@astrale-os/cli 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/types/lib/idp.d.ts

@@ -47,114 +47,47 @@ export declare const OidcMetadataSchema: z.ZodObject<{
     jwks_uri: z.ZodString;
     device_authorization_endpoint: z.ZodOptional<z.ZodString>;
     revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodOptional<z.ZodString>;
-    token_endpoint: z.ZodString;
-    jwks_uri: z.ZodString;
-    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
-    revocation_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, z.ZodTypeAny, "passthrough">>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
 export type OidcMetadata = z.infer<typeof OidcMetadataSchema>;
 export declare const IdpClientConfigSchema: z.ZodObject<{
     client_id: z.ZodOptional<z.ZodString>;
     client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    scope: z.ZodOptional<z.ZodString>;
-    public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
-    workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    client_id: z.ZodOptional<z.ZodString>;
-    client_secret_env: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
     scope: z.ZodOptional<z.ZodString>;
     public: z.ZodOptional<z.ZodBoolean>;
-    token_response: z.ZodOptional<z.ZodEnum<["oauth", "workos-authkit"]>>;
-    token_request_format: z.ZodOptional<z.ZodEnum<["form", "json"]>>;
+    token_response: z.ZodOptional<z.ZodEnum<{
+        oauth: "oauth";
+        "workos-authkit": "workos-authkit";
+    }>>;
+    token_request_format: z.ZodOptional<z.ZodEnum<{
+        form: "form";
+        json: "json";
+    }>>;
     workos_application_id: z.ZodOptional<z.ZodString>;
-    workos_application_type: z.ZodOptional<z.ZodEnum<["oauth", "m2m"]>>;
-}, z.ZodTypeAny, "passthrough">>;
+    workos_application_type: z.ZodOptional<z.ZodEnum<{
+        m2m: "m2m";
+        oauth: "oauth";
+    }>>;
+}, z.core.$loose>;
 export type IdpClientConfig = z.infer<typeof IdpClientConfigSchema>;
 export declare const IdpIndexEntrySchema: z.ZodObject<{
     issuer: z.ZodString;
     builtIn: z.ZodOptional<z.ZodBoolean>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}, {
-    issuer: string;
-    builtIn?: boolean | undefined;
-    createdAt: string;
-    updatedAt: string;
-}>;
+}, z.core.$strip>;
 export declare const IdpStoreSchema: z.ZodObject<{
     idps: z.ZodRecord<z.ZodString, z.ZodObject<{
         issuer: z.ZodString;
         builtIn: z.ZodOptional<z.ZodBoolean>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}, {
-    idps: Record<string, {
-        issuer: string;
-        builtIn?: boolean | undefined;
-        createdAt: string;
-        updatedAt: string;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type IdpStore = z.infer<typeof IdpStoreSchema>;
 export type IdpIndexEntry = z.infer<typeof IdpIndexEntrySchema>;
 export declare const IdpSessionSchema: z.ZodObject<{
@@ -162,75 +95,6 @@ export declare const IdpSessionSchema: z.ZodObject<{
     idp: z.ZodString;
     issuer: z.ZodString;
     subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
-    clientId: z.ZodOptional<z.ZodString>;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
-    clientId: z.ZodOptional<z.ZodString>;
-    audience: z.ZodOptional<z.ZodString>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    access_token: z.ZodString;
-    id_token: z.ZodOptional<z.ZodString>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    token_type: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-    expires_at: z.ZodOptional<z.ZodString>;
-    claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
-    tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    identity: z.ZodString;
-    idp: z.ZodString;
-    issuer: z.ZodString;
-    subject: z.ZodString;
-    /** OAuth client that issued this session's refresh token. */
     clientId: z.ZodOptional<z.ZodString>;
     audience: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -241,25 +105,12 @@ export declare const IdpSessionSchema: z.ZodObject<{
     scope: z.ZodOptional<z.ZodString>;
     expires_at: z.ZodOptional<z.ZodString>;
     claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * Access tokens by audience. WorkOS mints one `aud` per token, so a
-     * session juggling several instances would otherwise burn a (single-use)
-     * refresh-token rotation on every instance flip. The top-level
-     * `access_token`/`expires_at` stay the most recently minted token for
-     * back-compat with older CLI builds.
-     */
     tokens: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         access_token: z.ZodString;
         expires_at: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        access_token: z.ZodString;
-        expires_at: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>>>;
+    }, z.core.$loose>>>;
     updatedAt: z.ZodString;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type IdpSession = z.infer<typeof IdpSessionSchema>;
 export type TokenResponse = {
     access_token?: string;
@@ -322,6 +173,7 @@ export declare function fetchOidcMetadata(issuer: string): Promise<OidcMetadata>
 export declare function workosAuthKitMetadata(apiHost?: string, clientId?: string): OidcMetadata;
 export declare function builtinIdpConfig(name: string, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | null;
 export declare function workosClientIdFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function legacyBuiltinWorkosReplacement(existing: IdpConfig, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | undefined;
 export declare function postForm(url: string, params: URLSearchParams): Promise<TokenResponse>;
 export declare function postJson(url: string, bodyInput: Record<string, string>): Promise<TokenResponse>;
 export declare function tokenExpiresAt(token: TokenResponse): string | undefined;

package/dist/types/lib/instance-target.d.ts

@@ -1,5 +1,5 @@
-import type { InstanceInfo } from '../admin/instance/model';
 import type { AstraleConfig } from './config';
+import { type InstanceInfo } from '../admin/instance/model';
 import { type AdminTargetCommandOpts, type ResolvedAdminTarget } from './admin-target';
 import { type InstanceStore } from './instance';
 export type InstanceTargetRequest = {

package/dist/types/lib/instance.d.ts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 import type { AstraleConfig } from './config';
 import { type RegistryMode } from './validation';
-export declare const InstanceKindSchema: z.ZodEnum<["bookmark"]>;
+export declare const InstanceKindSchema: z.ZodEnum<{
+    bookmark: "bookmark";
+}>;
 export type InstanceKind = z.infer<typeof InstanceKindSchema>;
 export declare const InstanceEntrySchema: z.ZodObject<{
     url: z.ZodOptional<z.ZodString>;
@@ -10,36 +12,17 @@ export declare const InstanceEntrySchema: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
-    kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-    mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        bookmark: "bookmark";
+    }>>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        remote: "remote";
+    }>>;
     defaultIdentity: z.ZodOptional<z.ZodString>;
     caFile: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}, {
-    url?: string | undefined;
-    issuer?: string | undefined;
-    domainIssuer?: string | undefined;
-    createdAt?: string | undefined;
-    slug?: string | undefined;
-    name?: string | undefined;
-    kind?: "bookmark" | undefined;
-    mode?: "local" | "remote" | undefined;
-    defaultIdentity?: string | undefined;
-    caFile?: string | undefined;
-    organizationId?: string | undefined;
-}>;
+}, z.core.$strip>;
 export declare const InstanceStoreSchema: z.ZodObject<{
     active: z.ZodString;
     instances: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -49,67 +32,18 @@ export declare const InstanceStoreSchema: z.ZodObject<{
         createdAt: z.ZodOptional<z.ZodString>;
         slug: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
-        kind: z.ZodOptional<z.ZodEnum<["bookmark"]>>;
-        mode: z.ZodOptional<z.ZodEnum<["local", "remote"]>>;
+        kind: z.ZodOptional<z.ZodEnum<{
+            bookmark: "bookmark";
+        }>>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            remote: "remote";
+        }>>;
         defaultIdentity: z.ZodOptional<z.ZodString>;
         caFile: z.ZodOptional<z.ZodString>;
         organizationId: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}, {
-    active: string;
-    instances: Record<string, {
-        url?: string | undefined;
-        issuer?: string | undefined;
-        domainIssuer?: string | undefined;
-        createdAt?: string | undefined;
-        slug?: string | undefined;
-        name?: string | undefined;
-        kind?: "bookmark" | undefined;
-        mode?: "local" | "remote" | undefined;
-        defaultIdentity?: string | undefined;
-        caFile?: string | undefined;
-        organizationId?: string | undefined;
-    }>;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type InstanceEntry = z.infer<typeof InstanceEntrySchema>;
 export type InstanceStore = z.infer<typeof InstanceStoreSchema>;
 export type AddInstanceOpts = {
@@ -172,7 +106,13 @@ export declare function upsertInstance(key: string, opts?: AddInstanceOpts): Pro
  * normalized kernel URL). Reports the previous URL when an existing
  * bookmark was repointed to a different kernel so callers can warn.
  */
-export declare function upsertManagedBookmark(key: string, slug: string, rawUrl: string, organizationId?: string): Promise<{
+export declare function upsertManagedBookmark(input: Readonly<{
+    key: string;
+    slug: string;
+    url: string;
+    organizationId?: string;
+    defaultIdentity?: string;
+}>): Promise<{
     entry: InstanceEntry;
     repointedFrom?: string;
 }>;
@@ -182,7 +122,9 @@ export declare function clearActive(identifier: string): Promise<void>;
 export declare function getActive(config?: AstraleConfig): Promise<InstanceEntry & {
     name: string;
 }>;
-export declare function resolveInstance(identifier: string, config?: AstraleConfig): Promise<ResolvedInstance>;
+export declare function resolveInstance(identifier: string, config?: AstraleConfig, opts?: {
+    persist?: boolean;
+}): Promise<ResolvedInstance>;
 export declare function resolveKernelUrl(opts: {
     url?: string;
     instance?: string;

package/dist/types/lib/log.d.ts

@@ -10,9 +10,11 @@ export declare const log: {
 };
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
-export declare function fatal(e: unknown, opts?: MachineOpts): never;
-/** Admit expected invalid input and exit through {@link fatal}. */
-export declare function failClosed(error: unknown, opts?: MachineOpts): never;
+export declare function fatal(e: unknown, opts?: MachineOpts & {
+    readonly debug?: boolean;
+}): never;
+/** Project only a caller-authored admission failure into the CLI input family. */
+export declare function failInput(error: unknown, opts?: MachineOpts): never;
 /** Shortcut for stub commands that aren't wired in v1 (§15). */
 export declare function fatalNotImplemented(feature: string, hint?: string): never;
 /**

package/dist/types/lib/output.d.ts

@@ -11,7 +11,7 @@ export type MachineOpts = RawOutputOpts & {
 };
 export declare const RAW_OUTPUT_OPTIONS: readonly [{
     readonly flags: '--json';
-    readonly description: 'Always-valid JSON (for jq)';
+    readonly description: 'JSON; streaming commands emit one JSON value per line';
 }, {
     readonly flags: '--raw';
     readonly description: 'Unwrapped: bare scalar / raw bytes / JSON for objects';

package/dist/types/lib/proc.d.ts

@@ -0,0 +1,43 @@
+import { type ChildProcess, type StdioOptions } from 'node:child_process';
+export type RunResult = {
+    /** Exit code, or -1 when the process was killed by a signal. */
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Spawn a child process and capture stdout/stderr as UTF-8 text.
+ *
+ * Uses `node:child_process` rather than `Bun.spawn` so the exact same code runs
+ * under both the Bun-compiled standalone binary (Linux/macOS) and the Node/npm
+ * build (Windows and any Node user). The promise rejects only when the process
+ * fails to spawn (e.g. ENOENT); a non-zero exit resolves with that `code` so
+ * callers can branch on it.
+ */
+export declare function run(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<RunResult>;
+/**
+ * Spawn a child process with inherited stdio so its output streams live to the
+ * user's terminal. Used for hand-held installs (npm / npx) where progress
+ * matters and the output is for the human, not for parsing. Resolves with the
+ * exit code; rejects only when the process fails to spawn (e.g. ENOENT).
+ */
+export declare function runInherit(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<number>;
+/**
+ * Spawn a LONG-LIVED child and return the handle immediately so the caller can
+ * supervise it (wait for exit, forward signals, tear down siblings). Unlike
+ * run()/runInherit() — which resolve only once the child closes — this is for
+ * servers the command keeps attached to (e.g. `astrale studio`'s Bun server and
+ * Vite dev process). Same node:child_process basis (cross-runtime) and bare
+ * PATH-name lookup convention. Default stdio streams stdout/stderr live but
+ * ignores stdin, so two supervised children never contend for the TTY.
+ */
+export declare function spawnHandle(file: string, args?: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    stdio?: StdioOptions;
+    detached?: boolean;
+}): ChildProcess;

package/dist/types/lib/self.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lexical `@self` helpers. Effective-principal resolution is deliberately not
+ * local: connection/self.ts asks the authenticated target Kernel through
+ * Identity.whoami before replacing any reference.
+ */
+/** Cheap pre-check before invoking authenticated principal resolution. */
+export declare function containsSelfRef(input: string): boolean;
+/** Replace every admitted `@self` token with one authenticated NodeId. */
+export declare function expandSelfReferences(input: string, selfId: string): string;

package/dist/types/lib/update.d.ts

@@ -0,0 +1,109 @@
+import { chmod, copyFile, mkdir, rename, rm } from 'node:fs/promises';
+import { z } from 'zod';
+import { AstraleError } from '../errors';
+export declare const DEFAULT_UPDATE_CHANNEL = "beta";
+export declare const InstallMetadataSchema: z.ZodObject<{
+    method: z.ZodLiteral<"script">;
+    channel: z.ZodDefault<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    repo: z.ZodDefault<z.ZodString>;
+    bin: z.ZodString;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
+export declare const UpdateManifestSchema: z.ZodObject<{
+    version: z.ZodString;
+    binaryVersion: z.ZodOptional<z.ZodString>;
+    channel: z.ZodString;
+    repo: z.ZodOptional<z.ZodString>;
+    assets: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        name: z.ZodString;
+        sha256: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodPipe<z.ZodString, z.ZodTransform<{
+        name: string;
+    }, string>>]>>;
+}, z.core.$strip>;
+export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;
+export type Platform = {
+    os: 'darwin' | 'linux';
+    arch: 'arm64' | 'x64';
+};
+export type UpdateRequest = {
+    check?: boolean;
+    channel?: string;
+    version?: string;
+    currentVersion: string;
+    platform?: Platform;
+    installPath?: string;
+    execution?: UpdateExecution;
+};
+export type UpdateExecution = {
+    kind: 'standalone';
+    executable: string;
+} | {
+    kind: 'package-managed';
+    executable: string;
+};
+declare const admittedScriptInstall: unique symbol;
+export type AdmittedScriptInstall = Readonly<{
+    metadata: InstallMetadata;
+    executable: string;
+    [admittedScriptInstall]: true;
+}>;
+export type UpdateResult = {
+    status: 'managed';
+    currentVersion: string;
+    executable: string;
+} | {
+    status: 'up-to-date';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'available';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'updated';
+    previousVersion: string;
+    currentVersion: string;
+    channel: string;
+    bin: string;
+};
+export declare function detectPlatform(): Platform;
+export declare function platformKey(platform: Platform): string;
+export declare function classifyUpdateExecution(input: {
+    bunVersion?: string;
+    executable: string;
+    entry?: string;
+}): UpdateExecution;
+export declare function detectUpdateExecution(): UpdateExecution;
+export declare function packageManagedUpdateError(executable: string): AstraleError;
+export declare function readInstallMetadata(path?: string): Promise<InstallMetadata>;
+export declare function admitScriptInstall(meta: InstallMetadata, execution: Extract<UpdateExecution, {
+    kind: 'standalone';
+}>): Promise<AdmittedScriptInstall>;
+export declare function writeInstallMetadata(meta: InstallMetadata, path?: string, filesystem?: Pick<CohortFilesystem, 'mkdir' | 'rename' | 'rm'> & Pick<typeof import('node:fs/promises'), 'writeFile'>): Promise<void>;
+export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
+export declare function fetchManifest(base: string): Promise<UpdateManifest>;
+export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
+interface CohortFilesystem {
+    readonly chmod: typeof chmod;
+    readonly copyFile: typeof copyFile;
+    readonly mkdir: typeof mkdir;
+    readonly rename: typeof rename;
+    readonly rm: typeof rm;
+}
+export interface StandaloneCohortReplacement {
+    readonly finalize: () => Promise<void>;
+    readonly rollback: () => Promise<void>;
+}
+/** Replace the standalone executable and its Viewer as one rollback-safe cohort. */
+export declare function replaceStandaloneCohort(installedBinary: string, nextBinary: string, nextViewerDist: string, filesystem?: Partial<CohortFilesystem>): Promise<StandaloneCohortReplacement>;
+interface UpdateDependencies {
+    readonly replaceStandaloneCohort: typeof replaceStandaloneCohort;
+    readonly writeInstallMetadata: typeof writeInstallMetadata;
+}
+export declare function updateAstrale(req: UpdateRequest, dependencies?: Partial<UpdateDependencies>): Promise<UpdateResult>;
+export {};

package/dist/types/lib/validation.d.ts

@@ -7,5 +7,8 @@ export declare function validateUrl(url: string): void;
 /** Non-throwing predicate form of `validateUrl`. */
 export declare function isHttpUrl(url: string): boolean;
 /** `local` = only this machine. `remote` = mirrored via astrale cloud (§2.7). */
-export declare const RegistryModeSchema: z.ZodEnum<["local", "remote"]>;
+export declare const RegistryModeSchema: z.ZodEnum<{
+    local: "local";
+    remote: "remote";
+}>;
 export type RegistryMode = z.infer<typeof RegistryModeSchema>;