@astrale-os/cli 1.0.0-beta.0 → 1.0.0-beta.10

package/src/admin/instance/client.ts

@@ -1,14 +1,16 @@
-import type { DomainBinding } from '@astrale-os/kernel-client/domain'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
-import type { Node } from '@astrale-os/sdk/graph/node'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
 
-import { bind } from '@astrale-os/kernel-client/domain'
 import { Path } from '@astrale-os/sdk/graph/path'
-import { Query } from '@astrale-os/sdk/query'
 
-import { readAllNodes, type AdminGraphApi } from '../graph'
 import {
-  AdminHostNotFoundError,
+  bindAdmin,
+  invokeAdminMethod,
+  requireAdminBinding,
+  requireAdminClass,
+  requireAdminCore,
+  type AdminBinding,
+} from '../binding'
+import {
   AdminInstanceNotFoundError,
   findOwnedInstance,
   type DomainInstallReceipt,
@@ -17,33 +19,20 @@ import {
   type OwnedInstanceInfo,
 } from './model'
 
-const ADMIN_ORIGIN = 'admin.astrale.ai'
-const PAGE_SIZE = 256
-const MAXIMUM_INSTANCES = 10_000
-const MAXIMUM_PAGES = Math.ceil(MAXIMUM_INSTANCES / PAGE_SIZE) + 1
-
-const HostRef = Object.freeze({ origin: ADMIN_ORIGIN, kind: 'class' as const, name: 'Host' })
-const fleetReservesAdminHost = Object.freeze({
-  origin: ADMIN_ORIGIN,
-  kind: 'class' as const,
-  name: 'fleet_reserves_admin_host',
-})
-
 export interface AdminInstanceContext {
   readonly session: ClientSession
-  readonly graph: AdminGraphApi
 }
 
 export interface AdminInstanceApi {
   list(): Promise<OwnedInstanceInfo[]>
-  create(slug: string, hostId?: string): Promise<InstanceInfo>
+  create(slug: string): Promise<InstanceInfo>
   status(identifier: string): Promise<InstanceInfo>
   delete(identifier: string): Promise<InstanceInfo>
   installDomain(identifier: string, domain: string): Promise<DomainInstallReceipt>
 }
 
 export interface AdminInstanceDependencies {
-  readonly bind?: (session: ClientSession) => Promise<DomainBinding>
+  readonly bind?: (session: ClientSession) => Promise<AdminBinding>
   readonly operationId?: (kind: 'create' | 'status' | 'delete' | 'install-domain') => string
 }
 
@@ -55,24 +44,22 @@ export async function connectAdminInstances(
   context: AdminInstanceContext,
   dependencies: AdminInstanceDependencies = {},
 ): Promise<AdminInstanceApi> {
-  const binding = await (dependencies.bind ?? bindInstalledAdmin)(context.session)
-  if (binding.$.publication?.origin !== ADMIN_ORIGIN || binding.$.origin !== ADMIN_ORIGIN) {
-    throw new TypeError('Configured Admin target does not serve the Admin Domain.')
-  }
+  const binding = requireAdminBinding(await (dependencies.bind ?? bindAdmin)(context.session))
 
-  const Instance = binding.$.class('Instance')
-  const Host = binding.$.class('Host')
-  const Fleet = binding.$.class('Fleet')
-  const fleet = binding.$.core.nodes.fleet?.path
-  if (fleet === undefined) throw new TypeError('Admin Domain has no singleton Fleet receiver.')
+  const Instance = requireAdminClass(binding, 'Instance', 'node')
+  const Fleet = requireAdminClass(binding, 'Fleet', 'node')
+  const fleet = requireAdminCore(binding, 'fleet')
 
   const operationId = dependencies.operationId ?? defaultOperationId
 
   const list = async (): Promise<OwnedInstanceInfo[]> => {
-    const result: unknown = await binding.$.invoke(
-      Fleet.$.method('listInstances') as never,
+    const result: unknown = await invokeAdminMethod(
+      context.session,
+      binding,
+      Fleet,
+      'listInstances',
       fleet,
-      {} as never,
+      {},
     )
     if (!Array.isArray(result)) throw new TypeError('Admin Instance inventory is invalid.')
     return result.map((value) => instanceFromSummary(value) as OwnedInstanceInfo)
@@ -89,126 +76,48 @@ export async function connectAdminInstances(
     identifier: string,
   ): Promise<InstanceInfo> => {
     const instance = await requireInstance(identifier)
-    const output = await binding.$.invoke(
-      Instance.$.method(method) as never,
+    const output = await invokeAdminMethod(
+      context.session,
+      binding,
+      Instance,
+      method,
       Path.parse(instance.id),
-      { operationId: operationId(method) } as never,
+      { operationId: operationId(method) },
     )
     return instanceFromSummary(output)
   }
 
   return Object.freeze({
     list,
-    async create(slug: string, hostId?: string) {
+    async create(slug: string) {
       const input = Object.freeze({
         operationId: operationId('create'),
         slug,
       })
-      if (hostId !== undefined) {
-        const selected = await hostInventory(context.graph, binding, Host, fleet)
-        const host = selected.hosts.find(
-          (item) => item.id === hostId && item.state === 'ready' && item.path !== selected.reserved,
-        )
-        if (host === undefined) throw new AdminHostNotFoundError(hostId)
-        return instanceFromSummary(
-          await binding.$.invoke(
-            Host.$.method('createInstance') as never,
-            Path.parse(host.path),
-            input as never,
-          ),
-        )
-      }
-
-      // Preserve the existing interactive multi-Host picker without accepting a
-      // doomed operation first. Graph read policy exposes only caller-usable
-      // Hosts; the reserved Admin Host is excluded explicitly.
-      const inventory = await hostInventory(context.graph, binding, Host, fleet)
-      const eligible = inventory.hosts.filter(
-        (host) => host.state === 'ready' && host.path !== inventory.reserved,
-      )
-      if (eligible.length > 1) throw hostSelectionRequired(eligible.map((host) => host.id))
-
       return instanceFromSummary(
-        await binding.$.invoke(Fleet.$.method('createInstance') as never, fleet, input as never),
+        await invokeAdminMethod(context.session, binding, Fleet, 'createInstance', fleet, input),
       )
     },
     status: (identifier: string) => invokeInstance('status', identifier),
     delete: (identifier: string) => invokeInstance('delete', identifier),
     async installDomain(identifier: string, domain: string): Promise<DomainInstallReceipt> {
       const instance = await requireInstance(identifier)
-      const output = await binding.$.invoke(
-        Instance.$.method('installDomain') as never,
+      const output = await invokeAdminMethod(
+        context.session,
+        binding,
+        Instance,
+        'installDomain',
         Path.parse(instance.id),
         {
           operationId: operationId('install-domain'),
           domain: Path.parse(domain).raw,
-        } as never,
+        },
       )
       return domainInstallReceipt(output)
     },
   })
 }
 
-async function bindInstalledAdmin(session: ClientSession): Promise<DomainBinding> {
-  return bind(session, await session.installed(ADMIN_ORIGIN))
-}
-
-interface HostInventoryItem {
-  readonly id: string
-  readonly nodeId: string
-  readonly path: string
-  readonly state: string
-}
-
-async function hostInventory(
-  graph: AdminGraphApi,
-  binding: DomainBinding,
-  Host: ReturnType<DomainBinding['$']['class']>,
-  fleet: Path,
-): Promise<{ readonly hosts: readonly HostInventoryItem[]; readonly reserved?: string }> {
-  const [nodes, reservedPage] = await Promise.all([
-    readAllNodes(
-      graph,
-      Query.from({ kind: 'node', definitions: [HostRef] }).select({
-        kind: 'nodes',
-        projection: { kind: 'value' },
-      }),
-      {
-        label: 'Admin Host inventory',
-        maximum: MAXIMUM_INSTANCES,
-        maximumPages: MAXIMUM_PAGES,
-      },
-    ),
-    graph.neighbors(fleet, fleetReservesAdminHost, {
-      direction: 'outgoing',
-      page: { size: 1 },
-    }),
-  ])
-  const reserved = reservedPage.first === null ? undefined : Path.id(reservedPage.first.id).raw
-  return Object.freeze({
-    hosts: Object.freeze(
-      nodes.map((node) =>
-        Object.freeze({
-          id: requiredStringProperty(Host, node, 'id'),
-          nodeId: String(node.id),
-          path: Path.id(node.id).raw,
-          state: requiredStringProperty(Host, node, 'state'),
-        }),
-      ),
-    ),
-    ...(reserved === undefined ? {} : { reserved }),
-  })
-}
-
-function hostSelectionRequired(ids: readonly string[]): Error {
-  return new Error(
-    `alphaCreate could not choose a host: ${ids.length} ready hosts are assigned (${[...ids].sort().join(', ')}). ` +
-      'Specify host_id once multi-host placement is enabled.',
-  )
-}
-
-type DynamicDefinition = ReturnType<DomainBinding['$']['class']>
-
 function instanceFromSummary(input: unknown): InstanceInfo {
   const value = record(input, 'Admin Instance summary')
   const failure = value.failure === undefined ? undefined : record(value.failure, 'Admin failure')
@@ -217,10 +126,6 @@ function instanceFromSummary(input: unknown): InstanceInfo {
     slug: requiredString(value.slug, 'Admin Instance slug'),
     url: optionalStringValue(value.url) ?? '',
     state: instanceState(value.state),
-    ...(value.hostId === undefined
-      ? {}
-      : { hostId: requiredString(value.hostId, 'Admin Host id') }),
-    ...(value.region === undefined ? {} : { region: requiredString(value.region, 'Admin region') }),
     ...(value.phase === undefined
       ? {}
       : { phase: requiredString(value.phase, 'Admin Instance phase') }),
@@ -256,13 +161,6 @@ function domainInstallReceipt(input: unknown): DomainInstallReceipt {
   })
 }
 
-function requiredStringProperty(definition: DynamicDefinition, node: Node, name: string): string {
-  return requiredString(
-    node.props[definition.$.property(name).key],
-    `Admin ${definition.name}.${name}`,
-  )
-}
-
 function instanceState(input: unknown): InstanceState {
   if (
     input === 'provisioning' ||

package/src/admin/instance/index.ts

@@ -5,10 +5,9 @@ export {
   type AdminInstanceDependencies,
 } from './client'
 export {
-  AdminHostNotFoundError,
   AdminInstanceNotFoundError,
   findOwnedInstance,
-  formatInstanceLocation,
+  formatInstanceState,
   type DomainInstallReceipt,
   type InstanceInfo,
   type InstanceState,

package/src/admin/instance/model.ts

@@ -5,9 +5,7 @@ export interface InstanceInfo {
   readonly id: string
   readonly slug: string
   readonly url: string
-  readonly hostId?: string
-  readonly region?: string
-  readonly state?: InstanceState
+  readonly state: InstanceState
   readonly phase?: string
   readonly error?: string | null
   readonly createdAt?: string
@@ -28,19 +26,13 @@ export interface DomainInstallReceipt {
   readonly error?: string
 }
 
-export class AdminInstanceNotFoundError extends Error {
-  readonly name = 'NotFoundError'
-
-  constructor(readonly identifier: string) {
-    super(`No owned Admin Instance matches ${JSON.stringify(identifier)}.`)
-  }
-}
-
-export class AdminHostNotFoundError extends Error {
-  readonly name = 'NotFoundError'
-
+export class AdminInstanceNotFoundError extends AstraleError {
   constructor(readonly identifier: string) {
-    super(`No caller-usable Admin Host matches ${JSON.stringify(identifier)}.`)
+    super(
+      'INSTANCE_NOT_FOUND',
+      `No owned Admin Instance matches ${JSON.stringify(identifier)}.`,
+      'Run `astrale instance list` to see your instances.',
+    )
   }
 }
 
@@ -57,9 +49,8 @@ export function findOwnedInstance(
   )
 }
 
-/** Human-readable location of an Instance (state, region, and Host Path). */
-export function formatInstanceLocation(info: InstanceInfo): string {
-  return [info.state && info.state !== 'ready' ? info.state : undefined, info.region, info.hostId]
-    .filter(Boolean)
-    .join(' · ')
+/** Human-readable non-ready lifecycle state for one Instance. */
+export function formatInstanceState(info: InstanceInfo): string {
+  return info.state === 'ready' ? '' : `${info.state}${info.phase ? ` (${info.phase})` : ''}`
 }
+import { AstraleError } from '../../errors'

package/src/commands/__tests__/admin-instance.test.ts

@@ -4,7 +4,10 @@ import type { IdentityStore } from '../../identity/index'
 
 import { AuthError } from '../../errors'
 import { findOwnedInstance, type OwnedInstanceInfo } from '../../lib/admin-instance'
-import { assertAlphaCreateIdentity } from '../instance/create'
+import {
+  assertInstanceCreateIdentity,
+  selectInstanceCreateIdentity,
+} from '../../lib/provision-instance'
 
 describe('admin-backed instance commands', () => {
   test('findOwnedInstance matches owner inventory by slug or stable node id', () => {
@@ -14,8 +17,6 @@ describe('admin-backed instance commands', () => {
       url: 'https://demo.eu.astrale.ai',
       state: 'failed',
       organizationId: 'org_123',
-      hostId: 'host-1',
-      region: 'eu',
       phase: 'installing:default-domains',
       error: 'postInstall failed',
       createdAt: '2026-07-16T00:00:00.000Z',
@@ -39,8 +40,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store)).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store)).toThrow('WorkOS login required')
+    expect(() => assertInstanceCreateIdentity(store)).toThrow(AuthError)
+    expect(() => assertInstanceCreateIdentity(store)).toThrow('WorkOS login required')
   })
 
   test('instance create preflight accepts IdP-backed identities', () => {
@@ -58,7 +59,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store)).not.toThrow()
+    expect(() => assertInstanceCreateIdentity(store)).not.toThrow()
+    expect(selectInstanceCreateIdentity(store)).toBe('bryan')
   })
 
   test('--as selection must also be IdP-backed', () => {
@@ -82,7 +84,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store, { as: 'local' })).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store, { as: 'workos' })).not.toThrow()
+    expect(() => assertInstanceCreateIdentity(store, { as: 'local' })).toThrow(AuthError)
+    expect(() => assertInstanceCreateIdentity(store, { as: 'workos' })).not.toThrow()
+    expect(selectInstanceCreateIdentity(store, { as: 'workos' })).toBe('workos')
   })
 })

package/src/commands/__tests__/auth-login.test.ts

@@ -81,11 +81,56 @@ describe('auth login command', () => {
       expect(result.exitCode).toBe(0)
       const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
       expect(session.audience).toBe('https://kernel.example.com')
+      expect(session.clientId).toBe('client_123')
       expect(session.subject).toBe('user_123')
     } finally {
       await server.stop()
     }
   })
+
+  test('persists an explicit client id and reuses it for a named login', async () => {
+    const server = oauthServer({
+      accessToken: unsignedJwt({
+        iss: 'http://127.0.0.1',
+        sub: 'user_123',
+        exp: 1893456000,
+      }),
+    })
+    try {
+      await writeIdpConfig(server.url)
+
+      const explicit = await runAuthLogin(
+        '--idp',
+        'test',
+        '--name',
+        'alice',
+        '--client-id',
+        'client_override',
+        '--client-credentials',
+        '--client-secret-env',
+        'TEST_CLIENT_SECRET',
+        '--raw',
+      )
+      const reused = await runAuthLogin(
+        '--idp',
+        'test',
+        '--name',
+        'alice',
+        '--client-credentials',
+        '--client-secret-env',
+        'TEST_CLIENT_SECRET',
+        '--raw',
+      )
+
+      expect(explicit.exitCode).toBe(0)
+      expect(reused.exitCode).toBe(0)
+      expect(server.clientIds()).toEqual(['client_override', 'client_override'])
+      const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
+      expect(session.clientId).toBe('client_override')
+    } finally {
+      await server.stop()
+    }
+  })
 })
 
 async function writeIdpConfig(baseUrl: string): Promise<void> {
@@ -131,12 +176,19 @@ async function writeIdpConfig(baseUrl: string): Promise<void> {
   )
 }
 
-function oauthServer(args: { accessToken: string }): { url: string; stop: () => Promise<void> } {
+function oauthServer(args: { accessToken: string }): {
+  url: string
+  clientIds: () => Array<string | null>
+  stop: () => Promise<void>
+} {
+  const clientIds: Array<string | null> = []
   const server = Bun.serve({
     port: 0,
     fetch: async (request) => {
       const url = new URL(request.url)
       if (url.pathname !== '/token') return new Response('not found', { status: 404 })
+      const form = new URLSearchParams(await request.text())
+      clientIds.push(form.get('client_id'))
       return Response.json({
         access_token: args.accessToken,
         token_type: 'Bearer',
@@ -146,6 +198,7 @@ function oauthServer(args: { accessToken: string }): { url: string; stop: () =>
   })
   return {
     url: `http://${server.hostname}:${server.port}`,
+    clientIds: () => clientIds,
     stop: () => server.stop(true),
   }
 }

package/src/commands/__tests__/call-describe.test.ts

@@ -1,34 +1,47 @@
 import { Path } from '@astrale-os/sdk/graph/path'
+import { bundle, defineSchema, func, method, nodeClass } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
-import { describeCallableFromSchema } from '../call-describe'
+import { describeCallableFromBundle } from '../call-describe'
 
-const schema = {
-  classes: {
-    Manager: {
-      methods: {
-        createInstance: {
-          auth: 'authorized',
-          description: 'Create one child Instance.',
-          input: { type: 'object', required: ['operationId', 'slug'] },
-          output: { mode: 'value' },
-        },
-      },
-    },
+const createInstance = method({
+  auth: 'authenticated',
+  description: 'Create one child Instance.',
+  input: {
+    type: 'object',
+    properties: { operationId: { type: 'string' }, slug: { type: 'string' } },
+    required: ['operationId', 'slug'],
+    additionalProperties: false,
   },
-  functions: {
-    journal: {
-      description: 'Read the authorized Kernel journal.',
-      input: { type: 'object' },
-    },
+  output: { type: 'object', additionalProperties: true },
+  static: true,
+})
+const inspectInstance = method({
+  auth: 'authenticated',
+  description: 'Inspect one child Instance.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const journal = func({
+  auth: 'authenticated',
+  description: 'Read the authorized Kernel journal.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const source = defineSchema('host.astrale.ai', {
+  classes: {
+    Manager: nodeClass({ methods: { createInstance } }),
+    Instance: nodeClass({ methods: { inspectInstance } }),
   },
-}
+  functions: { journal },
+})
+const installed = bundle.create(source)
 
-describe('describeCallableFromSchema', () => {
-  test('reads a static Class method from the Domain schema', () => {
-    const described = describeCallableFromSchema(
+describe('describeCallableFromBundle', () => {
+  test('reads a static Class method from the resolved Domain', () => {
+    const described = describeCallableFromBundle(
       Path.parse('/:host.astrale.ai:class.Manager:createInstance'),
-      schema,
+      installed,
     )
     expect(described).toMatchObject({
       origin: 'host.astrale.ai',
@@ -36,30 +49,30 @@ describe('describeCallableFromSchema', () => {
       method: 'createInstance',
       dispatch: 'static',
       description: 'Create one child Instance.',
-      auth: 'authorized',
+      auth: 'authenticated',
     })
     expect(described?.input).toMatchObject({ required: ['operationId', 'slug'] })
   })
 
-  test('finds an instance method when the receiver Path is not a Class projection', () => {
+  test('finds one instance method when the receiver Path is not a Class projection', () => {
     expect(
-      describeCallableFromSchema(
-        Path.parse('/:host.astrale.ai:core.manager::createInstance'),
-        schema,
+      describeCallableFromBundle(
+        Path.parse('/:host.astrale.ai:core.manager::inspectInstance'),
+        installed,
       ),
     ).toMatchObject({
       origin: 'host.astrale.ai',
-      class: 'Manager',
-      method: 'createInstance',
+      class: 'Instance',
+      method: 'inspectInstance',
       dispatch: 'instance',
     })
   })
 
-  test('reads a standalone Function from the Domain schema', () => {
+  test('reads a standalone Function from the resolved Domain', () => {
     expect(
-      describeCallableFromSchema(Path.parse('/:kernel.astrale.ai:function.journal'), schema),
+      describeCallableFromBundle(Path.parse('/:host.astrale.ai:function.journal'), installed),
     ).toMatchObject({
-      origin: 'kernel.astrale.ai',
+      origin: 'host.astrale.ai',
       function: 'journal',
       description: 'Read the authorized Kernel journal.',
     })

package/src/commands/__tests__/call.test.ts

@@ -14,7 +14,11 @@ describe('call command result lifetime', () => {
     }
 
     const sessionStream = Object.assign(stream(), { async cancel() {} })
-    const materialized = await materializeCallResult({ kind: 'stream', stream: sessionStream })
+    const materialized = await materializeCallResult({
+      kind: 'stream',
+      invocation: { source: 'https://kernel.test' as never, id: 'test-stream' },
+      stream: sessionStream,
+    })
     sessionOpen = false
 
     expect(materialized).toEqual({ kind: 'stream', values: ['first', 'second'] })

package/src/commands/__tests__/domain-install-operation.test.ts

@@ -1,5 +1,7 @@
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { afterEach, describe, expect, mock, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { installDirect } from '../domain/install'
 
 const GENERATED = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
@@ -7,6 +9,13 @@ const RETRY = '139137b5-af47-47ce-92b2-b64a2b0c63d7'
 
 const originalFetch = globalThis.fetch
 
+const schema = defineSchema('crm.test', {})
+const deployed = releaseFor(schema, 'https://crm.test').publication
+
+function publicationResponse(): Response {
+  return Response.json(deployed)
+}
+
 class ExitError extends Error {}
 
 afterEach(() => {
@@ -15,9 +24,7 @@ afterEach(() => {
 
 describe('direct domain install operation identity', () => {
   test('generates one operation before transport and exposes it for recovery', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ domainName: 'crm.test' }),
-    ) as unknown as typeof fetch
+    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
     const create = mock(() => GENERATED)
     const requests: unknown[] = []
     let recovery: unknown
@@ -54,9 +61,7 @@ describe('direct domain install operation identity', () => {
   })
 
   test('accepts an explicit operation only as the exact retry identity', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ domainName: 'crm.test' }),
-    ) as unknown as typeof fetch
+    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
     const create = mock(() => GENERATED)
     const accepted: string[] = []
     const requests: unknown[] = []
@@ -95,7 +100,7 @@ describe('direct domain install operation identity', () => {
   test('rejects a non-UUID operation before metadata or Kernel transport', async () => {
     const originalExit = process.exit
     const originalWrite = process.stderr.write
-    const fetch = mock(async () => Response.json({ domainName: 'crm.test' }))
+    const fetch = mock(async () => publicationResponse())
     const run = mock(async () => undefined)
     globalThis.fetch = fetch as unknown as typeof globalThis.fetch
     process.exit = (() => {

package/src/commands/__tests__/domain-install-owned.test.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '@astrale-os/kernel-client'
+import { ResponseError } from '@astrale-os/sdk/client'
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
 
 import type { OwnedInstanceInfo } from '../../lib/admin-instance'
@@ -11,6 +11,10 @@ class ExitError extends Error {
 
 const calls: Array<{ path: string; params: unknown }> = []
 let inventory: OwnedInstanceInfo[] = []
+const TEST_INVOCATION = {
+  source: 'https://kernel.test',
+  id: 'domain-install-owned',
+} as ConstructorParameters<typeof ResponseError>[2]
 
 const hostCall = mock(async (call: { target: string; input: unknown }): Promise<unknown> => {
   const path = call.target
@@ -137,7 +141,7 @@ describe('admin domain install owner boundary', () => {
       createdAt: '2026-08-20T00:00:00.000Z',
       updatedAt: '2026-08-20T00:00:00.000Z',
     }
-    const failure = new ResponseError(5001, 'Schema operation is not supported.', {
+    const failure = new ResponseError(5001, 'Schema operation is not supported.', TEST_INVOCATION, {
       code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
       details: {
         phase: 'upgrade',