@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.10

package/src/graph/.spec/layout.ts

@@ -1,6 +1,14 @@
 import { defineLayout } from '@astrale-os/spec/authoring'
 
 export default defineLayout({
-  entries: ['__tests__/', 'index.ts', 'mutation.ts', 'projection.ts', 'query.ts', 'tsconfig.json'],
+  entries: [
+    '__tests__/',
+    'class.ts',
+    'index.ts',
+    'mutation.ts',
+    'projection.ts',
+    'query.ts',
+    'tsconfig.json',
+  ],
   exact: true,
 })

package/src/graph/__tests__/mutation.test.ts

@@ -14,7 +14,7 @@ describe('prepareMutation', () => {
               {
                 op: 'node.create',
                 as: 'note',
-                class: '/:notes.example.dev:class.Note',
+                class: 'notes.example.dev:class.Note',
                 props: {},
               },
             ],
@@ -29,7 +29,7 @@ describe('prepareMutation', () => {
         {
           op: 'node.create',
           as: 'note',
-          class: '/:notes.example.dev:class.Note',
+          class: 'notes.example.dev:class.Note',
           props: {},
         },
       ],

package/src/graph/__tests__/query.test.ts

@@ -38,7 +38,7 @@ describe('prepareQuery', () => {
   })
 
   /** @evidence TEST-CLI-GRAPH-AUTHORS-DEFINITION-QUERY */
-  test('authors an exact Definition source without backend query text', () => {
+  test('authors an exact Class source without backend query text', () => {
     const prepared = prepareQuery({
       sources: [],
       definition: '/:issues.astrale.ai:class.Issue',
@@ -52,8 +52,8 @@ describe('prepareQuery', () => {
         kind: 'node',
         terms: [
           {
-            kind: 'definition',
-            definition: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
+            kind: 'class',
+            class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
           },
         ],
         binding: 'n0',
@@ -64,6 +64,25 @@ describe('prepareQuery', () => {
     expect(prepared.page).toEqual({ size: 201 })
   })
 
+  test('unions positional Paths and one Class source in authored order', () => {
+    const prepared = prepareQuery({
+      sources: ['@note'],
+      definition: '/:issues.astrale.ai:class.Issue',
+    })
+
+    expect(JSON.parse(JSON.stringify(prepared.ast.source))).toEqual({
+      kind: 'node',
+      terms: [
+        { kind: 'path', path: '@note' },
+        {
+          kind: 'class',
+          class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
+        },
+      ],
+      binding: 'n0',
+    })
+  })
+
   /** @evidence TEST-CLI-GRAPH-ADMITS-QUERY-V6-ORDERING */
   test('admits one exact Property-ordered Query V6 document', () => {
     const ast = {
@@ -73,8 +92,8 @@ describe('prepareQuery', () => {
         kind: 'node',
         terms: [
           {
-            kind: 'definition',
-            definition: { origin: 'notes.example.dev', kind: 'class', name: 'Note' },
+            kind: 'class',
+            class: { origin: 'notes.example.dev', kind: 'class', name: 'Note' },
           },
         ],
         binding: 'n0',
@@ -149,6 +168,6 @@ describe('prepareQuery', () => {
     ).toThrow('--limit must be a positive integer')
     expect(() =>
       prepareQuery({ sources: [], definition: '/:notes.example.dev:view.note' }),
-    ).toThrow('--definition must be one canonical Class or Interface Path')
+    ).toThrow('--definition must be one canonical Class Path')
   })
 })

package/src/graph/class.ts

@@ -0,0 +1,30 @@
+import type { ClassKey as ClassKeyValue, ClassRef } from '@astrale-os/sdk/graph/class'
+
+import { ClassKey } from '@astrale-os/sdk/graph/class'
+import { Path } from '@astrale-os/sdk/graph/path'
+
+/** Admit one canonical Domain-rooted Class Path into its DSL coordinate. */
+export function classReference(input: string, label: string): ClassRef {
+  const path = Path.parse(input)
+  const step = path.ast.steps[0]
+  if (
+    path.ast.anchor.kind !== 'domain' ||
+    path.ast.steps.length !== 1 ||
+    step?.kind !== 'projection' ||
+    step.projection.kind !== 'class'
+  ) {
+    throw new TypeError(`${label} must be one canonical Class Path`)
+  }
+  return ClassKey.ref(
+    ClassKey.of({
+      origin: path.ast.anchor.origin,
+      kind: 'class',
+      name: step.projection.name,
+    }),
+  )
+}
+
+/** Admit one canonical Domain-rooted Class Path into its exact string identity. */
+export function classKey(input: string, label: string): ClassKeyValue {
+  return ClassKey.of(classReference(input, label))
+}

package/src/graph/index.ts

@@ -1,3 +1,4 @@
+export { classKey, classReference } from './class'
 export { prepareMutation } from './mutation'
 export { nodeProperty, unqualifyProperty } from './projection'
 export { prepareQuery, type PreparedQuery, type QueryCommandInput } from './query'

package/src/graph/query.ts

@@ -1,12 +1,15 @@
 import type {
+  NodeQueryBuilder,
   QueryAST as QueryASTValue,
-  QueryDefinitionRef,
   QueryDirection,
+  QueryNodeInput,
 } from '@astrale-os/sdk/query'
 
 import { Path } from '@astrale-os/sdk/graph/path'
 import { Query, QueryAST } from '@astrale-os/sdk/query'
 
+import { classReference } from './class'
+
 export interface QueryCommandInput {
   readonly sources: readonly string[]
   readonly definition?: string
@@ -51,43 +54,29 @@ export function prepareQuery(input: QueryCommandInput): PreparedQuery {
   }
 
   const paths = input.sources.map((source) => Path.parse(source))
-  const definition = input.definition === undefined ? undefined : definitionRef(input.definition)
-  const query =
-    paths.length > 0
-      ? Query.from({
-          kind: 'node',
-          paths: paths as [Path, ...Path[]],
-          ...(definition === undefined ? {} : { definitions: [definition] }),
-        })
-      : Query.from({ kind: 'node', definitions: [definition!] })
+  const definition =
+    input.definition === undefined ? undefined : classReference(input.definition, '--definition')
+  const nodes = definition === undefined ? paths : [...paths, definition]
+  const query: NodeQueryBuilder<unknown> = Query.from({
+    nodes: nodes as [QueryNodeInput, ...QueryNodeInput[]],
+  })
   const ast =
     input.edge === undefined
-      ? query.select({ kind: 'graph' })
-      : query
-          .expand({
-            via: [definitionRef(input.edge)],
-            direction: input.direction ?? 'outgoing',
-          })
-          .select({ kind: 'graph' })
+      ? query.select({ kind: 'graph', binding: query.node })
+      : expanded(query, input.edge, input.direction)
   return withPage(ast, limit, input.cursor)
 }
 
-function definitionRef(input: string): QueryDefinitionRef {
-  const path = Path.parse(input)
-  const step = path.ast.steps[0]
-  if (
-    path.ast.anchor.kind !== 'domain' ||
-    path.ast.steps.length !== 1 ||
-    step?.kind !== 'projection' ||
-    (step.projection.kind !== 'class' && step.projection.kind !== 'interface')
-  ) {
-    throw new TypeError('--definition must be one canonical Class or Interface Path')
-  }
-  return Object.freeze({
-    origin: path.ast.anchor.origin,
-    kind: step.projection.kind,
-    name: step.projection.name,
+function expanded(
+  query: NodeQueryBuilder<unknown>,
+  edge: string,
+  direction: QueryDirection | undefined,
+): QueryASTValue {
+  const result = query.expand({
+    via: [classReference(edge, '--edge')],
+    direction: direction ?? 'outgoing',
   })
+  return result.select({ kind: 'graph', binding: result.node })
 }
 
 function positiveInteger(raw: string | undefined, name: string, fallback: number): number {

package/src/identity/.spec/api.d.ts

@@ -1,6 +1,6 @@
-import type { Call } from '@astrale-os/kernel-client'
 import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { LocalBinding } from '@astrale-os/sdk/graph/model'
+import type { Call } from '@astrale-os/sdk/client'
+import type { LocalBinding } from '@astrale-os/sdk/graph'
 import type { JWK } from 'jose'
 
 import type {

package/src/identity/__tests__/registration.test.ts

@@ -1,6 +1,6 @@
 import type { ProvisionRequest } from '@astrale-os/sdk/auth'
 
-import { LocalBinding } from '@astrale-os/sdk/graph/model'
+import { LocalBinding } from '@astrale-os/sdk/graph'
 import { expect, test } from 'bun:test'
 
 import { submitIdentityProvision } from '../registration'

package/src/identity/registration.ts

@@ -1,9 +1,9 @@
-import type { Call } from '@astrale-os/kernel-client'
 import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { LocalBinding } from '@astrale-os/sdk/graph/model'
+import type { Call } from '@astrale-os/sdk/client'
+import type { LocalBinding } from '@astrale-os/sdk/graph'
 
-import { call } from '@astrale-os/kernel-client'
 import { issuer } from '@astrale-os/sdk/auth'
+import { call } from '@astrale-os/sdk/client'
 import { NodeId } from '@astrale-os/sdk/graph/node'
 import { Path } from '@astrale-os/sdk/graph/path'
 

package/src/keys/__tests__/keys.test.ts

@@ -62,6 +62,10 @@ describe('DESIGN — per-identity keys', () => {
     await persistKeypair('alice', { keysDir: tmp })
     const jwt = await signAs('alice', tmp)
     expect(jwt.split('.').length).toBe(3)
+    const claims = decodeJwt(jwt)
+    expect(claims.iat).toBeUndefined()
+    expect(claims.exp).toBeNumber()
+    expect((claims.exp as number) * 1_000).toBeGreaterThan(Date.now() + 299_000)
   })
 
   /** @evidence TEST-CLI-KEYS-DISTINGUISHES-KERNEL-ROOT-GRANT */

package/src/keys/credential.ts

@@ -47,6 +47,7 @@ async function signIdentityCredential(options: {
     .setIssuer(options.issuer)
     .setSubject(options.subject)
     .setAudience(options.audience)
+    .setExpirationTime('5m')
     .sign(privateKey)
 }
 

package/src/lib/__tests__/admin-target.test.ts

@@ -6,6 +6,7 @@ import {
   DEFAULT_ADMIN_TARGET_NAME,
   DEFAULT_ADMIN_DOMAIN_ISSUER,
   DEFAULT_ADMIN_TARGET_URL,
+  defaultAdminTargetForChannel,
   resolveAdminTargetFromStore,
 } from '../admin-target'
 import { DEFAULT_CONFIG, type AstraleConfig } from '../config'
@@ -32,6 +33,17 @@ const instances: InstanceStore = {
 }
 
 describe('resolveAdminTargetFromStore', () => {
+  test('derives hosted Admin defaults from the release channel', () => {
+    expect(defaultAdminTargetForChannel('beta')).toEqual({
+      url: 'https://admin.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+    })
+    expect(defaultAdminTargetForChannel('stable')).toEqual({
+      url: 'https://admin.eu.astrale.ai/api',
+      domainIssuer: 'https://admin.astrale.ai',
+    })
+  })
+
   test('uses hosted admin default without active instance coupling', () => {
     expect(resolveAdminTargetFromStore({}, DEFAULT_CONFIG, instances)).toEqual({
       name: DEFAULT_ADMIN_TARGET_NAME,

package/src/lib/__tests__/command-dx.test.ts

@@ -16,7 +16,7 @@ function dx(
   error: CommanderError,
   argv: string[],
 ) {
-  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv))) as {
+  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv, true))) as {
     error: string
     message: string
     detail: string

package/src/lib/__tests__/domain-publication.test.ts

@@ -0,0 +1,138 @@
+import { publication } from '@astrale-os/sdk/publication'
+import { defineSchema } from '@astrale-os/sdk/schema'
+import { describe, expect, test } from 'bun:test'
+
+import { releaseFor } from '../../__tests__/fixtures/publication'
+import { domainPublicationUrl, fetchDomainPublication } from '../domain-publication'
+
+const ROOT = 'https://publication-reader.example.dev'
+const PUBLICATION_URL = `${ROOT}/.well-known/astrale/domain.json`
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
+const schema = defineSchema('publication-reader.example.dev', {})
+const deployed = releaseFor(schema, ROOT).publication
+
+describe('Domain Publication reader', () => {
+  test('fetches only the canonical path with redirects disabled', async () => {
+    const requests: Array<{ readonly url: string; readonly redirect?: RequestRedirect }> = []
+    const fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      requests.push({ url: String(input), redirect: init?.redirect })
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(`${ROOT}/`, undefined, fetch)).resolves.toEqual(deployed)
+    expect(requests).toEqual([{ url: PUBLICATION_URL, redirect: 'error' }])
+  })
+
+  test('normalizes an origin and admits the exact canonical Publication URL', () => {
+    expect(domainPublicationUrl(ROOT).href).toBe(PUBLICATION_URL)
+    expect(domainPublicationUrl(PUBLICATION_URL).href).toBe(PUBLICATION_URL)
+  })
+
+  test('propagates redirect rejection instead of accepting another target', async () => {
+    const fetch = async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      expect(init?.redirect).toBe('error')
+      throw new TypeError('redirect rejected')
+    }
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      'redirect rejected',
+    )
+  })
+
+  test('stops at one MiB and cancels an over-limit response stream', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull(controller) {
+          pulls += 1
+          if (pulls === 1) {
+            controller.enqueue(new Uint8Array(MAXIMUM_PUBLICATION_BYTES))
+            return
+          }
+          if (pulls === 2) {
+            controller.enqueue(Uint8Array.of(0))
+            return
+          }
+          controller.error(new Error('reader consumed beyond its byte limit'))
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> => new Response(body)
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(2)
+    expect(cancelled).toBe(true)
+  })
+
+  test('rejects an oversized Content-Length before pulling and cancels the body', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull() {
+          pulls += 1
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> =>
+      new Response(body, {
+        headers: { 'content-length': String(MAXIMUM_PUBLICATION_BYTES + 1) },
+      })
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(0)
+    expect(cancelled).toBe(true)
+  })
+
+  test.each([
+    ['invalid UTF-8', Uint8Array.of(0xc3, 0x28), TypeError],
+    ['invalid JSON', new TextEncoder().encode('{'), SyntaxError],
+    ['invalid Publication', new TextEncoder().encode('{}'), publication.PublicationError],
+  ] as const)('rejects %s before returning a Publication', async (_label, bytes, Cause) => {
+    const fetch = async (): Promise<Response> => new Response(bytes)
+    const error = await rejection(fetchDomainPublication(ROOT, undefined, fetch))
+
+    expect(error.message).toBe(`GET ${PUBLICATION_URL} returned an invalid Domain Publication`)
+    expect(error.cause).toBeInstanceOf(Cause)
+  })
+
+  test.each([
+    `${ROOT}/nested`,
+    `${ROOT}?deployment=current`,
+    `${ROOT}#fragment`,
+    'https://user:secret@publication-reader.example.dev',
+    'ftp://publication-reader.example.dev',
+  ])('rejects a non-origin deployment URL before fetch: %s', async (input) => {
+    let called = false
+    const fetch = async (): Promise<Response> => {
+      called = true
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(input, undefined, fetch)).rejects.toBeInstanceOf(TypeError)
+    expect(called).toBe(false)
+  })
+})
+
+async function rejection(input: Promise<unknown>): Promise<Error> {
+  try {
+    await input
+  } catch (cause) {
+    if (cause instanceof Error) return cause
+    throw new Error('Expected an Error rejection.', { cause })
+  }
+  throw new Error('Expected the promise to reject.')
+}

package/src/lib/__tests__/idp-session.test.ts

@@ -68,11 +68,29 @@ describe('ensureFreshSession', () => {
       expect(result.orgHintCalls).toBe(1)
       expect(server.refreshCount()).toBe(1)
       const session = await readSession()
+      expect(session.clientId).toBe('c_1')
       expect(session.refresh_token).toBe('rt-1')
       expect((session.tokens as Record<string, { access_token: string }>)[AUD].access_token).toBe(
         result.token as string,
       )
       expect(server.lastOrganizationId()).toBe('org_1')
+      expect(server.lastClientId()).toBe('c_1')
+    } finally {
+      await server.stop()
+    }
+  })
+
+  test('refreshes with the client that issued the session instead of the IdP default', async () => {
+    const server = rotationServer()
+    try {
+      await writeIdpConfig(server.url)
+      await writeSession({ clientId: 'c_session', expires_at: past() })
+
+      const result = await runDriver('ensure', { DRIVER_AUDIENCE: AUD })
+
+      expect(result.ok).toBe(true)
+      expect(server.lastClientId()).toBe('c_session')
+      expect((await readSession()).clientId).toBe('c_session')
     } finally {
       await server.stop()
     }
@@ -273,6 +291,7 @@ function rotationServer(opts?: {
 }): {
   url: string
   refreshCount: () => number
+  lastClientId: () => string | undefined
   lastOrganizationId: () => string | undefined
   stop: () => Promise<void>
 } {
@@ -280,6 +299,7 @@ function rotationServer(opts?: {
   // refresh token is invalid_grant.
   let current = 'rt-0'
   let count = 0
+  let lastClientId: string | undefined
   let lastOrgId: string | undefined
   const server = Bun.serve({
     port: 0,
@@ -300,6 +320,7 @@ function rotationServer(opts?: {
       if (opts?.delayMs) await new Promise((r) => setTimeout(r, opts.delayMs))
       count += 1
       current = `rt-${count}`
+      lastClientId = form.get('client_id') ?? undefined
       lastOrgId = form.get('organization_id') ?? undefined
       return Response.json({
         access_token: unsignedJwt({ aud: AUD, exp: futureEpoch() }),
@@ -312,6 +333,7 @@ function rotationServer(opts?: {
   return {
     url: `http://${server.hostname}:${server.port}`,
     refreshCount: () => count,
+    lastClientId: () => lastClientId,
     lastOrganizationId: () => lastOrgId,
     stop: () => server.stop(true),
   }

package/src/lib/__tests__/idp.test.ts

@@ -9,6 +9,7 @@ import {
   IdpSessionSchema,
   isSessionExpired,
   issuerFromToken,
+  legacyBuiltinWorkosReplacement,
   normalizeTokenResponse,
   OAuthTokenError,
   OidcMetadataSchema,
@@ -63,8 +64,11 @@ describe('IdP schemas and token helpers', () => {
     expect(config?.client.token_request_format).toBe('json')
   })
 
-  test('does not invent a WorkOS environment when no client id is configured', () => {
-    expect(builtinIdpConfig('workos', undefined, {})).toBeNull()
+  test('builds the built-in WorkOS IdP with the public client id by default', () => {
+    const config = builtinIdpConfig('workos', undefined, {})
+
+    expect(config?.entry.builtIn).toBe(true)
+    expect(config?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
   })
 
   test('reads WorkOS client id from WORKOS_CLIENT_ID before VITE_WORKOS_CLIENT_ID', () => {
@@ -75,8 +79,34 @@ describe('IdP schemas and token helpers', () => {
       }),
     ).toBe('client_primary')
     expect(workosClientIdFromEnv({ VITE_WORKOS_CLIENT_ID: 'client_vite' })).toBe('client_vite')
-    expect(workosClientIdFromEnv({})).toBeUndefined()
-    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBeUndefined()
+    expect(workosClientIdFromEnv({})).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBe(
+      'client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+  })
+
+  test('replaces only the legacy persisted built-in WorkOS client', () => {
+    const legacy = builtinIdpConfig('workos', 'client_01KC29HEGD7B40TV2C4QZ436BG', {})!
+    const replacement = legacyBuiltinWorkosReplacement(legacy, undefined, {})
+
+    expect(replacement?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(replacement?.metadata.jwks_uri).toBe(
+      'https://api.workos.com/sso/jwks/client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, entry: { ...legacy.entry, builtIn: false } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, client: { ...legacy.client, client_id: 'client_custom' } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
   })
 
   test('stores client secret env names, not secret material', () => {
@@ -100,6 +130,7 @@ describe('IdP schemas and token helpers', () => {
       idp: 'workos',
       issuer: 'https://example.authkit.app',
       subject: 'user_123',
+      clientId: 'client_123',
       access_token: 'opaque-token',
       refresh_token: 'refresh-token',
       token_type: 'Bearer',
@@ -110,6 +141,7 @@ describe('IdP schemas and token helpers', () => {
     })
 
     expect(session.claims?.email).toBe('alice@example.com')
+    expect(session.clientId).toBe('client_123')
     expect(session.refresh_token).toBe('refresh-token')
   })
 

package/src/lib/__tests__/instance-candidates.test.ts

@@ -18,7 +18,6 @@ const managedDemo: OwnedInstanceInfo = {
   slug: 'demo',
   url: 'https://demo.eu.astrale.ai',
   state: 'ready',
-  region: 'eu',
 }
 
 describe('collectInstanceCandidates', () => {
@@ -138,11 +137,10 @@ describe('describeInstanceCandidate', () => {
         slug: 'twin',
         url: 'https://twin.eu.astrale.ai',
         state: 'ready',
-        region: 'eu',
       },
     ])
     expect(describeInstanceCandidate(managed!)).toBe(
-      'twin (managed) https://twin.eu.astrale.ai/api — eu',
+      'twin (managed) https://twin.eu.astrale.ai/api',
     )
   })
 })