@astrale-os/cli 0.4.0-alpha.13 → 0.6.0-alpha.0

package/studio/server/introspect/overlay-tsmorph.test.ts

@@ -0,0 +1,104 @@
+import { expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { buildHandlerLinks } from './overlay-tsmorph'
+
+test('resolves authorization hooks from imported remote method definitions', () => {
+  const root = mkdtempSync(join(tmpdir(), 'astrale-studio-handler-links-'))
+  const runtime = join(root, 'runtime')
+  mkdirSync(runtime)
+
+  writeFileSync(
+    join(runtime, 'index.ts'),
+    `
+      import { remoteClassMethods } from '@astrale-os/sdk'
+      import {
+        absentMethod,
+        guardedMethod,
+        noopMethod,
+      } from './methods.js'
+
+      const classMethods = remoteClassMethods()
+
+      export const methods = {
+        class: {
+          Issue: classMethods(schema, 'Issue', {
+            absent: absentMethod,
+            guarded: guardedMethod,
+            noop: noopMethod,
+          }),
+        },
+      }
+    `,
+  )
+  writeFileSync(
+    join(runtime, 'methods.ts'),
+    `
+      import { remoteMethod } from '@astrale-os/sdk'
+
+      const method = remoteMethod()
+      const run = () => 'ok'
+
+      export const guardedMethod = method(schema, 'Issue', 'guarded', {
+        authorize: ({ auth, kernel, self }) =>
+          kernel.auth.require({ who: auth.principal, on: self.path, perms: 1 }),
+        execute: () => run(),
+      })
+
+      export const noopMethod = method(schema, 'Issue', 'noop', {
+        authorize: async () => undefined,
+        execute: () => run(),
+      })
+
+      export const absentMethod = method(schema, 'Issue', 'absent', {
+        execute: () => run(),
+      })
+    `,
+  )
+
+  try {
+    const links = buildHandlerLinks({ ir: null, domainRoot: root })
+    expect(
+      links.map(({ method, authorize, auth, implemented, unlinked, handlerFile }) => ({
+        method,
+        authorize,
+        auth,
+        implemented,
+        unlinked: unlinked ?? false,
+        handlerFile,
+      })),
+    ).toEqual([
+      {
+        method: 'absent',
+        authorize: 'absent',
+        auth: 'required',
+        implemented: true,
+        unlinked: false,
+        handlerFile: 'runtime/methods.ts',
+      },
+      {
+        method: 'guarded',
+        authorize: 'custom',
+        auth: 'required',
+        implemented: true,
+        unlinked: false,
+        handlerFile: 'runtime/methods.ts',
+      },
+      {
+        method: 'noop',
+        authorize: 'noop',
+        auth: 'required',
+        implemented: true,
+        unlinked: false,
+        handlerFile: 'runtime/methods.ts',
+      },
+    ])
+    expect(links.find((link) => link.method === 'guarded')?.authorizeSnippet).toContain(
+      'kernel.auth.require',
+    )
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

package/studio/server/introspect/overlay-tsmorph.ts

@@ -1,18 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, isAbsolute, relative, resolve as resolvePath } from 'node:path'
 /**
- * overlay-tsmorph.ts — ts-morph extraction of the things the IR cannot carry:
- *   - handlerLinks: schema method → runtime handler file (follow the `execute`
- *     import in runtime/index.ts; do NOT assume a folder/name convention).
- *   - sourceSpans: file:line + JSDoc for each class/interface/edge/prop/method,
- *     keyed by anchor ref (class.X / class.X.property.y / class.X.method.m / …).
- *   - annotations: sharp-edge hints (ENUM_DROPPED_BY_UPDATE).
- *
- * Implementation notes:
- *   - We open files with a throwaway ts-morph Project (no tsconfig, no type
- *     checker required) so this stays cheap and tolerant of broken trees.
- *   - Everything degrades gracefully: a missing file/dir yields [] / {}, an
- *     unresolvable handler yields `{ unlinked: true }` rather than a wrong guess.
+ * ts-morph overlay for IR gaps: handler links, source spans, and annotations.
+ * It is tolerant by contract; unresolved files or handlers produce empty/unlinked output.
  */
 import { Node, Project, SyntaxKind, type CallExpression, type SourceFile } from 'ts-morph'
 
@@ -38,7 +28,7 @@ function newProject(): Project {
 function tryAddFile(project: Project, file: string): SourceFile | undefined {
   try {
     if (!existsSync(file)) return undefined
-    return project.addSourceFileAtPath(file)
+    return project.getSourceFile(file) ?? project.addSourceFileAtPath(file)
   } catch {
     return undefined
   }
@@ -114,12 +104,7 @@ function stringArg(call: CallExpression, index: number): string | undefined {
 
 // ───────────────────────────── handler links ─────────────────────────────
 
-/**
- * The shape of a "wire one method" call we recognise, after normalising the two
- * fixture styles:
- *   my-domain:   method(schema, 'Owner', 'name', { authorize, execute })
- *   evaluation:  classMethods(schema, 'Owner', { name: todo('Owner.name'), … })
- */
+/** Recognized method-wiring calls after normalizing single-method and grouped helpers. */
 interface WiredMethod {
   owner: string
   method: string
@@ -136,15 +121,29 @@ const GROUP_HELPERS = new Set([
   'remoteInterfaceMethods',
 ])
 
-/** Kernel-op tokens we surface as `kernelCalls`, longest-first to avoid overlap. */
-const KERNEL_TOKENS = [
-  '::getLinks',
-  '::getLink',
-  '::update',
-  '::link',
-  '::create',
-  'createNode',
-  'grantPerm',
+type KernelToken = { token: string; label?: string }
+
+/** Kernel-op idioms surfaced as `kernelCalls`; entries are longest-first. */
+const KERNEL_TOKENS: KernelToken[] = [
+  { token: 'graph.createEdge' },
+  { token: 'graph.removeEdge' },
+  { token: 'function.mutate' },
+  { token: 'graph.children' },
+  { token: 'function.get' },
+  { token: 'graph.create' },
+  { token: 'graph.update' },
+  { token: 'graph.remove' },
+  { token: 'graph.mutate' },
+  { token: 'auth.revoke' },
+  { token: 'graph.links' },
+  { token: 'auth.grant' },
+  { token: 'auth.check' },
+  { token: 'graph.tree' },
+  { token: 'graph.node' },
+  { token: 'revokePerm', label: 'revokePerm (legacy)' },
+  { token: 'checkPerm', label: 'checkPerm (legacy)' },
+  { token: 'graph.get' },
+  { token: 'grantPerm', label: 'grantPerm (legacy)' },
 ]
 
 /**
@@ -164,28 +163,129 @@ interface ConfigResolution {
   unlinkedReason?: 'no-config'
 }
 
-function resolveConfigObject(configNode: Node): ConfigResolution {
-  // Case A: a call expression, e.g. `todo('Owner.name')`. Follow the helper to
-  // its returned object literal (the local `todo` factory in evaluation).
-  if (Node.isCallExpression(configNode)) {
-    const obj = followFactoryToObject(configNode)
+function resolveConfigObject(configNode: Node, seen = new Set<string>()): ConfigResolution {
+  const node = unwrapExpression(configNode)
+  const key = `${node.getSourceFile().getFilePath()}:${node.getStart()}`
+  if (seen.has(key)) return { implemented: false, unlinkedReason: 'no-config' }
+  seen.add(key)
+
+  if (Node.isCallExpression(node)) {
+    // Curried SDK helpers carry the handler config in their final argument:
+    // `remoteMethod()(schema, 'Issue', 'delete', { authorize, execute })`.
+    const lastArg = node.getArguments().at(-1)
+    if (lastArg) {
+      const candidate = unwrapExpression(lastArg)
+      if (Node.isObjectLiteralExpression(candidate) || Node.isIdentifier(candidate)) {
+        return resolveConfigObject(candidate, seen)
+      }
+    }
+
+    // Local factories such as `todo('Owner.name')` return the config object themselves.
+    const obj = followFactoryToObject(node)
     if (obj) return classifyObjectLiteral(obj)
     return { implemented: false, unlinkedReason: 'no-config' }
   }
-  if (Node.isObjectLiteralExpression(configNode)) {
-    return classifyObjectLiteral(configNode)
+  if (Node.isObjectLiteralExpression(node)) {
+    return classifyObjectLiteral(node)
   }
-  // An identifier referencing a config defined elsewhere — try to resolve it.
-  if (Node.isIdentifier(configNode)) {
-    const decl = firstValueDeclaration(configNode)
-    if (decl && Node.isVariableDeclaration(decl)) {
-      const init = decl.getInitializer()
-      if (init) return resolveConfigObject(init)
-    }
+  // Handler maps normally reference a local or imported `remoteMethod` value.
+  if (Node.isIdentifier(node)) {
+    const value = valueOfIdentifier(node)
+    if (value) return resolveConfigObject(value, seen)
   }
   return { implemented: false, unlinkedReason: 'no-config' }
 }
 
+/** Remove syntax-only wrappers around a runtime value. */
+function unwrapExpression(node: Node): Node {
+  let current = node
+  while (
+    Node.isParenthesizedExpression(current) ||
+    Node.isAsExpression(current) ||
+    Node.isSatisfiesExpression(current) ||
+    Node.isTypeAssertion(current)
+  ) {
+    current = current.getExpression()
+  }
+  return current
+}
+
+/** Resolve a local or relatively imported identifier to its runtime value. */
+function valueOfIdentifier(id: Node): Node | undefined {
+  if (!Node.isIdentifier(id)) return undefined
+  const decl = firstValueDeclaration(id)
+  if (decl && Node.isVariableDeclaration(decl)) return decl.getInitializer()
+  return resolveImportedValue(id)
+}
+
+/** Follow a named relative import to the exported value that defines it. */
+function resolveImportedValue(id: Node): Node | undefined {
+  if (!Node.isIdentifier(id)) return undefined
+  const localName = id.getText()
+  const sourceFile = id.getSourceFile()
+
+  for (const imp of sourceFile.getImportDeclarations()) {
+    for (const named of imp.getNamedImports()) {
+      const local = named.getAliasNode()?.getText() ?? named.getName()
+      if (local !== localName) continue
+      const target = resolveModuleFile(sourceFile, imp.getModuleSpecifierValue())
+      if (!target) return undefined
+      return findExportedValue(id.getProject(), target, named.getName(), new Set<string>())
+    }
+  }
+  return undefined
+}
+
+/** Find an exported variable/function value, following local and barrel exports. */
+function findExportedValue(
+  project: Project,
+  file: string,
+  exportName: string,
+  seen: Set<string>,
+): Node | undefined {
+  const key = `${file}:${exportName}`
+  if (seen.has(key)) return undefined
+  seen.add(key)
+  const sf = tryAddFile(project, file)
+  if (!sf) return undefined
+
+  const localValue = (name: string, exportedOnly: boolean): Node | undefined => {
+    const variable = sf
+      .getVariableDeclarations()
+      .find(
+        (candidate) => candidate.getName() === name && (!exportedOnly || candidate.isExported()),
+      )
+    if (variable) return variable.getInitializer()
+    return sf
+      .getFunctions()
+      .find(
+        (candidate) => candidate.getName() === name && (!exportedOnly || candidate.isExported()),
+      )
+  }
+
+  const direct = localValue(exportName, true)
+  if (direct) return direct
+
+  for (const ex of sf.getExportDeclarations()) {
+    const modSpec = ex.getModuleSpecifierValue()
+    const target = modSpec ? resolveModuleFile(sf, modSpec) : undefined
+    const named = ex.getNamedExports()
+    if (named.length > 0) {
+      for (const specifier of named) {
+        const exposed = specifier.getAliasNode()?.getText() ?? specifier.getName()
+        if (exposed !== exportName) continue
+        const original = specifier.getName()
+        if (target) return findExportedValue(project, target, original, seen)
+        return localValue(original, false)
+      }
+    } else if (target) {
+      const found = findExportedValue(project, target, exportName, seen)
+      if (found) return found
+    }
+  }
+  return undefined
+}
+
 /** Given `todo('x')`, find the factory's `return { … }` object literal. */
 function followFactoryToObject(call: CallExpression): Node | undefined {
   const expr = call.getExpression()
@@ -288,11 +388,8 @@ function functionBodyOf(node: Node): Node | null | undefined {
   if (Node.isArrowFunction(node) || Node.isFunctionExpression(node)) fn = node
   else if (Node.isMethodDeclaration(node)) fn = node
   else if (Node.isIdentifier(node)) {
-    const decl = firstValueDeclaration(node)
-    if (decl && Node.isVariableDeclaration(decl)) {
-      const init = decl.getInitializer()
-      if (init) return functionBodyOf(init)
-    }
+    const value = valueOfIdentifier(node)
+    if (value) return functionBodyOf(value)
     return undefined
   }
   if (!fn) return undefined
@@ -435,9 +532,11 @@ function resolveModuleFile(from: SourceFile, spec: string): string | undefined {
   if (!spec.startsWith('.')) return undefined
   const baseDir = dirname(from.getFilePath())
   const base = resolvePath(baseDir, spec)
+  const sourceBase = base.replace(/\.(?:[cm]?js|jsx)$/, '')
   const candidates = [
-    base.endsWith('.ts') ? base : `${base}.ts`,
-    base.endsWith('.tsx') ? base : `${base}.tsx`,
+    base,
+    sourceBase.endsWith('.ts') ? sourceBase : `${sourceBase}.ts`,
+    sourceBase.endsWith('.tsx') ? sourceBase : `${sourceBase}.tsx`,
     `${base}/index.ts`,
     `${base}/index.tsx`,
   ]
@@ -506,11 +605,11 @@ function scanKernelCalls(file: string): string[] {
   }
   const found: string[] = []
   let work = text
-  for (const token of KERNEL_TOKENS) {
-    if (work.includes(token)) {
-      found.push(token)
+  for (const entry of KERNEL_TOKENS) {
+    if (work.includes(entry.token)) {
+      found.push(entry.label ?? entry.token)
       // Blank out matches so `::getLinks` doesn't also count as `::getLink`.
-      work = work.split(token).join(' '.repeat(token.length))
+      work = work.split(entry.token).join(' '.repeat(entry.token.length))
     }
   }
   return found
@@ -663,23 +762,78 @@ const DECL_HELPERS: Record<string, 'node' | 'interface' | 'edge'> = {
 }
 
 /**
- * Decide the anchor namespace ('class' | 'interface' | 'edge') for a declared
- * name, preferring the IR's authority (an edgeClass is a class whose IR type is
- * 'edge'); fall back to the declaration helper used.
+ * A schema member's true NAME + section, resolved from the `defineSchema` map.
+ * The declaration helpers (nodeClass/nodeInterface/edgeClass) carry no name — a
+ * member is named by the KEY it is registered under, not by its variable — and a
+ * domain may register a class and an interface under the SAME name (the
+ * intentional same-name pattern: the `iUser` interface alongside the `User`
+ * class). So the map is the sole authority for both the anchor name and the
+ * interface-vs-class distinction; the variable identifier alone tells us neither.
+ */
+interface MemberName {
+  schemaName: string
+  section: 'interface' | 'class' // the `classes` map also holds edge classes
+}
+
+/** Map each registered member VARIABLE (as referenced in `defineSchema`) to its
+ *  schema name + section, from the domain's own schema files — never node_modules
+ *  (a dependency's `defineSchema` is not this domain's). */
+function buildMemberNameMap(files: SourceFile[]): Map<string, MemberName> {
+  const map = new Map<string, MemberName>()
+  for (const sf of files) {
+    if (sf.getFilePath().includes('/node_modules/')) continue
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (calleeName(call) !== 'defineSchema') continue
+      const cfg = call.getArguments()[1]
+      if (!cfg || !Node.isObjectLiteralExpression(cfg)) continue
+      collectSchemaSection(map, cfg, 'interfaces', 'interface')
+      collectSchemaSection(map, cfg, 'classes', 'class')
+    }
+  }
+  return map
+}
+
+/** Record `variable → { schemaName, section }` for one `defineSchema` section
+ *  (`interfaces` / `classes`), handling both `Key: alias` and shorthand `Key`. */
+function collectSchemaSection(
+  map: Map<string, MemberName>,
+  cfg: Node,
+  prop: 'interfaces' | 'classes',
+  section: 'interface' | 'class',
+): void {
+  const obj = getObjectProp(cfg, prop)
+  if (!obj) return
+  for (const p of obj.getProperties()) {
+    if (Node.isShorthandPropertyAssignment(p)) {
+      map.set(p.getName(), { schemaName: p.getName(), section })
+    } else if (Node.isPropertyAssignment(p)) {
+      const init = p.getInitializer()
+      if (init && Node.isIdentifier(init)) {
+        map.set(init.getText(), { schemaName: p.getName(), section })
+      }
+    }
+  }
+}
+
+/**
+ * The anchor namespace ('class' | 'interface' | 'edge') for a declared member.
+ * The `defineSchema` SECTION is authoritative for interface-vs-class — a
+ * `nodeClass` whose name collides with a same-named interface must still anchor
+ * as a class. Within the class section, an `edgeClass` (or an IR edge type)
+ * anchors as 'edge'. Falls back to the declaration helper when the member isn't
+ * in a parseable `defineSchema` map (e.g. an imported kernel member).
  */
-function anchorKindFor(
+function resolveMemberKind(
   ir: SchemaIR | null,
   name: string,
+  section: 'interface' | 'class' | undefined,
   helperKind: 'node' | 'interface' | 'edge',
 ): 'class' | 'interface' | 'edge' {
-  if (ir) {
-    if (ir.interfaces?.[name]) return 'interface'
-    const cls = ir.classes?.[name]
-    if (cls) return cls.type === 'edge' ? 'edge' : 'class'
-  }
+  if (section === 'interface') return 'interface'
+  const isEdge = helperKind === 'edge' || ir?.classes?.[name]?.type === 'edge'
+  if (section === 'class') return isEdge ? 'edge' : 'class'
   if (helperKind === 'interface') return 'interface'
-  if (helperKind === 'edge') return 'edge'
-  return 'class'
+  return isEdge ? 'edge' : 'class'
 }
 
 export function buildSourceSpans(args: {
@@ -703,10 +857,14 @@ export function buildSourceSpans(args: {
 
   const spans: Record<string, SourceSpan> = {}
 
-  for (const filePath of files) {
-    const sf = project.getSourceFile(filePath)
-    if (!sf) continue
-    const fileRel = relToRoot(domainRoot, filePath)
+  const sourceFiles = files.map((f) => project.getSourceFile(f)).filter((f): f is SourceFile => !!f)
+  // The domain's `defineSchema` map is authoritative for each member's name +
+  // interface-vs-class kind, so an aliased interface (`iUser`→`User`) and a class
+  // sharing its name (`User`) each anchor correctly instead of colliding.
+  const memberNames = buildMemberNameMap(sourceFiles)
+
+  for (const sf of sourceFiles) {
+    const fileRel = relToRoot(domainRoot, sf.getFilePath())
 
     for (const v of sf.getVariableDeclarations()) {
       if (!v.isExported()) continue
@@ -715,9 +873,9 @@ export function buildSourceSpans(args: {
       const helper = calleeName(init)
       if (!helper || !(helper in DECL_HELPERS)) continue
       const helperKind = DECL_HELPERS[helper]
-      const name = v.getName()
-      const kind = anchorKindFor(ir, name, helperKind)
-      const ns = kind // 'class' | 'interface' | 'edge'
+      const member = memberNames.get(v.getName())
+      const name = member?.schemaName ?? v.getName()
+      const ns = resolveMemberKind(ir, name, member?.section, helperKind)
 
       const stmt = v.getVariableStatement() ?? v
       spans[`${ns}.${name}`] = makeSpan(domainRoot, fileRel, stmt, v)
@@ -729,7 +887,7 @@ export function buildSourceSpans(args: {
       }
 
       // Edges: endpoints are the first two args; props live in the third.
-      if (kind === 'edge') {
+      if (ns === 'edge') {
         collectEdge(spans, name, init, domainRoot, fileRel)
       }
     }

package/studio/server/state/harness-gateway.ts

@@ -45,7 +45,8 @@ function normalize(input: any): HarnessGatewayConfig {
   const model = typeof input?.model === 'string' ? input.model.trim() : ''
   // back-compat: a pre-union config stored only `apiKey` → treat as a static token
   const authInput =
-    input?.auth ?? (typeof input?.apiKey === 'string' ? { mode: 'token', token: input.apiKey } : undefined)
+    input?.auth ??
+    (typeof input?.apiKey === 'string' ? { mode: 'token', token: input.apiKey } : undefined)
   return {
     enabled: input?.enabled === true,
     baseUrl: typeof input?.baseUrl === 'string' ? input.baseUrl.trim() : '',
@@ -86,7 +87,12 @@ export function getHarnessGatewayState(root: string): HarnessGatewayState {
   const local = readLocal(root)
   const global = readGlobal()
   if (local) {
-    return { local, global, effective: local.enabled ? local : null, source: local.enabled ? 'domain' : 'none' }
+    return {
+      local,
+      global,
+      effective: local.enabled ? local : null,
+      source: local.enabled ? 'domain' : 'none',
+    }
   }
   return {
     local: null,
@@ -104,7 +110,10 @@ export interface SetHarnessGatewayInput {
 /** Persist the config to the chosen scope. Writing GLOBAL also clears any local
  *  override so this domain (and every un-overridden one) inherits it — that is the
  *  "apply to all domains" intent. */
-export function setHarnessGateway(root: string, input: SetHarnessGatewayInput): HarnessGatewayState {
+export function setHarnessGateway(
+  root: string,
+  input: SetHarnessGatewayInput,
+): HarnessGatewayState {
   const cfg = normalize(input.config)
   if (input.scope === 'global') {
     writeGlobal(cfg)

package/studio/server/state/views.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, test } from 'bun:test'
+
+import type { RememberedViewTarget, ViewTargetCandidate } from '../../shared/types'
+
+import {
+  conciseCliFailure,
+  localViewUrl,
+  reconcileRememberedTarget,
+  targetFromRow,
+  targetQuery,
+} from './views'
+
+describe('managed local view URLs', () => {
+  test('mounts each view beneath the Studio-assigned server origin', () => {
+    expect(localViewUrl('http://127.0.0.1:5173', '/ui/issues')).toBe(
+      'http://127.0.0.1:5173/ui/issues',
+    )
+    expect(localViewUrl('http://127.0.0.1:61001/ignored', 'ui/issue')).toBe(
+      'http://127.0.0.1:61001/ui/issue',
+    )
+  })
+})
+
+test('reduces CLI stack output to the actionable kernel failure', () => {
+  expect(
+    conciseCliFailure(
+      `275 |   if (code === KERNEL_ERROR_CODES.INVALID_REQUEST)\n276 |\nPermissionDeniedError: Permission denied: READ on /:issues.astrale.ai:view.issue\n details: {\n  method: \"View:resolve\"\n}\n at mapServerError (errors.ts:280:61)\nBun v1.3.14`,
+    ),
+  ).toBe('PermissionDeniedError: Permission denied: READ on /:issues.astrale.ai:view.issue')
+})
+
+describe('target candidates', () => {
+  const remembered: RememberedViewTarget = {
+    id: 'gone-id',
+    className: 'Issue',
+    classOrigin: 'issues.astrale.ai',
+    label: 'Deleted issue',
+  }
+  const candidate: ViewTargetCandidate = {
+    id: 'live-id',
+    ref: '@live-id',
+    className: 'Issue',
+    classOrigin: 'issues.astrale.ai',
+    label: 'Live issue',
+  }
+
+  test('turns a missing remembered node into an explicit stale selection', () => {
+    expect(reconcileRememberedTarget(remembered, [candidate])).toEqual({
+      selected: null,
+      stale: remembered,
+    })
+    expect(reconcileRememberedTarget({ ...remembered, id: 'live-id' }, [candidate])).toEqual({
+      selected: candidate,
+      stale: null,
+    })
+  })
+
+  test('builds friendly candidates from generic qualified node properties', () => {
+    expect(
+      targetFromRow(
+        {
+          id: 'iss-1',
+          props: {
+            'kernel.astrale.ai:interface.Named.property.name': 'Broken authorization badge',
+            'kernel.astrale.ai:interface.Descriptable.property.description': 'Studio regression',
+            'kernel.astrale.ai:interface.Statused.property.status': 'open',
+          },
+        },
+        'Issue',
+        'issues.astrale.ai',
+      ),
+    ).toEqual({
+      id: 'iss-1',
+      ref: '@iss-1',
+      className: 'Issue',
+      classOrigin: 'issues.astrale.ai',
+      label: 'Broken authorization badge',
+      description: 'Studio regression',
+      status: 'open',
+    })
+  })
+
+  test('queries exact class instances through instance_of', () => {
+    const query = targetQuery('Issue', 'issues.astrale.ai')
+    expect(query).toContain('(n:Node)-[:instance_of]->(c:Class)-[:of_domain]->(d:Domain)')
+    expect(query).toContain('"Issue"')
+    expect(query).toContain('"issues.astrale.ai"')
+    expect(query).toContain('LIMIT 201')
+  })
+})