@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/src/lib/instance-target.ts

@@ -1,6 +1,6 @@
-import type { InstanceInfo } from '../admin/instance/model'
 import type { AstraleConfig } from './config'
 
+import { AdminInstanceNotFoundError, type InstanceInfo } from '../admin/instance/model'
 import { AstraleError } from '../errors'
 import {
   DEFAULT_ADMIN_TARGET_NAME,
@@ -190,19 +190,8 @@ export function isAdminDiscoveryFailure(error: unknown): boolean {
 }
 
 export function isManagedInstanceNotFound(error: unknown): boolean {
-  if (error instanceof AstraleError && error.code === 'INSTANCE_NOT_FOUND') return true
-  if (!(error instanceof Error)) return false
-  if (error.name === 'NotFoundError') return true
-  // The admin kernel reports a missing instance node as InternalKernelError
-  // with a NOT_FOUND-prefixed message. In this lookup that's an instance
-  // miss (config problem), not a kernel fault — map it so callers get the
-  // typed INSTANCE_NOT_FOUND with remediation instead of a raw kernel error.
-  if (error.name === 'InternalKernelError' && /^NOT_FOUND\b/.test(error.message)) return true
-  const data = (error as Error & { data?: unknown }).data
   return (
-    error.name === 'KernelError' &&
-    !!data &&
-    typeof data === 'object' &&
-    (data as { type?: unknown }).type === 'NotFoundError'
+    error instanceof AdminInstanceNotFoundError ||
+    (error instanceof AstraleError && error.code === 'INSTANCE_NOT_FOUND')
   )
 }

package/src/lib/instance.ts

@@ -297,22 +297,26 @@ export async function upsertInstance(
  * bookmark was repointed to a different kernel so callers can warn.
  */
 export async function upsertManagedBookmark(
-  key: string,
-  slug: string,
-  rawUrl: string,
-  organizationId?: string,
+  input: Readonly<{
+    key: string
+    slug: string
+    url: string
+    organizationId?: string
+    defaultIdentity?: string
+  }>,
 ): Promise<{ entry: InstanceEntry; repointedFrom?: string }> {
   const store = await readInstances()
-  const previousUrl = store.instances[key]?.url
-  const url = normalizeInstanceKernelUrl(rawUrl)
-  const { entry } = await upsertInstance(key, {
+  const previousUrl = store.instances[input.key]?.url
+  const url = normalizeInstanceKernelUrl(input.url)
+  const { entry } = await upsertInstance(input.key, {
     url,
     issuer: url,
-    slug,
-    name: slug,
+    slug: input.slug,
+    name: input.slug,
     kind: 'bookmark',
     mode: 'remote',
-    ...(organizationId ? { organizationId } : {}),
+    ...(input.organizationId ? { organizationId: input.organizationId } : {}),
+    ...(input.defaultIdentity ? { defaultIdentity: input.defaultIdentity } : {}),
   })
   return {
     entry,
@@ -362,8 +366,9 @@ export async function getActive(config?: AstraleConfig): Promise<InstanceEntry &
 export async function resolveInstance(
   identifier: string,
   config?: AstraleConfig,
+  opts: { persist?: boolean } = {},
 ): Promise<ResolvedInstance> {
-  const store = await readInstances(config)
+  const store = await readInstances(config, opts)
   const key = resolveInstanceKey(store, identifier)
   const entry = key ? store.instances[key] : undefined
   if (!key || !entry?.url) {
@@ -448,7 +453,12 @@ function isRegionRoutedInstanceRoot(url: URL): boolean {
   if (url.search || url.hash) return false
 
   const labels = url.hostname.toLowerCase().split('.')
-  return labels.length === 4 && labels[2] === 'astrale' && labels[3] === 'ai'
+  return (
+    (labels.length === 4 || labels.length === 5) &&
+    /^[a-z]{2}(?:-[a-z0-9]+)*$/u.test(labels[1] ?? '') &&
+    labels.at(-2) === 'astrale' &&
+    labels.at(-1) === 'ai'
+  )
 }
 
 function definedEntry(entry: AddInstanceOpts): AddInstanceOpts {

package/src/lib/log.ts

@@ -2,6 +2,7 @@ import chalk from 'chalk'
 import ora, { type Ora } from 'ora'
 
 import { AstraleError, NotImplementedError } from '../errors'
+import { printFailureDebug } from './failure-debug'
 import { formatElapsed } from './format'
 import { isMachine, type MachineOpts } from './output'
 
@@ -18,28 +19,34 @@ export const log = {
 
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
-export function fatal(e: unknown, opts?: MachineOpts): never {
+export function fatal(e: unknown, opts?: MachineOpts & { readonly debug?: boolean }): never {
   // Ctrl-C at an interactive (@inquirer/prompts) prompt — exit quietly with the
   // SIGINT convention, not a red error line.
   if (e instanceof Error && e.name === 'ExitPromptError') process.exit(130)
-  const msg = e instanceof Error ? e.message : String(e)
-  const code = e instanceof AstraleError ? e.code : e instanceof Error ? e.name : 'Error'
+  const msg =
+    e instanceof AstraleError ? e.message : 'The CLI encountered an unexpected internal failure.'
+  const code = e instanceof AstraleError ? e.code : 'UNEXPECTED_ERROR'
   if (isMachine(opts)) {
     const payload: Record<string, unknown> = { error: code, message: msg }
     if (e instanceof AstraleError && e.hint) payload.hint = e.hint
     process.stderr.write(JSON.stringify(payload) + '\n')
-    process.exit(1)
+  } else {
+    log.error(`${code}: ${msg}`)
+    if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
   }
-  log.error(e instanceof AstraleError ? `${code}: ${msg}` : msg)
-  if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
+  if (opts?.debug) printFailureDebug(e, '')
   process.exit(1)
 }
 
-/** Admit expected invalid input and exit through {@link fatal}. */
-export function failClosed(error: unknown, opts?: MachineOpts): never {
+/** Project only a caller-authored admission failure into the CLI input family. */
+export function failInput(error: unknown, opts?: MachineOpts): never {
   if (error instanceof AstraleError) fatal(error, opts)
+  if (!(error instanceof TypeError)) fatal(error, opts)
   fatal(
-    new AstraleError('INVALID_INPUT', error instanceof Error ? error.message : String(error)),
+    new AstraleError(
+      'INVALID_INPUT',
+      error.message.trim() ? error.message : 'CLI input is invalid.',
+    ),
     opts,
   )
 }

package/src/lib/login-flow.ts

@@ -7,7 +7,9 @@ import {
   normalizeTokenResponse,
   pollDeviceToken,
   readIdpConfigOrBuiltin,
+  readIdpSession,
   readIdpStore,
+  requireClientId,
   requestClientCredentials,
   requestDeviceAuthorization,
   saveIdpSession,
@@ -71,10 +73,17 @@ export type LoginResult = {
  */
 export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
   const idpName = await resolveIdpName(opts.idp)
-  const idp = await readIdpConfigOrBuiltin(idpName, { clientId: opts.clientId, persist: true })
+  const previous = opts.name && !opts.clientId ? await readIdpSession(opts.name) : null
+  const savedClientId = previous?.idp === idpName ? previous.clientId : undefined
+  const requestedClientId = opts.clientId ?? savedClientId
+  const idp = await readIdpConfigOrBuiltin(idpName, {
+    clientId: requestedClientId,
+    persist: true,
+  })
+  const clientId = requireClientId(idp, requestedClientId)
   const scope = opts.scope ?? idp.client.scope ?? 'openid profile email offline_access'
 
-  const token = normalizeTokenResponse(await obtainToken(idp, opts, scope))
+  const token = normalizeTokenResponse(await obtainToken(idp, { ...opts, clientId }, scope))
   if (!token.access_token) throw new Error('IdP response did not include access_token')
   if (opts.audience && !tokenAudienceMatches(token.access_token, opts.audience)) {
     throw new Error(
@@ -83,7 +92,7 @@ export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
   }
 
   const claims = decodeTokenClaims(token.id_token ?? token.access_token)
-  const subject = subjectFromToken(token, opts.clientId ?? idp.client.client_id ?? idpName)
+  const subject = subjectFromToken(token, clientId)
   const issuer = issuerFromToken(token, idp.metadata.issuer)
   const identityName = opts.name ?? identityNameFromClaims(claims, idpName)
   const session: IdpSession = {
@@ -91,6 +100,7 @@ export async function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult> {
     idp: idpName,
     issuer,
     subject,
+    clientId,
     audience: opts.audience,
     access_token: token.access_token,
     id_token: token.id_token,

package/src/lib/meta.ts

@@ -6,8 +6,8 @@
  * `jwks_uri`) and JWKS at `/.well-known/jwks.json`. These helpers probe
  * both to verify the issuer is alive and publishes at least one key.
  *
- * Domain workers may expose `/meta` for deployment drift detection; that is
- * outside this connect-only CLI surface.
+ * Domain deployment readiness uses the canonical Domain Publication; that is
+ * outside this issuer-connectivity helper.
  */
 
 import { IssuerUnreachableError } from '../errors'

package/src/lib/provision-instance.ts

@@ -9,12 +9,10 @@ import { createOwnedInstance } from './admin-instance'
 import { setActive, upsertManagedBookmark } from './instance'
 import { withSpinner } from './log'
 import { isMachine } from './output'
-import { promptSelect } from './prompt'
 import { validateSlug } from './validation'
 
 export type ProvisionOpts = KernelCommandOpts &
   AdminTargetCommandOpts & {
-    hostId?: string
     // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
     ci?: boolean
     noPrompt?: boolean
@@ -35,10 +33,10 @@ export type ProvisionResult = {
 const SAGA_TIMEOUT_MS = '240000'
 
 /**
- * Provision an alpha instance through the admin kernel, then bookmark it and
+ * Provision an instance through the admin kernel, then bookmark it and
  * make it the active target. Extracted from `instance create` so `astrale
- * setup` provisions through the exact same saga (auth assertion → alphaCreate →
- * bookmark → set-active), including the interactive multi-host picker.
+ * setup` provisions through the exact same saga (auth assertion → create →
+ * bookmark → set-active).
  *
  * Presentation is deliberately minimal here (a spinner + a one-line success);
  * the caller renders anything richer — `setup` follows this with a hero panel.
@@ -48,15 +46,10 @@ export async function provisionInstance(
   opts: ProvisionOpts,
 ): Promise<ProvisionResult> {
   validateSlug(slug)
-  await assertAlphaCreateAuth(opts)
-  // The created instance must belong to the LOGGED-IN identity — never to an
-  // identity pinned on the admin bookmark (that mismatch silently made a fresh
-  // user's instance unusable). `--as` still wins.
-  if (!opts.as) opts = { ...opts, as: (await readIdentities()).default }
+  const authentication = await instanceCreateAuthentication(opts)
+  opts = authentication.opts
 
   const machine = isMachine(opts)
-  const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-
   let repointedFrom: string | undefined
   let selectionError: unknown = null
   // The global 30s default doesn't just fail the CLIENT: the disconnect kills
@@ -65,21 +58,24 @@ export async function provisionInstance(
   // timeout; an explicit --timeout still wins.
   const createOpts = { ...opts, timeout: opts.timeout ?? SAGA_TIMEOUT_MS }
 
-  const runProvision = (hostId: string | undefined) =>
+  const runProvision = () =>
     withSpinner(
       `Provisioning instance ${slug}`,
       !machine,
       async () => {
-        const created = await createOwnedInstance(createOpts, slug, hostId)
+        const created = await createOwnedInstance(createOpts, slug)
         try {
           // Org id from the create response — authoritative for token scoping
           // (the router's /auth/org is eventually consistent).
-          const bookmarked = await upsertManagedBookmark(
-            slug,
+          const bookmarked = await upsertManagedBookmark({
+            key: slug,
             slug,
-            created.url,
-            created.organizationId,
-          )
+            url: created.url,
+            ...(created.organizationId ? { organizationId: created.organizationId } : {}),
+            ...(authentication.defaultIdentity
+              ? { defaultIdentity: authentication.defaultIdentity }
+              : {}),
+          })
           repointedFrom = bookmarked.repointedFrom
           await setActive(slug)
         } catch (e) {
@@ -93,23 +89,7 @@ export async function provisionInstance(
       },
     )
 
-  // Host placement is chosen SERVER-side (the caller's ready + USE-granted
-  // hosts). We recover ONLY from its multi-host ambiguity: pop a picker and
-  // retry with the chosen host_id — the ambiguity error throws before any
-  // provisioning side effect, so the retry is clean. No host / permission /
-  // capacity / a non-interactive run all reject through to the caller's `fatal`,
-  // surfacing the server's own message plus the listed ids. An explicit
-  // `--host-id` skips all of this.
-  const created = await runProvision(opts.hostId).catch(async (e: unknown) => {
-    const hostIds = !opts.hostId && interactive ? parseEligibleHostIds(e) : null
-    if (!hostIds) throw e
-    const chosen = await promptSelect(
-      `${hostIds.length} hosts available — pick one to provision on`,
-      hostIds.map((hid) => ({ name: hid, value: hid })),
-    )
-    if (!chosen) throw e
-    return runProvision(chosen)
-  })
+  const created = await runProvision()
 
   // Warnings go to stderr so machine-readable stdout stays clean.
   const warn = (msg: string) => console.error(chalk.yellow('⚠'), msg)
@@ -124,31 +104,28 @@ export async function provisionInstance(
   return { created, slug, repointedFrom, ...(selectionError ? { selectionError } : {}) }
 }
 
-/**
- * Recover the eligible host ids from alphaCreate's multi-host error
- * ("N ready hosts are assigned (id1, id2). Specify host_id…") — only when
- * there's a real choice (>1). Returns null for any other error (no host,
- * permission, capacity). Deliberately coupled to that message wording (Option
- * B: no admin-side change); if it ever drifts we simply stop offering the
- * picker and the raw error is shown instead — no worse than before.
- */
-export function parseEligibleHostIds(error: unknown): string[] | null {
-  const text = error instanceof Error ? error.message : String(error)
-  const match = /ready hosts are assigned \(([^)]+)\)/.exec(text)
-  if (!match) return null
-  const ids = match[1]!
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean)
-  return ids.length > 1 ? ids : null
+async function instanceCreateAuthentication(opts: ProvisionOpts): Promise<{
+  readonly opts: ProvisionOpts
+  readonly defaultIdentity?: string
+}> {
+  if (opts.creds) return { opts }
+  const store = await readIdentities()
+  const defaultIdentity = selectInstanceCreateIdentity(store, opts)
+  return {
+    opts: opts.as ? opts : { ...opts, as: defaultIdentity },
+    defaultIdentity,
+  }
 }
 
-async function assertAlphaCreateAuth(opts: Pick<ProvisionOpts, 'as' | 'creds'>): Promise<void> {
-  if (opts.creds) return
-  assertAlphaCreateIdentity(await readIdentities(), opts)
+export function selectInstanceCreateIdentity(
+  store: IdentityStore,
+  opts: Pick<ProvisionOpts, 'as'> = {},
+): string {
+  assertInstanceCreateIdentity(store, opts)
+  return opts.as ?? store.default
 }
 
-export function assertAlphaCreateIdentity(
+export function assertInstanceCreateIdentity(
   store: IdentityStore,
   opts: Pick<ProvisionOpts, 'as'> = {},
 ): void {

package/src/lib/update.ts

@@ -1,5 +1,15 @@
 import { createHash } from 'node:crypto'
-import { chmod, copyFile, mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import {
+  chmod,
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rename,
+  rm,
+  writeFile,
+} from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { z } from 'zod'
@@ -9,11 +19,11 @@ import { INSTALL_PATH } from '../state/index'
 import { run } from './proc'
 
 const DEFAULT_REPO = 'astrale-os/cli'
-const DEFAULT_CHANNEL = 'alpha'
+export const DEFAULT_UPDATE_CHANNEL = 'beta'
 
 export const InstallMetadataSchema = z.object({
   method: z.literal('script'),
-  channel: z.string().min(1).default(DEFAULT_CHANNEL),
+  channel: z.string().min(1).default(DEFAULT_UPDATE_CHANNEL),
   version: z.string().min(1).optional(),
   repo: z.string().min(1).default(DEFAULT_REPO),
   bin: z.string().min(1),
@@ -61,9 +71,26 @@ export type UpdateRequest = {
   currentVersion: string
   platform?: Platform
   installPath?: string
+  execution?: UpdateExecution
 }
 
+export type UpdateExecution =
+  | { kind: 'standalone'; executable: string }
+  | { kind: 'package-managed'; executable: string }
+
+const admittedScriptInstall = Symbol('admittedScriptInstall')
+export type AdmittedScriptInstall = Readonly<{
+  metadata: InstallMetadata
+  executable: string
+  [admittedScriptInstall]: true
+}>
+
 export type UpdateResult =
+  | {
+      status: 'managed'
+      currentVersion: string
+      executable: string
+    }
   | {
       status: 'up-to-date'
       currentVersion: string
@@ -106,42 +133,99 @@ export function platformKey(platform: Platform): string {
   return `${platform.os}-${platform.arch}`
 }
 
-/**
- * True when running as the Bun-compiled standalone binary (Linux/macOS), which
- * self-updates by swapping its own file. The Node/npm build does not expose
- * `process.versions.bun`; it is managed by the user's package manager instead.
- */
-function isStandaloneBinary(): boolean {
-  return Boolean((process.versions as { bun?: string }).bun)
+export function classifyUpdateExecution(input: {
+  bunVersion?: string
+  executable: string
+  entry?: string
+}): UpdateExecution {
+  return input.bunVersion && input.entry?.startsWith('/$bunfs/')
+    ? { kind: 'standalone', executable: input.executable }
+    : { kind: 'package-managed', executable: input.executable }
+}
+
+export function detectUpdateExecution(): UpdateExecution {
+  return classifyUpdateExecution({
+    bunVersion: (process.versions as { bun?: string }).bun,
+    executable: process.execPath,
+    entry: process.argv[1],
+  })
+}
+
+export function packageManagedUpdateError(executable: string): AstraleError {
+  return new AstraleError(
+    'UPDATE_PACKAGE_MANAGED',
+    'This Astrale build is managed by your package manager.',
+    `Active binary: ${executable}. Update it with npm, pnpm, or bun; or put the official script installation first on PATH.`,
+  )
 }
 
 export async function readInstallMetadata(path = INSTALL_PATH): Promise<InstallMetadata> {
   let raw: string
   try {
     raw = await readFile(path, 'utf8')
-  } catch {
-    throw isStandaloneBinary()
-      ? new AstraleError(
-          'UPDATE_NOT_SCRIPT_INSTALLED',
-          'Astrale was not installed by the official install script.',
-          'Reinstall with: curl -fsSL https://raw.githubusercontent.com/astrale-os/cli/main/install.sh | sh',
-        )
-      : new AstraleError(
-          'UPDATE_PACKAGE_MANAGED',
-          'This Astrale build is managed by your package manager.',
-          'Update with: npm install -g @astrale-os/cli@latest  (or pnpm/bun)',
-        )
+  } catch (error) {
+    if (!isMissingFile(error)) throw error
+    throw new AstraleError(
+      'UPDATE_NOT_SCRIPT_INSTALLED',
+      'Astrale was not installed by the official install script.',
+      'Reinstall with: curl -fsSL https://raw.githubusercontent.com/astrale-os/cli/main/install.sh | sh',
+    )
   }
 
-  const parsed = InstallMetadataSchema.safeParse(JSON.parse(raw))
+  let decoded: unknown
+  try {
+    decoded = JSON.parse(raw)
+  } catch {
+    throw badInstallMetadata(path)
+  }
+  const parsed = InstallMetadataSchema.safeParse(decoded)
   if (!parsed.success) {
+    throw badInstallMetadata(path)
+  }
+  return parsed.data
+}
+
+function isMissingFile(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
+
+function badInstallMetadata(path: string): AstraleError {
+  return new AstraleError(
+    'UPDATE_BAD_INSTALL_METADATA',
+    `Invalid install metadata at ${path}.`,
+    'Reinstall with: curl -fsSL https://raw.githubusercontent.com/astrale-os/cli/main/install.sh | sh',
+  )
+}
+
+export async function admitScriptInstall(
+  meta: InstallMetadata,
+  execution: Extract<UpdateExecution, { kind: 'standalone' }>,
+): Promise<AdmittedScriptInstall> {
+  const [running, recorded] = await Promise.all([
+    realpathIfExists(execution.executable),
+    realpathIfExists(meta.bin),
+  ])
+  if (running === undefined || recorded === undefined || running !== recorded) {
     throw new AstraleError(
-      'UPDATE_BAD_INSTALL_METADATA',
-      `Invalid install metadata at ${path}.`,
-      'Reinstall with: curl -fsSL https://raw.githubusercontent.com/astrale-os/cli/main/install.sh | sh',
+      'UPDATE_INSTALL_MISMATCH',
+      'The running Astrale binary does not own the recorded script installation.',
+      `Running binary: ${execution.executable}; recorded binary: ${meta.bin}. Refusing to replace a different installation.`,
     )
   }
-  return parsed.data
+  return Object.freeze({
+    metadata: meta,
+    executable: running,
+    [admittedScriptInstall]: true as const,
+  })
+}
+
+async function realpathIfExists(path: string): Promise<string | undefined> {
+  try {
+    return await realpath(path)
+  } catch (error) {
+    if (isMissingFile(error)) return undefined
+    throw error
+  }
 }
 
 export async function writeInstallMetadata(
@@ -162,7 +246,7 @@ export function releaseBase(
     const version = req.version.replace(/^cli\/v/, '').replace(/^v/, '')
     return `https://github.com/${repo}/releases/download/cli/v${version}`
   }
-  return `https://github.com/${repo}/releases/download/${req.channel ?? meta.channel ?? DEFAULT_CHANNEL}`
+  return `https://github.com/${repo}/releases/download/${req.channel ?? meta.channel ?? DEFAULT_UPDATE_CHANNEL}`
 }
 
 export async function fetchManifest(base: string): Promise<UpdateManifest> {
@@ -175,9 +259,19 @@ export function shouldUpdate(currentVersion: string, manifestVersion: string): b
 }
 
 export async function updateAstrale(req: UpdateRequest): Promise<UpdateResult> {
-  const meta = await readInstallMetadata(req.installPath)
+  const execution = req.execution ?? detectUpdateExecution()
+  if (execution.kind === 'package-managed') {
+    return {
+      status: 'managed',
+      currentVersion: req.currentVersion,
+      executable: execution.executable,
+    }
+  }
+
+  const install = await admitScriptInstall(await readInstallMetadata(req.installPath), execution)
+  const meta = install.metadata
   const currentVersion = meta.version ?? req.currentVersion
-  const channel = req.channel ?? meta.channel ?? DEFAULT_CHANNEL
+  const channel = req.channel ?? meta.channel ?? DEFAULT_UPDATE_CHANNEL
   const platform = req.platform ?? detectPlatform()
   const key = platformKey(platform)
   const base = releaseBase(meta, { channel, version: req.version })

package/src/lib/validation.ts

@@ -1,4 +1,4 @@
-import { isDnsLabel } from '@astrale-os/sdk/domain'
+import { isDnsLabel } from '@astrale-os/sdk/value'
 import { z } from 'zod'
 
 import { ReservedSlugError } from '../errors'
@@ -21,7 +21,7 @@ export function validateName(name: string, entity: string): void {
 }
 
 export function validateSlug(slug: string): void {
-  // Canonical DNS-label rule (`@astrale-os/sdk/domain`): a slug becomes a
+  // Canonical Core DNS-label rule: a slug becomes a
   // hostname label, so reject anything not DNS-safe (§4.7).
   if (!slug || !isDnsLabel(slug)) {
     throw new Error(

package/src/lib/view/resolve.ts

@@ -1,4 +1,4 @@
-import type { ResolvedView as SessionResolvedView } from '@astrale-os/kernel-client/session'
+import type { ResolvedView as SessionResolvedView } from '@astrale-os/sdk/client/session'
 import type { ResolvedView } from '@astrale-os/shell'
 
 import { Path } from '@astrale-os/sdk/graph/path'

package/src/lib/view/server.ts

@@ -1,3 +1,5 @@
+import type { AuthApi } from '@astrale-os/sdk/auth'
+import type { IssuerId } from '@astrale-os/sdk/auth'
 import type { ReadableStream as WebReadableStream } from 'node:stream/web'
 
 import { readFile } from 'node:fs/promises'
@@ -23,8 +25,9 @@ export { ensureViewerAssets, viewerDistDir } from './assets'
  * heartbeat keeps a live session alive.
  */
 
-const TOKEN_REFRESH_MARGIN_MS = 5 * 60_000
-const FALLBACK_TOKEN_TTL_MS = 3600_000
+const VIEW_TOKEN_TTL_SECONDS = 4 * 60
+const TOKEN_REFRESH_MARGIN_MS = 60_000
+const FALLBACK_TOKEN_TTL_MS = VIEW_TOKEN_TTL_SECONDS * 1_000
 const IDLE_SWEEP_MS = 60_000
 
 export type PageStatus = { state: string; error?: string; at: string }
@@ -44,7 +47,7 @@ export function startViewServer(config: ViewServeConfig): Server {
   async function freshGrant(): Promise<TokenGrant> {
     if (grant && grant.expiresAt - Date.now() > TOKEN_REFRESH_MARGIN_MS) return grant
     grant = await withClientSession(config.kernel, async ({ auth, target }) => {
-      const token = await auth.mint({ audience: target.kernelIssuer, ttlSeconds: 3_600 })
+      const token = await mintViewCredential(auth, target.kernelIssuer)
       return {
         token,
         expiresAt: jwtExpiry(token) ?? Date.now() + FALLBACK_TOKEN_TTL_MS,
@@ -182,6 +185,17 @@ export function startViewServer(config: ViewServeConfig): Server {
   return server
 }
 
+/** Mint a short-lived credential from the selected CLI identity proof. */
+export async function mintViewCredential(
+  auth: Pick<AuthApi, 'mint'>,
+  audience: IssuerId,
+): Promise<string> {
+  return auth.mint({
+    audience,
+    ttlSeconds: VIEW_TOKEN_TTL_SECONDS,
+  })
+}
+
 function jwtExpiry(token: string): number | null {
   try {
     const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8')) as {