@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/src/lib/__tests__/admin-target.test.ts

@@ -6,6 +6,7 @@ import {
   DEFAULT_ADMIN_TARGET_NAME,
   DEFAULT_ADMIN_DOMAIN_ISSUER,
   DEFAULT_ADMIN_TARGET_URL,
+  defaultAdminTargetForChannel,
   resolveAdminTargetFromStore,
 } from '../admin-target'
 import { DEFAULT_CONFIG, type AstraleConfig } from '../config'
@@ -32,6 +33,17 @@ const instances: InstanceStore = {
 }
 
 describe('resolveAdminTargetFromStore', () => {
+  test('derives hosted Admin defaults from the release channel', () => {
+    expect(defaultAdminTargetForChannel('beta')).toEqual({
+      url: 'https://admin.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+    })
+    expect(defaultAdminTargetForChannel('stable')).toEqual({
+      url: 'https://admin.eu.astrale.ai/api',
+      domainIssuer: 'https://admin.astrale.ai',
+    })
+  })
+
   test('uses hosted admin default without active instance coupling', () => {
     expect(resolveAdminTargetFromStore({}, DEFAULT_CONFIG, instances)).toEqual({
       name: DEFAULT_ADMIN_TARGET_NAME,

package/src/lib/__tests__/command-dx.test.ts

@@ -16,7 +16,7 @@ function dx(
   error: CommanderError,
   argv: string[],
 ) {
-  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv))) as {
+  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv, true))) as {
     error: string
     message: string
     detail: string

package/src/lib/__tests__/domain-publication.test.ts

@@ -0,0 +1,138 @@
+import { publication } from '@astrale-os/sdk/publication'
+import { defineSchema } from '@astrale-os/sdk/schema'
+import { describe, expect, test } from 'bun:test'
+
+import { releaseFor } from '../../__tests__/fixtures/publication'
+import { domainPublicationUrl, fetchDomainPublication } from '../domain-publication'
+
+const ROOT = 'https://publication-reader.example.dev'
+const PUBLICATION_URL = `${ROOT}/.well-known/astrale/domain.json`
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
+const schema = defineSchema('publication-reader.example.dev', {})
+const deployed = releaseFor(schema, ROOT).publication
+
+describe('Domain Publication reader', () => {
+  test('fetches only the canonical path with redirects disabled', async () => {
+    const requests: Array<{ readonly url: string; readonly redirect?: RequestRedirect }> = []
+    const fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      requests.push({ url: String(input), redirect: init?.redirect })
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(`${ROOT}/`, undefined, fetch)).resolves.toEqual(deployed)
+    expect(requests).toEqual([{ url: PUBLICATION_URL, redirect: 'error' }])
+  })
+
+  test('normalizes an origin and admits the exact canonical Publication URL', () => {
+    expect(domainPublicationUrl(ROOT).href).toBe(PUBLICATION_URL)
+    expect(domainPublicationUrl(PUBLICATION_URL).href).toBe(PUBLICATION_URL)
+  })
+
+  test('propagates redirect rejection instead of accepting another target', async () => {
+    const fetch = async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      expect(init?.redirect).toBe('error')
+      throw new TypeError('redirect rejected')
+    }
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      'redirect rejected',
+    )
+  })
+
+  test('stops at one MiB and cancels an over-limit response stream', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull(controller) {
+          pulls += 1
+          if (pulls === 1) {
+            controller.enqueue(new Uint8Array(MAXIMUM_PUBLICATION_BYTES))
+            return
+          }
+          if (pulls === 2) {
+            controller.enqueue(Uint8Array.of(0))
+            return
+          }
+          controller.error(new Error('reader consumed beyond its byte limit'))
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> => new Response(body)
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(2)
+    expect(cancelled).toBe(true)
+  })
+
+  test('rejects an oversized Content-Length before pulling and cancels the body', async () => {
+    let pulls = 0
+    let cancelled = false
+    const body = new ReadableStream<Uint8Array>(
+      {
+        pull() {
+          pulls += 1
+        },
+        cancel() {
+          cancelled = true
+        },
+      },
+      { highWaterMark: 0 },
+    )
+    const fetch = async (): Promise<Response> =>
+      new Response(body, {
+        headers: { 'content-length': String(MAXIMUM_PUBLICATION_BYTES + 1) },
+      })
+
+    await expect(fetchDomainPublication(ROOT, undefined, fetch)).rejects.toThrow(
+      `exceeded ${MAXIMUM_PUBLICATION_BYTES} bytes`,
+    )
+    expect(pulls).toBe(0)
+    expect(cancelled).toBe(true)
+  })
+
+  test.each([
+    ['invalid UTF-8', Uint8Array.of(0xc3, 0x28), TypeError],
+    ['invalid JSON', new TextEncoder().encode('{'), SyntaxError],
+    ['invalid Publication', new TextEncoder().encode('{}'), publication.PublicationError],
+  ] as const)('rejects %s before returning a Publication', async (_label, bytes, Cause) => {
+    const fetch = async (): Promise<Response> => new Response(bytes)
+    const error = await rejection(fetchDomainPublication(ROOT, undefined, fetch))
+
+    expect(error.message).toBe(`GET ${PUBLICATION_URL} returned an invalid Domain Publication`)
+    expect(error.cause).toBeInstanceOf(Cause)
+  })
+
+  test.each([
+    `${ROOT}/nested`,
+    `${ROOT}?deployment=current`,
+    `${ROOT}#fragment`,
+    'https://user:secret@publication-reader.example.dev',
+    'ftp://publication-reader.example.dev',
+  ])('rejects a non-origin deployment URL before fetch: %s', async (input) => {
+    let called = false
+    const fetch = async (): Promise<Response> => {
+      called = true
+      return Response.json(deployed)
+    }
+
+    await expect(fetchDomainPublication(input, undefined, fetch)).rejects.toBeInstanceOf(TypeError)
+    expect(called).toBe(false)
+  })
+})
+
+async function rejection(input: Promise<unknown>): Promise<Error> {
+  try {
+    await input
+  } catch (cause) {
+    if (cause instanceof Error) return cause
+    throw new Error('Expected an Error rejection.', { cause })
+  }
+  throw new Error('Expected the promise to reject.')
+}

package/src/lib/__tests__/idp-session.test.ts

@@ -68,11 +68,29 @@ describe('ensureFreshSession', () => {
       expect(result.orgHintCalls).toBe(1)
       expect(server.refreshCount()).toBe(1)
       const session = await readSession()
+      expect(session.clientId).toBe('c_1')
       expect(session.refresh_token).toBe('rt-1')
       expect((session.tokens as Record<string, { access_token: string }>)[AUD].access_token).toBe(
         result.token as string,
       )
       expect(server.lastOrganizationId()).toBe('org_1')
+      expect(server.lastClientId()).toBe('c_1')
+    } finally {
+      await server.stop()
+    }
+  })
+
+  test('refreshes with the client that issued the session instead of the IdP default', async () => {
+    const server = rotationServer()
+    try {
+      await writeIdpConfig(server.url)
+      await writeSession({ clientId: 'c_session', expires_at: past() })
+
+      const result = await runDriver('ensure', { DRIVER_AUDIENCE: AUD })
+
+      expect(result.ok).toBe(true)
+      expect(server.lastClientId()).toBe('c_session')
+      expect((await readSession()).clientId).toBe('c_session')
     } finally {
       await server.stop()
     }
@@ -273,6 +291,7 @@ function rotationServer(opts?: {
 }): {
   url: string
   refreshCount: () => number
+  lastClientId: () => string | undefined
   lastOrganizationId: () => string | undefined
   stop: () => Promise<void>
 } {
@@ -280,6 +299,7 @@ function rotationServer(opts?: {
   // refresh token is invalid_grant.
   let current = 'rt-0'
   let count = 0
+  let lastClientId: string | undefined
   let lastOrgId: string | undefined
   const server = Bun.serve({
     port: 0,
@@ -300,6 +320,7 @@ function rotationServer(opts?: {
       if (opts?.delayMs) await new Promise((r) => setTimeout(r, opts.delayMs))
       count += 1
       current = `rt-${count}`
+      lastClientId = form.get('client_id') ?? undefined
       lastOrgId = form.get('organization_id') ?? undefined
       return Response.json({
         access_token: unsignedJwt({ aud: AUD, exp: futureEpoch() }),
@@ -312,6 +333,7 @@ function rotationServer(opts?: {
   return {
     url: `http://${server.hostname}:${server.port}`,
     refreshCount: () => count,
+    lastClientId: () => lastClientId,
     lastOrganizationId: () => lastOrgId,
     stop: () => server.stop(true),
   }

package/src/lib/__tests__/idp.test.ts

@@ -9,6 +9,7 @@ import {
   IdpSessionSchema,
   isSessionExpired,
   issuerFromToken,
+  legacyBuiltinWorkosReplacement,
   normalizeTokenResponse,
   OAuthTokenError,
   OidcMetadataSchema,
@@ -63,8 +64,11 @@ describe('IdP schemas and token helpers', () => {
     expect(config?.client.token_request_format).toBe('json')
   })
 
-  test('does not invent a WorkOS environment when no client id is configured', () => {
-    expect(builtinIdpConfig('workos', undefined, {})).toBeNull()
+  test('builds the built-in WorkOS IdP with the public client id by default', () => {
+    const config = builtinIdpConfig('workos', undefined, {})
+
+    expect(config?.entry.builtIn).toBe(true)
+    expect(config?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
   })
 
   test('reads WorkOS client id from WORKOS_CLIENT_ID before VITE_WORKOS_CLIENT_ID', () => {
@@ -75,8 +79,34 @@ describe('IdP schemas and token helpers', () => {
       }),
     ).toBe('client_primary')
     expect(workosClientIdFromEnv({ VITE_WORKOS_CLIENT_ID: 'client_vite' })).toBe('client_vite')
-    expect(workosClientIdFromEnv({})).toBeUndefined()
-    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBeUndefined()
+    expect(workosClientIdFromEnv({})).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBe(
+      'client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+  })
+
+  test('replaces only the legacy persisted built-in WorkOS client', () => {
+    const legacy = builtinIdpConfig('workos', 'client_01KC29HEGD7B40TV2C4QZ436BG', {})!
+    const replacement = legacyBuiltinWorkosReplacement(legacy, undefined, {})
+
+    expect(replacement?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(replacement?.metadata.jwks_uri).toBe(
+      'https://api.workos.com/sso/jwks/client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, entry: { ...legacy.entry, builtIn: false } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, client: { ...legacy.client, client_id: 'client_custom' } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
   })
 
   test('stores client secret env names, not secret material', () => {
@@ -100,6 +130,7 @@ describe('IdP schemas and token helpers', () => {
       idp: 'workos',
       issuer: 'https://example.authkit.app',
       subject: 'user_123',
+      clientId: 'client_123',
       access_token: 'opaque-token',
       refresh_token: 'refresh-token',
       token_type: 'Bearer',
@@ -110,6 +141,7 @@ describe('IdP schemas and token helpers', () => {
     })
 
     expect(session.claims?.email).toBe('alice@example.com')
+    expect(session.clientId).toBe('client_123')
     expect(session.refresh_token).toBe('refresh-token')
   })
 

package/src/lib/__tests__/instance-candidates.test.ts

@@ -18,7 +18,6 @@ const managedDemo: OwnedInstanceInfo = {
   slug: 'demo',
   url: 'https://demo.eu.astrale.ai',
   state: 'ready',
-  region: 'eu',
 }
 
 describe('collectInstanceCandidates', () => {
@@ -138,11 +137,10 @@ describe('describeInstanceCandidate', () => {
         slug: 'twin',
         url: 'https://twin.eu.astrale.ai',
         state: 'ready',
-        region: 'eu',
       },
     ])
     expect(describeInstanceCandidate(managed!)).toBe(
-      'twin (managed) https://twin.eu.astrale.ai/api — eu',
+      'twin (managed) https://twin.eu.astrale.ai/api',
     )
   })
 })

package/src/lib/__tests__/instance-target.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from 'bun:test'
 import type { AstraleConfig } from '../config'
 import type { InstanceStore } from '../instance'
 
+import { AdminInstanceNotFoundError } from '../../admin/instance/model'
 import { AstraleError } from '../../errors'
 import { DEFAULT_CONFIG } from '../config'
 import {
@@ -112,6 +113,7 @@ describe('resolveInstanceTarget', () => {
             id: 'node-1',
             slug,
             url: `https://${slug}.eu.astrale.ai`,
+            state: 'ready',
           }),
         },
       ),
@@ -124,9 +126,6 @@ describe('resolveInstanceTarget', () => {
   })
 
   test('unknown slugs surface the original instance-not-found error', async () => {
-    const notFound = new Error('Path not found: "/admin/instances/missing"')
-    notFound.name = 'NotFoundError'
-
     await expect(
       resolveInstanceTarget(
         { source: 'name', name: 'missing' },
@@ -134,7 +133,7 @@ describe('resolveInstanceTarget', () => {
           config: DEFAULT_CONFIG,
           instances: emptyStore,
           managed: async () => {
-            throw notFound
+            throw new AdminInstanceNotFoundError('missing')
           },
         },
       ),
@@ -168,14 +167,8 @@ describe('instance target helpers', () => {
     expect(couldBeConfiguredAdminInstance('bryan', directAdminConfig)).toBe(false)
   })
 
-  test('treats wrapped remote Instance.info misses as managed lookup not-found', () => {
-    const wrapped = new Error('Path not found: "/admin/instances/admin"') as Error & {
-      data?: unknown
-    }
-    wrapped.name = 'KernelError'
-    wrapped.data = { type: 'NotFoundError' }
-
-    expect(isManagedInstanceNotFound(wrapped)).toBe(true)
+  test('treats the owner-scoped Admin error as managed lookup not-found', () => {
+    expect(isManagedInstanceNotFound(new AdminInstanceNotFoundError('admin'))).toBe(true)
   })
 
   test('does not hide non-not-found managed lookup failures', () => {
@@ -194,37 +187,12 @@ describe('instance target helpers', () => {
   })
 })
 
-describe('isManagedInstanceNotFound: kernel InternalKernelError wrap', () => {
-  test('NOT_FOUND-prefixed InternalKernelError is an instance miss', () => {
-    const e = new Error('NOT_FOUND: no instance node for "knowledge"')
-    e.name = 'InternalKernelError'
-    expect(isManagedInstanceNotFound(e)).toBe(true)
-  })
-  test('other InternalKernelError messages are not swallowed', () => {
+describe('isManagedInstanceNotFound: unknown errors', () => {
+  test('does not infer a miss from an InternalKernelError message', () => {
     const e = new Error('DISPATCH_FAILED: handler crashed')
     e.name = 'InternalKernelError'
     expect(isManagedInstanceNotFound(e)).toBe(false)
   })
-  test('resolveNamedInstanceTarget maps the wrap to typed INSTANCE_NOT_FOUND', async () => {
-    const managed = async () => {
-      const e = new Error('NOT_FOUND: no instance node for "ghost"')
-      e.name = 'InternalKernelError'
-      throw e
-    }
-    const opts = {
-      config: DEFAULT_CONFIG,
-      instances: { instances: {} },
-      managed,
-    } as unknown as Parameters<typeof resolveInstanceTarget>[1]
-    let caught: unknown
-    try {
-      await resolveInstanceTarget({ source: 'name', name: 'ghost' }, opts)
-    } catch (e) {
-      caught = e
-    }
-    expect(caught).toBeInstanceOf(AstraleError)
-    expect((caught as AstraleError).code).toBe('INSTANCE_NOT_FOUND')
-  })
 
   test('maps Admin token-exchange failure to INSTANCE_NOT_FOUND', async () => {
     const managed = async () => {

package/src/lib/__tests__/instance.test.ts

@@ -74,6 +74,12 @@ describe('InstanceStoreSchema', () => {
     expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai/')).toBe(
       'https://testmarc.eu.astrale.ai/api',
     )
+    expect(normalizeInstanceKernelUrl('https://testmarc.eu.beta.astrale.ai')).toBe(
+      'https://testmarc.eu.beta.astrale.ai/api',
+    )
+    expect(normalizeInstanceKernelUrl('https://shell.beta.astrale.ai')).toBe(
+      'https://shell.beta.astrale.ai',
+    )
   })
 
   test('does not rewrite explicit kernel or non-managed URLs', () => {

package/src/lib/__tests__/log-errors.test.ts

@@ -0,0 +1,64 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+
+import { AstraleError } from '../../errors'
+import { failInput, fatal } from '../log'
+
+class ExitError extends Error {}
+
+let stderr = ''
+let exit: typeof process.exit
+let write: typeof process.stderr.write
+
+beforeEach(() => {
+  stderr = ''
+  exit = process.exit
+  write = process.stderr.write
+  process.exit = (() => {
+    throw new ExitError()
+  }) as typeof process.exit
+  process.stderr.write = ((chunk: string | Uint8Array) => {
+    stderr += String(chunk)
+    return true
+  }) as typeof process.stderr.write
+})
+
+afterEach(() => {
+  process.exit = exit
+  process.stderr.write = write
+})
+
+describe('terminal error safety', () => {
+  test('renders an empty aggregate as an honest non-blank unexpected failure', () => {
+    expect(() => fatal(new AggregateError([], ''), { json: true })).toThrow(ExitError)
+    expect(JSON.parse(stderr)).toEqual({
+      error: 'UNEXPECTED_ERROR',
+      message: 'The CLI encountered an unexpected internal failure.',
+    })
+  })
+
+  test('retains unknown failure evidence only under explicit debug output', () => {
+    const failure = new AggregateError([new Error('provider rejected organization scope')], '')
+
+    expect(() => fatal(failure, { json: true, debug: true })).toThrow(ExitError)
+
+    expect(stderr).toContain(
+      '{"error":"UNEXPECTED_ERROR","message":"The CLI encountered an unexpected internal failure."}',
+    )
+    expect(stderr).toContain('aggregate: Error: provider rejected organization scope')
+  })
+
+  test('rejects blank admitted CLI diagnostics', () => {
+    expect(() => new AstraleError('INVALID_INPUT', '  ')).toThrow(TypeError)
+  })
+
+  test('labels only expected admission failures as invalid input', () => {
+    expect(() => failInput(new TypeError('Authored value is invalid.'), { json: true })).toThrow(
+      ExitError,
+    )
+    expect(JSON.parse(stderr)).toMatchObject({ error: 'INVALID_INPUT' })
+
+    stderr = ''
+    expect(() => failInput(new AggregateError([], ''), { json: true })).toThrow(ExitError)
+    expect(JSON.parse(stderr)).toMatchObject({ error: 'UNEXPECTED_ERROR' })
+  })
+})

package/src/lib/__tests__/studio-server-deps.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
 import { Project } from 'ts-morph'
 
 /**
@@ -19,6 +19,18 @@ import { Project } from 'ts-morph'
 
 const CLI_ROOT = new URL('../../../', import.meta.url).pathname
 
+interface PackageManifest {
+  dependencies?: Record<string, string>
+  scripts?: Record<string, string>
+}
+
+const cliPackage = JSON.parse(
+  readFileSync(join(CLI_ROOT, 'package.json'), 'utf8'),
+) as PackageManifest
+const studioPackage = JSON.parse(
+  readFileSync(join(CLI_ROOT, 'studio/package.json'), 'utf8'),
+) as PackageManifest
+
 /** Base package of a bare specifier: `@scope/pkg/sub` → `@scope/pkg`, `pkg/sub` → `pkg`. */
 function basePackage(spec: string): string {
   const parts = spec.split('/')
@@ -29,26 +41,33 @@ function isBuiltin(spec: string): boolean {
   return spec.startsWith('node:') || spec === 'bun' || spec.startsWith('bun:')
 }
 
+function runtimeFiles(directory: string): string[] {
+  return readdirSync(directory).flatMap((entry) => {
+    const path = join(directory, entry)
+    if (statSync(path).isDirectory()) return runtimeFiles(path)
+    return /\.(?:ts|tsx)$/.test(path) && !/\.test\.(?:ts|tsx)$/.test(path) ? [path] : []
+  })
+}
+
+const studioPath = (path: string) => relative(CLI_ROOT, path).replaceAll('\\', '/')
+
 describe('studio server runtime deps', () => {
-  const deps = new Set(
-    Object.keys(
-      (
-        JSON.parse(readFileSync(join(CLI_ROOT, 'package.json'), 'utf8')) as {
-          dependencies?: Record<string, string>
-        }
-      ).dependencies ?? {},
-    ),
-  )
+  const deps = new Set(Object.keys(cliPackage.dependencies ?? {}))
 
   const project = new Project({ skipAddingFilesFromTsConfig: true })
   project.addSourceFilesAtPaths([
     join(CLI_ROOT, 'studio/server/**/*.ts'),
+    join(CLI_ROOT, 'studio/server/**/*.tsx'),
     join(CLI_ROOT, 'studio/shared/**/*.ts'),
+    join(CLI_ROOT, 'studio/shared/**/*.tsx'),
   ])
+  const runtimeSourceFiles = project
+    .getSourceFiles()
+    .filter((sourceFile) => !/\.test\.(?:ts|tsx)$/.test(sourceFile.getBaseName()))
 
   // getImportStringLiterals covers static imports, re-exports, and dynamic import().
   const offenders: Record<string, string[]> = {}
-  for (const sf of project.getSourceFiles()) {
+  for (const sf of runtimeSourceFiles) {
     const specs = sf.getImportStringLiterals().map((l) => l.getLiteralValue())
     for (const spec of specs) {
       if (spec.startsWith('.') || spec.startsWith('/') || isBuiltin(spec)) continue
@@ -66,9 +85,27 @@ describe('studio server runtime deps', () => {
     ).toEqual({})
   })
 
-  test('parsed at least the known studio server files', () => {
-    // Guard against the glob silently matching nothing (which would make the
-    // invariant vacuously pass).
-    expect(project.getSourceFiles().length).toBeGreaterThan(10)
+  test('parses every shipped Studio server and shared runtime source', () => {
+    const expected = [
+      ...runtimeFiles(join(CLI_ROOT, 'studio/server')),
+      ...runtimeFiles(join(CLI_ROOT, 'studio/shared')),
+    ]
+      .map(studioPath)
+      .sort()
+    const parsed = runtimeSourceFiles
+      .map((sourceFile) => studioPath(sourceFile.getFilePath()))
+      .sort()
+
+    expect(parsed).toEqual(expected)
+  })
+})
+
+describe('studio test gate', () => {
+  test('the root and Studio suites include all client, server, and shared tests', () => {
+    expect(cliPackage.scripts?.test).toBe(
+      'node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs',
+    )
+    expect(cliPackage.scripts?.['test:studio']).toBe('pnpm --dir studio test')
+    expect(studioPackage.scripts?.test).toBe('bun test client/src server shared')
   })
 })