npm - @astrale-os/cli - Versions diffs - 0.4.0-alpha.13 → 0.5.0-alpha.0 - Mend

@astrale-os/cli 0.4.0-alpha.13 → 0.5.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (46) hide show

package/LICENSE +202 -0
package/README.md +2 -2
package/THIRD-PARTY-NOTICES.md +27 -0
package/dist/astrale.js +8687 -6398
package/package.json +19 -21
package/src/commands/__tests__/help-contract.test.ts +27 -14
package/src/commands/__tests__/install-identity-override.test.ts +2 -2
package/src/commands/__tests__/ls.test.ts +1 -1
package/src/commands/__tests__/read-commands.test.ts +201 -0
package/src/commands/call.ts +27 -44
package/src/commands/describe.ts +57 -58
package/src/commands/domain/install.ts +4 -4
package/src/commands/get.ts +48 -23
package/src/commands/identity/register.ts +27 -33
package/src/commands/logs.ts +8 -8
package/src/commands/ls.ts +77 -55
package/src/commands/mutate.ts +191 -0
package/src/commands/query.ts +288 -20
package/src/commands/token.ts +4 -7
package/src/kernel/__tests__/expand.test.ts +123 -0
package/src/kernel/client.ts +3 -13
package/src/kernel/expand.ts +52 -59
package/src/kernel/graph.ts +96 -0
package/src/kernel/index.ts +11 -2
package/src/kernel/run.ts +0 -13
package/src/lib/__tests__/table.test.ts +1 -1
package/src/lib/admin-domain.ts +3 -3
package/src/lib/domain-identity.ts +1 -1
package/src/lib/self.ts +1 -3
package/src/program.ts +5 -3
package/src/setup/render.ts +1 -3
package/studio/client/dist/assets/index-BcejyJpa.css +1 -0
package/studio/client/dist/assets/index-Cqz3Oy_B.js +179 -0
package/studio/client/dist/index.html +2 -2
package/studio/server/agent/ask.ts +5 -1
package/studio/server/agent/claude.ts +15 -3
package/studio/server/api.ts +7 -7
package/studio/server/introspect/overlay-tsmorph.ts +108 -50
package/studio/server/state/harness-gateway.ts +12 -3
package/studio/server/state/harness-token.ts +0 -0
package/studio/server/state/visibility.ts +5 -1
package/src/kernel/__tests__/remote-routing.test.ts +0 -70
package/src/kernel/remote-routing.ts +0 -88
package/studio/client/dist/assets/index-DOwzZAEK.css +0 -1
package/studio/client/dist/assets/index-wtU0Zxhy.js +0 -183
package/studio/tsconfig.json +0 -23

package/studio/client/dist/index.html CHANGED Viewed

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Domain Studio</title>
-    <script type="module" crossorigin src="/assets/index-wtU0Zxhy.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DOwzZAEK.css">
+    <script type="module" crossorigin src="/assets/index-Cqz3Oy_B.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BcejyJpa.css">
   </head>
   <body>
     <div id="root"></div>

package/studio/server/agent/ask.ts CHANGED Viewed

@@ -53,7 +53,11 @@ export async function runAsk(
   const settings = readSettings(handle.root)
   const envResult = await resolveHarnessEnv(handle.root)
   if (!envResult.ok)
-    return { text: '', isError: true, errorMessage: `model gateway auth failed — ${envResult.error}` }
+    return {
+      text: '',
+      isError: true,
+      errorMessage: `model gateway auth failed — ${envResult.error}`,
+    }
   return harness.ask({
     root: handle.root,

package/studio/server/agent/claude.ts CHANGED Viewed

@@ -320,7 +320,11 @@ export class ClaudeCodeHarness implements AgentHarness {
       const args = ['-p', '--output-format', 'stream-json', '--verbose', ...EXTRA_ARGS]
       let child: ReturnType<typeof spawn>
       try {
-        child = spawn(BIN, args, { cwd: root, stdio: ['pipe', 'pipe', 'ignore'], env: childEnv(env) })
+        child = spawn(BIN, args, {
+          cwd: root,
+          stdio: ['pipe', 'pipe', 'ignore'],
+          env: childEnv(env),
+        })
       } catch (e) {
         resolve({
           ok: false,
@@ -416,7 +420,11 @@ export class ClaudeCodeHarness implements AgentHarness {
       let errorMessage: string | undefined
       let stderr = ''
-      const child = spawn(BIN, args, { cwd: root, stdio: ['pipe', 'pipe', 'pipe'], env: childEnv(env) })
+      const child = spawn(BIN, args, {
+        cwd: root,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: childEnv(env),
+      })
       const onAbort = () => {
         try {
@@ -595,7 +603,11 @@ export class ClaudeCodeHarness implements AgentHarness {
       let isError = false
       let errorMessage: string | undefined
-      const child = spawn(BIN, args, { cwd: root, stdio: ['pipe', 'pipe', 'pipe'], env: childEnv(env) })
+      const child = spawn(BIN, args, {
+        cwd: root,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: childEnv(env),
+      })
       const onAbort = () => {
         try {
           child.kill('SIGTERM')

package/studio/server/api.ts CHANGED Viewed

@@ -47,13 +47,6 @@ import {
 import { isEnvName, readEnvModel, writeEnvUpdates } from './state/env'
 import { detectGit } from './state/git'
 import { refreshAuto } from './state/handoff'
-import {
-  activeInstanceName,
-  instanceStatus,
-  listInstances,
-  runDeploy,
-  setActiveInstance,
-} from './state/instance'
 import {
   clearHarnessGateway,
   gatewayAudience,
@@ -62,6 +55,13 @@ import {
   setHarnessGateway,
 } from './state/harness-gateway'
 import { setHostToken } from './state/harness-token'
+import {
+  activeInstanceName,
+  instanceStatus,
+  listInstances,
+  runDeploy,
+  setActiveInstance,
+} from './state/instance'
 import { deleteIntegration, readIntegrations, upsertIntegration } from './state/integrations'
 import { readLayout, resetLayout, saveLayout, setNodePositions } from './state/layout'
 import { readSettings, updateSettings } from './state/settings'

package/studio/server/introspect/overlay-tsmorph.ts CHANGED Viewed

@@ -1,18 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, isAbsolute, relative, resolve as resolvePath } from 'node:path'
 /**
- * overlay-tsmorph.ts — ts-morph extraction of the things the IR cannot carry:
- *   - handlerLinks: schema method → runtime handler file (follow the `execute`
- *     import in runtime/index.ts; do NOT assume a folder/name convention).
- *   - sourceSpans: file:line + JSDoc for each class/interface/edge/prop/method,
- *     keyed by anchor ref (class.X / class.X.property.y / class.X.method.m / …).
- *   - annotations: sharp-edge hints (ENUM_DROPPED_BY_UPDATE).
- *
- * Implementation notes:
- *   - We open files with a throwaway ts-morph Project (no tsconfig, no type
- *     checker required) so this stays cheap and tolerant of broken trees.
- *   - Everything degrades gracefully: a missing file/dir yields [] / {}, an
- *     unresolvable handler yields `{ unlinked: true }` rather than a wrong guess.
+ * ts-morph overlay for IR gaps: handler links, source spans, and annotations.
+ * It is tolerant by contract; unresolved files or handlers produce empty/unlinked output.
  */
 import { Node, Project, SyntaxKind, type CallExpression, type SourceFile } from 'ts-morph'
@@ -114,12 +104,7 @@ function stringArg(call: CallExpression, index: number): string | undefined {
 // ───────────────────────────── handler links ─────────────────────────────
-/**
- * The shape of a "wire one method" call we recognise, after normalising the two
- * fixture styles:
- *   my-domain:   method(schema, 'Owner', 'name', { authorize, execute })
- *   evaluation:  classMethods(schema, 'Owner', { name: todo('Owner.name'), … })
- */
+/** Recognized method-wiring calls after normalizing single-method and grouped helpers. */
 interface WiredMethod {
   owner: string
   method: string
@@ -136,15 +121,29 @@ const GROUP_HELPERS = new Set([
   'remoteInterfaceMethods',
 ])
-/** Kernel-op tokens we surface as `kernelCalls`, longest-first to avoid overlap. */
-const KERNEL_TOKENS = [
-  '::getLinks',
-  '::getLink',
-  '::update',
-  '::link',
-  '::create',
-  'createNode',
-  'grantPerm',
+type KernelToken = { token: string; label?: string }
+/** Kernel-op idioms surfaced as `kernelCalls`; entries are longest-first. */
+const KERNEL_TOKENS: KernelToken[] = [
+  { token: 'graph.createEdge' },
+  { token: 'graph.removeEdge' },
+  { token: 'function.mutate' },
+  { token: 'graph.children' },
+  { token: 'function.get' },
+  { token: 'graph.create' },
+  { token: 'graph.update' },
+  { token: 'graph.remove' },
+  { token: 'graph.mutate' },
+  { token: 'auth.revoke' },
+  { token: 'graph.links' },
+  { token: 'auth.grant' },
+  { token: 'auth.check' },
+  { token: 'graph.tree' },
+  { token: 'graph.node' },
+  { token: 'revokePerm', label: 'revokePerm (legacy)' },
+  { token: 'checkPerm', label: 'checkPerm (legacy)' },
+  { token: 'graph.get' },
+  { token: 'grantPerm', label: 'grantPerm (legacy)' },
 ]
 /**
@@ -506,11 +505,11 @@ function scanKernelCalls(file: string): string[] {
   }
   const found: string[] = []
   let work = text
-  for (const token of KERNEL_TOKENS) {
-    if (work.includes(token)) {
-      found.push(token)
+  for (const entry of KERNEL_TOKENS) {
+    if (work.includes(entry.token)) {
+      found.push(entry.label ?? entry.token)
       // Blank out matches so `::getLinks` doesn't also count as `::getLink`.
-      work = work.split(token).join(' '.repeat(token.length))
+      work = work.split(entry.token).join(' '.repeat(entry.token.length))
     }
   }
   return found
@@ -663,23 +662,78 @@ const DECL_HELPERS: Record<string, 'node' | 'interface' | 'edge'> = {
 }
 /**
- * Decide the anchor namespace ('class' | 'interface' | 'edge') for a declared
- * name, preferring the IR's authority (an edgeClass is a class whose IR type is
- * 'edge'); fall back to the declaration helper used.
+ * A schema member's true NAME + section, resolved from the `defineSchema` map.
+ * The declaration helpers (nodeClass/nodeInterface/edgeClass) carry no name — a
+ * member is named by the KEY it is registered under, not by its variable — and a
+ * domain may register a class and an interface under the SAME name (the
+ * intentional same-name pattern: the `iUser` interface alongside the `User`
+ * class). So the map is the sole authority for both the anchor name and the
+ * interface-vs-class distinction; the variable identifier alone tells us neither.
  */
-function anchorKindFor(
+interface MemberName {
+  schemaName: string
+  section: 'interface' | 'class' // the `classes` map also holds edge classes
+}
+/** Map each registered member VARIABLE (as referenced in `defineSchema`) to its
+ *  schema name + section, from the domain's own schema files — never node_modules
+ *  (a dependency's `defineSchema` is not this domain's). */
+function buildMemberNameMap(files: SourceFile[]): Map<string, MemberName> {
+  const map = new Map<string, MemberName>()
+  for (const sf of files) {
+    if (sf.getFilePath().includes('/node_modules/')) continue
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (calleeName(call) !== 'defineSchema') continue
+      const cfg = call.getArguments()[1]
+      if (!cfg || !Node.isObjectLiteralExpression(cfg)) continue
+      collectSchemaSection(map, cfg, 'interfaces', 'interface')
+      collectSchemaSection(map, cfg, 'classes', 'class')
+    }
+  }
+  return map
+}
+/** Record `variable → { schemaName, section }` for one `defineSchema` section
+ *  (`interfaces` / `classes`), handling both `Key: alias` and shorthand `Key`. */
+function collectSchemaSection(
+  map: Map<string, MemberName>,
+  cfg: Node,
+  prop: 'interfaces' | 'classes',
+  section: 'interface' | 'class',
+): void {
+  const obj = getObjectProp(cfg, prop)
+  if (!obj) return
+  for (const p of obj.getProperties()) {
+    if (Node.isShorthandPropertyAssignment(p)) {
+      map.set(p.getName(), { schemaName: p.getName(), section })
+    } else if (Node.isPropertyAssignment(p)) {
+      const init = p.getInitializer()
+      if (init && Node.isIdentifier(init)) {
+        map.set(init.getText(), { schemaName: p.getName(), section })
+      }
+    }
+  }
+}
+/**
+ * The anchor namespace ('class' | 'interface' | 'edge') for a declared member.
+ * The `defineSchema` SECTION is authoritative for interface-vs-class — a
+ * `nodeClass` whose name collides with a same-named interface must still anchor
+ * as a class. Within the class section, an `edgeClass` (or an IR edge type)
+ * anchors as 'edge'. Falls back to the declaration helper when the member isn't
+ * in a parseable `defineSchema` map (e.g. an imported kernel member).
+ */
+function resolveMemberKind(
   ir: SchemaIR | null,
   name: string,
+  section: 'interface' | 'class' | undefined,
   helperKind: 'node' | 'interface' | 'edge',
 ): 'class' | 'interface' | 'edge' {
-  if (ir) {
-    if (ir.interfaces?.[name]) return 'interface'
-    const cls = ir.classes?.[name]
-    if (cls) return cls.type === 'edge' ? 'edge' : 'class'
-  }
+  if (section === 'interface') return 'interface'
+  const isEdge = helperKind === 'edge' || ir?.classes?.[name]?.type === 'edge'
+  if (section === 'class') return isEdge ? 'edge' : 'class'
   if (helperKind === 'interface') return 'interface'
-  if (helperKind === 'edge') return 'edge'
-  return 'class'
+  return isEdge ? 'edge' : 'class'
 }
 export function buildSourceSpans(args: {
@@ -703,10 +757,14 @@ export function buildSourceSpans(args: {
   const spans: Record<string, SourceSpan> = {}
-  for (const filePath of files) {
-    const sf = project.getSourceFile(filePath)
-    if (!sf) continue
-    const fileRel = relToRoot(domainRoot, filePath)
+  const sourceFiles = files.map((f) => project.getSourceFile(f)).filter((f): f is SourceFile => !!f)
+  // The domain's `defineSchema` map is authoritative for each member's name +
+  // interface-vs-class kind, so an aliased interface (`iUser`→`User`) and a class
+  // sharing its name (`User`) each anchor correctly instead of colliding.
+  const memberNames = buildMemberNameMap(sourceFiles)
+  for (const sf of sourceFiles) {
+    const fileRel = relToRoot(domainRoot, sf.getFilePath())
     for (const v of sf.getVariableDeclarations()) {
       if (!v.isExported()) continue
@@ -715,9 +773,9 @@ export function buildSourceSpans(args: {
       const helper = calleeName(init)
       if (!helper || !(helper in DECL_HELPERS)) continue
       const helperKind = DECL_HELPERS[helper]
-      const name = v.getName()
-      const kind = anchorKindFor(ir, name, helperKind)
-      const ns = kind // 'class' | 'interface' | 'edge'
+      const member = memberNames.get(v.getName())
+      const name = member?.schemaName ?? v.getName()
+      const ns = resolveMemberKind(ir, name, member?.section, helperKind)
       const stmt = v.getVariableStatement() ?? v
       spans[`${ns}.${name}`] = makeSpan(domainRoot, fileRel, stmt, v)
@@ -729,7 +787,7 @@ export function buildSourceSpans(args: {
       }
       // Edges: endpoints are the first two args; props live in the third.
-      if (kind === 'edge') {
+      if (ns === 'edge') {
         collectEdge(spans, name, init, domainRoot, fileRel)
       }
     }

package/studio/server/state/harness-gateway.ts CHANGED Viewed

@@ -45,7 +45,8 @@ function normalize(input: any): HarnessGatewayConfig {
   const model = typeof input?.model === 'string' ? input.model.trim() : ''
   // back-compat: a pre-union config stored only `apiKey` → treat as a static token
   const authInput =
-    input?.auth ?? (typeof input?.apiKey === 'string' ? { mode: 'token', token: input.apiKey } : undefined)
+    input?.auth ??
+    (typeof input?.apiKey === 'string' ? { mode: 'token', token: input.apiKey } : undefined)
   return {
     enabled: input?.enabled === true,
     baseUrl: typeof input?.baseUrl === 'string' ? input.baseUrl.trim() : '',
@@ -86,7 +87,12 @@ export function getHarnessGatewayState(root: string): HarnessGatewayState {
   const local = readLocal(root)
   const global = readGlobal()
   if (local) {
-    return { local, global, effective: local.enabled ? local : null, source: local.enabled ? 'domain' : 'none' }
+    return {
+      local,
+      global,
+      effective: local.enabled ? local : null,
+      source: local.enabled ? 'domain' : 'none',
+    }
   }
   return {
     local: null,
@@ -104,7 +110,10 @@ export interface SetHarnessGatewayInput {
 /** Persist the config to the chosen scope. Writing GLOBAL also clears any local
  *  override so this domain (and every un-overridden one) inherits it — that is the
  *  "apply to all domains" intent. */
-export function setHarnessGateway(root: string, input: SetHarnessGatewayInput): HarnessGatewayState {
+export function setHarnessGateway(
+  root: string,
+  input: SetHarnessGatewayInput,
+): HarnessGatewayState {
   const cfg = normalize(input.config)
   if (input.scope === 'global') {
     writeGlobal(cfg)

package/studio/server/state/harness-token.ts CHANGED Viewed

Binary file

package/studio/server/state/visibility.ts CHANGED Viewed

@@ -14,7 +14,11 @@ export interface VisibilityState {
 }
 const FILE = 'visibility.json'
-const DEFAULT: VisibilityState = { hidden: {}, showInheritedEdges: true, materializedInterfaces: {} }
+const DEFAULT: VisibilityState = {
+  hidden: {},
+  showInheritedEdges: true,
+  materializedInterfaces: {},
+}
 export function readVisibility(root: string): VisibilityState {
   // merge over DEFAULT so a file written before a field existed (e.g. pre-materialize)

package/src/kernel/__tests__/remote-routing.test.ts DELETED Viewed

@@ -1,70 +0,0 @@
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
-import { describe, expect, test } from 'bun:test'
-import { mintDelegationPath } from '../remote-routing'
-function unsignedJwt(payload: Record<string, unknown>): string {
-  const encode = (value: unknown) =>
-    Buffer.from(JSON.stringify(value)).toString('base64url').replace(/=+$/, '')
-  return `${encode({ alg: 'none' })}.${encode(payload)}.signature`
-}
-/** A ClientSession stub that records call paths and returns a canned whoami node. */
-function stubClient(whoamiNode: unknown): {
-  client: ClientSession<FnMap>
-  calls: Array<{ path: string }>
-} {
-  const calls: Array<{ path: string }> = []
-  const client = {
-    call: async (path: string) => {
-      calls.push({ path })
-      return whoamiNode
-    },
-  } as unknown as ClientSession<FnMap>
-  return { client, calls }
-}
-describe('mintDelegationPath — caller self-anchor resolution', () => {
-  test('resolves an IdP identity to its NODE id via whoami (not the JWT sub)', async () => {
-    // A WorkOS subject is the upstream user id, NOT the kernel node id — `@<sub>`
-    // would 404. whoami returns the caller's own identity node; its id is the anchor.
-    const { client, calls } = stubClient({ id: 'ef280077-6039-4a1a-9d06-403718d8e112' })
-    const credential = unsignedJwt({ sub: 'user_01KC9MW1M6S5J6V9ERSRJ8RDYF' })
-    expect(await mintDelegationPath(client, credential)).toBe(
-      '@ef280077-6039-4a1a-9d06-403718d8e112::mintDelegationCredential',
-    )
-    expect(calls).toEqual([{ path: '/:kernel.astrale.ai:interface.Identity:whoami' }])
-  })
-  test('legacy system subject maps to the __system__ graph node WITHOUT a whoami call', async () => {
-    const { client, calls } = stubClient({ id: 'unused' })
-    expect(await mintDelegationPath(client, unsignedJwt({ sub: 'system' }))).toBe(
-      '@__system__::mintDelegationCredential',
-    )
-    expect(calls).toEqual([])
-  })
-  test('opaque non-JWT credential falls back to __system__ (no whoami)', async () => {
-    const { client, calls } = stubClient({ id: 'unused' })
-    expect(await mintDelegationPath(client, 'not-a-jwt')).toBe(
-      '@__system__::mintDelegationCredential',
-    )
-    expect(calls).toEqual([])
-  })
-  test('throws when whoami returns no id (cannot address the caller)', async () => {
-    const { client } = stubClient({ notAnId: true })
-    await expect(mintDelegationPath(client, unsignedJwt({ sub: 'abc' }))).rejects.toThrow(
-      /could not resolve the caller identity/i,
-    )
-  })
-})
-// `lookupRemoteBinding` (the proactive `<path>::get` resolver) was removed: the
-// kernel now carries the worker's `iss` on the redirect and the ClientSession
-// follows it reactively, minting via `mintRemoteCredential` (the cache mint
-// wired in `kernel/client.ts`). The slug→iss audience derivation it tested now
-// lives in the kernel resolver (`runtime/__tests__/resolver-remote.test.ts`).

package/src/kernel/remote-routing.ts DELETED Viewed

@@ -1,88 +0,0 @@
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
-/**
- * Credential-minting helpers for remote-bound kernel calls.
- *
- * The CLI no longer resolves remote bindings client-side: the kernel emits a
- * redirect carrying the target worker's `iss`, and the `ClientSession` follows
- * it, minting a worker-scoped delegation via `mintRemoteCredential` (wired as
- * the session's delegation-cache mint in `client.ts`). These helpers (whoami →
- * self-delegation) are the mint itself.
- */
-/**
- * Mint a delegation credential scoped to the remote worker's audience.
- *
- * The Function lives under the caller's self identity (`@__system__` in manager
- * kernels), so the invariant on `mintDelegationCredential` passes without
- * additional claims. A self-delegation is the least-privilege shape — the
- * worker inherits whatever grants the caller already has.
- *
- * Internal calls pass `skipDelegation: true`: they target the default kernel
- * (same origin), so the delegation cache would skip them anyway, but being
- * explicit guarantees the mint can never recurse into itself.
- */
-export async function mintRemoteCredential(
-  client: ClientSession<FnMap>,
-  audience: string,
-  callerCredential: string,
-): Promise<string> {
-  const mintPath = await mintDelegationPath(client, callerCredential)
-  const result = await client.call(
-    mintPath,
-    {
-      audience,
-      delegation: { kind: 'identity', self: true },
-      ttl: 3600,
-    },
-    { credential: callerCredential, skipDelegation: true },
-  )
-  if (typeof result !== 'string') {
-    throw new Error(
-      `mintDelegationCredential returned non-string: ${typeof result} — cannot use as credential`,
-    )
-  }
-  return result
-}
-/**
- * Resolve the kernel path that mints a self-delegation credential for the
- * CALLER: `@<nodeId>::mintDelegationCredential`.
- */
-export async function mintDelegationPath(
-  client: ClientSession<FnMap>,
-  credential: string,
-): Promise<string> {
-  const sub = readJwtSub(credential)
-  // System / opaque credential: the graph node id is literally `__system__`,
-  // so we can skip the whoami round-trip.
-  if (!sub || sub === 'system') return '@__system__::mintDelegationCredential'
-  const self = (await client.call(
-    '/:kernel.astrale.ai:interface.Identity:whoami',
-    {},
-    { credential, skipDelegation: true },
-  )) as { id?: unknown } | null
-  const id = self && typeof self.id === 'string' ? self.id : undefined
-  if (!id) {
-    throw new Error(
-      'Could not resolve the caller identity (whoami returned no id) — cannot mint a delegation credential.',
-    )
-  }
-  return `@${id}::mintDelegationCredential`
-}
-function readJwtSub(credential: string): string | null {
-  const [, payload] = credential.split('.')
-  if (!payload) return null
-  try {
-    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')
-    const decoded = JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as {
-      sub?: unknown
-    }
-    return typeof decoded.sub === 'string' && decoded.sub.length > 0 ? decoded.sub : null
-  } catch {
-    return null
-  }
-}