@astrale-os/cli 0.4.0-alpha.13

package/src/lib/__tests__/port.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'bun:test'
+import net from 'node:net'
+
+import { findFreePort, portFree } from '../port'
+
+function listen(port: number): Promise<net.Server> {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer()
+    s.once('error', reject)
+    s.listen({ port, host: '127.0.0.1', exclusive: true }, () => resolve(s))
+  })
+}
+const close = (s: net.Server) => new Promise<void>((r) => s.close(() => r()))
+
+describe('port', () => {
+  it('portFree: true for an unbound port, false once it is bound', async () => {
+    const p = await findFreePort(48000, 200)
+    expect(p).not.toBeNull()
+    expect(await portFree(p as number)).toBe(true)
+    const srv = await listen(p as number)
+    try {
+      expect(await portFree(p as number)).toBe(false)
+    } finally {
+      await close(srv)
+    }
+  })
+
+  it('findFreePort: skips a busy port and returns a later free one', async () => {
+    const base = await findFreePort(48000, 200)
+    expect(base).not.toBeNull()
+    const srv = await listen(base as number)
+    try {
+      const next = await findFreePort(base as number, 10)
+      expect(next).not.toBeNull()
+      expect(next as number).toBeGreaterThan(base as number)
+    } finally {
+      await close(srv)
+    }
+  })
+
+  it('findFreePort: returns null when the band is empty (span 0)', async () => {
+    expect(await findFreePort(48000, 0)).toBeNull()
+  })
+})

package/src/lib/__tests__/prompt.test.ts

@@ -0,0 +1,25 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+
+import { promptText } from '../prompt'
+
+// The no-TTY branch IS the LLM / CI / piped case. promptText must resolve to a
+// default (never await a stdin read) there, so `astrale domain publish` fails
+// fast on its required-flag error instead of hanging. Force isTTY=false so this
+// holds even when the suite is run from an interactive terminal.
+describe('promptText — non-TTY never blocks on input', () => {
+  const original = process.stdin.isTTY
+  beforeAll(() => {
+    ;(process.stdin as { isTTY?: boolean }).isTTY = false
+  })
+  afterAll(() => {
+    ;(process.stdin as { isTTY?: boolean }).isTTY = original
+  })
+
+  test('returns the provided default', async () => {
+    expect(await promptText('Domain origin', { default: 'crm.acme.dev' })).toBe('crm.acme.dev')
+  })
+
+  test('returns undefined with no default (caller then hits its required-flag error)', async () => {
+    expect(await promptText('Published worker URL')).toBeUndefined()
+  })
+})

package/src/lib/__tests__/sdk-deps.test.ts

@@ -0,0 +1,68 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { foreignPackageManager, inDomainProject, parseSdkOutdated } from '../sdk-deps'
+
+describe('parseSdkOutdated', () => {
+  test('keeps only deps with a strictly newer latest; uses wanted when current is absent', () => {
+    const json = JSON.stringify({
+      '@astrale-os/sdk': { current: '0.1.5', wanted: '0.1.5', latest: '0.1.9' }, // behind
+      '@astrale-os/kernel-dsl': { current: '0.1.2', wanted: '0.1.2', latest: '0.1.2' }, // current
+      '@astrale-os/shell': { wanted: '0.1.0', latest: '0.1.1' }, // no `current` (not installed)
+    })
+    expect(parseSdkOutdated(json)).toEqual([
+      { pkg: '@astrale-os/sdk', current: '0.1.5', latest: '0.1.9' },
+      { pkg: '@astrale-os/shell', current: '0.1.0', latest: '0.1.1' },
+    ])
+  })
+
+  test('empty / non-JSON / no-latest input yields no upgrades (never throws)', () => {
+    expect(parseSdkOutdated('')).toEqual([])
+    expect(parseSdkOutdated('{}')).toEqual([])
+    expect(parseSdkOutdated('not json')).toEqual([])
+    expect(parseSdkOutdated(JSON.stringify({ '@astrale-os/sdk': { current: '0.1.9' } }))).toEqual(
+      [],
+    )
+  })
+})
+
+describe('inDomainProject', () => {
+  let tmp: string
+  afterEach(async () => {
+    if (tmp) await rm(tmp, { recursive: true, force: true })
+  })
+
+  test('true only where astrale.config.ts exists', async () => {
+    tmp = await mkdtemp(join(tmpdir(), 'sdk-deps-'))
+    expect(inDomainProject(tmp)).toBe(false)
+    await writeFile(join(tmp, 'astrale.config.ts'), 'export default {}\n')
+    expect(inDomainProject(tmp)).toBe(true)
+  })
+})
+
+describe('foreignPackageManager', () => {
+  let tmp: string
+  afterEach(async () => {
+    if (tmp) await rm(tmp, { recursive: true, force: true })
+  })
+
+  test('pnpm-lock / no lockfile → null (we own it); other lockfiles → that PM', async () => {
+    tmp = await mkdtemp(join(tmpdir(), 'sdk-deps-pm-'))
+    expect(foreignPackageManager(tmp)).toBeNull() // fresh → pnpm-first default
+
+    await writeFile(join(tmp, 'package-lock.json'), '{}')
+    expect(foreignPackageManager(tmp)).toBe('npm')
+
+    // pnpm-lock wins even alongside another lockfile (it's a pnpm project).
+    await writeFile(join(tmp, 'pnpm-lock.yaml'), "lockfileVersion: '9.0'\n")
+    expect(foreignPackageManager(tmp)).toBeNull()
+  })
+
+  test('yarn.lock → yarn', async () => {
+    tmp = await mkdtemp(join(tmpdir(), 'sdk-deps-yarn-'))
+    await writeFile(join(tmp, 'yarn.lock'), '')
+    expect(foreignPackageManager(tmp)).toBe('yarn')
+  })
+})

package/src/lib/__tests__/self.test.ts

@@ -0,0 +1,272 @@
+import { describe, expect, test } from 'bun:test'
+import { SignJWT } from 'jose'
+import { webcrypto } from 'node:crypto'
+
+import {
+  containsSelfRef,
+  expandSelfReferences,
+  resolveSelfNodeId,
+  selfRefusalError,
+  type SelfResolverContext,
+  type SelfResolution,
+} from '../self'
+
+// ── Regex behavior ───────────────────────────────────────────
+
+describe('containsSelfRef / expandSelfReferences', () => {
+  const ID = 'node-abc-123'
+
+  // Cases that MUST match — documented positions only.
+  test.each([
+    ['@self', `@${ID}`],
+    ['@self::deployFunction', `@${ID}::deployFunction`],
+    ['@self/functions', `@${ID}/functions`], // path navigation
+    ['@self/functions/foo', `@${ID}/functions/foo`],
+    ['node=@self', `node=@${ID}`],
+    ['target=@self::method', `target=@${ID}::method`],
+    ['target=@self/sub', `target=@${ID}/sub`],
+    ['x=@self::m  y=@self', `x=@${ID}::m  y=@${ID}`], // double match
+  ])('expands %p → %p', (input, expected) => {
+    expect(containsSelfRef(input)).toBe(true)
+    expect(expandSelfReferences(input, ID)).toBe(expected)
+  })
+
+  // selfId carrying `String.replace` substitution metacharacters must not
+  // be re-interpreted (function-form replacement guards this).
+  test.each([
+    ['@self', 'x$&y', '@x$&y'],
+    ['@self', 'x$$y', '@x$$y'],
+    ['@self', 'x$1y', '@x$1y'],
+    ['@self', 'x$`y', '@x$`y'],
+    ['@self::m', 'x$&y', '@x$&y::m'],
+  ])('selfId with `$` metachars is treated literally: %p × %p → %p', (input, id, expected) => {
+    expect(expandSelfReferences(input, id)).toBe(expected)
+  })
+
+  // Cases that MUST NOT match — substrings, JSON-like, comma-lists.
+  test.each([
+    'prefix@self',
+    '@selfsuffix',
+    '@self.example',
+    '@self,@other',
+    'node=before@self',
+    '{"ref":"@self"}', // inside quoted JSON — lookbehind requires `=` or `^`
+    'no-self-here',
+  ])('does NOT expand %p', (input) => {
+    expect(containsSelfRef(input)).toBe(false)
+    expect(expandSelfReferences(input, ID)).toBe(input)
+  })
+
+  test('containsSelfRef is stateless across calls (regex.lastIndex reset)', () => {
+    // Both calls should return true even though the underlying global regex
+    // tracks lastIndex internally. The implementation must reset it.
+    expect(containsSelfRef('@self')).toBe(true)
+    expect(containsSelfRef('@self')).toBe(true)
+    expect(containsSelfRef('@self')).toBe(true)
+  })
+})
+
+// ── Resolver — refusal paths ─────────────────────────────────
+
+describe('resolveSelfNodeId refusals', () => {
+  test('bootstrap manager identity → manager', () => {
+    const ctx: SelfResolverContext = {
+      identity: { name: 'manager', subject: 'manager', createdAt: 'x' },
+      instanceSlug: 'manager',
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'manager' })
+  })
+
+  test('identity without registration on slug → no-registration', () => {
+    const ctx: SelfResolverContext = {
+      identity: { name: 'alice', subject: 'alice', createdAt: 'x' },
+      instanceSlug: 'kernel-aidev',
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({
+      reason: 'no-registration',
+      identityName: 'alice',
+      instanceSlug: 'kernel-aidev',
+    })
+  })
+
+  test('instance-signed path → instance-signed', () => {
+    const ctx: SelfResolverContext = {
+      identity: { name: 'manager', subject: 'manager', createdAt: 'x' },
+      instanceSlug: 'child-with-keypair',
+      instanceSigned: true,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'instance-signed', instanceSlug: 'child-with-keypair' })
+  })
+
+  test('no slug (--url without -i) → url-no-slug', () => {
+    const ctx: SelfResolverContext = {
+      identity: { name: 'alice', subject: 'alice', createdAt: 'x' },
+      instanceSlug: undefined,
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'url-no-slug' })
+  })
+
+  test('--creds with malformed JWT → creds-no-sub', () => {
+    const ctx: SelfResolverContext = {
+      credsJwt: 'not-a-jwt',
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'creds-no-sub' })
+  })
+
+  test('--creds with valid JWT but empty sub → creds-no-sub', async () => {
+    const key = await generateEs256()
+    const jwt = await new SignJWT({})
+      .setProtectedHeader({ alg: 'ES256' })
+      .setIssuer('test')
+      .setAudience('test')
+      .sign(key)
+    const ctx: SelfResolverContext = { credsJwt: jwt, instanceSigned: false }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'creds-no-sub' })
+  })
+
+  test('--creds with whitespace-only sub → creds-no-sub', async () => {
+    const key = await generateEs256()
+    const jwt = await new SignJWT({})
+      .setProtectedHeader({ alg: 'ES256' })
+      .setSubject('   ')
+      .setIssuer('test')
+      .setAudience('test')
+      .sign(key)
+    const ctx: SelfResolverContext = { credsJwt: jwt, instanceSigned: false }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ reason: 'creds-no-sub' })
+  })
+})
+
+// ── Resolver — happy paths ───────────────────────────────────
+
+describe('resolveSelfNodeId happy paths', () => {
+  test('--as identity with registration → registration sub', () => {
+    const ctx: SelfResolverContext = {
+      identity: {
+        name: 'alice',
+        subject: 'alice',
+        createdAt: 'x',
+        registrations: {
+          'kernel-aidev': { iss: 'https://aidev/', sub: 'node-id-aidev', registeredAt: 'x' },
+        },
+      },
+      instanceSlug: 'kernel-aidev',
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ id: 'node-id-aidev' })
+  })
+
+  test('default identity with registration → registration sub', () => {
+    const ctx: SelfResolverContext = {
+      identity: {
+        name: 'computer',
+        subject: 'kernel-node-id',
+        createdAt: 'x',
+        registrations: {
+          kernel: { iss: 'https://k/', sub: 'kernel-node-id', registeredAt: 'x' },
+        },
+      },
+      instanceSlug: 'kernel',
+      instanceSigned: false,
+    }
+    const r: SelfResolution = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ id: 'kernel-node-id' })
+  })
+
+  test('--creds with valid sub → sub wins over identity', async () => {
+    const key = await generateEs256()
+    const jwt = await new SignJWT({ sub: 'creds-derived-id' })
+      .setProtectedHeader({ alg: 'ES256' })
+      .setIssuer('test')
+      .setSubject('creds-derived-id')
+      .setAudience('test')
+      .sign(key)
+    const ctx: SelfResolverContext = {
+      identity: { name: 'alice', subject: 'alice', createdAt: 'x' },
+      instanceSlug: 'kernel',
+      credsJwt: jwt,
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ id: 'creds-derived-id' })
+  })
+
+  test('manager identity WITH registrations → uses registration sub (not refused)', () => {
+    const ctx: SelfResolverContext = {
+      identity: {
+        name: 'manager',
+        subject: 'manager',
+        createdAt: 'x',
+        registrations: {
+          'some-child': { iss: 'x', sub: 'mgr-node-id-on-child', registeredAt: 'x' },
+        },
+      },
+      instanceSlug: 'some-child',
+      instanceSigned: false,
+    }
+    const r = resolveSelfNodeId(ctx)
+    expect(r).toEqual({ id: 'mgr-node-id-on-child' })
+  })
+})
+
+// ── Error builder ────────────────────────────────────────────
+
+describe('selfRefusalError', () => {
+  test('manager refusal carries metadata + actionable message', () => {
+    const e = selfRefusalError({ reason: 'manager' })
+    expect(e).toBeInstanceOf(Error)
+    expect(e.name).toBe('SelfRefusalError')
+    expect(e.message).toContain('bootstrap `manager` identity')
+    expect(e.message).toContain('astrale identity create')
+    expect((e as Error & { selfRefusal?: { reason: string } }).selfRefusal?.reason).toBe('manager')
+  })
+
+  test('no-registration message references the specific identity + slug', () => {
+    const e = selfRefusalError({
+      reason: 'no-registration',
+      identityName: 'alice',
+      instanceSlug: 'kernel-aidev',
+    })
+    expect(e.message).toContain('alice')
+    expect(e.message).toContain('kernel-aidev')
+    expect(e.message).toContain('astrale identity register alice -i kernel-aidev')
+  })
+
+  test('instance-signed message hints at --as', () => {
+    const e = selfRefusalError({ reason: 'instance-signed', instanceSlug: 'child' })
+    expect(e.message).toContain('--as')
+    expect(e.message).toContain('child')
+  })
+
+  test('url-no-slug message hints at -i', () => {
+    const e = selfRefusalError({ reason: 'url-no-slug' })
+    expect(e.message).toContain('-i')
+  })
+
+  test('creds-no-sub message hints at literal @<nodeId>', () => {
+    const e = selfRefusalError({ reason: 'creds-no-sub' })
+    expect(e.message).toContain('@<nodeId>')
+  })
+})
+
+// ── Helpers ──────────────────────────────────────────────────
+
+async function generateEs256(): Promise<CryptoKey> {
+  const pair = await webcrypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, [
+    'sign',
+    'verify',
+  ])
+  return pair.privateKey
+}

package/src/lib/__tests__/studio-server-deps.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, test } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { Project } from 'ts-morph'
+
+/**
+ * The Domain Studio SERVER ships as raw source inside the published CLI package
+ * (package.json `files`: studio/server, studio/shared) and runs UNBUNDLED under
+ * Bun — unlike the CLI itself, which is bundled into dist/astrale.js with all its
+ * deps inlined. So at `astrale studio` runtime, the server can only resolve the
+ * third-party packages that the CLI declares in its own `dependencies` (the
+ * studio's package.json deps are NOT installed for an `npm i -g @astrale-os/cli`
+ * consumer — they're client/build-only, inlined into studio/client/dist).
+ *
+ * This test enforces that invariant. If it fails, either add the package to the
+ * CLI's `dependencies` or drop the import — do NOT add it to studio/package.json
+ * (that won't ship to npm consumers).
+ */
+
+const CLI_ROOT = new URL('../../../', import.meta.url).pathname
+
+/** Base package of a bare specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
+function basePackage(spec: string): string {
+  const parts = spec.split('/')
+  return spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]!
+}
+
+function isBuiltin(spec: string): boolean {
+  return spec.startsWith('node:') || spec === 'bun' || spec.startsWith('bun:')
+}
+
+describe('studio server runtime deps', () => {
+  const deps = new Set(
+    Object.keys(
+      (
+        JSON.parse(readFileSync(join(CLI_ROOT, 'package.json'), 'utf8')) as {
+          dependencies?: Record<string, string>
+        }
+      ).dependencies ?? {},
+    ),
+  )
+
+  const project = new Project({ skipAddingFilesFromTsConfig: true })
+  project.addSourceFilesAtPaths([
+    join(CLI_ROOT, 'studio/server/**/*.ts'),
+    join(CLI_ROOT, 'studio/shared/**/*.ts'),
+  ])
+
+  // getImportStringLiterals covers static imports, re-exports, and dynamic import().
+  const offenders: Record<string, string[]> = {}
+  for (const sf of project.getSourceFiles()) {
+    const specs = sf.getImportStringLiterals().map((l) => l.getLiteralValue())
+    for (const spec of specs) {
+      if (spec.startsWith('.') || spec.startsWith('/') || isBuiltin(spec)) continue
+      const pkg = basePackage(spec)
+      if (!deps.has(pkg)) (offenders[pkg] ??= []).push(sf.getFilePath().replace(CLI_ROOT, ''))
+    }
+  }
+
+  test('only import Node/Bun builtins or packages in the CLI dependencies', () => {
+    expect(
+      offenders,
+      `studio server imports packages NOT in the CLI's package.json dependencies — ` +
+        `they won't be installed for an \`npm i -g @astrale-os/cli\` consumer:\n` +
+        JSON.stringify(offenders, null, 2),
+    ).toEqual({})
+  })
+
+  test('parsed at least the known studio server files', () => {
+    // Guard against the glob silently matching nothing (which would make the
+    // invariant vacuously pass).
+    expect(project.getSourceFiles().length).toBeGreaterThan(10)
+  })
+})

package/src/lib/__tests__/table.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'bun:test'
+
+import { renderTable } from '../table'
+
+const ESC = String.fromCharCode(27)
+const strip = (s: string): string => s.replace(new RegExp(`${ESC}\\[[0-9;]*m`, 'g'), '')
+
+const COLS = [
+  { key: 'name', header: 'NAME' },
+  { key: 'kind', header: 'KIND' },
+]
+
+describe('renderTable', () => {
+  test('aligns the KIND column across rows of different name widths', () => {
+    const out = strip(
+      renderTable(
+        [
+          { name: 'dist.astrale.ai', kind: 'Domain' },
+          { name: 'workspace', kind: 'Folder' },
+        ],
+        { columns: COLS },
+      ),
+    )
+    const [a, b] = out.split('\n')
+    expect(a.indexOf('Domain')).toBe(b.indexOf('Folder'))
+  })
+
+  test('empty rows render as (empty)', () => {
+    expect(strip(renderTable([], { columns: COLS }))).toContain('(empty)')
+  })
+
+  test('drops a column that is empty across every row (with header)', () => {
+    const out = strip(renderTable([{ name: 'a', kind: '' }], { columns: COLS, showHeader: true }))
+    expect(out).toContain('NAME')
+    expect(out).not.toContain('KIND')
+  })
+
+  test('computes width on visible length, ignoring ANSI in cells', () => {
+    const colored = `${ESC}[32mok${ESC}[39m`
+    const out = strip(
+      renderTable(
+        [
+          { name: colored, kind: 'x' },
+          { name: 'wider-name', kind: 'y' },
+        ],
+        { columns: COLS },
+      ),
+    )
+    const [a, b] = out.split('\n')
+    // KIND aligns despite the ANSI codes that were in row 0's name cell.
+    expect(a.indexOf('x')).toBe(b.indexOf('y'))
+  })
+})