@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/src/commands/__tests__/auth-login.test.ts

@@ -81,11 +81,56 @@ describe('auth login command', () => {
       expect(result.exitCode).toBe(0)
       const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
       expect(session.audience).toBe('https://kernel.example.com')
+      expect(session.clientId).toBe('client_123')
       expect(session.subject).toBe('user_123')
     } finally {
       await server.stop()
     }
   })
+
+  test('persists an explicit client id and reuses it for a named login', async () => {
+    const server = oauthServer({
+      accessToken: unsignedJwt({
+        iss: 'http://127.0.0.1',
+        sub: 'user_123',
+        exp: 1893456000,
+      }),
+    })
+    try {
+      await writeIdpConfig(server.url)
+
+      const explicit = await runAuthLogin(
+        '--idp',
+        'test',
+        '--name',
+        'alice',
+        '--client-id',
+        'client_override',
+        '--client-credentials',
+        '--client-secret-env',
+        'TEST_CLIENT_SECRET',
+        '--raw',
+      )
+      const reused = await runAuthLogin(
+        '--idp',
+        'test',
+        '--name',
+        'alice',
+        '--client-credentials',
+        '--client-secret-env',
+        'TEST_CLIENT_SECRET',
+        '--raw',
+      )
+
+      expect(explicit.exitCode).toBe(0)
+      expect(reused.exitCode).toBe(0)
+      expect(server.clientIds()).toEqual(['client_override', 'client_override'])
+      const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
+      expect(session.clientId).toBe('client_override')
+    } finally {
+      await server.stop()
+    }
+  })
 })
 
 async function writeIdpConfig(baseUrl: string): Promise<void> {
@@ -131,12 +176,19 @@ async function writeIdpConfig(baseUrl: string): Promise<void> {
   )
 }
 
-function oauthServer(args: { accessToken: string }): { url: string; stop: () => Promise<void> } {
+function oauthServer(args: { accessToken: string }): {
+  url: string
+  clientIds: () => Array<string | null>
+  stop: () => Promise<void>
+} {
+  const clientIds: Array<string | null> = []
   const server = Bun.serve({
     port: 0,
     fetch: async (request) => {
       const url = new URL(request.url)
       if (url.pathname !== '/token') return new Response('not found', { status: 404 })
+      const form = new URLSearchParams(await request.text())
+      clientIds.push(form.get('client_id'))
       return Response.json({
         access_token: args.accessToken,
         token_type: 'Bearer',
@@ -146,6 +198,7 @@ function oauthServer(args: { accessToken: string }): { url: string; stop: () =>
   })
   return {
     url: `http://${server.hostname}:${server.port}`,
+    clientIds: () => clientIds,
     stop: () => server.stop(true),
   }
 }

package/src/commands/__tests__/call-describe.test.ts

@@ -1,34 +1,47 @@
 import { Path } from '@astrale-os/sdk/graph/path'
+import { bundle, defineSchema, func, method, nodeClass } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
-import { describeCallableFromSchema } from '../call-describe'
+import { describeCallableFromBundle } from '../call-describe'
 
-const schema = {
-  classes: {
-    Manager: {
-      methods: {
-        createInstance: {
-          auth: 'authorized',
-          description: 'Create one child Instance.',
-          input: { type: 'object', required: ['operationId', 'slug'] },
-          output: { mode: 'value' },
-        },
-      },
-    },
+const createInstance = method({
+  auth: 'authenticated',
+  description: 'Create one child Instance.',
+  input: {
+    type: 'object',
+    properties: { operationId: { type: 'string' }, slug: { type: 'string' } },
+    required: ['operationId', 'slug'],
+    additionalProperties: false,
   },
-  functions: {
-    journal: {
-      description: 'Read the authorized Kernel journal.',
-      input: { type: 'object' },
-    },
+  output: { type: 'object', additionalProperties: true },
+  static: true,
+})
+const inspectInstance = method({
+  auth: 'authenticated',
+  description: 'Inspect one child Instance.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const journal = func({
+  auth: 'authenticated',
+  description: 'Read the authorized Kernel journal.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const source = defineSchema('host.astrale.ai', {
+  classes: {
+    Manager: nodeClass({ methods: { createInstance } }),
+    Instance: nodeClass({ methods: { inspectInstance } }),
   },
-}
+  functions: { journal },
+})
+const installed = bundle.create(source)
 
-describe('describeCallableFromSchema', () => {
-  test('reads a static Class method from the Domain schema', () => {
-    const described = describeCallableFromSchema(
+describe('describeCallableFromBundle', () => {
+  test('reads a static Class method from the resolved Domain', () => {
+    const described = describeCallableFromBundle(
       Path.parse('/:host.astrale.ai:class.Manager:createInstance'),
-      schema,
+      installed,
     )
     expect(described).toMatchObject({
       origin: 'host.astrale.ai',
@@ -36,30 +49,30 @@ describe('describeCallableFromSchema', () => {
       method: 'createInstance',
       dispatch: 'static',
       description: 'Create one child Instance.',
-      auth: 'authorized',
+      auth: 'authenticated',
     })
     expect(described?.input).toMatchObject({ required: ['operationId', 'slug'] })
   })
 
-  test('finds an instance method when the receiver Path is not a Class projection', () => {
+  test('finds one instance method when the receiver Path is not a Class projection', () => {
     expect(
-      describeCallableFromSchema(
-        Path.parse('/:host.astrale.ai:core.manager::createInstance'),
-        schema,
+      describeCallableFromBundle(
+        Path.parse('/:host.astrale.ai:core.manager::inspectInstance'),
+        installed,
       ),
     ).toMatchObject({
       origin: 'host.astrale.ai',
-      class: 'Manager',
-      method: 'createInstance',
+      class: 'Instance',
+      method: 'inspectInstance',
       dispatch: 'instance',
     })
   })
 
-  test('reads a standalone Function from the Domain schema', () => {
+  test('reads a standalone Function from the resolved Domain', () => {
     expect(
-      describeCallableFromSchema(Path.parse('/:kernel.astrale.ai:function.journal'), schema),
+      describeCallableFromBundle(Path.parse('/:host.astrale.ai:function.journal'), installed),
     ).toMatchObject({
-      origin: 'kernel.astrale.ai',
+      origin: 'host.astrale.ai',
       function: 'journal',
       description: 'Read the authorized Kernel journal.',
     })

package/src/commands/__tests__/call.test.ts

@@ -14,7 +14,11 @@ describe('call command result lifetime', () => {
     }
 
     const sessionStream = Object.assign(stream(), { async cancel() {} })
-    const materialized = await materializeCallResult({ kind: 'stream', stream: sessionStream })
+    const materialized = await materializeCallResult({
+      kind: 'stream',
+      invocation: { source: 'https://kernel.test' as never, id: 'test-stream' },
+      stream: sessionStream,
+    })
     sessionOpen = false
 
     expect(materialized).toEqual({ kind: 'stream', values: ['first', 'second'] })

package/src/commands/__tests__/domain-install-operation.test.ts

@@ -1,5 +1,7 @@
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { afterEach, describe, expect, mock, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { installDirect } from '../domain/install'
 
 const GENERATED = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
@@ -7,6 +9,13 @@ const RETRY = '139137b5-af47-47ce-92b2-b64a2b0c63d7'
 
 const originalFetch = globalThis.fetch
 
+const schema = defineSchema('crm.test', {})
+const deployed = releaseFor(schema, 'https://crm.test').publication
+
+function publicationResponse(): Response {
+  return Response.json(deployed)
+}
+
 class ExitError extends Error {}
 
 afterEach(() => {
@@ -15,9 +24,7 @@ afterEach(() => {
 
 describe('direct domain install operation identity', () => {
   test('generates one operation before transport and exposes it for recovery', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ domainName: 'crm.test' }),
-    ) as unknown as typeof fetch
+    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
     const create = mock(() => GENERATED)
     const requests: unknown[] = []
     let recovery: unknown
@@ -54,9 +61,7 @@ describe('direct domain install operation identity', () => {
   })
 
   test('accepts an explicit operation only as the exact retry identity', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ domainName: 'crm.test' }),
-    ) as unknown as typeof fetch
+    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
     const create = mock(() => GENERATED)
     const accepted: string[] = []
     const requests: unknown[] = []
@@ -95,7 +100,7 @@ describe('direct domain install operation identity', () => {
   test('rejects a non-UUID operation before metadata or Kernel transport', async () => {
     const originalExit = process.exit
     const originalWrite = process.stderr.write
-    const fetch = mock(async () => Response.json({ domainName: 'crm.test' }))
+    const fetch = mock(async () => publicationResponse())
     const run = mock(async () => undefined)
     globalThis.fetch = fetch as unknown as typeof globalThis.fetch
     process.exit = (() => {

package/src/commands/__tests__/domain-install-owned.test.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '@astrale-os/kernel-client'
+import { ResponseError } from '@astrale-os/sdk/client'
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
 
 import type { OwnedInstanceInfo } from '../../lib/admin-instance'
@@ -11,6 +11,10 @@ class ExitError extends Error {
 
 const calls: Array<{ path: string; params: unknown }> = []
 let inventory: OwnedInstanceInfo[] = []
+const TEST_INVOCATION = {
+  source: 'https://kernel.test',
+  id: 'domain-install-owned',
+} as ConstructorParameters<typeof ResponseError>[2]
 
 const hostCall = mock(async (call: { target: string; input: unknown }): Promise<unknown> => {
   const path = call.target
@@ -137,7 +141,7 @@ describe('admin domain install owner boundary', () => {
       createdAt: '2026-08-20T00:00:00.000Z',
       updatedAt: '2026-08-20T00:00:00.000Z',
     }
-    const failure = new ResponseError(5001, 'Schema operation is not supported.', {
+    const failure = new ResponseError(5001, 'Schema operation is not supported.', TEST_INVOCATION, {
       code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
       details: {
         phase: 'upgrade',

package/src/commands/__tests__/domain-list.test.ts

@@ -1,8 +1,10 @@
-import { describe, expect, test } from 'bun:test'
+import { defineSchema, schema as schemaApi } from '@astrale-os/sdk/schema'
+import { afterAll, describe, expect, test } from 'bun:test'
 
 import type { DomainInfo } from '../../lib/admin-domain'
 
-import { byDefaultThenName, domainProjection, type DomainRow } from '../domain/list'
+import { releaseFor } from '../../__tests__/fixtures/publication'
+import { byDefaultThenName, domainProjection, probe, type DomainRow } from '../domain/list'
 
 const strip = (s: string): string => s.replace(/\[[0-9;]*m/g, '')
 
@@ -68,7 +70,64 @@ describe('domain list — projection', () => {
     const live: DomainRow = { ...base, reachable: true, checkError: null }
     expect(strip(domainProjection([live]).rows[0].status)).toBe('● live')
 
-    const down: DomainRow = { ...base, reachable: false, checkError: 'meta HTTP 502' }
-    expect(strip(domainProjection([down]).rows[0].status)).toBe('○ meta HTTP 502')
+    const down: DomainRow = { ...base, reachable: false, checkError: 'Publication HTTP 502' }
+    expect(strip(domainProjection([down]).rows[0].status)).toBe('○ Publication HTTP 502')
+  })
+})
+
+describe('domain list — canonical Publication check', () => {
+  const servers: { stop(): void }[] = []
+  afterAll(() => {
+    for (const server of servers) server.stop()
+  })
+
+  test('reports the admitted schema revision in machine data', async () => {
+    const schema = defineSchema('catalog-check.example.dev', {})
+    const deployed = releaseFor(schema, 'https://catalog-check.example.dev').publication
+    const server = Bun.serve({
+      port: 0,
+      fetch(request) {
+        return new URL(request.url).pathname === '/.well-known/astrale/domain.json'
+          ? Response.json(deployed)
+          : new Response('not found', { status: 404 })
+      },
+    })
+    servers.push(server)
+
+    await expect(
+      probe(
+        entry({
+          origin: schema.origin,
+          url: `http://localhost:${server.port}`,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      reachable: true,
+      schemaRevision: schemaApi.revision(schema),
+      checkError: null,
+    })
+  })
+
+  test('rejects a Publication whose origin differs from the catalog entry', async () => {
+    const schema = defineSchema('deployed.example.dev', {})
+    const deployed = releaseFor(schema, 'https://deployed.example.dev').publication
+    const server = Bun.serve({
+      port: 0,
+      fetch: () => Response.json(deployed),
+    })
+    servers.push(server)
+
+    await expect(
+      probe(
+        entry({
+          origin: 'catalog.example.dev',
+          url: `http://localhost:${server.port}`,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      reachable: false,
+      checkError:
+        'Domain origin mismatch: deployed=deployed.example.dev expected=catalog.example.dev',
+    })
   })
 })

package/src/commands/__tests__/install-identity-override.test.ts

@@ -1,5 +1,7 @@
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { afterAll, describe, expect, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { domainRefFromTarget, isIdentityOverride, probeDeclaredOrigin } from '../domain/install'
 
 describe('admin-path target classification', () => {
@@ -29,46 +31,44 @@ describe('identity-override detection', () => {
   })
 })
 
-describe('declared-origin probe (/meta)', () => {
+describe('declared-origin Publication probe', () => {
   const servers: { stop(): void }[] = []
   afterAll(() => {
     for (const s of servers) s.stop()
   })
 
-  function serveMeta(handler: (req: Request) => Response): string {
+  function servePublication(handler: (req: Request) => Response): string {
     const server = Bun.serve({ port: 0, fetch: handler })
     servers.push(server)
     return `http://localhost:${server.port}`
   }
 
-  test('reads origin from a well-formed /meta', async () => {
-    // The exact shape SDK workers serve (adapter-cloudflare worker `/meta`).
-    const url = serveMeta((req) =>
-      new URL(req.url).pathname === '/meta'
-        ? Response.json({
-            origin: 'crm.acme.dev',
-            issuer: 'https://crm.acme.dev',
-            schemaRevision: 'sha256:abc',
-            deploymentVersion: 'v1',
-          })
+  test('reads origin from a well-formed canonical Publication', async () => {
+    const schema = defineSchema('crm.acme.dev', {})
+    const deployed = releaseFor(schema, 'https://crm.acme.dev').publication
+    const url = servePublication((req) =>
+      new URL(req.url).pathname === '/.well-known/astrale/domain.json'
+        ? Response.json(deployed)
         : new Response('nope', { status: 404 }),
     )
     expect(await probeDeclaredOrigin(url)).toBe('crm.acme.dev')
   })
 
-  test('falls back to the pre-Kernel-V2 domainName field', async () => {
-    const legacy = serveMeta(() => Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' }))
-    expect(await probeDeclaredOrigin(legacy)).toBe('crm.acme.dev')
+  test('does not accept the removed pre-Kernel-V2 domainName shape', async () => {
+    const legacy = servePublication(() =>
+      Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' }),
+    )
+    expect(await probeDeclaredOrigin(legacy)).toBeUndefined()
   })
 
-  test('degrades to undefined on missing origin, non-200, bad JSON, or dead host', async () => {
-    const noName = serveMeta(() => Response.json({ iss: 'https://x' }))
+  test('degrades to undefined on invalid Publication, non-200, bad JSON, or dead host', async () => {
+    const noName = servePublication(() => Response.json({ iss: 'https://x' }))
     expect(await probeDeclaredOrigin(noName)).toBeUndefined()
 
-    const error = serveMeta(() => new Response('boom', { status: 500 }))
+    const error = servePublication(() => new Response('boom', { status: 500 }))
     expect(await probeDeclaredOrigin(error)).toBeUndefined()
 
-    const badJson = serveMeta(() => new Response('<html>', { status: 200 }))
+    const badJson = servePublication(() => new Response('<html>', { status: 200 }))
     expect(await probeDeclaredOrigin(badJson)).toBeUndefined()
 
     expect(await probeDeclaredOrigin('http://127.0.0.1:1')).toBeUndefined()

package/src/commands/__tests__/instance-list-rows.test.ts

@@ -5,7 +5,7 @@ import type { InstanceInfo } from '../../lib/admin-instance'
 import { buildInstanceRows, type Bookmark } from '../instance/list'
 
 const managed: InstanceInfo[] = [
-  { id: 'demo', slug: 'demo', url: 'https://demo.eu.astrale.ai', region: 'eu' },
+  { id: 'demo', slug: 'demo', url: 'https://demo.eu.astrale.ai', state: 'ready' },
 ]
 
 function bookmark(overrides: Partial<Bookmark> = {}): Bookmark {

package/src/commands/__tests__/instance-status.test.ts

@@ -0,0 +1,139 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import type { InstanceInfo } from '../../lib/admin-instance'
+import type { ResolvedInstance } from '../../lib/instance'
+
+import { resolveStatus, type StatusDependencies } from '../instance/status'
+
+const cliRoot = join(import.meta.dir, '../../..')
+
+let home: string
+let server: ReturnType<typeof Bun.serve>
+
+beforeEach(async () => {
+  home = await mkdtemp(join(tmpdir(), 'astrale-instance-status-'))
+  server = Bun.serve({
+    port: 0,
+    fetch(request) {
+      const url = new URL(request.url)
+      const issuer = `http://127.0.0.1:${server.port}`
+      if (url.pathname === '/.well-known/openid-configuration') {
+        return Response.json({ issuer, jwks_uri: `${issuer}/.well-known/jwks.json` })
+      }
+      if (url.pathname === '/.well-known/jwks.json') {
+        return Response.json({ keys: [{ kid: 'status-test' }] })
+      }
+      return new Response('Not found', { status: 404 })
+    },
+  })
+})
+
+afterEach(async () => {
+  server.stop(true)
+  await rm(home, { recursive: true, force: true })
+})
+
+describe('instance status', () => {
+  test('keeps managed lifecycle authoritative when the slug is also bookmarked', async () => {
+    const managed: InstanceInfo = {
+      id: '@managed',
+      slug: 'shared',
+      url: 'https://managed.example.com',
+      state: 'provisioning',
+      phase: 'bootstrap',
+    }
+    const statusOwnedInstance: StatusDependencies['statusOwnedInstance'] = mock(async () => managed)
+    const resolveInstance: StatusDependencies['resolveInstance'] = mock(async () => {
+      throw new Error('bookmark resolution must not run')
+    })
+    const probeBookmark: StatusDependencies['probeBookmark'] = mock(async () => {
+      throw new Error('bookmark probe must not run')
+    })
+
+    await expect(
+      resolveStatus('shared', {}, { statusOwnedInstance, resolveInstance, probeBookmark }),
+    ).resolves.toEqual(managed)
+    expect(statusOwnedInstance).toHaveBeenCalledWith({}, 'shared')
+    expect(resolveInstance).not.toHaveBeenCalled()
+    expect(probeBookmark).not.toHaveBeenCalled()
+  })
+
+  test('probes only an explicitly selected bookmark and rejects mixed source flags', async () => {
+    const bookmark: ResolvedInstance = {
+      name: 'local',
+      kind: 'bookmark',
+      url: 'https://local.example.com',
+      issuer: 'https://issuer.example.com',
+    }
+    const statusOwnedInstance: StatusDependencies['statusOwnedInstance'] = mock(async () => {
+      throw new Error('managed status must not run')
+    })
+    const resolveInstance: StatusDependencies['resolveInstance'] = mock(async () => bookmark)
+    const probeBookmark: StatusDependencies['probeBookmark'] = mock(async () => undefined)
+    const dependencies = { statusOwnedInstance, resolveInstance, probeBookmark }
+
+    await expect(resolveStatus('local', { bookmarked: true }, dependencies)).resolves.toEqual({
+      slug: 'local',
+      url: bookmark.url,
+      issuer: 'https://issuer.example.com',
+      kind: 'bookmark',
+      state: 'ready',
+    })
+    expect(resolveInstance).toHaveBeenCalledWith('local', undefined, { persist: false })
+    expect(probeBookmark).toHaveBeenCalledWith(bookmark)
+    expect(statusOwnedInstance).not.toHaveBeenCalled()
+
+    await expect(
+      resolveStatus('local', { bookmarked: true, admin: 'admin' }, dependencies),
+    ).rejects.toMatchObject({ code: 'INVALID_FLAG' })
+  })
+
+  test('probes an explicit local bookmark without rewriting its registry', async () => {
+    const issuer = `http://127.0.0.1:${server.port}`
+    const registry = `${JSON.stringify({
+      active: 'local',
+      instances: {
+        local: {
+          url: issuer,
+          issuer,
+          mode: 'remote',
+        },
+      },
+    })}\n`
+    const path = join(home, 'instances.json')
+    await writeFile(path, registry)
+
+    const process = Bun.spawn({
+      cmd: [
+        'bun',
+        join(cliRoot, 'bin/astrale.ts'),
+        'instance',
+        'status',
+        'local',
+        '--bookmarked',
+        '--json',
+      ],
+      env: { ...Bun.env, ASTRALE_HOME: home },
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(process.stdout).text(),
+      new Response(process.stderr).text(),
+      process.exited,
+    ])
+
+    expect(exitCode, stderr).toBe(0)
+    expect(JSON.parse(stdout)).toEqual({
+      slug: 'local',
+      url: issuer,
+      issuer,
+      kind: 'bookmark',
+      state: 'ready',
+    })
+    expect(await readFile(path, 'utf8')).toBe(registry)
+  })
+})