@astrale-os/sdk 0.6.0-beta.17 → 0.6.0-beta.19

package/dist/tooling/cli/legacy/development/candidate.js

@@ -1,170 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdir, rm, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { admitRuntime, compile, resolveRuntime, runtime, verifyPreflight, } from '../../../../deployment/index.js';
-import { admitProjectModule } from '../../../../project/index.js';
-import { loadDeclaredSecrets } from '../../dotenv.js';
-import { selectEnvironment } from '../../project.js';
-import { stableTargetAdapter } from '../stable-target-adapter.js';
-import { projectImportPlugin } from './project-imports.js';
-import { DevelopmentSources } from './sources.js';
-/** Rebuild one complete, isolated Environment candidate from authored sources. */
-export class DevelopmentCandidateBuilder {
-    #configPath;
-    #projectDir;
-    #environment;
-    #runtimePath;
-    #overrideSecrets;
-    #generation = 0;
-    constructor(input) {
-        this.#configPath = input.configPath;
-        this.#projectDir = input.projectDir;
-        this.#environment = input.environment;
-        this.#runtimePath = input.runtimePath;
-        this.#overrideSecrets = input.overrideSecrets;
-    }
-    async prepare(signal) {
-        throwIfAborted(signal);
-        const directory = join(this.#projectDir, '.astrale', 'development', this.#environment, 'source', String(++this.#generation));
-        await mkdir(directory, { recursive: true });
-        const bridge = join(directory, 'bridge.ts');
-        const sources = new DevelopmentSources(this.#projectDir);
-        sources.record(join(this.#projectDir, 'package.json'));
-        const configImport = moduleSpecifier(dirname(bridge), this.#configPath);
-        const runtimeImport = moduleSpecifier(dirname(bridge), resolve(dirname(this.#configPath), this.#runtimePath));
-        await writeFile(bridge, `export { default as project } from ${JSON.stringify(configImport)}\n` +
-            `export { default as runtime } from ${JSON.stringify(runtimeImport)}\n`);
-        try {
-            const bunRuntime = bun();
-            const built = await bunRuntime.build({
-                entrypoints: [bridge],
-                outdir: directory,
-                naming: 'application.mjs',
-                target: 'bun',
-                format: 'esm',
-                packages: 'bundle',
-                plugins: [projectImportPlugin(this.#projectDir, bunRuntime)],
-                splitting: false,
-                sourcemap: 'inline',
-                metafile: true,
-                throw: false,
-            });
-            throwIfAborted(signal);
-            if (!built.success) {
-                const diagnostics = built.logs.map(({ message, position }) => position === undefined || position === null
-                    ? message
-                    : `${relative(this.#projectDir, position.file)}:${position.line}:${position.column}: ${message}`);
-                throw new Error(['Authored Domain rebuild failed.', ...diagnostics].join('\n'));
-            }
-            const output = built.outputs.find((candidate) => candidate.path.endsWith('application.mjs'));
-            if (output === undefined)
-                throw new Error('Authored Domain rebuild produced no module.');
-            const loaded = (await import(`${pathToFileURL(output.path).href}?development=${this.#generation}`));
-            if (Object.keys(loaded).some((key) => key !== 'project' && key !== 'runtime')) {
-                throw new TypeError('Development bridge produced unexpected exports.');
-            }
-            const project = admitProjectModule({ default: loaded.project });
-            if ((project.entrypoints?.runtime ?? './runtime.ts') !== this.#runtimePath) {
-                throw new Error('Runtime entrypoint changed; restart pnpm dev to apply it.');
-            }
-            const environment = selectEnvironment(project, this.#environment);
-            const resolved = await resolveRuntime(runtime(this.#runtimePath), async (path) => {
-                if (path !== this.#runtimePath) {
-                    throw new Error('Runtime entrypoint changed; restart pnpm dev to apply it.');
-                }
-                return Object.freeze({ default: loaded.runtime });
-            });
-            const build = compile(project.domain);
-            admitRuntime({ runtime: build.runtime }, resolved);
-            const adapter = stableTargetAdapter(environment.deployment.adapter);
-            const parameters = environment.deployment.parameters;
-            for (const path of Object.keys(built.metafile?.inputs ?? {}))
-                sources.record(path);
-            const source = await adapter.prepare(parameters, {
-                projectDir: this.#projectDir,
-                environment: this.#environment,
-                mode: 'release',
-                recordSource: sources.record,
-                signal,
-                build,
-                runtime: resolved,
-            });
-            const artifact = verifyPreflight({ build, runtime: resolved, source });
-            const declared = this.#overrideSecrets === undefined
-                ? secretsFor(adapter, parameters, this.#projectDir, resolved.runtime)
-                : { values: this.#overrideSecrets };
-            if (declared.path !== undefined)
-                sources.record(declared.path);
-            return Object.freeze({
-                adapter,
-                parameters,
-                artifact,
-                secrets: declared.values,
-                sources: sources.snapshot(),
-            });
-        }
-        finally {
-            await rm(directory, { recursive: true, force: true });
-        }
-    }
-}
-export async function discoverRuntimePath(configPath) {
-    const loaded = (await import(`${pathToFileURL(configPath).href}?discover=${Date.now()}`));
-    const project = admitProjectModule(loaded);
-    return project.entrypoints?.runtime ?? './runtime.ts';
-}
-export function sameEnvironment(current, candidate) {
-    return (candidate.adapter.name === current.adapter.name &&
-        candidate.adapter.version === current.adapter.version &&
-        candidate.artifact.build.schema.compiled.root.origin ===
-            current.artifact.build.schema.compiled.root.origin &&
-        stable(candidate.parameters) === stable(current.parameters));
-}
-/** Identify a rebuilt candidate that cannot change provider state. */
-export function sameDeploymentCandidate(current, candidate) {
-    return (sameEnvironment(current, candidate) &&
-        candidate.artifact.build.schema.compiled.root.revision ===
-            current.artifact.build.schema.compiled.root.revision &&
-        candidate.artifact.digest === current.artifact.digest &&
-        stable(candidate.secrets) === stable(current.secrets));
-}
-function secretsFor(adapter, parameters, projectDir, selectedRuntime) {
-    const file = adapter.secretsFile?.(parameters);
-    if (file === undefined)
-        return { values: Object.freeze({}) };
-    const path = isAbsolute(file) ? file : join(projectDir, file);
-    if (Object.keys(selectedRuntime.integrations).length === 0 && !existsSync(path)) {
-        return { values: Object.freeze({}) };
-    }
-    return { values: Object.freeze(loadDeclaredSecrets(path, file)), path };
-}
-function bun() {
-    const value = Reflect.get(globalThis, 'Bun');
-    if (value === undefined || typeof value.build !== 'function') {
-        throw new TypeError('Domain development requires the Bun runtime.');
-    }
-    return value;
-}
-function moduleSpecifier(from, target) {
-    const path = relative(from, target).split(sep).join('/');
-    return path.startsWith('.') ? path : `./${path}`;
-}
-function stable(input) {
-    if (input === undefined)
-        return 'undefined';
-    if (input === null || typeof input !== 'object')
-        return JSON.stringify(input);
-    if (Array.isArray(input))
-        return `[${input.map(stable).join(',')}]`;
-    const record = input;
-    return `{${Object.keys(record)
-        .sort()
-        .map((key) => `${JSON.stringify(key)}:${stable(record[key])}`)
-        .join(',')}}`;
-}
-function throwIfAborted(signal) {
-    if (signal.aborted) {
-        throw signal.reason instanceof Error ? signal.reason : new Error('Development interrupted.');
-    }
-}

package/dist/tooling/cli/legacy/development/credential.d.ts

@@ -1,2 +0,0 @@
-/** Admit one caller-owned credential without retaining its value outside this command. */
-export declare function loadPrivateCredentialFile(path: string, platform?: NodeJS.Platform): string;

package/dist/tooling/cli/legacy/development/credential.js

@@ -1,57 +0,0 @@
-import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
-const MAXIMUM_CREDENTIAL_BYTES = 64 * 1024;
-/** Admit one caller-owned credential without retaining its value outside this command. */
-export function loadPrivateCredentialFile(path, platform = process.platform) {
-    if (platform === 'win32') {
-        throw new Error('--credential-file is unavailable on Windows until private no-reparse file admission is supported.');
-    }
-    let descriptor;
-    try {
-        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    }
-    catch (cause) {
-        if (errorCode(cause) === 'ENOENT') {
-            throw new Error(`Credential file '${path}' is missing.`, { cause });
-        }
-        if (errorCode(cause) === 'ELOOP') {
-            throw new Error(`Credential file '${path}' must be a regular file and not a symlink.`, {
-                cause,
-            });
-        }
-        throw cause;
-    }
-    try {
-        const info = fstatSync(descriptor);
-        if (!info.isFile())
-            throw new Error(`Credential file '${path}' must be a regular file.`);
-        if ((info.mode & 0o077) !== 0) {
-            throw new Error(`Credential file '${path}' must not be accessible by group or other users.`);
-        }
-        if (info.size === 0 || info.size > MAXIMUM_CREDENTIAL_BYTES) {
-            throw new Error(`Credential file '${path}' must contain one bounded credential.`);
-        }
-        const bytes = Buffer.allocUnsafe(info.size + 1);
-        let offset = 0;
-        while (offset < bytes.length) {
-            const read = readSync(descriptor, bytes, offset, bytes.length - offset, null);
-            if (read === 0)
-                break;
-            offset += read;
-        }
-        if (offset !== info.size)
-            throw new Error(`Credential file '${path}' changed while read.`);
-        const credential = bytes.subarray(0, offset).toString('utf8').trim();
-        if (credential.length === 0 || /[\r\n\0]/u.test(credential)) {
-            throw new Error(`Credential file '${path}' must contain exactly one credential.`);
-        }
-        return credential;
-    }
-    finally {
-        closeSync(descriptor);
-    }
-}
-function errorCode(input) {
-    return input !== null && typeof input === 'object' && 'code' in input
-        ? String(Reflect.get(input, 'code'))
-        : undefined;
-}

package/dist/tooling/cli/legacy/development/deployment.d.ts

@@ -1,10 +0,0 @@
-import type { ReadyDeployResult } from '../../../../deployment/adapter/index.js';
-import type { DevelopmentCandidate } from './candidate.js';
-export interface DevelopmentDeploymentInput {
-    readonly projectDir: string;
-    readonly environment: string;
-    readonly identity?: string;
-    readonly credential?: string;
-}
-/** Commit and verify one complete remote candidate. A development deployment installs nothing. */
-export declare function deployDevelopmentCandidate(candidate: DevelopmentCandidate, input: DevelopmentDeploymentInput, signal: AbortSignal): Promise<ReadyDeployResult>;

package/dist/tooling/cli/legacy/development/deployment.js

@@ -1,20 +0,0 @@
-import { verifyDeployment } from '../../../../deployment/index.js';
-/** Commit and verify one complete remote candidate. A development deployment installs nothing. */
-export async function deployDevelopmentCandidate(candidate, input, signal) {
-    const deployed = await candidate.adapter.deploy(candidate.parameters, {
-        projectDir: input.projectDir,
-        environment: input.environment,
-        ...(input.identity === undefined ? {} : { identity: input.identity }),
-        ...(input.credential === undefined ? {} : { credential: input.credential }),
-        secrets: candidate.secrets,
-        artifact: candidate.artifact,
-        signal,
-    });
-    const verified = verifyDeployment(candidate.artifact, deployed);
-    if (verified.status === 'failed') {
-        throw new Error(`Deployment failed during ${verified.phase}: ${verified.error.message}`, {
-            cause: verified.error,
-        });
-    }
-    return verified;
-}

package/dist/tooling/cli/legacy/development/deprecation.d.ts

@@ -1,11 +0,0 @@
-/**
- * What replaces `astrale-domain dev`, for its author: development is not a command of the
- * deployment model. A developer, or an agent, deploys the Environment and installs the URL that
- * deploy prints on their own instance.
- *
- * `--direct` sends that URL to the instance's Kernel. Without it, the CLI releases published so
- * far route a bare URL through the Admin catalog, which only knows published entries, so a fresh
- * deployment URL fails to install. The CLI keeps accepting `--direct` after it starts sending
- * every URL to the Kernel, and drops the flag only after this command is removed.
- */
-export declare function developmentDeprecation(environment: string): string;

package/dist/tooling/cli/legacy/development/deprecation.js

@@ -1,13 +0,0 @@
-/**
- * What replaces `astrale-domain dev`, for its author: development is not a command of the
- * deployment model. A developer, or an agent, deploys the Environment and installs the URL that
- * deploy prints on their own instance.
- *
- * `--direct` sends that URL to the instance's Kernel. Without it, the CLI releases published so
- * far route a bare URL through the Admin catalog, which only knows published entries, so a fresh
- * deployment URL fails to install. The CLI keeps accepting `--direct` after it starts sending
- * every URL to the Kernel, and drops the flag only after this command is removed.
- */
-export function developmentDeprecation(environment) {
-    return `astrale-domain dev is deprecated and will be removed: run \`astrale-domain deploy ${environment}\`, then \`astrale domain install <url> --direct -i <instance>\` with the URL it prints.`;
-}

package/dist/tooling/cli/legacy/development/develop.d.ts

@@ -1,15 +0,0 @@
-/**
- * Watch one Project Environment and serialize complete remote deployment generations. Each
- * generation replaces the Environment's stable target in place; none installs anything.
- *
- * @deprecated Deploy the Environment with `astrale-domain deploy`, then install the printed URL
- * with `astrale domain install <url> --direct -i <instance>`.
- */
-export declare function develop(input: {
-    readonly configPath: string;
-    readonly projectDir: string;
-    readonly environment: string;
-    readonly identity?: string;
-    readonly credentialFile?: string;
-    readonly secretsFile?: string;
-}): Promise<number>;

package/dist/tooling/cli/legacy/development/develop.js

@@ -1,142 +0,0 @@
-import { rm, rmdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { deprecationWarnings } from '../../deprecations.js';
-import { error, info, warn } from '../../log.js';
-import { DevelopmentCandidateBuilder, discoverRuntimePath, sameDeploymentCandidate, sameEnvironment, } from './candidate.js';
-import { loadPrivateCredentialFile } from './credential.js';
-import { deployDevelopmentCandidate } from './deployment.js';
-import { DevelopmentLifecycle } from './lifecycle.js';
-import { acquireProjectLock } from './project-lock.js';
-import { LatestRebuild } from './rebuild.js';
-import { reportDevelopmentDeployment } from './report.js';
-import { loadPrivateSecretsFile } from './secrets-file.js';
-import { watchSources } from './source-watch.js';
-/**
- * Watch one Project Environment and serialize complete remote deployment generations. Each
- * generation replaces the Environment's stable target in place; none installs anything.
- *
- * @deprecated Deploy the Environment with `astrale-domain deploy`, then install the printed URL
- * with `astrale domain install <url> --direct -i <instance>`.
- */
-export async function develop(input) {
-    const lifecycle = new DevelopmentLifecycle();
-    let lock;
-    let sourceWatch;
-    let rebuild;
-    let current;
-    let failure;
-    const cleanup = [];
-    try {
-        lock = await acquireProjectLock({
-            projectRoot: input.projectDir,
-            environment: input.environment,
-        });
-        const overrideSecrets = input.secretsFile === undefined
-            ? undefined
-            : Object.freeze(loadPrivateSecretsFile(input.secretsFile));
-        const credential = input.credentialFile === undefined
-            ? undefined
-            : loadPrivateCredentialFile(input.credentialFile);
-        const runtimePath = await discoverRuntimePath(input.configPath);
-        const builder = new DevelopmentCandidateBuilder({
-            ...input,
-            runtimePath,
-            overrideSecrets,
-        });
-        current = await builder.prepare(lifecycle.signal);
-        info(`Domain: ${current.artifact.build.schema.compiled.root.origin}`);
-        for (const warning of deprecationWarnings(current.artifact.build))
-            warn(warning);
-        const first = await deployDevelopmentCandidate(current, { ...input, ...(credential === undefined ? {} : { credential }) }, lifecycle.signal);
-        reportDevelopmentDeployment(first, current.adapter, input);
-        let restartReported = false;
-        rebuild = new LatestRebuild({
-            async prepare(_ignored, signal) {
-                info(`Rebuilding: ${input.environment}`);
-                return builder.prepare(signal);
-            },
-            async commit(candidate, signal) {
-                if (!sameEnvironment(current, candidate)) {
-                    restartReported = true;
-                    throw new Error('Project Environment configuration changed; restart pnpm dev to apply it.');
-                }
-                if (sameDeploymentCandidate(current, candidate)) {
-                    current = candidate;
-                    sourceWatch?.update(candidate.sources);
-                    return;
-                }
-                const deployed = await deployDevelopmentCandidate(candidate, { ...input, ...(credential === undefined ? {} : { credential }) }, signal);
-                current = candidate;
-                sourceWatch?.update(candidate.sources);
-                info(`Updated: ${candidate.artifact.build.schema.compiled.root.revision}`);
-                reportDevelopmentDeployment(deployed, candidate.adapter, input);
-            },
-            async failed(cause) {
-                error(cause instanceof Error ? cause.message : String(cause));
-            },
-        });
-        sourceWatch = watchSources({
-            projectDir: input.projectDir,
-            configPath: input.configPath,
-            sources: current.sources,
-            onInvalidate: () => rebuild.invalidate(),
-            onRestartRequired: () => {
-                if (restartReported)
-                    return;
-                restartReported = true;
-                error('Project Environment configuration changed; restart pnpm dev to apply it.');
-            },
-            onError: (cause) => {
-                failure = cause;
-                lifecycle.stop(cause);
-            },
-        });
-        info('Ready: watching for remote deployments');
-        // Edits made while the first build/deployment was in flight predate this watcher.
-        // Catch up once; artifact deduplication prevents an unchanged second deployment.
-        rebuild.invalidate();
-        await lifecycle.stopped;
-    }
-    catch (cause) {
-        failure = cause;
-    }
-    lifecycle.stop(failure);
-    for (const operation of [
-        () => sourceWatch?.stop(),
-        () => rebuild?.stop(failure),
-        () => rm(join(input.projectDir, '.astrale', 'development', input.environment, 'source'), {
-            recursive: true,
-            force: true,
-        }),
-        () => lock?.release(),
-    ]) {
-        try {
-            await operation();
-        }
-        catch (cause) {
-            cleanup.push(cause);
-        }
-    }
-    for (const directory of [
-        join(input.projectDir, '.astrale', 'development', input.environment),
-        join(input.projectDir, '.astrale', 'development'),
-    ]) {
-        try {
-            await rmdir(directory);
-        }
-        catch (cause) {
-            const code = cause.code;
-            if (code !== 'ENOENT' && code !== 'ENOTEMPTY' && code !== 'EEXIST')
-                cleanup.push(cause);
-        }
-    }
-    lifecycle.dispose();
-    if (failure !== undefined) {
-        if (cleanup.length > 0)
-            error(new AggregateError(cleanup, 'Development cleanup failed.').message);
-        throw failure;
-    }
-    if (cleanup.length > 0)
-        throw new AggregateError(cleanup, 'Development cleanup failed.');
-    return 0;
-}

package/dist/tooling/cli/legacy/development/index.d.ts

@@ -1,21 +0,0 @@
-/**
- * `astrale-domain dev` (legacy, deprecated).
- *
- * Development is not a command of the deployment model: a developer, or an agent, iterates with
- * `astrale-domain deploy development`, then `astrale domain install <url> --direct -i <instance>`. This
- * folder keeps the watch loop that updates one deployment per Domain origin and Environment in
- * place and its private file boundaries, exactly as before. Every run warns with that replacement
- * on stderr.
- *
- * Short-term consumers: the `dev` scripts of the Domain packages that still deploy in place,
- * namely the domains repository's ai-gateway, closing, grc, integrations, issues, organization and
- * services packages, the Shell, and ui's Domain, and of the Projects create-astrale-domain
- * scaffolds while its template still declares `dev`. Projects that pin an SDK release older than
- * this folder never reach it.
- *
- * Deletion: once none of those packages runs `astrale-domain dev`, a separate breaking release
- * deletes this folder with the `dev` command and its `--credential-file` and `--secrets-file`
- * flags.
- */
-export { develop } from './develop.js';
-export { developmentDeprecation } from './deprecation.js';

package/dist/tooling/cli/legacy/development/index.js

@@ -1,21 +0,0 @@
-/**
- * `astrale-domain dev` (legacy, deprecated).
- *
- * Development is not a command of the deployment model: a developer, or an agent, iterates with
- * `astrale-domain deploy development`, then `astrale domain install <url> --direct -i <instance>`. This
- * folder keeps the watch loop that updates one deployment per Domain origin and Environment in
- * place and its private file boundaries, exactly as before. Every run warns with that replacement
- * on stderr.
- *
- * Short-term consumers: the `dev` scripts of the Domain packages that still deploy in place,
- * namely the domains repository's ai-gateway, closing, grc, integrations, issues, organization and
- * services packages, the Shell, and ui's Domain, and of the Projects create-astrale-domain
- * scaffolds while its template still declares `dev`. Projects that pin an SDK release older than
- * this folder never reach it.
- *
- * Deletion: once none of those packages runs `astrale-domain dev`, a separate breaking release
- * deletes this folder with the `dev` command and its `--credential-file` and `--secrets-file`
- * flags.
- */
-export { develop } from './develop.js';
-export { developmentDeprecation } from './deprecation.js';

package/dist/tooling/cli/legacy/development/lease.d.ts

@@ -1,18 +0,0 @@
-export declare class DevelopmentLeaseError extends Error {
-    readonly code: 'DEVELOPMENT_LEASE_LOCKED' | 'DEVELOPMENT_LEASE_LOST';
-    readonly name = "DevelopmentLeaseError";
-    constructor(code: 'DEVELOPMENT_LEASE_LOCKED' | 'DEVELOPMENT_LEASE_LOST', message: string, options?: ErrorOptions);
-}
-export interface DevelopmentLease {
-    readonly path: string;
-    readonly recovered: boolean;
-    release(): Promise<void>;
-}
-/** One fail-closed filesystem lease engine for every local development coordinate. */
-export declare function acquireDevelopmentLease(input: {
-    readonly directory: string;
-    readonly coordinate: string;
-    readonly pid?: number;
-    readonly sessionId?: string;
-    readonly processAlive?: (pid: number) => boolean;
-}): Promise<DevelopmentLease>;