@astrale-os/cli 1.0.0-beta.2 → 1.0.0-beta.20

package/src/lib/__tests__/admin-target.test.ts

@@ -6,6 +6,7 @@ import {
   DEFAULT_ADMIN_TARGET_NAME,
   DEFAULT_ADMIN_DOMAIN_ISSUER,
   DEFAULT_ADMIN_TARGET_URL,
+  defaultAdminTargetForChannel,
   resolveAdminTargetFromStore,
 } from '../admin-target'
 import { DEFAULT_CONFIG, type AstraleConfig } from '../config'
@@ -32,6 +33,17 @@ const instances: InstanceStore = {
 }
 
 describe('resolveAdminTargetFromStore', () => {
+  test('derives hosted Admin defaults from the release channel', () => {
+    expect(defaultAdminTargetForChannel('beta')).toEqual({
+      url: 'https://admin.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+    })
+    expect(defaultAdminTargetForChannel('stable')).toEqual({
+      url: 'https://admin.eu.astrale.ai/api',
+      domainIssuer: 'https://admin.astrale.ai',
+    })
+  })
+
   test('uses hosted admin default without active instance coupling', () => {
     expect(resolveAdminTargetFromStore({}, DEFAULT_CONFIG, instances)).toEqual({
       name: DEFAULT_ADMIN_TARGET_NAME,

package/src/lib/__tests__/binary.test.ts

@@ -39,11 +39,26 @@ describe('presentBinary', () => {
 
   test('--json inlines text for text-like content types', async () => {
     await presentBinary(
-      { mediaType: 'text/plain', body: new TextEncoder().encode('hi') },
+      { mediaType: 'text/plain', status: 202, body: new TextEncoder().encode('hi') },
       { json: true },
     )
     const obj = JSON.parse(Buffer.concat(chunks).toString())
     expect(obj.body).toBe('hi')
+    expect(obj.status).toBe(202)
+  })
+
+  test('--raw drains streaming binary chunks in exact order', async () => {
+    await presentBinary(
+      {
+        mediaType: 'application/octet-stream',
+        body: (async function* () {
+          yield new Uint8Array([1, 2])
+          yield new Uint8Array([3, 4])
+        })(),
+      },
+      { raw: true },
+    )
+    expect(Array.from(Buffer.concat(chunks))).toEqual([1, 2, 3, 4])
   })
 
   test('-o writes raw bytes to a file', async () => {

package/src/lib/__tests__/command-dx.test.ts

@@ -16,7 +16,7 @@ function dx(
   error: CommanderError,
   argv: string[],
 ) {
-  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv))) as {
+  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv, true))) as {
     error: string
     message: string
     detail: string

package/src/lib/__tests__/domain-publication.test.ts

@@ -1,26 +1,15 @@
-import { publication } from '@astrale-os/kernel-protocol'
-import { defineDomain } from '@astrale-os/sdk'
-import { issuer } from '@astrale-os/sdk/auth'
-import { createDeployment } from '@astrale-os/sdk/deployment'
-import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { publication } from '@astrale-os/sdk/publication'
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
-import { fetchDomainPublication } from '../domain-publication'
+import { releaseFor } from '../../__tests__/fixtures/publication'
+import { domainPublicationUrl, fetchDomainPublication } from '../domain-publication'
 
 const ROOT = 'https://publication-reader.example.dev'
 const PUBLICATION_URL = `${ROOT}/.well-known/astrale/domain.json`
 const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024
 const schema = defineSchema('publication-reader.example.dev', {})
-const definition = defineDomain({
-  schema,
-  handlers: { functions: {}, classes: {}, interfaces: {} },
-})
-const deployed = createDeployment({
-  definition,
-  issuer: issuer.accept(ROOT),
-  bundleHref: `${ROOT}/domain.bundle.json`,
-  bindings: { callables: [] },
-}).publication
+const deployed = releaseFor(schema, ROOT).publication
 
 describe('Domain Publication reader', () => {
   test('fetches only the canonical path with redirects disabled', async () => {
@@ -34,6 +23,11 @@ describe('Domain Publication reader', () => {
     expect(requests).toEqual([{ url: PUBLICATION_URL, redirect: 'error' }])
   })
 
+  test('normalizes an origin and admits the exact canonical Publication URL', () => {
+    expect(domainPublicationUrl(ROOT).href).toBe(PUBLICATION_URL)
+    expect(domainPublicationUrl(PUBLICATION_URL).href).toBe(PUBLICATION_URL)
+  })
+
   test('propagates redirect rejection instead of accepting another target', async () => {
     const fetch = async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
       expect(init?.redirect).toBe('error')

package/src/lib/__tests__/idp.test.ts

@@ -9,6 +9,7 @@ import {
   IdpSessionSchema,
   isSessionExpired,
   issuerFromToken,
+  legacyBuiltinWorkosReplacement,
   normalizeTokenResponse,
   OAuthTokenError,
   OidcMetadataSchema,
@@ -63,8 +64,11 @@ describe('IdP schemas and token helpers', () => {
     expect(config?.client.token_request_format).toBe('json')
   })
 
-  test('does not invent a WorkOS environment when no client id is configured', () => {
-    expect(builtinIdpConfig('workos', undefined, {})).toBeNull()
+  test('builds the built-in WorkOS IdP with the public client id by default', () => {
+    const config = builtinIdpConfig('workos', undefined, {})
+
+    expect(config?.entry.builtIn).toBe(true)
+    expect(config?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
   })
 
   test('reads WorkOS client id from WORKOS_CLIENT_ID before VITE_WORKOS_CLIENT_ID', () => {
@@ -75,8 +79,34 @@ describe('IdP schemas and token helpers', () => {
       }),
     ).toBe('client_primary')
     expect(workosClientIdFromEnv({ VITE_WORKOS_CLIENT_ID: 'client_vite' })).toBe('client_vite')
-    expect(workosClientIdFromEnv({})).toBeUndefined()
-    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBeUndefined()
+    expect(workosClientIdFromEnv({})).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBe(
+      'client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+  })
+
+  test('replaces only the legacy persisted built-in WorkOS client', () => {
+    const legacy = builtinIdpConfig('workos', 'client_01KC29HEGD7B40TV2C4QZ436BG', {})!
+    const replacement = legacyBuiltinWorkosReplacement(legacy, undefined, {})
+
+    expect(replacement?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(replacement?.metadata.jwks_uri).toBe(
+      'https://api.workos.com/sso/jwks/client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, entry: { ...legacy.entry, builtIn: false } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
+    expect(
+      legacyBuiltinWorkosReplacement(
+        { ...legacy, client: { ...legacy.client, client_id: 'client_custom' } },
+        undefined,
+        {},
+      ),
+    ).toBeUndefined()
   })
 
   test('stores client secret env names, not secret material', () => {

package/src/lib/__tests__/instance-candidates.test.ts

@@ -18,7 +18,6 @@ const managedDemo: OwnedInstanceInfo = {
   slug: 'demo',
   url: 'https://demo.eu.astrale.ai',
   state: 'ready',
-  region: 'eu',
 }
 
 describe('collectInstanceCandidates', () => {
@@ -138,11 +137,10 @@ describe('describeInstanceCandidate', () => {
         slug: 'twin',
         url: 'https://twin.eu.astrale.ai',
         state: 'ready',
-        region: 'eu',
       },
     ])
     expect(describeInstanceCandidate(managed!)).toBe(
-      'twin (managed) https://twin.eu.astrale.ai/api — eu',
+      'twin (managed) https://twin.eu.astrale.ai/api',
     )
   })
 })

package/src/lib/__tests__/instance-target.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from 'bun:test'
 import type { AstraleConfig } from '../config'
 import type { InstanceStore } from '../instance'
 
+import { AdminInstanceNotFoundError } from '../../admin/instance/model'
 import { AstraleError } from '../../errors'
 import { DEFAULT_CONFIG } from '../config'
 import {
@@ -112,6 +113,7 @@ describe('resolveInstanceTarget', () => {
             id: 'node-1',
             slug,
             url: `https://${slug}.eu.astrale.ai`,
+            state: 'ready',
           }),
         },
       ),
@@ -124,9 +126,6 @@ describe('resolveInstanceTarget', () => {
   })
 
   test('unknown slugs surface the original instance-not-found error', async () => {
-    const notFound = new Error('Path not found: "/admin/instances/missing"')
-    notFound.name = 'NotFoundError'
-
     await expect(
       resolveInstanceTarget(
         { source: 'name', name: 'missing' },
@@ -134,7 +133,7 @@ describe('resolveInstanceTarget', () => {
           config: DEFAULT_CONFIG,
           instances: emptyStore,
           managed: async () => {
-            throw notFound
+            throw new AdminInstanceNotFoundError('missing')
           },
         },
       ),
@@ -168,14 +167,8 @@ describe('instance target helpers', () => {
     expect(couldBeConfiguredAdminInstance('bryan', directAdminConfig)).toBe(false)
   })
 
-  test('treats wrapped remote Instance.info misses as managed lookup not-found', () => {
-    const wrapped = new Error('Path not found: "/admin/instances/admin"') as Error & {
-      data?: unknown
-    }
-    wrapped.name = 'KernelError'
-    wrapped.data = { type: 'NotFoundError' }
-
-    expect(isManagedInstanceNotFound(wrapped)).toBe(true)
+  test('treats the owner-scoped Admin error as managed lookup not-found', () => {
+    expect(isManagedInstanceNotFound(new AdminInstanceNotFoundError('admin'))).toBe(true)
   })
 
   test('does not hide non-not-found managed lookup failures', () => {
@@ -194,37 +187,12 @@ describe('instance target helpers', () => {
   })
 })
 
-describe('isManagedInstanceNotFound: kernel InternalKernelError wrap', () => {
-  test('NOT_FOUND-prefixed InternalKernelError is an instance miss', () => {
-    const e = new Error('NOT_FOUND: no instance node for "knowledge"')
-    e.name = 'InternalKernelError'
-    expect(isManagedInstanceNotFound(e)).toBe(true)
-  })
-  test('other InternalKernelError messages are not swallowed', () => {
+describe('isManagedInstanceNotFound: unknown errors', () => {
+  test('does not infer a miss from an InternalKernelError message', () => {
     const e = new Error('DISPATCH_FAILED: handler crashed')
     e.name = 'InternalKernelError'
     expect(isManagedInstanceNotFound(e)).toBe(false)
   })
-  test('resolveNamedInstanceTarget maps the wrap to typed INSTANCE_NOT_FOUND', async () => {
-    const managed = async () => {
-      const e = new Error('NOT_FOUND: no instance node for "ghost"')
-      e.name = 'InternalKernelError'
-      throw e
-    }
-    const opts = {
-      config: DEFAULT_CONFIG,
-      instances: { instances: {} },
-      managed,
-    } as unknown as Parameters<typeof resolveInstanceTarget>[1]
-    let caught: unknown
-    try {
-      await resolveInstanceTarget({ source: 'name', name: 'ghost' }, opts)
-    } catch (e) {
-      caught = e
-    }
-    expect(caught).toBeInstanceOf(AstraleError)
-    expect((caught as AstraleError).code).toBe('INSTANCE_NOT_FOUND')
-  })
 
   test('maps Admin token-exchange failure to INSTANCE_NOT_FOUND', async () => {
     const managed = async () => {

package/src/lib/__tests__/log-errors.test.ts

@@ -0,0 +1,64 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+
+import { AstraleError } from '../../errors'
+import { failInput, fatal } from '../log'
+
+class ExitError extends Error {}
+
+let stderr = ''
+let exit: typeof process.exit
+let write: typeof process.stderr.write
+
+beforeEach(() => {
+  stderr = ''
+  exit = process.exit
+  write = process.stderr.write
+  process.exit = (() => {
+    throw new ExitError()
+  }) as typeof process.exit
+  process.stderr.write = ((chunk: string | Uint8Array) => {
+    stderr += String(chunk)
+    return true
+  }) as typeof process.stderr.write
+})
+
+afterEach(() => {
+  process.exit = exit
+  process.stderr.write = write
+})
+
+describe('terminal error safety', () => {
+  test('renders an empty aggregate as an honest non-blank unexpected failure', () => {
+    expect(() => fatal(new AggregateError([], ''), { json: true })).toThrow(ExitError)
+    expect(JSON.parse(stderr)).toEqual({
+      error: 'UNEXPECTED_ERROR',
+      message: 'The CLI encountered an unexpected internal failure.',
+    })
+  })
+
+  test('retains unknown failure evidence only under explicit debug output', () => {
+    const failure = new AggregateError([new Error('provider rejected organization scope')], '')
+
+    expect(() => fatal(failure, { json: true, debug: true })).toThrow(ExitError)
+
+    expect(stderr).toContain(
+      '{"error":"UNEXPECTED_ERROR","message":"The CLI encountered an unexpected internal failure."}',
+    )
+    expect(stderr).toContain('aggregate: Error: provider rejected organization scope')
+  })
+
+  test('rejects blank admitted CLI diagnostics', () => {
+    expect(() => new AstraleError('INVALID_INPUT', '  ')).toThrow(TypeError)
+  })
+
+  test('labels only expected admission failures as invalid input', () => {
+    expect(() => failInput(new TypeError('Authored value is invalid.'), { json: true })).toThrow(
+      ExitError,
+    )
+    expect(JSON.parse(stderr)).toMatchObject({ error: 'INVALID_INPUT' })
+
+    stderr = ''
+    expect(() => failInput(new AggregateError([], ''), { json: true })).toThrow(ExitError)
+    expect(JSON.parse(stderr)).toMatchObject({ error: 'UNEXPECTED_ERROR' })
+  })
+})

package/src/lib/__tests__/studio-server-deps.test.ts

@@ -103,7 +103,7 @@ describe('studio server runtime deps', () => {
 describe('studio test gate', () => {
   test('the root and Studio suites include all client, server, and shared tests', () => {
     expect(cliPackage.scripts?.test).toBe(
-      'bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs',
+      'node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs',
     )
     expect(cliPackage.scripts?.['test:studio']).toBe('pnpm --dir studio test')
     expect(studioPackage.scripts?.test).toBe('bun test client/src server shared')