@astrale-os/cli 1.0.0-beta.10 → 1.0.0-beta.11

package/dist/types/lib/admin-target.d.ts

@@ -14,42 +14,13 @@ export declare const DEFAULT_ADMIN_TARGET_CONFIG: {
     kernelIssuer: string;
     domainIssuer: string;
 };
-export declare const AdminTargetConfigSchema: z.ZodEffects<z.ZodObject<{
-    /** Friendly name / auth registration slug for direct URL admin targets. */
+export declare const AdminTargetConfigSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    /** Direct admin kernel URL. */
-    url: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** Kernel issuer / JWT audience when different from url. */
-    kernelIssuer: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** Exact native Admin Domain issuer used by the standard token exchange. */
-    domainIssuer: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** Bookmark name for the admin kernel. */
+    url: z.ZodOptional<z.ZodString>;
+    kernelIssuer: z.ZodOptional<z.ZodString>;
+    domainIssuer: z.ZodOptional<z.ZodString>;
     instance: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    name?: string | undefined;
-    url?: string | undefined;
-    kernelIssuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    instance?: string | undefined;
-}, {
-    name?: string | undefined;
-    url?: string | undefined;
-    kernelIssuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    instance?: string | undefined;
-}>, {
-    name?: string | undefined;
-    url?: string | undefined;
-    kernelIssuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    instance?: string | undefined;
-}, {
-    name?: string | undefined;
-    url?: string | undefined;
-    kernelIssuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    instance?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type AdminTargetConfig = z.infer<typeof AdminTargetConfigSchema>;
 export type AdminTargetCommandOpts = {
     admin?: string;

package/dist/types/lib/config.d.ts

@@ -1,69 +1,17 @@
 import { z } from 'zod';
 export declare const AstraleConfigSchema: z.ZodObject<{
     issuer: z.ZodDefault<z.ZodString>;
-    admin: z.ZodDefault<z.ZodEffects<z.ZodObject<{
+    admin: z.ZodDefault<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
-        url: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        kernelIssuer: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        domainIssuer: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        url: z.ZodOptional<z.ZodString>;
+        kernelIssuer: z.ZodOptional<z.ZodString>;
+        domainIssuer: z.ZodOptional<z.ZodString>;
         instance: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    }, {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    }>, {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    }, {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    }>>;
+    }, z.core.$strip>>;
     telemetry: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-    }, {
-        enabled?: boolean | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    issuer: string;
-    admin: {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    };
-    telemetry: {
-        enabled: boolean;
-    };
-}, {
-    issuer?: string | undefined;
-    admin?: {
-        name?: string | undefined;
-        url?: string | undefined;
-        kernelIssuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        instance?: string | undefined;
-    } | undefined;
-    telemetry?: {
-        enabled?: boolean | undefined;
-    } | undefined;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type AstraleConfig = z.infer<typeof AstraleConfigSchema>;
 export declare const DEFAULT_CONFIG: AstraleConfig;
 export declare function readConfig(): Promise<AstraleConfig>;

package/dist/types/lib/idp.d.ts

@@ -47,114 +47,47 @@ export declare const OidcMetadataSchema: z.ZodObject<{
     jwks_uri: z.ZodString;
     device_authorization_endpoint: z.ZodOptional<z.ZodString>;
     revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
 export type OidcMetadata = z.infer<typeof OidcMetadataSchema>;
 export declare const IdpClientConfigSchema: z.ZodObject<{
     client_id: z.ZodOptional<z.ZodString>;
     client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
     scope: z.ZodOptional<z.ZodString>;
     public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
+    token_response: z.ZodOptional<z.ZodEnum<{
+        oauth: "oauth";
+        "workos-authkit": "workos-authkit";
+    }>>;
+    token_request_format: z.ZodOptional<z.ZodEnum<{
+        form: "form";
+        json: "json";
+    }>>;
     workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">>;
+    workos_application_type: z.ZodOptional<z.ZodEnum<{
+        m2m: "m2m";
+        oauth: "oauth";
+    }>>;
+}, z.core.$loose>;
 export type IdpClientConfig = z.infer<typeof IdpClientConfigSchema>;
 export declare const IdpIndexEntrySchema: z.ZodObject<{
     issuer: z.ZodString;
     builtIn: z.ZodOptional<z.ZodBoolean>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}>;
+}, z.core.$strip>;
 export declare const IdpStoreSchema: z.ZodObject<{
     idps: z.ZodRecord<z.ZodString, z.ZodObject<{
         issuer: z.ZodString;
         builtIn: z.ZodOptional<z.ZodBoolean>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type IdpStore = z.infer<typeof IdpStoreSchema>;
 export type IdpIndexEntry = z.infer<typeof IdpIndexEntrySchema>;
 export declare const IdpSessionSchema: z.ZodObject<{
@@ -162,75 +95,6 @@ export declare const IdpSessionSchema: z.ZodObject<{
     idp: z.ZodString;
     issuer: z.ZodString;
     subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
-    clientId: z.ZodOptional<z.ZodString>;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
-    clientId: z.ZodOptional<z.ZodString>;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
     clientId: z.ZodOptional<z.ZodString>;
     audience: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -241,25 +105,12 @@ export declare const IdpSessionSchema: z.ZodObject<{
     scope: z.ZodOptional<z.ZodString>;
     expires_at: z.ZodOptional<z.ZodString>;
     claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
     tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         access_token: z.ZodString;
         expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
+    }, z.core.$loose>>>;
     updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type IdpSession = z.infer<typeof IdpSessionSchema>;
 export type TokenResponse = {
     access_token?: string;

package/dist/types/lib/instance.d.ts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 import type { AstraleConfig } from './config';
 import { type RegistryMode } from './validation';
-export declare const InstanceKindSchema: z.ZodEnum<["bookmark"]>;
+export declare const InstanceKindSchema: z.ZodEnum<{
+    bookmark: "bookmark";
+}>;
 export type InstanceKind = z.infer<typeof InstanceKindSchema>;
 export declare const InstanceEntrySchema: z.ZodObject<{
     url: z.ZodOptional<z.ZodString>;
@@ -10,36 +12,17 @@ export declare const InstanceEntrySchema: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
-    kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-    mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        bookmark: "bookmark";
+    }>>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        remote: "remote";
+    }>>;
     defaultIdentity: z.ZodOptional<z.ZodString>;
     caFile: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}>;
+}, z.core.$strip>;
 export declare const InstanceStoreSchema: z.ZodObject<{
     active: z.ZodString;
     instances: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -49,67 +32,18 @@ export declare const InstanceStoreSchema: z.ZodObject<{
         createdAt: z.ZodOptional<z.ZodString>;
         slug: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
-        kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-        mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+        kind: z.ZodOptional<z.ZodEnum<{
+            bookmark: "bookmark";
+        }>>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            remote: "remote";
+        }>>;
         defaultIdentity: z.ZodOptional<z.ZodString>;
         caFile: z.ZodOptional<z.ZodString>;
         organizationId: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type InstanceEntry = z.infer<typeof InstanceEntrySchema>;
 export type InstanceStore = z.infer<typeof InstanceStoreSchema>;
 export type AddInstanceOpts = {

package/dist/types/lib/update.d.ts

@@ -8,60 +8,20 @@ export declare const InstallMetadataSchema: z.ZodObject<{
     repo: z.ZodDefault<z.ZodString>;
     bin: z.ZodString;
     installedAt: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    method: "script";
-    channel: string;
-    version?: string | undefined;
-    repo: string;
-    bin: string;
-    installedAt?: string | undefined;
-}, {
-    method: "script";
-    channel?: string | undefined;
-    version?: string | undefined;
-    repo?: string | undefined;
-    bin: string;
-    installedAt?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
 export declare const UpdateManifestSchema: z.ZodObject<{
     version: z.ZodString;
     binaryVersion: z.ZodOptional<z.ZodString>;
     channel: z.ZodString;
     repo: z.ZodOptional<z.ZodString>;
-    assets: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+    assets: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
         name: z.ZodString;
         sha256: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        name: string;
-        sha256?: string | undefined;
-    }, {
-        name: string;
-        sha256?: string | undefined;
-    }>, z.ZodEffects<z.ZodString, {
+    }, z.core.$strip>, z.ZodPipe<z.ZodString, z.ZodTransform<{
         name: string;
-    }, string>]>>;
-}, "strip", z.ZodTypeAny, {
-    version: string;
-    binaryVersion?: string | undefined;
-    channel: string;
-    repo?: string | undefined;
-    assets: Record<string, {
-        name: string;
-        sha256?: string | undefined;
-    } | {
-        name: string;
-    }>;
-}, {
-    version: string;
-    binaryVersion?: string | undefined;
-    channel: string;
-    repo?: string | undefined;
-    assets: Record<string, string | {
-        name: string;
-        sha256?: string | undefined;
-    }>;
-}>;
+    }, string>>]>>;
+}, z.core.$strip>;
 export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;
 export type Platform = {
     os: 'darwin' | 'linux';

package/dist/types/lib/validation.d.ts

@@ -7,5 +7,8 @@ export declare function validateUrl(url: string): void;
 /** Non-throwing predicate form of `validateUrl`. */
 export declare function isHttpUrl(url: string): boolean;
 /** `local` = only this machine. `remote` = mirrored via astrale cloud (§2.7). */
-export declare const RegistryModeSchema: z.ZodEnum<["local", "remote"]>;
+export declare const RegistryModeSchema: z.ZodEnum<{
+    local: "local";
+    remote: "remote";
+}>;
 export type RegistryMode = z.infer<typeof RegistryModeSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.10",
+  "version": "1.0.0-beta.11",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -58,24 +58,23 @@
     "ora": "^9.0.0",
     "ts-morph": "^25.0.1",
     "yaml": "^2.8.2",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.32",
-    "@astrale-os/shell": "0.4.2-beta.1",
+    "@astrale-os/sdk": "0.5.0-beta.38",
+    "@astrale-os/shell": "0.4.2-beta.3",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
-    "@commitlint/cli": "~20.3.1",
-    "@commitlint/config-conventional": "~20.3.1",
+    "@commitlint/cli": "21.2.2",
+    "@commitlint/config-conventional": "21.2.2",
     "@types/bun": "^1.1.16",
     "@types/node": "^22.0.0",
-    "@typescript/native-preview": "latest",
     "husky": "~9.1.7",
-    "lint-staged": "~16.2.7",
+    "lint-staged": "17.3.0",
     "msgpackr": "^2.0.5",
-    "oxfmt": "0.52.0",
-    "oxlint": "latest",
-    "typescript": "~6.0.1-rc"
+    "oxfmt": "0.63.0",
+    "oxlint": "1.78.0",
+    "typescript": "7.0.2"
   },
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
@@ -99,7 +98,7 @@
   "scripts": {
     "build": "bun scripts/build.ts",
     "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-public-dependency-boundary.mjs",
-    "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json && tsc --noEmit -p viewer && pnpm --dir studio run typecheck",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",
     "format": "pnpm exec oxfmt --write .",

package/src/lib/__tests__/view-server.test.ts

@@ -1,10 +1,12 @@
-import { describe, expect, test } from 'bun:test'
+import type { AuthApi } from '@astrale-os/sdk/auth'
+
+import { describe, expect, mock, test } from 'bun:test'
 import { once } from 'node:events'
 
 import type { ViewServeConfig } from '../view/session'
 
 import { findFreePort } from '../port'
-import { startViewServer } from '../view/server'
+import { mintViewCredential, startViewServer } from '../view/server'
 
 const digest = (character: string) => `sha256:${character.repeat(64)}` as const
 const target = (value: string) => value as ViewServeConfig['session']['view']['target']
@@ -13,6 +15,19 @@ const revision = (character: string) =>
   digest(character) as ViewServeConfig['session']['view']['route']['revision']
 
 describe('view session server credentials', () => {
+  test('mints a proof-bounded credential for the Kernel audience', async () => {
+    const mint = mock(async () => 'minted-credential')
+    const auth = { mint } as unknown as Pick<AuthApi, 'mint'>
+
+    await expect(mintViewCredential(auth, issuer('https://kernel.test'))).resolves.toBe(
+      'minted-credential',
+    )
+    expect(mint).toHaveBeenCalledWith({
+      audience: 'https://kernel.test',
+      ttlSeconds: 240,
+    })
+  })
+
   /** @evidence TEST-CLI-PLAIN-VIEW-RECEIVES-NO-CREDENTIAL */
   test('refuses to mint a token for a handshake-none View', async () => {
     const nonce = 'plain-view'