@astrale-os/cli 1.0.0-beta.0 → 1.0.0-beta.2

package/src/connection/__tests__/errors.test.ts

@@ -5,6 +5,10 @@ import { formatKernelError, functionInputIssues, schemaUpgradeHint } from '../er
 
 const CONFLICT = 4001
 const VALIDATION = 1003
+const TEST_INVOCATION = {
+  source: 'https://kernel.test',
+  id: 'connection-errors',
+} as ConstructorParameters<typeof ResponseError>[2]
 
 describe('formatKernelError', () => {
   /** @evidence TEST-CLI-CONNECTION-MAPS-TYPED-TRANSPORT */
@@ -87,7 +91,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(CONFLICT, 'Schema change requires migration.', {
+        new ResponseError(CONFLICT, 'Schema change requires migration.', TEST_INVOCATION, {
           code: 'DATA_MIGRATION_REQUIRED',
           details: {
             requirements: [
@@ -138,7 +142,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(CONFLICT, 'Schema change requires migration.', {
+        new ResponseError(CONFLICT, 'Schema change requires migration.', TEST_INVOCATION, {
           code: 'DATA_MIGRATION_REQUIRED',
           details: {
             requirements: [
@@ -193,7 +197,7 @@ describe('formatKernelError', () => {
     console.log = (...values: unknown[]) => hints.push(values.map(String).join(' '))
     try {
       await formatKernelError(
-        new ResponseError(CONFLICT, 'Schema change requires migration.', {
+        new ResponseError(CONFLICT, 'Schema change requires migration.', TEST_INVOCATION, {
           code: 'DATA_MIGRATION_REQUIRED',
           details: {
             requirements: [
@@ -254,7 +258,7 @@ describe('formatKernelError', () => {
     console.log = (...values: unknown[]) => lines.push(values.join(' '))
     try {
       await formatKernelError(
-        new ResponseError(VALIDATION, 'Function input is invalid.', {
+        new ResponseError(VALIDATION, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'FUNCTION_INPUT_INVALID',
           details: {
             issues: [
@@ -279,7 +283,7 @@ describe('formatKernelError', () => {
         false,
       )
       await formatKernelError(
-        new ResponseError(VALIDATION, 'Query input is invalid.', {
+        new ResponseError(VALIDATION, 'Query input is invalid.', TEST_INVOCATION, {
           code: 'QUERY_INPUT_INVALID',
           details: {
             phase: 'plan',
@@ -310,7 +314,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(5001, 'Schema operation is not supported.', {
+        new ResponseError(5001, 'Schema operation is not supported.', TEST_INVOCATION, {
           code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
           details: {
             phase: 'upgrade',
@@ -358,7 +362,7 @@ describe('formatKernelError', () => {
     console.log = (...values: unknown[]) => details.push(values.map(String).join(' '))
     try {
       await formatKernelError(
-        new ResponseError(5001, 'Schema operation is not supported.', {
+        new ResponseError(5001, 'Schema operation is not supported.', TEST_INVOCATION, {
           code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
           details: {
             phase: 'upgrade',
@@ -391,7 +395,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(1003, 'Function input is invalid.', {
+        new ResponseError(1003, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'SCHEMA_DOMAIN_ADDRESS_NOT_PUBLIC',
           details: { phase: 'publication', requiredScope: 'public' },
         }),
@@ -421,7 +425,7 @@ describe('formatKernelError', () => {
     console.log = (...values: unknown[]) => hints.push(values.map(String).join(' '))
     try {
       await formatKernelError(
-        new ResponseError(1003, 'Function input is invalid.', {
+        new ResponseError(1003, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'SCHEMA_DOMAIN_ADDRESS_NOT_PUBLIC',
           details: { phase: 'publication', requiredScope: 'public' },
         }),
@@ -448,7 +452,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(1003, 'Function input is invalid.', {
+        new ResponseError(1003, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'FUNCTION_INPUT_INVALID',
           details: {
             issues: [
@@ -495,7 +499,7 @@ describe('formatKernelError', () => {
     console.log = (...values: unknown[]) => details.push(values.map(String).join(' '))
     try {
       await formatKernelError(
-        new ResponseError(1003, 'Function input is invalid.', {
+        new ResponseError(1003, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'FUNCTION_INPUT_INVALID',
           details: {
             issues: [
@@ -530,7 +534,7 @@ describe('formatKernelError', () => {
     }) as typeof process.stderr.write
     try {
       await formatKernelError(
-        new ResponseError(1003, 'Function input is invalid.', {
+        new ResponseError(1003, 'Function input is invalid.', TEST_INVOCATION, {
           code: 'FUNCTION_INPUT_INVALID',
           details: { issues: [{ code: 'INVALID_FORMAT', path: '/customer/email' }] },
         }),

package/src/connection/__tests__/exchange.test.ts

@@ -47,7 +47,7 @@ describe('Domain token exchange', () => {
         observed.push({ url, init, body })
         const index = observed.filter((entry) => entry.url === INVOCATION).length
         return invocationResponse(
-          body.id,
+          body.requestId,
           index === 1
             ? { id: 'user-1' }
             : index === 2
@@ -121,7 +121,7 @@ describe('Domain token exchange', () => {
       if (url === INVOCATION) {
         const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
         return invocationResponse(
-          body.id,
+          body.requestId,
           body.call.input && Object.keys(body.call.input).length === 0
             ? { id: 'user-1' }
             : 'kernel-destination-envelope',
@@ -201,7 +201,7 @@ function exchangeFetch(
     if (url === INVOCATION) {
       const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
       return invocationResponse(
-        body.id,
+        body.requestId,
         body.call.input && Object.keys(body.call.input).length === 0
           ? { id: 'user-1' }
           : 'kernel-destination-envelope',
@@ -233,8 +233,9 @@ function configuration(enabled: boolean) {
   }
 }
 
-function invocationResponse(id: number, result: unknown, contentType: string): Response {
-  return new Response(JSON.stringify({ id, result }), {
+function invocationResponse(requestId: unknown, result: unknown, contentType: string): Response {
+  const invocation = { source: KERNEL, id: `exchange-${String(requestId)}` }
+  return new Response(JSON.stringify({ requestId, invocation, result }), {
     headers: { 'content-type': contentType, 'cache-control': 'no-store' },
   })
 }

package/src/connection/exchange.ts

@@ -33,12 +33,13 @@ export function createExchangeCredentialResolver(
       const client = new Client({ url: `${kernelIssuer}/invoke`, fetch, timeoutMs })
       try {
         const authenticated = client.as(sourceToken)
-        const auth = createAuth((path, input, options) =>
-          authenticated.call(call(path, input), {
+        const auth = createAuth(async (path, input, options) => {
+          const result = await authenticated.call(call(path, input), {
             ...options,
             delegate: { ttlSeconds: delegationTtlSeconds },
-          }),
-        )
+          })
+          return result.value
+        })
         const user = await auth.whoami({ signal })
         const key = Object.freeze({
           kernelIssuer,

package/src/lib/__tests__/domain-publication.test.ts

@@ -0,0 +1,144 @@
+import { publication } from '@astrale-os/kernel-protocol'
+import { defineDomain } from '@astrale-os/sdk'
+import { issuer } from '@astrale-os/sdk/auth'
+import { createDeployment } from '@astrale-os/sdk/deployment'
+import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { describe, expect, test } from 'bun:test'
+
+import { fetchDomainPublication } from '../domain-publication'
+
+const ROOT = 'https://publication-reader.example.dev'
+const PUBLICATION_URL = `${ROOT}/.well-known/astrale/domain.json`
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
+const schema = defineSchema('publication-reader.example.dev', {})
+const definition = defineDomain({
+  schema,
+  handlers: { functions: {}, classes: {}, interfaces: {} },
+})
+const deployed = createDeployment({
+  definition,
+  issuer: issuer.accept(ROOT),
+  bundleHref: `${ROOT}/domain.bundle.json`,
+  bindings: { callables: [] },
+}).publication
+
+describe('Domain Publication reader', () => {
+  test('fetches only the canonical path with redirects disabled', async () => {
+    const requests: Array<{ readonly url: string; readonly redirect?: RequestRedirect }> = []
+    const fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      requests.push({ url: String(input), redirect: init?.redirect })
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(`${ROOT}/`, undefined, fetch)).resolves.toEqual(deployed)
+    expect(requests).toEqual([{ url: PUBLICATION_URL, redirect: 'error' }])
+  })
+
+  test('propagates redirect rejection instead of accepting another target', async () => {
+    const fetch = async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      expect(init?.redirect).toBe('error')
+      throw new TypeError('redirect rejected')
+    }
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      'redirect rejected',
+    )
+  })
+
+  test('stops at one MiB and cancels an over-limit response stream', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull(controller) {
+          pulls += 1
+          if (pulls === 1) {
+            controller.enqueue(new Uint8Array(MAXIMUM_PUBLICATION_BYTES))
+            return
+          }
+          if (pulls === 2) {
+            controller.enqueue(Uint8Array.of(0))
+            return
+          }
+          controller.error(new Error('reader consumed beyond its byte limit'))
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> => new Response(body)
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(2)
+    expect(cancelled).toBe(true)
+  })
+
+  test('rejects an oversized Content-Length before pulling and cancels the body', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull() {
+          pulls += 1
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> =>
+      new Response(body, {
+        headers: { 'content-length': String(MAXIMUM_PUBLICATION_BYTES + 1) },
+      })
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(0)
+    expect(cancelled).toBe(true)
+  })
+
+  test.each([
+    ['invalid UTF-8', Uint8Array.of(0xc3, 0x28), TypeError],
+    ['invalid JSON', new TextEncoder().encode('{'), SyntaxError],
+    ['invalid Publication', new TextEncoder().encode('{}'), publication.PublicationError],
+  ] as const)('rejects %s before returning a Publication', async (_label, bytes, Cause) => {
+    const fetch = async (): Promise<Response> => new Response(bytes)
+    const error = await rejection(fetchDomainPublication(ROOT, undefined, fetch))
+
+    expect(error.message).toBe(`GET ${PUBLICATION_URL} returned an invalid Domain Publication`)
+    expect(error.cause).toBeInstanceOf(Cause)
+  })
+
+  test.each([
+    `${ROOT}/nested`,
+    `${ROOT}?deployment=current`,
+    `${ROOT}#fragment`,
+    'https://user:secret@publication-reader.example.dev',
+    'ftp://publication-reader.example.dev',
+  ])('rejects a non-origin deployment URL before fetch: %s', async (input) => {
+    let called = false
+    const fetch = async (): Promise<Response> => {
+      called = true
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(input, undefined, fetch)).rejects.toBeInstanceOf(TypeError)
+    expect(called).toBe(false)
+  })
+})
+
+async function rejection(input: Promise<unknown>): Promise<Error> {
+  try {
+    await input
+  } catch (cause) {
+    if (cause instanceof Error) return cause
+    throw new Error('Expected an Error rejection.', { cause })
+  }
+  throw new Error('Expected the promise to reject.')
+}

package/src/lib/__tests__/idp-session.test.ts

@@ -68,11 +68,29 @@ describe('ensureFreshSession', () => {
       expect(result.orgHintCalls).toBe(1)
       expect(server.refreshCount()).toBe(1)
       const session = await readSession()
+      expect(session.clientId).toBe('c_1')
       expect(session.refresh_token).toBe('rt-1')
       expect((session.tokens as Record<string, { access_token: string }>)[AUD].access_token).toBe(
         result.token as string,
       )
       expect(server.lastOrganizationId()).toBe('org_1')
+      expect(server.lastClientId()).toBe('c_1')
+    } finally {
+      await server.stop()
+    }
+  })
+
+  test('refreshes with the client that issued the session instead of the IdP default', async () => {
+    const server = rotationServer()
+    try {
+      await writeIdpConfig(server.url)
+      await writeSession({ clientId: 'c_session', expires_at: past() })
+
+      const result = await runDriver('ensure', { DRIVER_AUDIENCE: AUD })
+
+      expect(result.ok).toBe(true)
+      expect(server.lastClientId()).toBe('c_session')
+      expect((await readSession()).clientId).toBe('c_session')
     } finally {
       await server.stop()
     }
@@ -273,6 +291,7 @@ function rotationServer(opts?: {
 }): {
   url: string
   refreshCount: () => number
+  lastClientId: () => string | undefined
   lastOrganizationId: () => string | undefined
   stop: () => Promise<void>
 } {
@@ -280,6 +299,7 @@ function rotationServer(opts?: {
   // refresh token is invalid_grant.
   let current = 'rt-0'
   let count = 0
+  let lastClientId: string | undefined
   let lastOrgId: string | undefined
   const server = Bun.serve({
     port: 0,
@@ -300,6 +320,7 @@ function rotationServer(opts?: {
       if (opts?.delayMs) await new Promise((r) => setTimeout(r, opts.delayMs))
       count += 1
       current = `rt-${count}`
+      lastClientId = form.get('client_id') ?? undefined
       lastOrgId = form.get('organization_id') ?? undefined
       return Response.json({
         access_token: unsignedJwt({ aud: AUD, exp: futureEpoch() }),
@@ -312,6 +333,7 @@ function rotationServer(opts?: {
   return {
     url: `http://${server.hostname}:${server.port}`,
     refreshCount: () => count,
+    lastClientId: () => lastClientId,
     lastOrganizationId: () => lastOrgId,
     stop: () => server.stop(true),
   }

package/src/lib/__tests__/idp.test.ts

@@ -100,6 +100,7 @@ describe('IdP schemas and token helpers', () => {
       idp: 'workos',
       issuer: 'https://example.authkit.app',
       subject: 'user_123',
+      clientId: 'client_123',
       access_token: 'opaque-token',
       refresh_token: 'refresh-token',
       token_type: 'Bearer',
@@ -110,6 +111,7 @@ describe('IdP schemas and token helpers', () => {
     })
 
     expect(session.claims?.email).toBe('alice@example.com')
+    expect(session.clientId).toBe('client_123')
     expect(session.refresh_token).toBe('refresh-token')
   })
 

package/src/lib/__tests__/instance.test.ts

@@ -74,6 +74,12 @@ describe('InstanceStoreSchema', () => {
     expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai/')).toBe(
       'https://testmarc.eu.astrale.ai/api',
     )
+    expect(normalizeInstanceKernelUrl('https://testmarc.eu.beta.astrale.ai')).toBe(
+      'https://testmarc.eu.beta.astrale.ai/api',
+    )
+    expect(normalizeInstanceKernelUrl('https://shell.beta.astrale.ai')).toBe(
+      'https://shell.beta.astrale.ai',
+    )
   })
 
   test('does not rewrite explicit kernel or non-managed URLs', () => {

package/src/lib/__tests__/studio-server-deps.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
 import { Project } from 'ts-morph'
 
 /**
@@ -19,6 +19,18 @@ import { Project } from 'ts-morph'
 
 const CLI_ROOT = new URL('../../../', import.meta.url).pathname
 
+interface PackageManifest {
+  dependencies?: Record<string, string>
+  scripts?: Record<string, string>
+}
+
+const cliPackage = JSON.parse(
+  readFileSync(join(CLI_ROOT, 'package.json'), 'utf8'),
+) as PackageManifest
+const studioPackage = JSON.parse(
+  readFileSync(join(CLI_ROOT, 'studio/package.json'), 'utf8'),
+) as PackageManifest
+
 /** Base package of a bare specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
 function basePackage(spec: string): string {
   const parts = spec.split('/')
@@ -29,26 +41,33 @@ function isBuiltin(spec: string): boolean {
   return spec.startsWith('node:') || spec === 'bun' || spec.startsWith('bun:')
 }
 
+function runtimeFiles(directory: string): string[] {
+  return readdirSync(directory).flatMap((entry) => {
+    const path = join(directory, entry)
+    if (statSync(path).isDirectory()) return runtimeFiles(path)
+    return /\.(?:ts|tsx)$/.test(path) && !/\.test\.(?:ts|tsx)$/.test(path) ? [path] : []
+  })
+}
+
+const studioPath = (path: string) => relative(CLI_ROOT, path).replaceAll('\\', '/')
+
 describe('studio server runtime deps', () => {
-  const deps = new Set(
-    Object.keys(
-      (
-        JSON.parse(readFileSync(join(CLI_ROOT, 'package.json'), 'utf8')) as {
-          dependencies?: Record<string, string>
-        }
-      ).dependencies ?? {},
-    ),
-  )
+  const deps = new Set(Object.keys(cliPackage.dependencies ?? {}))
 
   const project = new Project({ skipAddingFilesFromTsConfig: true })
   project.addSourceFilesAtPaths([
     join(CLI_ROOT, 'studio/server/**/*.ts'),
+    join(CLI_ROOT, 'studio/server/**/*.tsx'),
     join(CLI_ROOT, 'studio/shared/**/*.ts'),
+    join(CLI_ROOT, 'studio/shared/**/*.tsx'),
   ])
+  const runtimeSourceFiles = project
+    .getSourceFiles()
+    .filter((sourceFile) => !/\.test\.(?:ts|tsx)$/.test(sourceFile.getBaseName()))
 
   // getImportStringLiterals covers static imports, re-exports, and dynamic import().
   const offenders: Record<string, string[]> = {}
-  for (const sf of project.getSourceFiles()) {
+  for (const sf of runtimeSourceFiles) {
     const specs = sf.getImportStringLiterals().map((l) => l.getLiteralValue())
     for (const spec of specs) {
       if (spec.startsWith('.') || spec.startsWith('/') || isBuiltin(spec)) continue
@@ -66,9 +85,27 @@ describe('studio server runtime deps', () => {
     ).toEqual({})
   })
 
-  test('parsed at least the known studio server files', () => {
-    // Guard against the glob silently matching nothing (which would make the
-    // invariant vacuously pass).
-    expect(project.getSourceFiles().length).toBeGreaterThan(10)
+  test('parses every shipped Studio server and shared runtime source', () => {
+    const expected = [
+      ...runtimeFiles(join(CLI_ROOT, 'studio/server')),
+      ...runtimeFiles(join(CLI_ROOT, 'studio/shared')),
+    ]
+      .map(studioPath)
+      .sort()
+    const parsed = runtimeSourceFiles
+      .map((sourceFile) => studioPath(sourceFile.getFilePath()))
+      .sort()
+
+    expect(parsed).toEqual(expected)
+  })
+})
+
+describe('studio test gate', () => {
+  test('the root and Studio suites include all client, server, and shared tests', () => {
+    expect(cliPackage.scripts?.test).toBe(
+      'bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs',
+    )
+    expect(cliPackage.scripts?.['test:studio']).toBe('pnpm --dir studio test')
+    expect(studioPackage.scripts?.test).toBe('bun test client/src server shared')
   })
 })

package/src/lib/__tests__/update.test.ts

@@ -4,6 +4,8 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
 import {
+  DEFAULT_UPDATE_CHANNEL,
+  InstallMetadataSchema,
   releaseBase,
   shouldUpdate,
   updateAstrale,
@@ -84,6 +86,16 @@ async function makeInstall(
 }
 
 describe('update helpers', () => {
+  test('defaults missing install metadata to the beta channel', () => {
+    expect(DEFAULT_UPDATE_CHANNEL).toBe('beta')
+    expect(
+      InstallMetadataSchema.parse({
+        method: 'script',
+        bin: '/tmp/astrale',
+      }).channel,
+    ).toBe('beta')
+  })
+
   test('releaseBase resolves exact versions and channels', () => {
     const meta: InstallMetadata = {
       method: 'script',

package/src/lib/domain-publication.ts

@@ -0,0 +1,102 @@
+import { publication } from '@astrale-os/kernel-protocol'
+
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
+
+/** Fetch and admit one canonical Domain Publication without following its bundle. */
+export async function fetchDomainPublication(
+  input: string,
+  signal?: AbortSignal,
+  fetchImpl: FetchLike = globalThis.fetch,
+): Promise<publication.Publication> {
+  const root = deploymentRoot(input)
+  const url = new URL(publication.PATH, root)
+  const response = await fetchImpl(url, {
+    redirect: 'error',
+    ...(signal === undefined ? {} : { signal }),
+  })
+  if (!response.ok) {
+    await cancel(response.body)
+    throw new Error(`GET ${url.href} → ${response.status}`)
+  }
+  const bytes = await readBounded(response, url)
+  try {
+    const source = new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+    return publication.accept(JSON.parse(source) as unknown)
+  } catch (cause) {
+    throw new Error(`GET ${url.href} returned an invalid Domain Publication`, { cause })
+  }
+}
+
+async function readBounded(response: Response, url: URL): Promise<Uint8Array> {
+  const declared = response.headers.get('content-length')
+  if (
+    declared !== null &&
+    (!/^\d+$/u.test(declared) ||
+      !Number.isSafeInteger(Number(declared)) ||
+      Number(declared) > MAXIMUM_PUBLICATION_BYTES)
+  ) {
+    await cancel(response.body)
+    throw sizeError(url)
+  }
+  if (response.body === null) return new Uint8Array()
+
+  const reader = response.body.getReader()
+  const chunks: Uint8Array[] = []
+  let size = 0
+  let complete = false
+  try {
+    for (;;) {
+      const next = await reader.read()
+      if (next.done) {
+        complete = true
+        break
+      }
+      if (next.value.byteLength === 0) continue
+      if (next.value.byteLength > MAXIMUM_PUBLICATION_BYTES - size) {
+        throw sizeError(url)
+      }
+      chunks.push(next.value)
+      size += next.value.byteLength
+    }
+  } finally {
+    if (!complete) await reader.cancel().catch(() => undefined)
+    reader.releaseLock()
+  }
+
+  const bytes = new Uint8Array(size)
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return bytes
+}
+
+function sizeError(url: URL): Error {
+  return new Error(`GET ${url.href} exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`)
+}
+
+async function cancel(body: ReadableStream<Uint8Array> | null): Promise<void> {
+  if (body !== null) await body.cancel().catch(() => undefined)
+}
+
+function deploymentRoot(input: string): URL {
+  let url: URL
+  try {
+    url = new URL(input)
+  } catch {
+    throw new TypeError(`Domain deployment URL is invalid: ${input}`)
+  }
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.search !== '' ||
+    url.hash !== '' ||
+    !['', '/'].includes(url.pathname)
+  ) {
+    throw new TypeError(`Domain deployment URL must be an HTTP(S) origin: ${input}`)
+  }
+  return new URL(url.origin)
+}

package/src/lib/idp.ts

@@ -145,6 +145,8 @@ export const IdpSessionSchema = z
     idp: z.string(),
     issuer: z.string().url(),
     subject: z.string(),
+    /** OAuth client that issued this session's refresh token. */
+    clientId: z.string().optional(),
     audience: z.string().optional(),
     organizationId: z.string().optional(),
     access_token: z.string(),
@@ -644,10 +646,11 @@ export async function refreshSession(
   if (!session.refresh_token)
     throw new Error(`IdP session for "${identityName}" has no refresh token`)
   const idp = await readIdpConfig(session.idp)
+  const clientId = requireClientId(idp, session.clientId)
   const params = new URLSearchParams({
     grant_type: 'refresh_token',
     refresh_token: session.refresh_token,
-    client_id: requireClientId(idp),
+    client_id: clientId,
   })
   const audience = opts.audience ?? session.audience
   if (audience) params.set('audience', audience)
@@ -674,6 +677,7 @@ export async function refreshSession(
   const expiresAt = tokenExpiresAt(token)
   const next: IdpSession = {
     ...session,
+    clientId,
     access_token: token.access_token,
     id_token: token.id_token ?? session.id_token,
     refresh_token: token.refresh_token ?? session.refresh_token,