@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/commands/__tests__/read-commands.test.ts

@@ -1,41 +1,53 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
 
-type Wire = { nodes: unknown[]; edges: unknown[]; roots: string[]; next?: Record<string, unknown> }
+type GraphContext = {
+  graph: {
+    query: typeof queryMock
+    getOrThrow: typeof getOrThrowMock
+    mutate: typeof mutateMock
+  }
+}
+
 type RunOpts = {
   opts: Record<string, unknown>
-  fn: (ctx: { client: { call: typeof clientCallMock } }) => Promise<unknown>
-  format?: (result: unknown, opts: Record<string, unknown>, isRaw: boolean) => void | Promise<void>
+  fn: (context: GraphContext) => Promise<unknown>
+  format?: (
+    result: unknown,
+    opts: Record<string, unknown>,
+    machine: boolean,
+  ) => void | Promise<void>
 }
 
 class ExitError extends Error {
   constructor(readonly code: string | number | null | undefined) {
-    super('process.exit(' + String(code) + ')')
+    super(`process.exit(${String(code)})`)
   }
 }
 
-const emptyWire = (): Wire => ({ nodes: [], edges: [], roots: [] })
-
 let stdout = ''
 let errors: string[] = []
 let originalStdoutWrite: typeof process.stdout.write
 let originalConsoleError: typeof console.error
 let originalExit: typeof process.exit
-let queryAsts: unknown[] = []
-let getPaths: string[] = []
-let queryResult: { wire: Wire } = { wire: emptyWire() }
-let getResult: unknown = null
-let clientCallResult: unknown = { rows: [] }
-
-const clientCallMock = mock(async () => clientCallResult)
-const queryMock = mock(async (ast: unknown) => {
-  queryAsts.push(ast)
+let queryCalls: Array<{ ast: unknown; options: unknown }> = []
+let getTargets: string[] = []
+let mutations: unknown[] = []
+let queryResult: unknown
+let getResult: unknown
+let mutationResult: unknown
+
+const queryMock = mock(async (ast: unknown, options?: unknown) => {
+  queryCalls.push({ ast, options })
   return queryResult
 })
-const getMock = mock(async (path: string) => {
-  getPaths.push(path)
+const getOrThrowMock = mock(async (target: { readonly raw?: string; toString(): string }) => {
+  getTargets.push(target.raw ?? target.toString())
   return getResult
 })
-const bindGraphMock = mock(() => ({ query: queryMock, get: getMock }))
+const mutateMock = mock(async (mutation: unknown) => {
+  mutations.push(mutation)
+  return mutationResult
+})
 const expandSelfInPathMock = mock(async (path: string) => {
   if (path === '@self') {
     return {
@@ -45,14 +57,15 @@ const expandSelfInPathMock = mock(async (path: string) => {
   }
   return { path, meta: undefined }
 })
-const withSelfHintMock = mock(async (fn: () => Promise<unknown>) => fn())
+const withSelfHintMock = mock(async (action: () => Promise<unknown>) => action())
 const runKernelCommandMock = mock(async (run: RunOpts) => {
-  const result = await run.fn({ client: { call: clientCallMock } })
-  if (run.format) await run.format(result, run.opts, true)
+  const result = await run.fn({
+    graph: { query: queryMock, getOrThrow: getOrThrowMock, mutate: mutateMock },
+  })
+  await run.format?.(result, run.opts, true)
 })
 
-mock.module('../../kernel', () => ({
-  bindGraph: bindGraphMock,
+mock.module('../../connection', () => ({
   expandSelfInPath: expandSelfInPathMock,
   runKernelCommand: runKernelCommandMock,
   withSelfHint: withSelfHintMock,
@@ -61,28 +74,35 @@ mock.module('../../kernel', () => ({
 beforeEach(() => {
   stdout = ''
   errors = []
-  queryAsts = []
-  getPaths = []
-  queryResult = { wire: emptyWire() }
-  getResult = null
-  clientCallResult = { rows: [] }
-  clientCallMock.mockClear()
+  queryCalls = []
+  getTargets = []
+  mutations = []
+  queryResult = {
+    result: {
+      kind: 'graph',
+      graph: { nodes: [], edges: [] },
+      selection: { kind: 'node', ids: [] },
+    },
+    page: {},
+  }
+  getResult = undefined
+  mutationResult = { createdNodes: {} }
   queryMock.mockClear()
-  getMock.mockClear()
-  bindGraphMock.mockClear()
+  getOrThrowMock.mockClear()
+  mutateMock.mockClear()
   expandSelfInPathMock.mockClear()
   withSelfHintMock.mockClear()
   runKernelCommandMock.mockClear()
 
-  originalStdoutWrite = process.stdout.write.bind(process.stdout)
+  originalStdoutWrite = process.stdout.write
   originalConsoleError = console.error
   originalExit = process.exit
   process.stdout.write = ((chunk: string | Uint8Array) => {
     stdout += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8')
     return true
   }) as typeof process.stdout.write
-  console.error = ((...args: unknown[]) => {
-    errors.push(args.map(String).join(' '))
+  console.error = ((...values: unknown[]) => {
+    errors.push(values.map(String).join(' '))
   }) as typeof console.error
   process.exit = ((code?: string | number | null) => {
     throw new ExitError(code)
@@ -96,106 +116,156 @@ afterEach(() => {
 })
 
 describe('query command', () => {
-  test('lowers roots and selectors to the expected QueryASTInput', async () => {
+  /** @evidence TEST-CLI-QUERY-DISPATCHES-CANONICAL-V6 */
+  test('dispatches the supported source/edge subset as Query V6 with its cursor', async () => {
     const { queryCommand } = await import('../query')
 
-    await queryCommand(['/root', '@self'], {
+    await queryCommand(['/:notes.example.dev:class.Note'], {
       json: true,
-      depth: '2',
-      children:
-        '{"classes":["/:kernel.astrale.ai:class.Folder"],"limit":50,"cursor":"child-cursor","order":{"by":"id","dir":"asc"}}',
-      edges:
-        '[{"as":"perm","classes":["/:kernel.astrale.ai:class.has_perm"],"direction":"out","limit":10,"cursor":"edge-cursor","order":{"by":"id","dir":"desc"}},{"direction":"both"}]',
+      edge: '/:notes.example.dev:class.references',
+      direction: 'incoming',
+      limit: '25',
+      cursor: 'next-page',
     })
 
-    expect(queryAsts).toEqual([
+    expect(JSON.parse(JSON.stringify(queryCalls))).toEqual([
       {
-        version: 1,
-        from: ['/root', '@expanded-self'],
-        steps: [
-          {
-            expand: {
-              edge: 'has_parent',
-              dir: 'in',
-              depth: 2,
-              filter: { class: ['/:kernel.astrale.ai:class.Folder'] },
-              page: { limit: 50, cursor: 'child-cursor' },
-              order: { by: 'id', dir: 'asc' },
-            },
+        ast: {
+          format: 'astrale.graph.query',
+          version: 'v6',
+          source: {
+            kind: 'node',
+            terms: [{ kind: 'path', path: '/:notes.example.dev:class.Note' }],
+            binding: 'n0',
           },
-          {
-            expand: {
-              edge: ['/:kernel.astrale.ai:class.has_perm'],
-              dir: 'out',
-              as: 'perm',
-              page: { limit: 10, cursor: 'edge-cursor' },
-              order: { by: 'id', dir: 'desc' },
+          steps: [
+            {
+              op: 'expand',
+              from: 'n0',
+              via: [{ origin: 'notes.example.dev', kind: 'class', name: 'references' }],
+              direction: 'incoming',
+              bindings: { edge: 'e0', node: 'n1' },
             },
-          },
-          { expand: { dir: 'both', as: 'e1' } },
-        ],
+          ],
+          select: { kind: 'graph', binding: 'n1' },
+        },
+        options: { page: { size: 25, after: 'next-page' } },
       },
     ])
-    expect(expandSelfInPathMock.mock.calls.map((call) => call[0])).toEqual(['/root', '@self'])
-    expect(withSelfHintMock).toHaveBeenCalledTimes(1)
   })
 
-  test('rejects an invalid children selector before dispatch', async () => {
+  test('authors a Definition source through the same canonical Query V6 call', async () => {
     const { queryCommand } = await import('../query')
 
-    await expect(queryCommand(['/'], { json: true, children: '{"bogus":true}' })).rejects.toEqual(
-      new ExitError(1),
-    )
+    await queryCommand([], {
+      json: true,
+      definition: '/:issues.astrale.ai:class.Issue',
+      limit: '20',
+    })
 
-    expect(errors.join('\n')).toContain('--children invalid selector')
-    expect(queryMock).not.toHaveBeenCalled()
+    expect(JSON.parse(JSON.stringify(queryCalls))).toEqual([
+      {
+        ast: {
+          format: 'astrale.graph.query',
+          version: 'v6',
+          source: {
+            kind: 'node',
+            terms: [
+              {
+                kind: 'definition',
+                definition: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
+              },
+            ],
+            binding: 'n0',
+          },
+          steps: [],
+          select: { kind: 'graph', binding: 'n0' },
+        },
+        options: { page: { size: 20 } },
+      },
+    ])
   })
 
-  test('rejects mixing --ast with positional roots', async () => {
+  /** @evidence TEST-CLI-QUERY-REJECTS-V1-BEFORE-CONNECTION */
+  test('rejects a legacy AST before opening the command connection', async () => {
     const { queryCommand } = await import('../query')
 
     await expect(
-      queryCommand(['/'], { json: true, ast: '{"version":1,"from":["/"]}' }),
+      queryCommand([], { json: true, ast: '{"version":1,"from":["/"]}' }),
     ).rejects.toEqual(new ExitError(1))
 
-    expect(errors.join('\n')).toContain(
-      '--ast cannot be used with positional roots or --depth/--children/--edges',
-    )
-    expect(queryMock).not.toHaveBeenCalled()
+    expect(runKernelCommandMock).not.toHaveBeenCalled()
+    expect(errors.join('\n')).toContain('expected "astrale.graph.query" at /format')
   })
 })
 
 describe('get command', () => {
-  test('dispatches a point read and prints the flat wire projection', async () => {
+  /** @evidence TEST-CLI-GET-RETURNS-CANONICAL-NODE */
+  test('point-reads the target and does not synthesize Path or backend fields', async () => {
     const { getCommand } = await import('../get')
-    const row = {
-      id: 'n1',
-      class: '/:demo:class.Widget',
-      path: '/demo/widget',
-      props: { name: 'Widget' },
-      __labels: ['Node', 'Widget'],
-      classId: 'class-1',
+    getResult = {
+      id: 'note-1',
+      class: '/:notes.example.dev:class.Note',
+      props: { 'notes.example.dev:class.Note.property.title': 'Hello' },
     }
-    getResult = row
 
-    await getCommand('/demo/widget', { json: true })
+    await getCommand('/:notes.example.dev:class.Note', { json: true })
 
-    expect(getPaths).toEqual(['/demo/widget'])
-    expect(JSON.parse(stdout)).toEqual({
-      id: 'n1',
-      class: '/:demo:class.Widget',
-      path: '/demo/widget',
-      props: { name: 'Widget' },
-    })
+    expect(getTargets).toEqual(['/:notes.example.dev:class.Note'])
+    expect(JSON.parse(stdout)).toEqual(getResult)
+    expect(stdout).not.toContain('__labels')
+    expect(stdout).not.toContain('classId')
   })
+})
 
-  test('errors with exit 1 when no node resolves', async () => {
-    const { getCommand } = await import('../get')
-    getResult = null
+describe('ls command', () => {
+  /** @evidence TEST-CLI-LS-REQUIRES-EXACT-EDGE-BEFORE-CONNECTION */
+  test('rejects a generic child listing before opening the command connection', async () => {
+    const { lsCommand } = await import('../ls')
+
+    await expect(lsCommand('@node', { json: true })).rejects.toEqual(new ExitError(1))
+
+    expect(runKernelCommandMock).not.toHaveBeenCalled()
+    expect(errors.join('\n')).toContain('Kernel V2 has no universal child relation')
+  })
+})
 
-    await expect(getCommand('/missing', { json: true })).rejects.toEqual(new ExitError(1))
+describe('mutate command', () => {
+  /** @evidence TEST-CLI-MUTATE-DISPATCHES-CANONICAL-V3 */
+  test('admits authoring input and dispatches one canonical Mutation V3 document', async () => {
+    const { mutateCommand } = await import('../mutate')
+    mutationResult = { createdNodes: { note: 'note-1' } }
 
-    expect(getPaths).toEqual(['/missing'])
-    expect(errors.join('\n')).toContain('node "/missing" not found or not visible')
+    await mutateCommand({
+      json: true,
+      data: JSON.stringify({
+        preconditions: [],
+        operations: [
+          {
+            op: 'node.create',
+            as: 'note',
+            class: '/:notes.example.dev:class.Note',
+            props: {},
+          },
+        ],
+      }),
+    })
+
+    expect(JSON.parse(JSON.stringify(mutations))).toEqual([
+      {
+        format: 'astrale.graph.mutation',
+        version: 'v3',
+        preconditions: [],
+        operations: [
+          {
+            op: 'node.create',
+            as: 'note',
+            class: '/:notes.example.dev:class.Note',
+            props: {},
+          },
+        ],
+      },
+    ])
+    expect(JSON.parse(stdout)).toEqual({ createdNodes: { note: 'note-1' } })
   })
 })

package/src/commands/__tests__/view.test.ts

@@ -1,23 +1,28 @@
+import type { ResolvedView } from '@astrale-os/shell'
+
+import { Path } from '@astrale-os/sdk/graph/path'
 import { beforeEach, describe, expect, mock, test } from 'bun:test'
 
-const getMock = mock(async (_path: string) => ({ id: 'issue-id' }))
-const clientCallMock = mock(async (): Promise<unknown> => {
-  throw new Error('View:resolve must not run for a bare --view-url')
-})
+const viewsForMock = mock(async (_target: unknown): Promise<unknown> => ({ views: [] }))
 const abMock = mock(async (_args: string[]) => ({
   ok: true,
   data: { snapshot: '- button "Ready" [ref=e1]' },
   error: null,
 }))
 
-mock.module('../../kernel', () => ({
-  bindGraph: () => ({ get: getMock }),
+mock.module('../../connection', () => ({
   expandSelfInPath: async (path: string) => ({ path }),
-  resolveKernelTarget: mock(),
-  withKernelClient: async (
+  withClientSession: async (
     _opts: unknown,
-    run: (ctx: { client: { call: typeof clientCallMock } }) => Promise<unknown>,
-  ) => run({ client: { call: clientCallMock } }),
+    run: (ctx: {
+      session: { viewsFor: typeof viewsForMock }
+      target: { url: string; kernelIssuer: string }
+    }) => Promise<unknown>,
+  ) =>
+    run({
+      session: { viewsFor: viewsForMock },
+      target: { url: 'https://kernel.test', kernelIssuer: 'https://kernel.test' },
+    }),
 }))
 
 mock.module('../../lib/browser', () => ({
@@ -28,62 +33,106 @@ mock.module('../../lib/browser', () => ({
 }))
 
 beforeEach(() => {
-  getMock.mockClear()
-  clientCallMock.mockClear()
+  viewsForMock.mockClear()
   abMock.mockClear()
 })
 
+const route = (value: unknown) => value as ResolvedView['route']
+
+const resolved = [
+  route({
+    key: 'ai-gateway.astrale.ai:view.chat',
+    href: 'https://ai-gateway.astrale.ai/ui/chat',
+    handshake: 'shell' as const,
+    issuer: 'https://ai-gateway.astrale.ai',
+    etag: `sha256:${'a'.repeat(64)}`,
+    revision: `sha256:${'b'.repeat(64)}`,
+    declaration: {
+      target: {
+        kind: 'definition' as const,
+        definitions: [{ origin: 'ai-gateway.astrale.ai', kind: 'class' as const, name: 'Model' }],
+      },
+      auth: 'required' as const,
+    },
+  }),
+  route({
+    key: 'ai-gateway.astrale.ai:view.model',
+    href: 'https://ai-gateway.astrale.ai/ui/model',
+    handshake: 'none' as const,
+    issuer: 'https://ai-gateway.astrale.ai',
+    etag: `sha256:${'c'.repeat(64)}`,
+    revision: `sha256:${'d'.repeat(64)}`,
+    declaration: { target: { kind: 'domain' as const }, auth: 'public' as const },
+  }),
+]
+
 describe('view session resolution', () => {
-  test('uses a bare --view-url target only as shell context', async () => {
+  /** @evidence TEST-CLI-VIEW-PRESERVES-HOST-PROVENANCE */
+  test('returns one exact target-bound placement without split mount coordinates', async () => {
     const { resolveSession } = await import('../view')
-    const targetPath = '/users/user-1/issue-1'
+    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
 
-    const result = await resolveSession(undefined, {
-      viewUrl: 'http://127.0.0.1:5173/ui/issues',
-      handshake: 'shell',
-      target: targetPath,
-    })
+    const result = await resolveSession('@model-id', { view: 'chat' })
 
-    expect(getMock).toHaveBeenCalledWith(targetPath)
-    expect(clientCallMock).not.toHaveBeenCalled()
-    expect(result).toEqual({
-      view: {
-        url: 'http://127.0.0.1:5173/ui/issues',
-        functionId: 'dev-view',
-        handshake: 'shell',
-        name: 'dev',
-      },
-      target: { id: 'issue-id', path: targetPath },
-      candidates: [],
-    })
+    expect(viewsForMock).toHaveBeenCalledTimes(1)
+    expect(String(viewsForMock.mock.calls[0]?.[0])).toBe('@model-id')
+    expect(result.view).toEqual({ target: Path.parse('@model-id').raw, route: resolved[0] })
+    expect(result.view).not.toHaveProperty('url')
+    expect(result.view).not.toHaveProperty('functionId')
+    expect(result.view).not.toHaveProperty('handshake')
   })
 
-  test('lists every candidate without requiring a view selection', async () => {
+  test('lists every candidate with its complete placement provenance', async () => {
     const { resolveSession } = await import('../view')
-    const targetPath = '/domains/ai-gateway.astrale.ai/core/gemini-3-5-flash'
-    const candidates = [
-      {
-        id: 'chat-id',
-        path: '/domains/ai-gateway.astrale.ai/views/chat',
+    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
+
+    const result = await resolveSession('@model-id', { list: true })
+
+    expect(result.view).toBeUndefined()
+    expect(result.candidates).toEqual([
+      expect.objectContaining({
+        target: '@model-id',
+        route: resolved[0],
+        id: 'ai-gateway.astrale.ai:view.chat',
+        path: '/:ai-gateway.astrale.ai:view.chat',
         url: 'https://ai-gateway.astrale.ai/ui/chat',
-        origin: 'class' as const,
-      },
-      {
-        id: 'model-id',
-        path: '/domains/ai-gateway.astrale.ai/views/model',
-        url: 'https://ai-gateway.astrale.ai/ui/model',
-        origin: 'class' as const,
-      },
-    ]
-    clientCallMock.mockImplementationOnce(async () => candidates)
+        name: 'chat',
+        handshake: 'shell',
+        origin: 'class',
+      }),
+      expect.objectContaining({
+        target: '@model-id',
+        route: resolved[1],
+        id: 'ai-gateway.astrale.ai:view.model',
+        handshake: 'none',
+        origin: 'self',
+      }),
+    ])
+  })
 
-    const result = await resolveSession(targetPath, { list: true })
+  test('resolves an explicit ViewPath against its Domain owner when no target is supplied', async () => {
+    const { resolveSession } = await import('../view')
+    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
+
+    const result = await resolveSession('/:ai-gateway.astrale.ai:view.model', {})
 
-    expect(result).toEqual({
-      target: { id: 'issue-id', path: targetPath },
-      candidates,
+    expect(String(viewsForMock.mock.calls[0]?.[0])).toBe('/:ai-gateway.astrale.ai')
+    expect(result.view).toEqual({
+      target: Path.parse('/:ai-gateway.astrale.ai').raw,
+      route: resolved[1],
     })
   })
+
+  test('retains legacy override flags but refuses to forge V2 placement provenance', async () => {
+    const { rejectUnrepresentableOverrides } = await import('../view')
+
+    expect(() => rejectUnrepresentableOverrides({ viewUrl: 'http://localhost:8787' })).toThrow(
+      'verified View placement',
+    )
+    expect(() => rejectUnrepresentableOverrides({ handshake: 'none' })).toThrow(
+      'verified View placement',
+    )
+  })
 })
 
 describe('view capture timing', () => {

package/src/commands/admin/status.ts

@@ -1,10 +1,10 @@
 import chalk from 'chalk'
 
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
+import { getDefault } from '../../identity/index'
 import { resolveAdminTargetFromStore } from '../../lib/admin-target'
 import { readConfig } from '../../lib/config'
-import { getDefault } from '../../lib/identity'
 import { readInstances } from '../../lib/instance'
 import { fatal, log } from '../../lib/log'
 import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
@@ -46,7 +46,7 @@ export default {
 
       console.log(chalk.bold('Admin'))
       console.log(`  ${chalk.bold(target.name)} ${chalk.dim(target.url)}`)
-      console.log(`  issuer: ${chalk.dim(target.issuer)}`)
+      console.log(`  kernel issuer: ${chalk.dim(target.kernelIssuer)}`)
       console.log(`  source: ${target.source}`)
       if (status.identity) {
         const mark = status.identity.registered ? chalk.green('yes') : chalk.yellow('no')

package/src/commands/admin/use.ts

@@ -1,6 +1,10 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
-import { AdminTargetConfigSchema, DEFAULT_ADMIN_TARGET_NAME } from '../../lib/admin-target'
+import {
+  AdminTargetConfigSchema,
+  DEFAULT_ADMIN_DOMAIN_ISSUER,
+  DEFAULT_ADMIN_TARGET_NAME,
+} from '../../lib/admin-target'
 import { readConfig, writeConfig } from '../../lib/config'
 import { resolveInstance } from '../../lib/instance'
 import { fatal, log } from '../../lib/log'
@@ -8,7 +12,8 @@ import { fatal, log } from '../../lib/log'
 type AdminUseOpts = {
   url?: string
   name?: string
-  issuer?: string
+  kernelIssuer?: string
+  domainIssuer?: string
 }
 
 export default {
@@ -23,7 +28,7 @@ Behavior:
 
 Examples:
   $ astrale admin use admin
-  $ astrale admin use --url https://admin.eu.astrale.ai/api
+  $ astrale admin use --url https://admin.eu.astrale.ai/api --domain-issuer https://admin.beta.astrale.ai
   $ astrale admin status
 `,
   arguments: [{ name: 'bookmark', description: 'Bookmarked admin instance', required: false }],
@@ -33,7 +38,14 @@ Examples:
       flags: '--name <name>',
       description: 'Friendly name / registration slug for direct URL admin target',
     },
-    { flags: '--issuer <url>', description: 'Admin kernel issuer/audience if different from URL' },
+    {
+      flags: '--kernel-issuer <url>',
+      description: 'Admin Kernel issuer/audience if different from URL',
+    },
+    {
+      flags: '--domain-issuer <url>',
+      description: 'Exact native Admin Domain issuer used for token exchange',
+    },
   ],
   action: async (bookmark: string | undefined, opts: AdminUseOpts) => {
     try {
@@ -43,13 +55,17 @@ Examples:
 
       const config = await readConfig()
       if (opts.url) {
+        if (opts.domainIssuer === undefined) {
+          fatal('Direct Admin targets require --domain-issuer <url> for token exchange.')
+        }
         const name = opts.name ?? DEFAULT_ADMIN_TARGET_NAME
         await writeConfig({
           ...config,
           admin: AdminTargetConfigSchema.parse({
             name,
             url: opts.url,
-            issuer: opts.issuer ?? opts.url,
+            kernelIssuer: opts.kernelIssuer ?? opts.url,
+            domainIssuer: opts.domainIssuer,
           }),
         })
         log.success(`Admin target: ${name} (${opts.url})`)
@@ -63,10 +79,17 @@ Examples:
       }
 
       const resolved = await resolveInstance(bookmark)
+      if (resolved.domainIssuer === undefined) {
+        fatal(
+          `Admin bookmark "${resolved.name}" has no Domain issuer. Re-bookmark it with --domain-issuer <url>.`,
+        )
+      }
       await writeConfig({
         ...config,
         admin: AdminTargetConfigSchema.parse({
           instance: resolved.name,
+          domainIssuer:
+            opts.domainIssuer ?? config.admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER,
         }),
       })
       log.success(`Admin target: ${resolved.name} (${resolved.url})`)

package/src/commands/auth/login.ts

@@ -1,4 +1,4 @@
-import type { CommandDefinition } from '../../command'
+import type { CommandDefinition } from '../../program/index'
 
 import { type IdpSession } from '../../lib/idp'
 import { log } from '../../lib/log'