@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/dist/tooling/cli/list.js

@@ -0,0 +1,297 @@
+import { acceptDeploymentRecord } from '../../deployment/address/index.js';
+import { deploymentName } from '../../platform/versioning/name.js';
+import { selectDeployMode } from './deploy-mode.js';
+/**
+ * List the deployments of the selected Environments, one adapter `list` call each.
+ *
+ * Only an Environment that deploys immutable deployments (CT33 canonical) is listed; the others are
+ * `unlisted`, with the reason. A record the host returns but `acceptDeploymentRecord` refuses never
+ * fails the listing: that deployment is listed from what its host knows, its record `null`. This
+ * covers a host whose SDK still admits a record this SDK refuses; a host that refuses a stored
+ * record itself may fail its own list (Admin's Services does, AM-152). An Environment whose host
+ * cannot be listed, or whose adapter answers anything but deployments, is a failure, and the others
+ * are still listed.
+ */
+export async function listDeployments(input) {
+    const deployments = [];
+    const unlisted = [];
+    const notices = [];
+    const failures = [];
+    for (const [environment, definition] of input.environments) {
+        const { adapter, parameters } = definition.deployment;
+        const name = `${adapter.name}@${adapter.version}`;
+        const mode = selectDeployMode({ command: 'deploy', environment, definition });
+        if (mode.kind !== 'canonical') {
+            unlisted.push(Object.freeze({
+                environment,
+                adapter: name,
+                reason: mode.kind,
+            }));
+            notices.push(mode.kind === 'legacy-direct'
+                ? `Environment ${environment} is not listed: it deploys in legacy direct mode, replacing ` +
+                    'one stable target in place, and has no immutable deployments.'
+                : `Environment ${environment} is not listed: deploy refuses its configuration. ` +
+                    mode.refusals.map((refusal) => refusal.guidance).join(' '));
+            continue;
+        }
+        if (!('list' in adapter) || typeof adapter.list !== 'function') {
+            unlisted.push(Object.freeze({ environment, adapter: name, reason: 'unsupported' }));
+            notices.push(`Environment ${environment} is not listed: adapter ${name} lists no deployments.`);
+            continue;
+        }
+        let listed;
+        try {
+            listed = await adapter.list(parameters, {
+                origin: input.origin,
+                environment,
+                signal: input.signal,
+                ...(input.identity === undefined ? {} : { identity: input.identity }),
+            });
+            if (!Array.isArray(listed)) {
+                throw new TypeError(`Adapter ${name} listed no array of deployments.`);
+            }
+            for (const deployment of listed)
+                admitListed(deployment, name);
+        }
+        catch (cause) {
+            failures.push(Object.freeze({
+                environment,
+                adapter: name,
+                error: cause instanceof Error ? cause : new Error(String(cause)),
+            }));
+            continue;
+        }
+        for (const deployment of listed) {
+            const row = listedDeployment(deployment, { origin: input.origin, environment, adapter: name });
+            if (row.recordRefusal !== undefined) {
+                notices.push(deployment.record === undefined
+                    ? `Deployment ${row.label} (${environment}) is listed from what its host knows: ` +
+                        `${row.recordRefusal}`
+                    : `Deployment ${row.label} (${environment}) is listed from what its host knows: its ` +
+                        `stored record is not admitted. ${row.recordRefusal}`);
+            }
+            deployments.push(row);
+        }
+    }
+    return Object.freeze({
+        result: Object.freeze({
+            format: 'astrale.deployment-list',
+            version: 1,
+            origin: input.origin,
+            deployments: Object.freeze(deployments),
+            unlisted: Object.freeze(unlisted),
+        }),
+        notices: Object.freeze(notices),
+        failures: Object.freeze(failures),
+    });
+}
+/**
+ * One listed deployment, its record admitted when it describes exactly this deployment of this
+ * origin and Environment. Its name comes from the admitted record; otherwise it is named in the
+ * listed Environment, with the commit of the stored record only when that record names this
+ * deployment, origin and Environment, as `deploymentName` reads a commit.
+ */
+export function listedDeployment(deployment, listing) {
+    let record = null;
+    let recordRefusal;
+    if (deployment.record === undefined) {
+        recordRefusal = NO_RECORD;
+    }
+    else {
+        try {
+            const admitted = acceptDeploymentRecord(deployment.record);
+            recordRefusal = describesAnother(admitted, deployment.label, listing);
+            if (recordRefusal === undefined)
+                record = admitted;
+        }
+        catch (cause) {
+            recordRefusal = cause instanceof Error ? cause.message : String(cause);
+        }
+    }
+    // No Publication names a deployment yet: the registry is read by `list` once versions exist.
+    const name = deploymentName(record ?? canonicalParts(deployment.record, deployment.label, listing), []);
+    return Object.freeze({
+        environment: listing.environment,
+        adapter: listing.adapter,
+        name,
+        id: deployment.id,
+        url: deployment.url,
+        label: deployment.label,
+        line: deployment.line,
+        owner: deployment.owner,
+        state: deployment.state,
+        retention: deployment.retention,
+        createdAt: deployment.createdAt,
+        ...(deployment.lastCallAt === undefined ? {} : { lastCallAt: deployment.lastCallAt }),
+        ...(deployment.expiresAt === undefined ? {} : { expiresAt: deployment.expiresAt }),
+        ...(deployment.retiredAt === undefined ? {} : { retiredAt: deployment.retiredAt }),
+        ...(deployment.retirement === undefined ? {} : { retirement: deployment.retirement }),
+        signingKeyId: deployment.signingKeyId,
+        record,
+        ...(recordRefusal === undefined ? {} : { recordRefusal }),
+        callTarget: deployment.callTarget,
+    });
+}
+/**
+ * Why a deployment its host keeps no record of has none: the adapter lists it without `record`, as a
+ * platform namespace lists a deployment it has not activated.
+ */
+const NO_RECORD = 'Its host keeps no record of it: it has not been activated (a deploy still in progress, or one ' +
+    'that stopped before activating it).';
+/** Why an admitted record does not describe the listed deployment, if it does not. */
+function describesAnother(record, label, listing) {
+    if (record.providerScript !== label) {
+        return `Deployment record describes deployment ${record.providerScript}, not ${label}.`;
+    }
+    if (record.origin !== listing.origin) {
+        return `Deployment record declares origin ${record.origin}, not ${listing.origin}.`;
+    }
+    if (record.environment !== listing.environment) {
+        return `Deployment record declares environment ${record.environment}, not ${listing.environment}.`;
+    }
+    return undefined;
+}
+/**
+ * What a deployment name may read of a stored record that is not admitted: the listed Environment,
+ * never the record's own, and the record's commit only when the record names this deployment, its
+ * origin and that Environment, each part kept only with the type the name reads. No digest: a
+ * record the listing does not admit is never named by a published version.
+ */
+function canonicalParts(input, label, listing) {
+    const value = members(input);
+    // A record that does not say it describes this deployment says nothing of it, not its commit.
+    const describesThis = value?.providerScript === label &&
+        value.origin === listing.origin &&
+        value.environment === listing.environment;
+    const commit = describesThis ? members(value.commit) : undefined;
+    const base = members(commit?.base);
+    return {
+        environment: listing.environment,
+        commit: typeof commit?.sha === 'string'
+            ? {
+                sha: commit.sha,
+                dirty: commit.dirty === true,
+                ...(typeof base?.version === 'string' && typeof base.distance === 'number'
+                    ? { base: { version: base.version, distance: base.distance } }
+                    : {}),
+            }
+            : null,
+    };
+}
+const STATES = ['deploying', 'active', 'retiring', 'retired', 'failed'];
+/**
+ * Admit one deployment an adapter listed, before any is kept: the facts a row prints, each of the
+ * type `DeploymentSummaryV1` gives it, and a call target an operator can act on. Anything else is
+ * that Environment's failure, never a row without its call target.
+ */
+function admitListed(deployment, adapter) {
+    const invalid = (member) => {
+        throw new TypeError(`Adapter ${adapter} listed an invalid deployment (${member}).`);
+    };
+    const value = members(deployment) ?? invalid('deployment');
+    for (const key of ['id', 'url', 'label', 'line', 'owner', 'createdAt', 'signingKeyId']) {
+        if (!text(value[key]))
+            invalid(key);
+    }
+    for (const key of ['lastCallAt', 'expiresAt', 'retiredAt']) {
+        if (value[key] !== undefined && !text(value[key]))
+            invalid(key);
+    }
+    if (!STATES.includes(value.state))
+        invalid('state');
+    if (value.retention !== 'preview' && value.retention !== 'published')
+        invalid('retention');
+    if (value.retirement !== undefined &&
+        value.retirement !== 'expired' &&
+        value.retirement !== 'withdrawn') {
+        invalid('retirement');
+    }
+    const target = members(value.callTarget) ?? invalid('callTarget');
+    if (target.kind === 'services') {
+        if (!text(target.path) || (target.admin !== undefined && !text(target.admin))) {
+            invalid('callTarget');
+        }
+    }
+    else if (target.kind !== 'namespace' || !text(target.namespace) || !text(target.script)) {
+        invalid('callTarget');
+    }
+}
+function text(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function members(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input)
+        ? input
+        : undefined;
+}
+const COLUMNS = ['RELEASE', 'VERSION', 'ENV', 'STATE', 'LAST CALL', 'EXPIRES', 'URL'];
+const MINUTE = 60_000;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+/**
+ * The listing as a table for a person, at `now`: each deployment's release, its name as computed
+ * (never shortened, AM-57), its Environment and state, its last call and its expiry, and the URL
+ * `astrale domain install` takes. Without deployments, it says so only for what was listed: nothing
+ * when a host `failed` (stderr says which), and that some Environments were not listed when any
+ * was not.
+ */
+export function renderDeploymentList(result, now, failed = false) {
+    if (result.deployments.length === 0) {
+        if (failed)
+            return Object.freeze([]);
+        return Object.freeze([
+            result.unlisted.length === 0
+                ? `No deployments of ${result.origin}.`
+                : `No deployments of ${result.origin} in the Environments listed; ` +
+                    `${result.unlisted.length} not listed (see above).`,
+        ]);
+    }
+    const rows = result.deployments.map((deployment) => [
+        deployment.record === null ? '?' : shortDigest(deployment.record.releaseDigest),
+        deployment.name,
+        deployment.environment,
+        deployment.state,
+        deployment.lastCallAt === undefined
+            ? '—'
+            : `${elapsed(now - Date.parse(deployment.lastCallAt))} ago`,
+        expiry(deployment, now),
+        deployment.url,
+    ]);
+    const widths = COLUMNS.map((column, index) => Math.max(column.length, ...rows.map((row) => row[index].length)));
+    const line = (cells) => cells
+        .map((cell, index) => (index === cells.length - 1 ? cell : cell.padEnd(widths[index])))
+        .join('  ');
+    return Object.freeze([line(COLUMNS), ...rows.map(line)]);
+}
+/** `sha256:` and the first seven hexadecimal digits, as git abbreviates a commit. */
+function shortDigest(digest) {
+    return `${digest.slice(0, 'sha256:'.length + 7)}…`;
+}
+/**
+ * When a deployment stops serving: `never` once published, else its preview expiry as its host
+ * keeps it, 30 days after its activation or its last call, whichever is later (AM-123), with the
+ * calls counted since the host recorded them; `due` once that instant passed but the host has not
+ * retired it yet; for a retired deployment, why it was retired.
+ */
+function expiry(deployment, now) {
+    if (deployment.state === 'retiring')
+        return 'retiring';
+    if (deployment.state === 'retired')
+        return deployment.retirement ?? 'retired';
+    if (deployment.retention === 'published')
+        return 'never';
+    if (deployment.expiresAt === undefined)
+        return '—';
+    const remaining = Date.parse(deployment.expiresAt) - now;
+    return remaining > 0 ? `in ${elapsed(remaining)}` : 'due';
+}
+/** A duration as a person reads it in a listing: minutes, then hours, then days. */
+function elapsed(milliseconds) {
+    if (!(milliseconds >= MINUTE))
+        return '< 1 min';
+    if (milliseconds < HOUR)
+        return `${Math.floor(milliseconds / MINUTE)} min`;
+    if (milliseconds < DAY)
+        return `${Math.floor(milliseconds / HOUR)} h`;
+    return `${Math.floor(milliseconds / DAY)} d`;
+}

package/dist/tooling/cli/orchestrate.d.ts

@@ -1,5 +1,5 @@
 import { type ParsedArgs } from './arguments.js';
-import { develop } from './development/develop.js';
+import { develop } from './legacy/development/index.js';
 export declare function run(argv: readonly string[]): Promise<number>;
 export declare function executeDevelopmentCommand(parsed: ParsedArgs, input: {
     readonly configPath: string;

package/dist/tooling/cli/orchestrate.js

@@ -1,21 +1,19 @@
 import { existsSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { admitRuntime, compile, resolveRuntime, verifyDeployment, verifyPreflight, } from '../../deployment/index.js';
+import { dirname, join, resolve } from 'node:path';
+import { admitRuntime, compile, resolveRuntime } from '../../deployment/index.js';
 import { packageDomain } from '../packaging/index.js';
 import { parseArgs } from './arguments.js';
-import { resolveCompatibleAstrale } from './astrale/version.js';
 import { buildResult, bundleBuild, bundlerCopyWarnings, projectBundlers } from './build.js';
 import { BunRequiredError } from './bun.js';
+import { selectDeployMode } from './deploy-mode.js';
 import { deprecationWarnings } from './deprecations.js';
-import { develop } from './development/develop.js';
-import { loadDeclaredSecrets } from './dotenv.js';
-import { reconcileEnvironmentRelease } from './environment-release.js';
 import { ERROR_USAGE, helpRequest, helpText } from './help.js';
-import { stableTargetDeployResult } from './legacy/deploy-result.js';
-import { stableTargetAdapter } from './legacy/stable-target-adapter.js';
-import { stableTargetBuildWarning } from './legacy/uploaded-build.js';
+import { deployImmutable } from './immutable-deployment.js';
+import { develop, developmentDeprecation } from './legacy/development/index.js';
+import { deployStableTarget } from './legacy/stable-target-deploy.js';
+import { listDeployments, renderDeploymentList } from './list.js';
 import { error, info, progress, warn } from './log.js';
-import { importModule, loadProject, runtimeEntrypoint, selectEnvironment } from './project.js';
+import { importModule, loadProject, runtimeEntrypoint, selectEnvironment, } from './project.js';
 import { executeTests } from './test.js';
 const CONFIG_NAMES = ['astrale.config.ts', 'astrale.config.js', 'astrale.config.mjs'];
 export async function run(argv) {
@@ -54,16 +52,30 @@ export async function run(argv) {
     if (!process.versions.bun) {
         throw new BunRequiredError();
     }
+    // Under Bun, before any Project prerequisite, so a refused `dev` run still names its
+    // replacement. The Node launcher re-enters Bun through BunRequiredError, so it prints once.
+    if (parsed.command === 'dev')
+        warn(developmentDeprecation(parsed.env));
     const projectDir = process.cwd();
     const configPath = findConfig(projectDir);
     if (configPath === undefined) {
         error(`No astrale.config.ts found in ${projectDir}.`);
         return 1;
     }
+    const project = await loadProject(configPath);
+    if (parsed.command === 'list')
+        return list(parsed, project);
     if (parsed.command === 'dev') {
+        // `dev` deploys only legacy direct-mode Environments; any other is refused before any effect.
+        const mode = selectDeployMode({
+            command: 'dev',
+            environment: parsed.env,
+            definition: selectEnvironment(project, parsed.env),
+        });
+        if (refused(mode))
+            return 1;
         return executeDevelopmentCommand(parsed, { configPath, projectDir });
     }
-    const project = await loadProject(configPath);
     if (parsed.command === 'test') {
         selectEnvironment(project, parsed.env);
         return executeTests({
@@ -111,97 +123,96 @@ export async function run(argv) {
         }
     }
     const environment = selectEnvironment(project, parsed.env);
+    // The configuration selects the deploy mode, before any effect (CT33).
+    const mode = selectDeployMode({
+        command: 'deploy',
+        environment: parsed.env,
+        definition: environment,
+    });
+    if (refused(mode))
+        return 1;
     // With `--json`, stdout carries only the DeployResultV1; progress goes to stderr.
     const report = progress(parsed.json === true);
-    const adapter = stableTargetAdapter(environment.deployment.adapter);
-    const parameters = environment.deployment.parameters;
     const lifecycle = deploymentLifecycle();
     try {
-        // `deploy` rebuilds exactly as `build` does; preparation then only places that Bundle.
-        const bundle = await bundleBuild({
-            bundler: adapter.bundler,
-            projectDir,
-            build,
-            runtime: resolved,
-            signal: lifecycle.signal,
-        });
-        const source = await adapter.prepare(parameters, {
+        const deployment = {
             projectDir,
             environment: parsed.env,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
-            mode: 'release',
-            signal: lifecycle.signal,
             build,
             runtime: resolved,
-            bundle,
-        });
-        const artifact = verifyPreflight({ build, runtime: resolved, source });
-        const secrets = secretsFor(adapter, parameters, projectDir, resolved.runtime);
-        const installationExecutable = environment.installation === undefined || parsed.deployOnly
-            ? undefined
-            : await resolveCompatibleAstrale({ projectDir, signal: lifecycle.signal });
-        const deployed = await adapter.deploy(parameters, {
-            projectDir,
-            environment: parsed.env,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
             ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
-            secrets,
-            artifact,
             signal: lifecycle.signal,
-        });
-        const result = verifyDeployment(artifact, deployed);
-        if (result.status === 'failed') {
-            error(`Deployment failed during ${result.phase}: ${result.error.message}`);
+            report,
+        };
+        const deployed = mode.kind === 'canonical'
+            ? await deployImmutable({
+                ...deployment,
+                adapter: environment.deployment.adapter,
+                parameters: environment.deployment.parameters,
+            })
+            : await deployStableTarget({
+                ...deployment,
+                definition: environment,
+                reasons: mode.reasons,
+            });
+        if (deployed === undefined)
             return 1;
-        }
-        const uploaded = result.progress.provider.evidence.build;
-        if (uploaded !== undefined) {
-            // prepare/deploy places a stable target: a differing upload only warns.
-            const warning = stableTargetBuildWarning(bundle, uploaded);
-            if (warning !== undefined)
-                warn(warning);
-        }
-        report(`Domain: ${result.release.publication.origin}`);
-        report(`Environment: ${parsed.env}`);
-        report(`Adapter: ${adapter.name}@${adapter.version}`);
-        report(`Deployment: ${result.progress.provider.evidence.deployment}`);
-        if (result.progress.provider.evidence.preflight !== undefined) {
-            report(`Preflight: ${result.progress.provider.evidence.preflight}; public readiness verified`);
-        }
-        report(`Public: ${result.release.addressing.publicUrl}`);
-        report(`Publication: ${result.release.publication.schema.revision} · ${result.release.publication.etag}`);
-        const installed = await reconcileEnvironmentRelease({
-            projectDir,
-            environment: parsed.env,
-            adapter,
-            deployment: result,
-            ...(environment.installation === undefined ? {} : { installation: environment.installation }),
-            deployOnly: parsed.deployOnly ?? false,
-            ...(installationExecutable === undefined ? {} : { installationExecutable }),
+        if (parsed.json === true)
+            process.stdout.write(`${JSON.stringify(deployed, null, 2)}\n`);
+        return 0;
+    }
+    finally {
+        lifecycle.dispose();
+    }
+}
+/**
+ * `astrale-domain list`: the deployments of every Environment, or of the one `--environment`
+ * names, as their hosts keep them for the caller. With `--json`, stdout carries only the
+ * ListResultV1, and only when every host answered; notices go to stderr.
+ */
+async function list(parsed, project) {
+    const origin = compile(project.domain).schema.compiled.root.origin;
+    const environments = parsed.env === ''
+        ? Object.entries(project.environments)
+        : [[parsed.env, selectEnvironment(project, parsed.env)]];
+    const lifecycle = deploymentLifecycle();
+    try {
+        const listing = await listDeployments({
+            origin,
+            environments,
             ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
             signal: lifecycle.signal,
         });
-        if (installed === undefined) {
-            report('Installation: skipped');
-        }
-        else {
-            report(`Installation: ${installed.instance} · ${installed.status}`);
+        for (const notice of listing.notices)
+            warn(notice);
+        for (const failure of listing.failures) {
+            error(`Environment ${failure.environment} could not be listed (${failure.adapter}): ` +
+                failure.error.message);
         }
-        report('Ready: deployment verified');
         if (parsed.json === true) {
-            const deployed = stableTargetDeployResult({
-                environment: parsed.env,
-                adapter,
-                deployment: result,
-            });
-            process.stdout.write(`${JSON.stringify(deployed, null, 2)}\n`);
+            if (listing.failures.length > 0)
+                return 1;
+            process.stdout.write(`${JSON.stringify(listing.result, null, 2)}\n`);
+            return 0;
         }
-        return 0;
+        const failed = listing.failures.length > 0;
+        for (const line of renderDeploymentList(listing.result, Date.now(), failed)) {
+            process.stdout.write(`${line}\n`);
+        }
+        return failed ? 1 : 0;
     }
     finally {
         lifecycle.dispose();
     }
 }
+/** Report every refusal of a refused deploy mode, each with what to write instead. */
+function refused(mode) {
+    if (mode.kind !== 'refused')
+        return false;
+    for (const refusal of mode.refusals)
+        error(refusal.guidance);
+    return true;
+}
 export function executeDevelopmentCommand(parsed, input, execute = develop) {
     if (parsed.command !== 'dev')
         throw new TypeError('Development execution requires the dev command.');
@@ -209,10 +220,8 @@ export function executeDevelopmentCommand(parsed, input, execute = develop) {
         configPath: input.configPath,
         projectDir: input.projectDir,
         environment: parsed.env,
-        deployOnly: parsed.deployOnly ?? false,
         ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
         ...(parsed.credentialFile === undefined ? {} : { credentialFile: parsed.credentialFile }),
-        ...(parsed.sessionFile === undefined ? {} : { sessionFile: parsed.sessionFile }),
         ...(parsed.secretsFile === undefined ? {} : { secretsFile: parsed.secretsFile }),
     });
 }
@@ -234,19 +243,6 @@ async function lint(parsed) {
         throw cause;
     }
 }
-function secretsFor(adapter, parameters, projectDir, runtime) {
-    const file = adapter.secretsFile?.(parameters);
-    if (file === undefined)
-        return Object.freeze({});
-    const path = isAbsolute(file) ? file : join(projectDir, file);
-    // An Integration-free Runtime has no Providers and therefore no author-owned
-    // environment secrets. Adapter-owned secrets, such as the signing identity,
-    // are resolved separately by the adapter and must not make this file required.
-    if (Object.keys(runtime.integrations).length === 0 && !existsSync(path)) {
-        return Object.freeze({});
-    }
-    return Object.freeze(loadDeclaredSecrets(path, file));
-}
 function findConfig(projectDir) {
     return CONFIG_NAMES.map((name) => join(projectDir, name)).find(existsSync);
 }

package/dist/tooling/cli/secrets.d.ts

@@ -0,0 +1,9 @@
+import type { Runtime } from '../../application/runtime/index.js';
+import type { Adapter, LegacyAdapter } from '../../deployment/adapter/index.js';
+/**
+ * The secrets one Environment's deployment binds: the values of the secrets file its adapter
+ * declares. An Integration-free Runtime has no Providers and therefore no author-owned secrets, so
+ * its file may be absent; adapter-owned secrets, such as a signing identity, are the adapter's to
+ * resolve and never make this file required.
+ */
+export declare function environmentSecrets(adapter: Adapter<object> | LegacyAdapter<object>, parameters: object, projectDir: string, runtime: Runtime): Readonly<Record<string, string>>;

package/dist/tooling/cli/secrets.js

@@ -0,0 +1,19 @@
+import { existsSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { loadDeclaredSecrets } from './dotenv.js';
+/**
+ * The secrets one Environment's deployment binds: the values of the secrets file its adapter
+ * declares. An Integration-free Runtime has no Providers and therefore no author-owned secrets, so
+ * its file may be absent; adapter-owned secrets, such as a signing identity, are the adapter's to
+ * resolve and never make this file required.
+ */
+export function environmentSecrets(adapter, parameters, projectDir, runtime) {
+    const file = adapter.secretsFile?.(parameters);
+    if (file === undefined)
+        return Object.freeze({});
+    const path = isAbsolute(file) ? file : join(projectDir, file);
+    if (Object.keys(runtime.integrations).length === 0 && !existsSync(path)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(loadDeclaredSecrets(path, file));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.13",
+  "version": "0.6.0-beta.15",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -253,11 +253,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.83",
-    "@astrale-os/kernel-core": "0.9.0-beta.62",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.44",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.68",
-    "@astrale-os/kernel-server": "0.5.0-beta.70",
+    "@astrale-os/kernel-client": "0.6.0-beta.84",
+    "@astrale-os/kernel-core": "0.9.0-beta.63",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.69",
+    "@astrale-os/kernel-server": "0.5.0-beta.71",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -333,7 +333,7 @@
     "e2e": "node __e2e__/flagship/runner.mjs",
     "typecheck": "tsgo --noEmit && pnpm run typecheck:workers && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
     "typecheck:workers": "tsgo --noEmit -p tsconfig.workers.json",
-    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json",
+    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/legacy/development/.spec/tsconfig.json",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "typecheck:tests": "tsgo --noEmit -p tsconfig.test.json",
     "typecheck:e2e": "tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.v1.json && tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.json",

package/dist/deployment/verify/readiness/publication.d.ts

@@ -1,11 +0,0 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
-import type { Release } from '../../release/legacy/index.js';
-export type ReadinessFetch = (input: string, init: {
-    readonly redirect: 'error';
-    readonly signal?: AbortSignal;
-}) => Promise<Response>;
-/** Fetch and verify the exact live Publication and Bundle for one Release. */
-export declare function verifyPublication(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<publication.Publication>;