@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/keys/index.ts

@@ -0,0 +1,14 @@
+export {
+  acceptKeypair,
+  fileExists,
+  generateEd25519Jwk,
+  importKeypair,
+  keypairPaths,
+  listIdentityKeys,
+  persistKeypair,
+  readKeypair,
+  removeKeypair,
+} from './pair'
+export { loadAuth, persistAuth, resolveAuth, signAs } from './credential'
+export type { Keypair, KeypairInput, KeypairPaths } from './pair'
+export type { AuthBinding } from './credential'

package/src/keys/pair.ts

@@ -0,0 +1,219 @@
+import { compactVerify, CompactSign, exportJWK, generateKeyPair, importJWK, type JWK } from 'jose'
+import { randomUUID } from 'node:crypto'
+import { access, mkdir, readFile, unlink } from 'node:fs/promises'
+import { dirname, join, resolve } from 'node:path'
+
+import { AstraleError } from '../errors'
+import { atomicWrite, KEYS_DIR } from '../state/index'
+import { inferAlg } from './algorithm'
+
+const LEGACY_MANAGER_PRIVATE = 'manager.private.jwk'
+const LEGACY_MANAGER_PUBLIC = 'manager.public.jwk'
+
+export type KeypairPaths = {
+  readonly privatePath: string
+  readonly publicPath: string
+}
+
+export interface Keypair {
+  readonly privateJwk: JWK
+  readonly publicJwk: JWK
+  readonly kid?: string
+}
+
+export interface KeypairInput {
+  readonly privateJwk: unknown
+  readonly publicJwk: unknown
+}
+
+/** Preserve manager filenames and confine every subject file to the selected key directory. */
+export function keypairPaths(subject: string, keysDir: string = KEYS_DIR): KeypairPaths {
+  if (
+    subject.length === 0 ||
+    subject.includes('\0') ||
+    subject.includes('/') ||
+    subject.includes('\\')
+  ) {
+    throw invalidKeySubject(subject)
+  }
+  const filenames =
+    subject === 'manager'
+      ? { private: LEGACY_MANAGER_PRIVATE, public: LEGACY_MANAGER_PUBLIC }
+      : { private: `${subject}.private.jwk`, public: `${subject}.public.jwk` }
+
+  return {
+    privatePath: confinedKeyPath(keysDir, filenames.private, subject),
+    publicPath: confinedKeyPath(keysDir, filenames.public, subject),
+  }
+}
+
+function confinedKeyPath(keysDir: string, filename: string, subject: string): string {
+  const path = join(keysDir, filename)
+  if (dirname(resolve(path)) !== resolve(keysDir)) throw invalidKeySubject(subject)
+  return path
+}
+
+function invalidKeySubject(subject: string): AstraleError {
+  return new AstraleError(
+    'INVALID_KEY_SUBJECT',
+    `Identity subject ${JSON.stringify(subject)} cannot name a key file.`,
+    'Use a non-empty subject without path separators.',
+  )
+}
+
+function invalidKeypair(message: string): AstraleError {
+  return new AstraleError('INVALID_KEYPAIR', message, 'Import a supported matching keypair.')
+}
+
+function acceptJwk(input: unknown, role: 'private' | 'public'): JWK {
+  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+    throw invalidKeypair(`The ${role} JWK must be an object.`)
+  }
+  const jwk = { ...input } as JWK
+  if (jwk.kid !== undefined && (typeof jwk.kid !== 'string' || jwk.kid.length === 0)) {
+    throw invalidKeypair(`The ${role} JWK kid must be a non-empty string when present.`)
+  }
+  return jwk
+}
+
+export async function acceptKeypair(input: KeypairInput): Promise<Keypair> {
+  const privateJwk = acceptJwk(input.privateJwk, 'private')
+  const publicJwk = acceptJwk(input.publicJwk, 'public')
+  if (!Object.hasOwn(privateJwk, 'd')) {
+    throw invalidKeypair('The private JWK does not contain private key material.')
+  }
+  if (Object.hasOwn(publicJwk, 'd')) {
+    throw invalidKeypair('The public JWK must not contain private key material.')
+  }
+
+  const privateAlg = inferAlg(privateJwk as Record<string, unknown>)
+  const publicAlg = inferAlg(publicJwk as Record<string, unknown>)
+  if (privateAlg !== publicAlg) {
+    throw invalidKeypair(
+      `The private and public JWK algorithms differ (${privateAlg} versus ${publicAlg}).`,
+    )
+  }
+  if (privateJwk.kid && publicJwk.kid && privateJwk.kid !== publicJwk.kid) {
+    throw invalidKeypair('The private and public JWK key IDs differ.')
+  }
+
+  try {
+    const [privateKey, publicKey] = await Promise.all([
+      importJWK(privateJwk, privateAlg),
+      importJWK(publicJwk, publicAlg),
+    ])
+    const proof = await new CompactSign(new TextEncoder().encode('astrale-keypair-proof'))
+      .setProtectedHeader({ alg: privateAlg })
+      .sign(privateKey)
+    await compactVerify(proof, publicKey, { algorithms: [publicAlg] })
+  } catch {
+    throw invalidKeypair('The private and public JWKs do not form a valid matching pair.')
+  }
+
+  return { privateJwk, publicJwk, kid: privateJwk.kid ?? publicJwk.kid }
+}
+
+export async function fileExists(path: string): Promise<boolean> {
+  try {
+    await access(path)
+    return true
+  } catch (error) {
+    if ((error as { code?: string }).code === 'ENOENT') return false
+    throw error
+  }
+}
+
+export async function listIdentityKeys(keysDir: string = KEYS_DIR): Promise<string[]> {
+  try {
+    const { readdir } = await import('node:fs/promises')
+    const entries = await readdir(keysDir)
+    const names = new Set<string>()
+    for (const entry of entries) {
+      if (entry === LEGACY_MANAGER_PRIVATE) names.add('manager')
+      else if (entry.endsWith('.private.jwk')) names.add(entry.replace(/\.private\.jwk$/, ''))
+    }
+    return Array.from(names).sort()
+  } catch (error) {
+    if ((error as { code?: string }).code === 'ENOENT') return []
+    throw error
+  }
+}
+
+export async function generateEd25519Jwk(
+  kid: string,
+): Promise<{ readonly privateJwk: JWK; readonly publicJwk: JWK }> {
+  const { publicKey, privateKey } = await generateKeyPair('EdDSA', {
+    crv: 'Ed25519',
+    extractable: true,
+  })
+  const privateJwk = await exportJWK(privateKey)
+  const publicJwk = await exportJWK(publicKey)
+  privateJwk.alg = 'EdDSA'
+  publicJwk.alg = 'EdDSA'
+  privateJwk.kid = kid
+  publicJwk.kid = kid
+  return { privateJwk, publicJwk }
+}
+
+export async function persistKeypair(
+  subject: string,
+  opts?: { readonly keysDir?: string; readonly kid?: string },
+): Promise<{ readonly publicJwk: JWK; readonly privateJwk: JWK; readonly kid: string }> {
+  const keysDir = opts?.keysDir ?? KEYS_DIR
+  const { publicKey, privateKey } = await generateKeyPair('ES256', { extractable: true })
+  const publicJwk = await exportJWK(publicKey)
+  const privateJwk = await exportJWK(privateKey)
+  const kid = opts?.kid ?? `${subject}-key-${randomUUID().slice(0, 8)}`
+  publicJwk.kid = kid
+  privateJwk.kid = kid
+  publicJwk.alg = 'ES256'
+  privateJwk.alg = 'ES256'
+
+  await writeKeypair(subject, { privateJwk, publicJwk, kid }, keysDir)
+  return { publicJwk, privateJwk, kid }
+}
+
+export async function readKeypair(subject: string, keysDir: string = KEYS_DIR): Promise<Keypair> {
+  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
+  try {
+    const [privateRaw, publicRaw] = await Promise.all([
+      readFile(privatePath, 'utf-8'),
+      readFile(publicPath, 'utf-8'),
+    ])
+    return await acceptKeypair({
+      privateJwk: JSON.parse(privateRaw) as unknown,
+      publicJwk: JSON.parse(publicRaw) as unknown,
+    })
+  } catch (error) {
+    if (error instanceof AstraleError) throw error
+    throw invalidKeypair(`Could not read the keypair for identity ${JSON.stringify(subject)}.`)
+  }
+}
+
+export async function importKeypair(
+  subject: string,
+  input: KeypairInput,
+  keysDir: string = KEYS_DIR,
+): Promise<Keypair> {
+  const pair = await acceptKeypair(input)
+  await writeKeypair(subject, pair, keysDir)
+  return pair
+}
+
+async function writeKeypair(subject: string, pair: Keypair, keysDir: string): Promise<void> {
+  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
+  await mkdir(keysDir, { recursive: true })
+  await atomicWrite(privatePath, JSON.stringify(pair.privateJwk, null, 2))
+  await atomicWrite(publicPath, JSON.stringify(pair.publicJwk, null, 2))
+}
+
+export async function removeKeypair(subject: string, keysDir: string = KEYS_DIR): Promise<void> {
+  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
+  for (const path of [privatePath, publicPath]) {
+    try {
+      await unlink(path)
+    } catch (error) {
+      if ((error as { code?: string }).code !== 'ENOENT') throw error
+    }
+  }
+}

package/src/keys/tsconfig.json

@@ -0,0 +1,6 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": { "types": ["@types/node"] },
+  "include": ["*.ts"],
+  "exclude": ["__tests__"]
+}

package/src/lib/__tests__/admin-target.test.ts

@@ -4,6 +4,7 @@ import type { InstanceStore } from '../instance'
 
 import {
   DEFAULT_ADMIN_TARGET_NAME,
+  DEFAULT_ADMIN_DOMAIN_ISSUER,
   DEFAULT_ADMIN_TARGET_URL,
   resolveAdminTargetFromStore,
 } from '../admin-target'
@@ -19,9 +20,14 @@ const instances: InstanceStore = {
     admin: {
       url: 'https://bookmarked-admin.example.com',
       issuer: 'https://bookmarked-issuer.example.com',
+      domainIssuer: 'https://bookmarked-domain.example.com',
       defaultIdentity: 'admin-workos',
     },
-    alias: { url: 'https://alias-admin.example.com', name: 'named-admin' },
+    alias: {
+      url: 'https://alias-admin.example.com',
+      domainIssuer: 'https://alias-domain.example.com',
+      name: 'named-admin',
+    },
   },
 }
 
@@ -31,7 +37,8 @@ describe('resolveAdminTargetFromStore', () => {
       name: DEFAULT_ADMIN_TARGET_NAME,
       registrationSlug: DEFAULT_ADMIN_TARGET_NAME,
       url: DEFAULT_ADMIN_TARGET_URL,
-      issuer: DEFAULT_ADMIN_TARGET_URL,
+      kernelIssuer: DEFAULT_ADMIN_TARGET_URL,
+      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
       source: 'default',
       configured: false,
     })
@@ -47,33 +54,69 @@ describe('resolveAdminTargetFromStore', () => {
       name: 'admin',
       registrationSlug: 'admin',
       url: 'https://bookmarked-admin.example.com',
-      issuer: 'https://bookmarked-issuer.example.com',
+      kernelIssuer: 'https://bookmarked-issuer.example.com',
+      domainIssuer: 'https://bookmarked-domain.example.com',
       defaultIdentity: 'admin-workos',
       source: 'config-instance',
       configured: true,
     })
   })
 
+  test('keeps an exact beta Domain issuer separate from the Admin Kernel target', () => {
+    const config: AstraleConfig = {
+      ...DEFAULT_CONFIG,
+      admin: {
+        url: 'https://admin.eu.beta.astrale.ai/api',
+        kernelIssuer: 'https://admin.eu.beta.astrale.ai/api',
+        domainIssuer: 'https://admin.beta.astrale.ai',
+      },
+    }
+
+    expect(resolveAdminTargetFromStore({}, config, instances)).toMatchObject({
+      url: 'https://admin.eu.beta.astrale.ai/api',
+      kernelIssuer: 'https://admin.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+      source: 'config-url',
+      configured: true,
+    })
+
+    expect(
+      resolveAdminTargetFromStore(
+        { adminUrl: 'https://override.eu.beta.astrale.ai/api' },
+        config,
+        instances,
+      ),
+    ).toMatchObject({
+      url: 'https://override.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+    })
+  })
+
   test('allows explicit admin bookmark and admin url overrides', () => {
     expect(
       resolveAdminTargetFromStore({ admin: 'alias' }, DEFAULT_CONFIG, instances),
     ).toMatchObject({
       name: 'alias',
       url: 'https://alias-admin.example.com',
-      issuer: 'https://alias-admin.example.com',
+      kernelIssuer: 'https://alias-admin.example.com',
+      domainIssuer: 'https://alias-domain.example.com',
       source: 'admin',
     })
 
     expect(
       resolveAdminTargetFromStore(
-        { adminUrl: 'https://override-admin.example.com' },
+        {
+          adminUrl: 'https://override-admin.example.com',
+          domainIssuer: 'https://override-domain.example.com',
+        },
         DEFAULT_CONFIG,
         instances,
       ),
     ).toMatchObject({
       name: 'admin',
       url: 'https://override-admin.example.com',
-      issuer: 'https://override-admin.example.com',
+      kernelIssuer: 'https://override-admin.example.com',
+      domainIssuer: 'https://override-domain.example.com',
       source: 'admin-url',
     })
   })
@@ -89,13 +132,17 @@ describe('resolveAdminTargetFromStore', () => {
 
     expect(
       resolveAdminTargetFromStore(
-        { url: 'https://override.example.com' },
+        {
+          url: 'https://override.example.com',
+          domainIssuer: 'https://override-domain.example.com',
+        },
         DEFAULT_CONFIG,
         instances,
       ),
     ).toMatchObject({
       name: 'admin',
       url: 'https://override.example.com',
+      domainIssuer: 'https://override-domain.example.com',
       source: 'admin-url',
     })
   })
@@ -109,4 +156,17 @@ describe('resolveAdminTargetFromStore', () => {
       ),
     ).toThrow('Choose one admin target override')
   })
+
+  test('retains configured Domain evidence instead of inferring it from the Kernel issuer', () => {
+    expect(
+      resolveAdminTargetFromStore(
+        { adminUrl: 'https://override-admin.example.com' },
+        DEFAULT_CONFIG,
+        instances,
+      ),
+    ).toMatchObject({
+      kernelIssuer: 'https://override-admin.example.com',
+      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
+    })
+  })
 })

package/src/lib/__tests__/binary.test.ts

@@ -4,8 +4,7 @@ import { readFile, unlink } from 'node:fs/promises'
 import { presentBinary, type BinaryLike } from '../binary'
 
 const png = (): BinaryLike => ({
-  status: 200,
-  contentType: 'image/png',
+  mediaType: 'image/png',
   body: new Uint8Array([1, 2, 3, 4]),
 })
 
@@ -40,7 +39,7 @@ describe('presentBinary', () => {
 
   test('--json inlines text for text-like content types', async () => {
     await presentBinary(
-      { status: 200, contentType: 'text/plain', body: new TextEncoder().encode('hi') },
+      { mediaType: 'text/plain', body: new TextEncoder().encode('hi') },
       { json: true },
     )
     const obj = JSON.parse(Buffer.concat(chunks).toString())

package/src/lib/__tests__/command-dx.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test'
 import { CommanderError } from 'commander'
 
-import { buildProgram } from '../../program'
+import { buildProgram } from '../../program/index'
 import { collectCommandCatalog, renderCommanderError } from '../command-dx'
 
 // `renderCommanderError` styles commands with `chalk.bold`, which emits ANSI
@@ -22,7 +22,7 @@ describe('command DX suggestions', () => {
     expect(usages).toContain('admin use [bookmark]')
     expect(usages).toContain('use <name>')
     expect(usages).toContain('update')
-    expect(usages).toContain('ls [path]')
+    expect(usages).toContain('ls <source>')
     expect(usages).toContain('status')
   })
 

package/src/lib/__tests__/config.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test'
 
-import { DEFAULT_ADMIN_TARGET_URL } from '../admin-target'
+import { DEFAULT_ADMIN_DOMAIN_ISSUER, DEFAULT_ADMIN_TARGET_URL } from '../admin-target'
 import { AstraleConfigSchema } from '../config'
 
 describe('AstraleConfigSchema', () => {
@@ -18,7 +18,8 @@ describe('AstraleConfigSchema', () => {
     expect(result.admin).toEqual({
       name: 'admin',
       url: DEFAULT_ADMIN_TARGET_URL,
-      issuer: DEFAULT_ADMIN_TARGET_URL,
+      kernelIssuer: DEFAULT_ADMIN_TARGET_URL,
+      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
     })
   })
 

package/src/lib/__tests__/idp.test.ts

@@ -63,11 +63,8 @@ describe('IdP schemas and token helpers', () => {
     expect(config?.client.token_request_format).toBe('json')
   })
 
-  test('builds built-in WorkOS IdP config with the public alpha client id by default', () => {
-    const config = builtinIdpConfig('workos', undefined, {})
-
-    expect(config?.entry.builtIn).toBe(true)
-    expect(config?.client.client_id).toBe('client_01KC29HEGD7B40TV2C4QZ436BG')
+  test('does not invent a WorkOS environment when no client id is configured', () => {
+    expect(builtinIdpConfig('workos', undefined, {})).toBeNull()
   })
 
   test('reads WorkOS client id from WORKOS_CLIENT_ID before VITE_WORKOS_CLIENT_ID', () => {
@@ -78,7 +75,8 @@ describe('IdP schemas and token helpers', () => {
       }),
     ).toBe('client_primary')
     expect(workosClientIdFromEnv({ VITE_WORKOS_CLIENT_ID: 'client_vite' })).toBe('client_vite')
-    expect(workosClientIdFromEnv({})).toBe('client_01KC29HEGD7B40TV2C4QZ436BG')
+    expect(workosClientIdFromEnv({})).toBeUndefined()
+    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBeUndefined()
   })
 
   test('stores client secret env names, not secret material', () => {

package/src/lib/__tests__/instance-target.test.ts

@@ -22,6 +22,7 @@ const store: InstanceStore = {
     admin: {
       url: 'https://bookmarked-admin.example.com/api',
       issuer: 'https://bookmarked-admin-issuer.example.com',
+      domainIssuer: 'https://bookmarked-admin-domain.example.com',
     },
   },
 }
@@ -36,7 +37,8 @@ const directAdminConfig: AstraleConfig = {
   admin: {
     name: 'admin',
     url: 'https://admin.eu.astrale.ai/api',
-    issuer: 'https://admin.eu.astrale.ai/api',
+    kernelIssuer: 'https://admin.eu.astrale.ai/api',
+    domainIssuer: 'https://admin.beta.astrale.ai',
   },
 }
 
@@ -83,7 +85,8 @@ describe('resolveInstanceTarget', () => {
       name: 'admin',
       source: 'admin',
       url: 'https://admin.eu.astrale.ai/api',
-      issuer: 'https://admin.eu.astrale.ai/api',
+      kernelIssuer: 'https://admin.eu.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
     })
     expect(managedCalls).toEqual([])
   })
@@ -116,7 +119,7 @@ describe('resolveInstanceTarget', () => {
       name: 'bryan',
       source: 'managed',
       url: 'https://bryan.eu.astrale.ai/api',
-      issuer: 'https://bryan.eu.astrale.ai/api',
+      kernelIssuer: 'https://bryan.eu.astrale.ai/api',
     })
   })
 
@@ -147,7 +150,7 @@ describe('resolveInstanceTarget', () => {
     ).resolves.toEqual({
       source: 'url',
       url: 'https://kernel.example.com/api',
-      issuer: 'https://kernel.example.com/api',
+      kernelIssuer: 'https://kernel.example.com/api',
       name: undefined,
     })
   })

package/src/lib/__tests__/local-status.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test'
 
-import type { IdentityStore } from '../identity'
+import type { IdentityStore } from '../../identity/index'
 import type { IdpSession } from '../idp'
 import type { InstanceStore } from '../instance'
 

package/src/lib/__tests__/log.test.ts

@@ -0,0 +1,31 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
+
+import { log } from '../log'
+
+describe('log diagnostics', () => {
+  let stdout: string[]
+  let stderr: string[]
+  let originalLog: typeof console.log
+  let originalError: typeof console.error
+
+  beforeEach(() => {
+    stdout = []
+    stderr = []
+    originalLog = console.log
+    originalError = console.error
+    console.log = mock((...values: unknown[]) => stdout.push(values.map(String).join(' ')))
+    console.error = mock((...values: unknown[]) => stderr.push(values.map(String).join(' ')))
+  })
+
+  afterEach(() => {
+    console.log = originalLog
+    console.error = originalError
+  })
+
+  test('warnings use stderr so machine-readable stdout remains one value', () => {
+    log.warn('identity override consented')
+
+    expect(stdout).toEqual([])
+    expect(stderr.join('\n')).toContain('identity override consented')
+  })
+})

package/src/lib/__tests__/meta.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from 'bun:test'
+
+import { checkIssuerReachability } from '../meta'
+
+const ISSUER = 'https://host.example/kernel/child'
+const INVOCATION = `${ISSUER}/invoke`
+
+describe('issuer reachability', () => {
+  /** @evidence TEST-CLI-CONNECTION-PROBES-PINNED-ISSUER */
+  test('probes OIDC discovery at the separately pinned issuer, not the invocation endpoint', async () => {
+    const requests: string[] = []
+    const fetch = async (input: RequestInfo | URL): Promise<Response> => {
+      const url = String(input)
+      requests.push(url)
+      if (url === `${ISSUER}/.well-known/openid-configuration`) {
+        return Response.json({
+          issuer: ISSUER,
+          jwks_uri: `${ISSUER}/.well-known/jwks.json`,
+        })
+      }
+      if (url === `${ISSUER}/.well-known/jwks.json`) {
+        return Response.json({ keys: [{ kid: 'bootstrap' }] })
+      }
+      return new Response(null, { status: 404 })
+    }
+
+    await expect(checkIssuerReachability(INVOCATION, ISSUER, fetch)).resolves.toEqual({
+      issuer: ISSUER,
+      keys: [{ kid: 'bootstrap' }],
+    })
+    expect(requests).toEqual([
+      `${ISSUER}/.well-known/openid-configuration`,
+      `${ISSUER}/.well-known/jwks.json`,
+    ])
+  })
+
+  /** @evidence TEST-CLI-CONNECTION-REJECTS-DISCOVERY-ISSUER-MISMATCH */
+  test('rejects discovery that contradicts the separately pinned issuer', async () => {
+    const conflictingIssuer = 'https://attacker.example/kernel/child'
+    const fetch = async (input: RequestInfo | URL): Promise<Response> => {
+      const url = String(input)
+      if (url.endsWith('/.well-known/openid-configuration')) {
+        return Response.json({
+          issuer: conflictingIssuer,
+          jwks_uri: `${conflictingIssuer}/.well-known/jwks.json`,
+        })
+      }
+      return Response.json({ keys: [{ kid: 'attacker' }] })
+    }
+
+    await expect(checkIssuerReachability(INVOCATION, ISSUER, fetch)).rejects.toMatchObject({
+      code: 'ISSUER_UNREACHABLE',
+    })
+  })
+})

package/src/lib/__tests__/sdk-deps.test.ts

@@ -9,7 +9,7 @@ describe('parseSdkOutdated', () => {
   test('keeps only deps with a strictly newer latest; uses wanted when current is absent', () => {
     const json = JSON.stringify({
       '@astrale-os/sdk': { current: '0.1.5', wanted: '0.1.5', latest: '0.1.9' }, // behind
-      '@astrale-os/kernel-dsl': { current: '0.1.2', wanted: '0.1.2', latest: '0.1.2' }, // current
+      '@astrale-os/sdk/schema': { current: '0.1.2', wanted: '0.1.2', latest: '0.1.2' }, // current
       '@astrale-os/shell': { wanted: '0.1.0', latest: '0.1.1' }, // no `current` (not installed)
     })
     expect(parseSdkOutdated(json)).toEqual([