@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/lib/admin-domain.ts

@@ -1,29 +1,43 @@
-/**
- * The admin `DomainEntry` surface used by `astrale domain publish`. The merged
- * admin domain models the installable-domain REGISTRY as the `DomainEntry`
- * class (named `DomainEntry`, not `Domain`, because `Domain` is a reserved
- * kernel node-kind); `publish` upserts a `name → url` catalog entry the child
- * kernel later installs from. Publishing only makes a domain INSTALLABLE —
- * mounting it on an instance is the separate `domain install` step (or the
- * admin's install-by-default policy).
- */
-export const ADMIN_DOMAIN = '/:admin.astrale.ai:class.DomainEntry'
+import type { AdminConnectionOptions, ConnectionContext } from '../connection'
 
-export function adminDomainMethod(method: 'info' | 'install' | 'list' | 'publish'): string {
-  return `${ADMIN_DOMAIN}:${method}`
+import { connectAdminCatalog, type DomainInfo, type PublishDomainInput } from '../admin/catalog'
+import { connectAdminInstances, type OwnedInstanceInfo } from '../admin/instance'
+import { withAdminClientSession } from '../connection'
+
+export type { DomainInfo, InstallDomainResult, PublishDomainInput } from '../admin/catalog'
+
+/** Read the caller-visible V2 Admin Domain catalog. */
+export function listAdminDomains(options: AdminConnectionOptions): Promise<DomainInfo[]> {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminCatalog(context)).list(),
+  )
+}
+
+/** Reuse one open Admin session for catalog reads. */
+export async function listAdminDomainsInContext(context: ConnectionContext): Promise<DomainInfo[]> {
+  return (await connectAdminCatalog(context)).list()
+}
+
+/** Publish and optionally configure default installation through V2 receiver Methods. */
+export function publishAdminDomain(options: AdminConnectionOptions, input: PublishDomainInput) {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminCatalog(context)).publish(input),
+  )
 }
 
-/** Read shape returned by `DomainEntry.publish` / `info` / `list` (domain `DomainInfoSchema`). */
-export type DomainInfo = {
-  id: string
-  /** shell.astrale.ai — the authority origin (== JWT aud + kernel path prefix). */
-  origin: string
-  /** 'shell' — the node slug + the id used in install plans / the CLI. */
-  name: string
-  /** https://shell.astrale.ai — the published worker URL the kernel installs from. */
-  url?: string
-  description?: string
-  installByDefault?: boolean
-  createdAt: string
-  updatedAt: string
+/** Install one resolved catalog Domain on one caller-visible Instance. */
+export async function installAdminDomainInContext(
+  context: ConnectionContext,
+  instance: OwnedInstanceInfo,
+  domain: DomainInfo,
+) {
+  const receipt = await (await connectAdminInstances(context)).installDomain(instance.id, domain.id)
+  return Object.freeze({
+    name: domain.name,
+    origin: receipt.origin,
+    instanceId: instance.slug,
+    url: domain.url ?? '',
+    ok: receipt.ok,
+    ...(receipt.error === undefined ? {} : { error: receipt.error }),
+  })
 }

package/src/lib/admin-instance.ts

@@ -1,55 +1,50 @@
-/**
- * The admin `Instance` surface used by `astrale instance
- * list/status/create/delete`. The merged admin domain models instances as the
- * `Instance` class (provisioned via `Instance.init`); these commands target it.
- */
-export const ADMIN_INSTANCE = '/:admin.astrale.ai:class.Instance'
+import type { AdminConnectionOptions, ConnectionContext } from '../connection'
 
-export function adminInstanceMethod(
-  method: 'alphaCreate' | 'delete' | 'info' | 'list' | 'listMine',
-): string {
-  return `${ADMIN_INSTANCE}:${method}`
-}
+import { connectAdminInstances } from '../admin/instance'
+import { withAdminClientSession } from '../connection'
 
-export type InstanceState = 'provisioning' | 'ready' | 'failed'
+export {
+  AdminInstanceNotFoundError,
+  findOwnedInstance,
+  formatInstanceLocation,
+  type InstanceInfo,
+  type InstanceState,
+  type OwnedInstanceInfo,
+} from '../admin/instance'
 
-/** Read shape returned by `Instance.list` / `info` / `delete` (domain `InstanceInfoSchema`). */
-export type InstanceInfo = {
-  id: string
-  slug: string
-  url: string
-  hostId?: string
-  region?: string
-  state?: InstanceState
-  phase?: string
-  error?: string | null
-  createdAt?: string
-  organizationId?: string
+/** Resolve the Admin target and read only the caller-visible Instance inventory. */
+export function listOwnedInstances(options: AdminConnectionOptions) {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminInstances(context)).list(),
+  )
 }
 
-/** Owner-scoped read shape returned by `Instance.listMine`. */
-export type OwnedInstanceInfo = InstanceInfo & {
-  state: InstanceState
+/** Reuse an already-open Admin session for a caller-visible Instance inventory. */
+export async function listOwnedInstancesInContext(context: ConnectionContext) {
+  return (await connectAdminInstances(context)).list()
 }
 
-/** Call the owner-scoped list contract through any admin client-shaped object. */
-export async function callOwnedInstances(client: {
-  call: (path: string, params: Record<string, never>) => Promise<unknown>
-}): Promise<OwnedInstanceInfo[]> {
-  return (await client.call(adminInstanceMethod('listMine'), {})) as OwnedInstanceInfo[]
+/** Provision through Fleet placement or one explicitly resolved Host receiver. */
+export function createOwnedInstance(
+  options: AdminConnectionOptions,
+  slug: string,
+  hostId?: string,
+) {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminInstances(context)).create(slug, hostId),
+  )
 }
 
-/** Match an owner-scoped instance by its stable node id or human slug. */
-export function findOwnedInstance(
-  instances: readonly OwnedInstanceInfo[],
-  identifier: string,
-): OwnedInstanceInfo | undefined {
-  return instances.find((instance) => instance.id === identifier || instance.slug === identifier)
+/** Refresh one exact caller-visible Instance through its V2 receiver Method. */
+export function statusOwnedInstance(options: AdminConnectionOptions, identifier: string) {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminInstances(context)).status(identifier),
+  )
 }
 
-/** Human-readable location of a managed instance ("region · hostId"). */
-export function formatInstanceLocation(info: InstanceInfo): string {
-  return [info.state && info.state !== 'ready' ? info.state : undefined, info.region, info.hostId]
-    .filter(Boolean)
-    .join(' · ')
+/** Delete one exact caller-visible Instance through its V2 receiver Method. */
+export function deleteOwnedInstance(options: AdminConnectionOptions, identifier: string) {
+  return withAdminClientSession(options, async (context) =>
+    (await connectAdminInstances(context)).delete(identifier),
+  )
 }

package/src/lib/admin-target.ts

@@ -9,11 +9,13 @@ import { isHttpUrl } from './validation'
 
 export const DEFAULT_ADMIN_TARGET_NAME = 'admin'
 export const DEFAULT_ADMIN_TARGET_URL = 'https://admin.eu.astrale.ai/api'
+export const DEFAULT_ADMIN_DOMAIN_ISSUER = 'https://admin.beta.astrale.ai'
 
 export const DEFAULT_ADMIN_TARGET_CONFIG = {
   name: DEFAULT_ADMIN_TARGET_NAME,
   url: DEFAULT_ADMIN_TARGET_URL,
-  issuer: DEFAULT_ADMIN_TARGET_URL,
+  kernelIssuer: DEFAULT_ADMIN_TARGET_URL,
+  domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
 } satisfies AdminTargetConfig
 
 const HttpUrlSchema = z.string().refine(isHttpUrl, {
@@ -27,7 +29,9 @@ export const AdminTargetConfigSchema = z
     /** Direct admin kernel URL. */
     url: HttpUrlSchema.optional(),
     /** Kernel issuer / JWT audience when different from url. */
-    issuer: HttpUrlSchema.optional(),
+    kernelIssuer: HttpUrlSchema.optional(),
+    /** Exact native Admin Domain issuer used by the standard token exchange. */
+    domainIssuer: HttpUrlSchema.optional(),
     /** Bookmark name for the admin kernel. */
     instance: z.string().min(1).optional(),
   })
@@ -45,11 +49,18 @@ export const AdminTargetConfigSchema = z
         message: 'admin target requires url or instance',
       })
     }
-    if (value.issuer && !value.url) {
+    if (value.kernelIssuer && !value.url) {
       ctx.addIssue({
         code: 'custom',
-        path: ['issuer'],
-        message: 'admin issuer is only valid with a direct url target',
+        path: ['kernelIssuer'],
+        message: 'admin kernel issuer is only valid with a direct url target',
+      })
+    }
+    if (value.domainIssuer && !value.url) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['domainIssuer'],
+        message: 'admin domain issuer is only valid with a direct url target',
       })
     }
   })
@@ -59,6 +70,7 @@ export type AdminTargetConfig = z.infer<typeof AdminTargetConfigSchema>
 export type AdminTargetCommandOpts = {
   admin?: string
   adminUrl?: string
+  domainIssuer?: string
   instance?: string
   url?: string
 }
@@ -68,7 +80,8 @@ export type AdminTargetSource = 'admin-url' | 'admin' | 'config-instance' | 'con
 export type ResolvedAdminTarget = {
   name: string
   url: string
-  issuer: string
+  kernelIssuer: string
+  domainIssuer: string
   defaultIdentity?: string
   caFile?: string
   source: AdminTargetSource
@@ -85,6 +98,10 @@ export const ADMIN_TARGET_OPTIONS = [
     flags: '--admin-url <url>',
     description: 'Admin kernel URL to use for this admin operation',
   },
+  {
+    flags: '--domain-issuer <url>',
+    description: 'Admin Domain issuer used for token exchange with an explicit URL',
+  },
 ]
 
 export async function resolveAdminTarget(
@@ -102,29 +119,50 @@ export function resolveAdminTargetFromStore(
 ): ResolvedAdminTarget {
   const override = readOverride(opts)
   if (override) {
+    if (override.kind === 'instance' && opts.domainIssuer !== undefined) {
+      throw new AstraleError(
+        'INVALID_FLAG',
+        '--domain-issuer is only valid with --admin-url or --url.',
+      )
+    }
     return override.kind === 'url'
       ? directTarget({
           url: override.url,
           name: DEFAULT_ADMIN_TARGET_NAME,
           source: override.source,
           configured: false,
+          domainIssuer: opts.domainIssuer ?? config.admin.domainIssuer,
         })
-      : bookmarkTarget(store, override.instance, override.source, false)
+      : bookmarkTarget(
+          store,
+          override.instance,
+          override.source,
+          false,
+          config.admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER,
+        )
   }
 
   const admin = config.admin
   if (admin.instance) {
-    return bookmarkTarget(store, admin.instance, 'config-instance', true)
+    return bookmarkTarget(
+      store,
+      admin.instance,
+      'config-instance',
+      true,
+      admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER,
+    )
   }
 
   const isDefaultDirectTarget =
     admin.url === DEFAULT_ADMIN_TARGET_URL &&
-    admin.issuer === DEFAULT_ADMIN_TARGET_URL &&
+    admin.kernelIssuer === DEFAULT_ADMIN_TARGET_URL &&
+    (admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER) === DEFAULT_ADMIN_DOMAIN_ISSUER &&
     admin.name === DEFAULT_ADMIN_TARGET_NAME
 
   return directTarget({
     url: admin.url ?? DEFAULT_ADMIN_TARGET_URL,
-    issuer: admin.issuer,
+    kernelIssuer: admin.kernelIssuer,
+    domainIssuer: admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER,
     name: admin.name ?? DEFAULT_ADMIN_TARGET_NAME,
     source: isDefaultDirectTarget ? 'default' : 'config-url',
     configured: !isDefaultDirectTarget,
@@ -177,6 +215,7 @@ function bookmarkTarget(
   identifier: string,
   source: AdminTargetSource,
   configured: boolean,
+  domainIssuer: string,
 ): ResolvedAdminTarget {
   const key = resolveInstanceKey(store, identifier)
   const entry = key ? store.instances[key] : undefined
@@ -191,7 +230,11 @@ function bookmarkTarget(
     name: key,
     registrationSlug: key,
     url: entry.url,
-    issuer: entry.issuer ?? entry.url,
+    kernelIssuer: entry.issuer ?? entry.url,
+    domainIssuer: requireDomainIssuer(
+      entry.domainIssuer ?? (configured ? domainIssuer : undefined),
+      `Admin bookmark "${key}"`,
+    ),
     defaultIdentity: entry.defaultIdentity,
     ...(entry.caFile ? { caFile: entry.caFile } : {}),
     source,
@@ -201,7 +244,8 @@ function bookmarkTarget(
 
 function directTarget(input: {
   url: string
-  issuer?: string
+  kernelIssuer?: string
+  domainIssuer?: string
   name: string
   source: AdminTargetSource
   configured: boolean
@@ -210,8 +254,18 @@ function directTarget(input: {
     name: input.name,
     registrationSlug: input.name,
     url: input.url,
-    issuer: input.issuer ?? input.url,
+    kernelIssuer: input.kernelIssuer ?? input.url,
+    domainIssuer: requireDomainIssuer(input.domainIssuer, 'Direct Admin target'),
     source: input.source,
     configured: input.configured,
   }
 }
+
+function requireDomainIssuer(value: string | undefined, label: string): string {
+  if (value !== undefined) return value
+  throw new AstraleError(
+    'ADMIN_DOMAIN_ISSUER_MISSING',
+    `${label} has no Domain issuer for token exchange.`,
+    'Configure domainIssuer or pass --domain-issuer <url>; there is no legacy token fallback.',
+  )
+}

package/src/lib/binary.ts

@@ -7,35 +7,14 @@ import { output } from './output'
 
 /** A binary kernel result: bytes (or a stream of them) plus its content-type. */
 export type BinaryLike = {
-  status: number
-  contentType: string
-  body: Uint8Array | ReadableStream<Uint8Array>
+  readonly body: Uint8Array
+  readonly mediaType: string
+  readonly headers?: Readonly<Record<string, string>>
 }
 
 /** Collapse a (possibly streamed) binary body into a single byte array. */
-export async function readBinaryBody(
-  body: Uint8Array | ReadableStream<Uint8Array>,
-): Promise<Uint8Array> {
-  if (body instanceof Uint8Array) return body
-
-  const chunks: Uint8Array[] = []
-  const reader = body.getReader()
-  let total = 0
-  while (true) {
-    const { done, value } = await reader.read()
-    if (done) break
-    if (!value) continue
-    chunks.push(value)
-    total += value.byteLength
-  }
-
-  const out = new Uint8Array(total)
-  let offset = 0
-  for (const chunk of chunks) {
-    out.set(chunk, offset)
-    offset += chunk.byteLength
-  }
-  return out
+export async function readBinaryBody(body: Uint8Array): Promise<Uint8Array> {
+  return body
 }
 
 function isTextLike(contentType: string): boolean {
@@ -62,16 +41,16 @@ function humanSize(bytes: number): string {
 
 /** The `--json` envelope: text-like inlines decoded text, otherwise base64. */
 function jsonEnvelope(resp: BinaryLike, bytes: Uint8Array): Record<string, unknown> {
-  if (isTextLike(resp.contentType)) {
+  if (isTextLike(resp.mediaType)) {
     return {
-      status: resp.status,
-      contentType: resp.contentType,
+      status: 200,
+      contentType: resp.mediaType,
       body: new TextDecoder().decode(bytes),
     }
   }
   return {
-    status: resp.status,
-    contentType: resp.contentType,
+    status: 200,
+    contentType: resp.mediaType,
     bodyBase64: Buffer.from(bytes).toString('base64'),
   }
 }
@@ -97,7 +76,7 @@ export async function presentBinary(
   if (io?.outFile) {
     await writeFile(io.outFile, bytes)
     process.stderr.write(
-      chalk.dim(`  wrote ${humanSize(bytes.length)} (${resp.contentType}) → ${io.outFile}\n`),
+      chalk.dim(`  wrote ${humanSize(bytes.length)} (${resp.mediaType}) → ${io.outFile}\n`),
     )
     return
   }
@@ -117,7 +96,7 @@ export async function presentBinary(
     return
   }
 
-  if (isTextLike(resp.contentType)) {
+  if (isTextLike(resp.mediaType)) {
     const text = new TextDecoder().decode(bytes)
     process.stdout.write(text.endsWith('\n') ? text : text + '\n')
     return
@@ -125,7 +104,7 @@ export async function presentBinary(
 
   process.stdout.write(
     chalk.dim(
-      `  <binary · ${resp.contentType} · ${humanSize(bytes.length)}> — pipe or use -o <file> to save\n`,
+      `  <binary · ${resp.mediaType} · ${humanSize(bytes.length)}> — pipe or use -o <file> to save\n`,
     ),
   )
 }

package/src/lib/browser.ts

@@ -1,7 +1,7 @@
 import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 
-import { paths } from './env'
+import { paths } from '../state/index'
 import { run } from './proc'
 
 /**

package/src/{kernel → lib}/ca-fetch.ts

@@ -4,18 +4,19 @@ import { Buffer } from 'node:buffer'
 import { readFileSync } from 'node:fs'
 import { request as httpsRequest } from 'node:https'
 
+/** Create a Fetch capability whose HTTPS requests trust one CLI-selected CA file. */
 export function fetchWithCaFile(
   caFile: string,
-  fallback: typeof fetch = globalThis.fetch,
-): typeof fetch {
+  fallback: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response> = globalThis.fetch,
+): (input: RequestInfo | URL, init?: RequestInit) => Promise<Response> {
   const ca = readFileSync(caFile)
   const fallbackFetch = fallback.bind(globalThis)
 
-  return (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
     const url = requestUrl(input)
     if (url.protocol !== 'https:') return fallbackFetch(input, init)
     return fetchWithNode(url, init, ca)
-  }) as typeof fetch
+  }
 }
 
 function requestUrl(input: RequestInfo | URL): URL {
@@ -26,12 +27,11 @@ function requestUrl(input: RequestInfo | URL): URL {
 
 function fetchWithNode(url: URL, init: RequestInit | undefined, ca: Buffer): Promise<Response> {
   return new Promise((resolve, reject) => {
-    const headers = headersInitToRecord(init?.headers)
     const request = httpsRequest(
       url,
       {
         method: init?.method ?? 'GET',
-        headers,
+        headers: headersInitToRecord(init?.headers),
         ca,
       },
       (response) => {
@@ -40,26 +40,32 @@ function fetchWithNode(url: URL, init: RequestInit | undefined, ca: Buffer): Pro
           chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)),
         )
         response.on('end', () => {
-          resolve(
-            new Response(Buffer.concat(chunks), {
-              status: response.statusCode ?? 0,
-              statusText: response.statusMessage,
-              headers: responseHeaders(response.headers),
-            }),
-          )
+          const result = new Response(Buffer.concat(chunks), {
+            status: response.statusCode ?? 0,
+            statusText: response.statusMessage,
+            headers: responseHeaders(response.headers),
+          })
+          // Synthetic Responses have no URL list. This transport does not follow
+          // redirects, so the exact request URL is also the final response URL.
+          Object.defineProperty(result, 'url', { value: url.toString() })
+          resolve(result)
         })
       },
     )
 
     request.on('error', reject)
     if (init?.signal) {
-      if (init.signal.aborted)
-        request.destroy(new DOMException('The operation was aborted.', 'AbortError'))
-      init.signal.addEventListener(
-        'abort',
-        () => request.destroy(new DOMException('The operation was aborted.', 'AbortError')),
-        { once: true },
-      )
+      if (init.signal.aborted) {
+        request.destroy(abortError(init.signal.reason))
+      } else {
+        init.signal.addEventListener(
+          'abort',
+          () => request.destroy(abortError(init.signal?.reason)),
+          {
+            once: true,
+          },
+        )
+      }
     }
 
     writeBody(request, init?.body)
@@ -68,16 +74,18 @@ function fetchWithNode(url: URL, init: RequestInit | undefined, ca: Buffer): Pro
   })
 }
 
+function abortError(reason: unknown): Error {
+  return reason instanceof Error
+    ? reason
+    : new DOMException('The operation was aborted.', 'AbortError')
+}
+
 async function writeBody(
   request: ReturnType<typeof httpRequest>,
   body: BodyInit | null | undefined,
 ): Promise<void> {
   if (body === undefined || body === null) return
-  if (typeof body === 'string') {
-    request.write(body)
-    return
-  }
-  if (body instanceof Uint8Array) {
+  if (typeof body === 'string' || body instanceof Uint8Array) {
     request.write(body)
     return
   }
@@ -89,7 +97,7 @@ async function writeBody(
     request.write(Buffer.from(await body.arrayBuffer()))
     return
   }
-  throw new Error(`Unsupported request body type for CA-backed fetch`)
+  throw new Error('Unsupported request body type for CA-backed fetch')
 }
 
 function headersInitToRecord(headers: HeadersInit | undefined): Record<string, string> {
@@ -101,7 +109,7 @@ function headersInitToRecord(headers: HeadersInit | undefined): Record<string, s
     })
     return out
   }
-  if (Array.isArray(headers)) return Object.fromEntries(headers.map(([key, value]) => [key, value]))
+  if (Array.isArray(headers)) return Object.fromEntries(headers)
   return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, String(value)]))
 }
 

package/src/lib/config.ts

@@ -2,9 +2,9 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises'
 import { dirname } from 'node:path'
 import { z } from 'zod'
 
+import { CONFIG_PATH } from '../state/index'
 import { AdminTargetConfigSchema, DEFAULT_ADMIN_TARGET_CONFIG } from './admin-target'
 import { log } from './log'
-import { CONFIG_PATH } from './paths'
 
 export const AstraleConfigSchema = z.object({
   issuer: z.string().url().default('https://unregistered.invalid'),

package/src/lib/idp-session.ts

@@ -1,4 +1,4 @@
-import { withFileLock } from './fs-atomic'
+import { withFileLock } from '../state/index'
 import {
   accessTokenForAudience,
   classifyRefreshFailure,

package/src/lib/idp.ts

@@ -3,10 +3,8 @@ import { mkdir, readFile, readdir, unlink } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import { z } from 'zod'
 
-import { paths } from './env'
-import { atomicWrite } from './fs-atomic'
+import { atomicWrite, IDPS_PATH, IDP_SESSIONS_DIR, paths } from '../state/index'
 import { log } from './log'
-import { IDPS_PATH, IDP_SESSIONS_DIR } from './paths'
 import { validateName, validateUrl } from './validation'
 
 /**
@@ -214,7 +212,6 @@ export type IdpConfig = {
 
 export const BUILTIN_WORKOS_IDP_NAME = 'workos'
 const DEFAULT_WORKOS_API_HOST = 'https://api.workos.com'
-const DEFAULT_WORKOS_CLIENT_ID = 'client_01KC29HEGD7B40TV2C4QZ436BG'
 const WORKOS_CLIENT_ID_ENV_NAMES = ['WORKOS_CLIENT_ID', 'VITE_WORKOS_CLIENT_ID'] as const
 
 export function idpDir(name: string): string {
@@ -414,10 +411,8 @@ export function builtinIdpConfig(
 }
 
 export function workosClientIdFromEnv(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  return (
-    WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env[name]).find(
-      (value): value is string => typeof value === 'string' && value.length > 0,
-    ) ?? DEFAULT_WORKOS_CLIENT_ID
+  return WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env[name]?.trim()).find(
+    (value): value is string => typeof value === 'string' && value.length > 0,
   )
 }