@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.11

package/dist/types/lib/idp.d.ts

@@ -47,114 +47,47 @@ export declare const OidcMetadataSchema: z.ZodObject<{
     jwks_uri: z.ZodString;
     device_authorization_endpoint: z.ZodOptional<z.ZodString>;
     revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
 export type OidcMetadata = z.infer<typeof OidcMetadataSchema>;
 export declare const IdpClientConfigSchema: z.ZodObject<{
     client_id: z.ZodOptional<z.ZodString>;
     client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
     scope: z.ZodOptional<z.ZodString>;
     public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
+    token_response: z.ZodOptional<z.ZodEnum<{
+        oauth: "oauth";
+        "workos-authkit": "workos-authkit";
+    }>>;
+    token_request_format: z.ZodOptional<z.ZodEnum<{
+        form: "form";
+        json: "json";
+    }>>;
     workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">>;
+    workos_application_type: z.ZodOptional<z.ZodEnum<{
+        m2m: "m2m";
+        oauth: "oauth";
+    }>>;
+}, z.core.$loose>;
 export type IdpClientConfig = z.infer<typeof IdpClientConfigSchema>;
 export declare const IdpIndexEntrySchema: z.ZodObject<{
     issuer: z.ZodString;
     builtIn: z.ZodOptional<z.ZodBoolean>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}>;
+}, z.core.$strip>;
 export declare const IdpStoreSchema: z.ZodObject<{
     idps: z.ZodRecord<z.ZodString, z.ZodObject<{
         issuer: z.ZodString;
         builtIn: z.ZodOptional<z.ZodBoolean>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type IdpStore = z.infer<typeof IdpStoreSchema>;
 export type IdpIndexEntry = z.infer<typeof IdpIndexEntrySchema>;
 export declare const IdpSessionSchema: z.ZodObject<{
@@ -162,6 +95,7 @@ export declare const IdpSessionSchema: z.ZodObject<{
     idp: z.ZodString;
     issuer: z.ZodString;
     subject: z.ZodString;
+    clientId: z.ZodOptional<z.ZodString>;
     audience: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
     access_token: z.ZodString;
@@ -171,89 +105,12 @@ export declare const IdpSessionSchema: z.ZodObject<{
     scope: z.ZodOptional<z.ZodString>;
     expires_at: z.ZodOptional<z.ZodString>;
     claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
     tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         access_token: z.ZodString;
         expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
+    }, z.core.$loose>>>;
     updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type IdpSession = z.infer<typeof IdpSessionSchema>;
 export type TokenResponse = {
     access_token?: string;
@@ -316,6 +173,7 @@ export declare function fetchOidcMetadata(issuer: string): Promise<OidcMetadata>
 export declare function workosAuthKitMetadata(apiHost?: string, clientId?: string): OidcMetadata;
 export declare function builtinIdpConfig(name: string, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | null;
 export declare function workosClientIdFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function legacyBuiltinWorkosReplacement(existing: IdpConfig, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | undefined;
 export declare function postForm(url: string, params: URLSearchParams): Promise<TokenResponse>;
 export declare function postJson(url: string, bodyInput: Record<string, string>): Promise<TokenResponse>;
 export declare function tokenExpiresAt(token: TokenResponse): string | undefined;

package/dist/types/lib/instance-target.d.ts

@@ -1,5 +1,5 @@
-import type { InstanceInfo } from '../admin/instance/model';
 import type { AstraleConfig } from './config';
+import { type InstanceInfo } from '../admin/instance/model';
 import { type AdminTargetCommandOpts, type ResolvedAdminTarget } from './admin-target';
 import { type InstanceStore } from './instance';
 export type InstanceTargetRequest = {

package/dist/types/lib/instance.d.ts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 import type { AstraleConfig } from './config';
 import { type RegistryMode } from './validation';
-export declare const InstanceKindSchema: z.ZodEnum<["bookmark"]>;
+export declare const InstanceKindSchema: z.ZodEnum<{
+    bookmark: "bookmark";
+}>;
 export type InstanceKind = z.infer<typeof InstanceKindSchema>;
 export declare const InstanceEntrySchema: z.ZodObject<{
     url: z.ZodOptional<z.ZodString>;
@@ -10,36 +12,17 @@ export declare const InstanceEntrySchema: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
-    kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-    mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        bookmark: "bookmark";
+    }>>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        remote: "remote";
+    }>>;
     defaultIdentity: z.ZodOptional<z.ZodString>;
     caFile: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}>;
+}, z.core.$strip>;
 export declare const InstanceStoreSchema: z.ZodObject<{
     active: z.ZodString;
     instances: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -49,67 +32,18 @@ export declare const InstanceStoreSchema: z.ZodObject<{
         createdAt: z.ZodOptional<z.ZodString>;
         slug: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
-        kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-        mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+        kind: z.ZodOptional<z.ZodEnum<{
+            bookmark: "bookmark";
+        }>>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            remote: "remote";
+        }>>;
         defaultIdentity: z.ZodOptional<z.ZodString>;
         caFile: z.ZodOptional<z.ZodString>;
         organizationId: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type InstanceEntry = z.infer<typeof InstanceEntrySchema>;
 export type InstanceStore = z.infer<typeof InstanceStoreSchema>;
 export type AddInstanceOpts = {
@@ -172,7 +106,13 @@ export declare function upsertInstance(key: string, opts?: AddInstanceOpts): Pro
  * normalized kernel URL). Reports the previous URL when an existing
  * bookmark was repointed to a different kernel so callers can warn.
  */
-export declare function upsertManagedBookmark(key: string, slug: string, rawUrl: string, organizationId?: string): Promise<{
+export declare function upsertManagedBookmark(input: Readonly<{
+    key: string;
+    slug: string;
+    url: string;
+    organizationId?: string;
+    defaultIdentity?: string;
+}>): Promise<{
     entry: InstanceEntry;
     repointedFrom?: string;
 }>;
@@ -182,7 +122,9 @@ export declare function clearActive(identifier: string): Promise<void>;
 export declare function getActive(config?: AstraleConfig): Promise<InstanceEntry & {
     name: string;
 }>;
-export declare function resolveInstance(identifier: string, config?: AstraleConfig): Promise<ResolvedInstance>;
+export declare function resolveInstance(identifier: string, config?: AstraleConfig, opts?: {
+    persist?: boolean;
+}): Promise<ResolvedInstance>;
 export declare function resolveKernelUrl(opts: {
     url?: string;
     instance?: string;

package/dist/types/lib/log.d.ts

@@ -10,9 +10,11 @@ export declare const log: {
 };
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
-export declare function fatal(e: unknown, opts?: MachineOpts): never;
-/** Admit expected invalid input and exit through {@link fatal}. */
-export declare function failClosed(error: unknown, opts?: MachineOpts): never;
+export declare function fatal(e: unknown, opts?: MachineOpts & {
+    readonly debug?: boolean;
+}): never;
+/** Project only a caller-authored admission failure into the CLI input family. */
+export declare function failInput(error: unknown, opts?: MachineOpts): never;
 /** Shortcut for stub commands that aren't wired in v1 (§15). */
 export declare function fatalNotImplemented(feature: string, hint?: string): never;
 /**

package/dist/types/lib/meta.d.ts

@@ -6,8 +6,8 @@
  * `jwks_uri`) and JWKS at `/.well-known/jwks.json`. These helpers probe
  * both to verify the issuer is alive and publishes at least one key.
  *
- * Domain workers may expose `/meta` for deployment drift detection; that is
- * outside this connect-only CLI surface.
+ * Domain deployment readiness uses the canonical Domain Publication; that is
+ * outside this issuer-connectivity helper.
  */
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 export type DiscoveryDocument = {

package/dist/types/lib/proc.d.ts

@@ -0,0 +1,43 @@
+import { type ChildProcess, type StdioOptions } from 'node:child_process';
+export type RunResult = {
+    /** Exit code, or -1 when the process was killed by a signal. */
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Spawn a child process and capture stdout/stderr as UTF-8 text.
+ *
+ * Uses `node:child_process` rather than `Bun.spawn` so the exact same code runs
+ * under both the Bun-compiled standalone binary (Linux/macOS) and the Node/npm
+ * build (Windows and any Node user). The promise rejects only when the process
+ * fails to spawn (e.g. ENOENT); a non-zero exit resolves with that `code` so
+ * callers can branch on it.
+ */
+export declare function run(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<RunResult>;
+/**
+ * Spawn a child process with inherited stdio so its output streams live to the
+ * user's terminal. Used for hand-held installs (npm / npx) where progress
+ * matters and the output is for the human, not for parsing. Resolves with the
+ * exit code; rejects only when the process fails to spawn (e.g. ENOENT).
+ */
+export declare function runInherit(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<number>;
+/**
+ * Spawn a LONG-LIVED child and return the handle immediately so the caller can
+ * supervise it (wait for exit, forward signals, tear down siblings). Unlike
+ * run()/runInherit() — which resolve only once the child closes — this is for
+ * servers the command keeps attached to (e.g. `astrale studio`'s Bun server and
+ * Vite dev process). Same node:child_process basis (cross-runtime) and bare
+ * PATH-name lookup convention. Default stdio streams stdout/stderr live but
+ * ignores stdin, so two supervised children never contend for the TTY.
+ */
+export declare function spawnHandle(file: string, args?: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    stdio?: StdioOptions;
+    detached?: boolean;
+}): ChildProcess;

package/dist/types/lib/self.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lexical `@self` helpers. Effective-principal resolution is deliberately not
+ * local: connection/self.ts asks the authenticated target Kernel through
+ * Identity.whoami before replacing any reference.
+ */
+/** Cheap pre-check before invoking authenticated principal resolution. */
+export declare function containsSelfRef(input: string): boolean;
+/** Replace every admitted `@self` token with one authenticated NodeId. */
+export declare function expandSelfReferences(input: string, selfId: string): string;

package/dist/types/lib/update.d.ts

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+import { AstraleError } from '../errors';
+export declare const DEFAULT_UPDATE_CHANNEL = "beta";
+export declare const InstallMetadataSchema: z.ZodObject<{
+    method: z.ZodLiteral<"script">;
+    channel: z.ZodDefault<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    repo: z.ZodDefault<z.ZodString>;
+    bin: z.ZodString;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
+export declare const UpdateManifestSchema: z.ZodObject<{
+    version: z.ZodString;
+    binaryVersion: z.ZodOptional<z.ZodString>;
+    channel: z.ZodString;
+    repo: z.ZodOptional<z.ZodString>;
+    assets: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        name: z.ZodString;
+        sha256: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodPipe<z.ZodString, z.ZodTransform<{
+        name: string;
+    }, string>>]>>;
+}, z.core.$strip>;
+export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;
+export type Platform = {
+    os: 'darwin' | 'linux';
+    arch: 'arm64' | 'x64';
+};
+export type UpdateRequest = {
+    check?: boolean;
+    channel?: string;
+    version?: string;
+    currentVersion: string;
+    platform?: Platform;
+    installPath?: string;
+    execution?: UpdateExecution;
+};
+export type UpdateExecution = {
+    kind: 'standalone';
+    executable: string;
+} | {
+    kind: 'package-managed';
+    executable: string;
+};
+declare const admittedScriptInstall: unique symbol;
+export type AdmittedScriptInstall = Readonly<{
+    metadata: InstallMetadata;
+    executable: string;
+    [admittedScriptInstall]: true;
+}>;
+export type UpdateResult = {
+    status: 'managed';
+    currentVersion: string;
+    executable: string;
+} | {
+    status: 'up-to-date';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'available';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'updated';
+    previousVersion: string;
+    currentVersion: string;
+    channel: string;
+    bin: string;
+};
+export declare function detectPlatform(): Platform;
+export declare function platformKey(platform: Platform): string;
+export declare function classifyUpdateExecution(input: {
+    bunVersion?: string;
+    executable: string;
+    entry?: string;
+}): UpdateExecution;
+export declare function detectUpdateExecution(): UpdateExecution;
+export declare function packageManagedUpdateError(executable: string): AstraleError;
+export declare function readInstallMetadata(path?: string): Promise<InstallMetadata>;
+export declare function admitScriptInstall(meta: InstallMetadata, execution: Extract<UpdateExecution, {
+    kind: 'standalone';
+}>): Promise<AdmittedScriptInstall>;
+export declare function writeInstallMetadata(meta: InstallMetadata, path?: string): Promise<void>;
+export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
+export declare function fetchManifest(base: string): Promise<UpdateManifest>;
+export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
+export declare function updateAstrale(req: UpdateRequest): Promise<UpdateResult>;
+export {};

package/dist/types/lib/validation.d.ts

@@ -7,5 +7,8 @@ export declare function validateUrl(url: string): void;
 /** Non-throwing predicate form of `validateUrl`. */
 export declare function isHttpUrl(url: string): boolean;
 /** `local` = only this machine. `remote` = mirrored via astrale cloud (§2.7). */
-export declare const RegistryModeSchema: z.ZodEnum<["local", "remote"]>;
+export declare const RegistryModeSchema: z.ZodEnum<{
+    local: "local";
+    remote: "remote";
+}>;
 export type RegistryMode = z.infer<typeof RegistryModeSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.11",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -19,7 +19,6 @@
     "dist",
     "src",
     "tsconfig.json",
-    ".check-workspace.cjs",
     "studio/server",
     "studio/shared",
     "studio/client/dist",
@@ -59,25 +58,23 @@
     "ora": "^9.0.0",
     "ts-morph": "^25.0.1",
     "yaml": "^2.8.2",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@astrale-os/kernel-client": ">=0.6.0-beta.3 <1.0.0",
-    "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": ">=0.5.0-beta.3 <1.0.0",
-    "@astrale-os/shell": ">=0.3.8-beta.2 <1.0.0",
+    "@astrale-os/ox": ">=0.1.3 <1.0.0",
+    "@astrale-os/sdk": "0.5.0-beta.38",
+    "@astrale-os/shell": "0.4.2-beta.3",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
-    "@commitlint/cli": "~20.3.1",
-    "@commitlint/config-conventional": "~20.3.1",
+    "@commitlint/cli": "21.2.2",
+    "@commitlint/config-conventional": "21.2.2",
     "@types/bun": "^1.1.16",
     "@types/node": "^22.0.0",
-    "@typescript/native-preview": "latest",
     "husky": "~9.1.7",
-    "lint-staged": "~16.2.7",
-    "msgpackr": "^1.12.1",
-    "oxfmt": "0.52.0",
-    "oxlint": "latest",
-    "typescript": "~6.0.1-rc"
+    "lint-staged": "17.3.0",
+    "msgpackr": "^2.0.5",
+    "oxfmt": "0.63.0",
+    "oxlint": "1.78.0",
+    "typescript": "7.0.2"
   },
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
@@ -99,15 +96,15 @@
     "node": ">=22"
   },
   "scripts": {
-    "preinstall": "node .check-workspace.cjs",
     "build": "bun scripts/build.ts",
-    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-private-ports-boundary.mjs",
-    "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
+    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-public-dependency-boundary.mjs",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json && tsc --noEmit -p viewer && pnpm --dir studio run typecheck",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",
     "format": "pnpm exec oxfmt --write .",
     "format:check": "pnpm exec oxfmt --check .",
-    "test": "bun test src && node --test scripts/*.test.mjs",
+    "test": "node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
+    "test:studio": "pnpm --dir studio test",
     "test:watch": "bun test --watch src"
   }
 }