projectDir,
                 environment: this.#environment,
-                ...(environment.installation === undefined
-                    ? {}
-                    : { installation: environment.installation }),
                 mode: 'release',
                 recordSource: sources.record,
                 signal,
@@ -102,9 +99,6 @@ export class DevelopmentCandidateBuilder {
             return Object.freeze({
                 adapter,
                 parameters,
-                ...(environment.installation === undefined
-                    ? {}
-                    : { installation: environment.installation }),
                 artifact,
                 secrets: declared.values,
                 sources: sources.snapshot(),
@@ -125,10 +119,9 @@ export function sameEnvironment(current, candidate) {
         candidate.adapter.version === current.adapter.version &&
         candidate.artifact.build.schema.compiled.root.origin ===
             current.artifact.build.schema.compiled.root.origin &&
-        stable(candidate.parameters) === stable(current.parameters) &&
-        stable(candidate.installation) === stable(current.installation));
+        stable(candidate.parameters) === stable(current.parameters));
 }
-/** Identify a rebuilt candidate that cannot change provider or installation state. */
+/** Identify a rebuilt candidate that cannot change provider state. */
 export function sameDeploymentCandidate(current, candidate) {
     return (sameEnvironment(current, candidate) &&
         candidate.artifact.build.schema.compiled.root.revision ===

package/dist/tooling/cli/legacy/development/deployment.d.ts

@@ -0,0 +1,10 @@
+import type { ReadyDeployResult } from '../../../../deployment/adapter/index.js';
+import type { DevelopmentCandidate } from './candidate.js';
+export interface DevelopmentDeploymentInput {
+    readonly projectDir: string;
+    readonly environment: string;
+    readonly identity?: string;
+    readonly credential?: string;
+}
+/** Commit and verify one complete remote candidate. A development deployment installs nothing. */
+export declare function deployDevelopmentCandidate(candidate: DevelopmentCandidate, input: DevelopmentDeploymentInput, signal: AbortSignal): Promise<ReadyDeployResult>;

package/dist/tooling/cli/legacy/development/deployment.js

@@ -0,0 +1,20 @@
+import { verifyDeployment } from '../../../../deployment/index.js';
+/** Commit and verify one complete remote candidate. A development deployment installs nothing. */
+export async function deployDevelopmentCandidate(candidate, input, signal) {
+    const deployed = await candidate.adapter.deploy(candidate.parameters, {
+        projectDir: input.projectDir,
+        environment: input.environment,
+        ...(input.identity === undefined ? {} : { identity: input.identity }),
+        ...(input.credential === undefined ? {} : { credential: input.credential }),
+        secrets: candidate.secrets,
+        artifact: candidate.artifact,
+        signal,
+    });
+    const verified = verifyDeployment(candidate.artifact, deployed);
+    if (verified.status === 'failed') {
+        throw new Error(`Deployment failed during ${verified.phase}: ${verified.error.message}`, {
+            cause: verified.error,
+        });
+    }
+    return verified;
+}

package/dist/tooling/cli/legacy/development/deprecation.d.ts

@@ -0,0 +1,11 @@
+/**
+ * What replaces `astrale-domain dev`, for its author: development is not a command of the
+ * deployment model. A developer, or an agent, deploys the Environment and installs the URL that
+ * deploy prints on their own instance.
+ *
+ * `--direct` sends that URL to the instance's Kernel. Without it, the CLI releases published so
+ * far route a bare URL through the Admin catalog, which only knows published entries, so a fresh
+ * deployment URL fails to install. The CLI keeps accepting `--direct` after it starts sending
+ * every URL to the Kernel, and drops the flag only after this command is removed.
+ */
+export declare function developmentDeprecation(environment: string): string;

package/dist/tooling/cli/legacy/development/deprecation.js

@@ -0,0 +1,13 @@
+/**
+ * What replaces `astrale-domain dev`, for its author: development is not a command of the
+ * deployment model. A developer, or an agent, deploys the Environment and installs the URL that
+ * deploy prints on their own instance.
+ *
+ * `--direct` sends that URL to the instance's Kernel. Without it, the CLI releases published so
+ * far route a bare URL through the Admin catalog, which only knows published entries, so a fresh
+ * deployment URL fails to install. The CLI keeps accepting `--direct` after it starts sending
+ * every URL to the Kernel, and drops the flag only after this command is removed.
+ */
+export function developmentDeprecation(environment) {
+    return `astrale-domain dev is deprecated and will be removed: run \`astrale-domain deploy ${environment}\`, then \`astrale domain install <url> --direct -i <instance>\` with the URL it prints.`;
+}

package/dist/tooling/cli/legacy/development/develop.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Watch one Project Environment and serialize complete remote deployment generations. Each
+ * generation replaces the Environment's stable target in place; none installs anything.
+ *
+ * @deprecated Deploy the Environment with `astrale-domain deploy`, then install the printed URL
+ * with `astrale domain install <url> --direct -i <instance>`.
+ */
+export declare function develop(input: {
+    readonly configPath: string;
+    readonly projectDir: string;
+    readonly environment: string;
+    readonly identity?: string;
+    readonly credentialFile?: string;
+    readonly secretsFile?: string;
+}): Promise<number>;