@astrale-os/cli 1.0.0-beta.2 → 1.0.0-beta.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.20",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -19,7 +19,6 @@
     "dist",
     "src",
     "tsconfig.json",
-    ".check-workspace.cjs",
     "studio/server",
     "studio/shared",
     "studio/client/dist",
@@ -59,26 +58,23 @@
     "ora": "^9.0.0",
     "ts-morph": "^25.0.1",
     "yaml": "^2.8.2",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@astrale-os/kernel-client": ">=0.6.0-beta.4 <1.0.0",
-    "@astrale-os/kernel-protocol": ">=0.5.0-beta.3 <1.0.0",
-    "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": ">=0.5.0-beta.4 <1.0.0",
-    "@astrale-os/shell": ">=0.3.8-beta.2 <1.0.0",
+    "@astrale-os/ox": ">=0.1.3 <1.0.0",
+    "@astrale-os/sdk": "0.5.0-beta.50",
+    "@astrale-os/shell": "0.4.2-beta.5",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
-    "@commitlint/cli": "~20.3.1",
-    "@commitlint/config-conventional": "~20.3.1",
+    "@commitlint/cli": "21.2.2",
+    "@commitlint/config-conventional": "21.2.2",
     "@types/bun": "^1.1.16",
     "@types/node": "^22.0.0",
-    "@typescript/native-preview": "latest",
     "husky": "~9.1.7",
-    "lint-staged": "~16.2.7",
-    "msgpackr": "^1.12.1",
-    "oxfmt": "0.52.0",
-    "oxlint": "latest",
-    "typescript": "~6.0.1-rc"
+    "lint-staged": "17.3.0",
+    "msgpackr": "^2.0.5",
+    "oxfmt": "0.63.0",
+    "oxlint": "1.78.0",
+    "typescript": "7.0.2"
   },
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
@@ -100,15 +96,14 @@
     "node": ">=22"
   },
   "scripts": {
-    "preinstall": "node .check-workspace.cjs",
     "build": "bun scripts/build.ts",
-    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-private-ports-boundary.mjs",
-    "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
+    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-public-dependency-boundary.mjs",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json && tsc --noEmit -p viewer && pnpm --dir studio run typecheck",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",
     "format": "pnpm exec oxfmt --write .",
     "format:check": "pnpm exec oxfmt --check .",
-    "test": "bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
+    "test": "node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
     "test:studio": "pnpm --dir studio test",
     "test:watch": "bun test --watch src"
   }

package/src/__tests__/fixtures/publication.ts

@@ -0,0 +1,20 @@
+import type { schema } from '@astrale-os/sdk/schema'
+
+import { defineApplication } from '@astrale-os/sdk/application'
+import { compile } from '@astrale-os/sdk/deployment/build'
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release'
+import { defineRuntime } from '@astrale-os/sdk/runtime'
+
+/** Build a canonical empty-runtime Release for cross-boundary CLI tests. */
+export function releaseFor<const Schema extends schema.DomainSchema>(
+  source: Schema,
+  issuer: string,
+) {
+  const runtime = defineRuntime<Schema>()({
+    integrations: {},
+    initialize: () => ({ providers: {} }),
+    actions: [],
+    workflows: [],
+  })
+  return assemble(compile(defineApplication({ schema: source, runtime })), addressing(issuer))
+}

package/src/admin/.spec/architecture.md

@@ -1,10 +1,10 @@
 # CLI Admin adapters
 
-This private aggregate translates the frozen CLI command journey into the discovered V2
-`admin.astrale.ai` contract. It binds the exact served Domain revision through Kernel Client,
-uses `GraphApi` for policy-visible inventory, and invokes receiver-oriented Methods through
-`DomainBinding`. It does not import Admin implementation code, hard-code one schema revision, call
-Host directly, or persist remote graph truth.
+This private aggregate translates the frozen CLI command journey into the stable public
+`admin.astrale.ai` contract. Routine commands use canonical Admin Class, Property, Core receiver,
+and Method paths through Kernel Client. They do not download, inspect, bind, or rebuild the Admin
+schema. Strict local decoders admit every untrusted Admin result. The adapter does not import Admin
+implementation code, call Host directly, or persist remote graph truth.
 
 `instance` owns create/list/status/delete/install projection and explicitly excludes the reserved
 Admin Host from consumer placement. `catalog` owns Domain inventory, publication, and default-set
@@ -13,3 +13,10 @@ configuration. `graph` is their bounded cursor helper and is not re-exported by
 Commander grammar, help text, output shapes, bookmark behavior, and current interactive host
 selection remain owned by the existing command surface; these adapters change only its remote
 semantic owner.
+
+## Performance contract
+
+`instance list` performs one Admin method call after connection setup and no schema-discovery call.
+Against the production beta Admin endpoint, the complete command must finish in less than 1 second
+with a warm route/cache and less than 2 seconds from a cold CLI process. Unit tests prove the
+single-call/no-reflection shape; retained live evidence proves the wall-clock bounds.

package/src/admin/__tests__/fixture.ts

@@ -0,0 +1,25 @@
+import type { Call } from '@astrale-os/sdk/client'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
+
+import { mock } from 'bun:test'
+
+export function adminSession(implementation?: (target: string, input: unknown) => unknown): {
+  readonly call: ReturnType<typeof mock>
+  readonly reflection: ReturnType<typeof mock>
+  readonly session: ClientSession
+} {
+  const call = mock(async (request: Call) =>
+    implementation?.(String(request.target), request.input),
+  )
+  const reflection = mock(() => {
+    throw new Error('Routine Admin commands must not perform schema discovery or reflection.')
+  })
+  const session = {
+    call,
+    installation: reflection,
+    snapshot: reflection,
+    bind: reflection,
+    invoke: reflection,
+  } as unknown as ClientSession
+  return { call, reflection, session }
+}

package/src/admin/catalog/.spec/api.d.ts

@@ -1,5 +1,4 @@
-import type { DomainBinding } from '@astrale-os/kernel-client/domain'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
 
 import type { AdminGraphApi } from '../../graph/.spec/api.js'
 
@@ -55,7 +54,6 @@ export class AdminDomainNotFoundError extends Error {
 }
 
 export interface AdminCatalogDependencies {
-  readonly bind?: (session: ClientSession) => Promise<DomainBinding>
   readonly operationId?: (kind: 'publish' | 'configure-default') => string
 }
 

package/src/admin/catalog/.spec/architecture.md

@@ -1,6 +1,7 @@
 # CLI Admin catalog adapter
 
-The adapter reads policy-visible `Domain` Nodes through bounded Graph pages and derives default
-membership from the Fleet relation. Publication invokes `Fleet.publishDomain`; a requested default
-change is a separate explicit `Domain.configureDefault` call. Unchanged publication input is a
-no-op, and an omitted description preserves the current value.
+The adapter reads policy-visible `Domain` Nodes through bounded Graph pages using stable Class and
+Property keys, and derives default membership from the stable Fleet relation. It performs no schema
+discovery or reflection. Publication invokes `Fleet.publishDomain`; a requested default change is a
+separate explicit `Domain.configureDefault` call. Unchanged publication input is a no-op, and an
+omitted description preserves the current value.

package/src/admin/catalog/__tests__/client.test.ts

@@ -1,67 +1,53 @@
 import type { Node } from '@astrale-os/sdk/graph/node'
 import type { QueryAST } from '@astrale-os/sdk/query'
 
-import { ClassPath } from '@astrale-os/sdk/graph/class'
 import { NodeId } from '@astrale-os/sdk/graph/node'
-import { Path } from '@astrale-os/sdk/graph/path'
+import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
+import { PropertyKey } from '@astrale-os/sdk/schema'
 import { describe, expect, mock, test } from 'bun:test'
 
-import type { AdminBinding } from '../../binding'
 import type { AdminGraphApi } from '../../graph'
 
+import { adminSession } from '../../__tests__/fixture'
 import { connectAdminCatalog } from '../client'
 
-function definition(name: string) {
-  return {
-    name,
-    $: {
-      method(method: string) {
-        return { owner: name, name: method }
-      },
-      property(property: string) {
-        return { key: property }
-      },
-    },
-  }
-}
+const domainProperties = Object.freeze({
+  origin: PropertyKey('admin.astrale.ai:class.Domain.property.origin'),
+  name: PropertyKey('kernel.astrale.ai:class.Named.property.name'),
+  discoveryUrl: PropertyKey('admin.astrale.ai:class.Domain.property.discoveryUrl'),
+  description: PropertyKey('kernel.astrale.ai:class.Descriptable.property.description'),
+  createdAt: PropertyKey('kernel.astrale.ai:class.Timestamped.property.createdAt'),
+  updatedAt: PropertyKey('kernel.astrale.ai:class.Timestamped.property.updatedAt'),
+})
 
 function domainNode(id: string, origin: string): Node {
   return {
     id: NodeId(id),
-    class: ClassPath.from('admin.astrale.ai', 'Domain'),
-    props: {
-      origin,
-      name: origin.split('.')[0]!,
-      discoveryUrl: `https://${origin}`,
-      createdAt: '2026-08-12T00:00:00.000Z',
-      updatedAt: '2026-08-12T00:00:00.000Z',
-    } as never,
+    class: 'admin.astrale.ai:Domain' as Node['class'],
+    props: normalizeProperties({
+      [domainProperties.origin]: origin,
+      [domainProperties.name]: origin.split('.')[0]!,
+      [domainProperties.discoveryUrl]: `https://${origin}`,
+      [domainProperties.description]: `${origin} description`,
+      [domainProperties.createdAt]: '2026-08-12T00:00:00.000Z',
+      [domainProperties.updatedAt]: '2026-08-12T00:00:00.000Z',
+    }),
   }
 }
 
 function fixture(input: {
   domains?: readonly Node[]
   defaults?: readonly Node[]
-  invoke?: (method: { owner: string; name: string }, receiver: unknown, value: unknown) => unknown
+  invoke?: (target: string, value: unknown) => unknown
 }) {
-  const Domain = definition('Domain')
-  const Fleet = definition('Fleet')
-  const invoke = mock(async (method: unknown, receiver: unknown, value: unknown) =>
-    input.invoke?.(method as { owner: string; name: string }, receiver, value),
-  )
-  const binding = {
-    $: {
-      publication: { origin: 'admin.astrale.ai' },
-      origin: 'admin.astrale.ai',
-      class(name: string) {
-        if (name === 'Domain') return Domain
-        if (name === 'Fleet') return Fleet
-        throw new Error(`Unexpected class ${name}`)
-      },
-      core: { nodes: { fleet: { path: Path.id(NodeId('fleet')) } } },
-      invoke,
-    },
-  } as unknown as AdminBinding
+  const calls: Array<{
+    target: string
+    value: unknown
+  }> = []
+  const remote = adminSession((target, value) => {
+    calls.push({ target, value })
+    return input.invoke?.(target, value)
+  })
   const query = mock(async (_ast: QueryAST) => ({
     result: {
       kind: 'nodes' as const,
@@ -70,21 +56,30 @@ function fixture(input: {
     page: {},
   }))
   const defaultNodes = input.defaults ?? []
-  const neighbors = mock(async () => ({
-    nodes: defaultNodes,
-    first: defaultNodes[0] ?? null,
-    graph: { nodes: defaultNodes, edges: [] },
-    cursor: null,
-    collect: async () => ({ nodes: defaultNodes, cursor: null }),
-  }))
+  const neighbors = mock(
+    async (
+      _source: Parameters<AdminGraphApi['neighbors']>[0],
+      _via: Parameters<AdminGraphApi['neighbors']>[1],
+      _options: Parameters<AdminGraphApi['neighbors']>[2],
+    ) => ({
+      nodes: defaultNodes,
+      first: defaultNodes[0] ?? null,
+      graph: { nodes: defaultNodes, edges: [] },
+      cursor: null,
+      collect: async () => ({ nodes: defaultNodes, cursor: null }),
+    }),
+  )
   const graph = { query, neighbors } as unknown as AdminGraphApi
   return {
-    invoke,
+    call: remote.call,
+    reflection: remote.reflection,
+    query,
+    neighbors,
+    calls,
     connect: () =>
       connectAdminCatalog(
-        { session: {} as never, graph },
+        { session: remote.session, graph },
         {
-          bind: async () => binding,
           operationId: (kind) => `cli.domain.${kind}:test`,
         },
       ),
@@ -106,16 +101,57 @@ describe('V2 Admin Domain catalog adapter', () => {
   test('lists Domain nodes through GraphApi and joins the Fleet default relation', async () => {
     const crm = domainNode('crm-domain', 'crm.acme.dev')
     const notes = domainNode('notes-domain', 'notes.acme.dev')
-    const api = await fixture({ domains: [crm, notes], defaults: [crm] }).connect()
+    const contract = fixture({ domains: [crm, notes], defaults: [crm] })
+    const api = await contract.connect()
 
     await expect(api.list()).resolves.toEqual([
-      expect.objectContaining({
+      {
         id: '@crm-domain',
         origin: 'crm.acme.dev',
+        name: 'crm',
+        url: 'https://crm.acme.dev',
+        description: 'crm.acme.dev description',
         installByDefault: true,
-      }),
-      expect.objectContaining({ id: '@notes-domain', origin: 'notes.acme.dev' }),
+        createdAt: '2026-08-12T00:00:00.000Z',
+        updatedAt: '2026-08-12T00:00:00.000Z',
+      },
+      {
+        id: '@notes-domain',
+        origin: 'notes.acme.dev',
+        name: 'notes',
+        url: 'https://notes.acme.dev',
+        description: 'notes.acme.dev description',
+        createdAt: '2026-08-12T00:00:00.000Z',
+        updatedAt: '2026-08-12T00:00:00.000Z',
+      },
     ])
+    expect(contract.query).toHaveBeenCalledWith(
+      {
+        format: 'astrale.graph.query',
+        version: 'v6',
+        source: {
+          kind: 'node',
+          terms: [
+            {
+              kind: 'class',
+              class: { origin: 'admin.astrale.ai', kind: 'class', name: 'Domain' },
+            },
+          ],
+          binding: 'n0',
+        },
+        steps: [],
+        select: { kind: 'nodes', binding: 'n0', projection: { kind: 'value' } },
+      },
+      { page: { size: 256 } },
+    )
+    const [source, edge, options] = contract.neighbors.mock.calls[0]!
+    expect(String(source)).toBe('/:admin.astrale.ai:core.fleet')
+    expect(edge).toEqual({
+      origin: 'admin.astrale.ai',
+      kind: 'class',
+      name: 'fleet_installs_domain_by_default',
+    })
+    expect(options).toEqual({ direction: 'outgoing', page: { size: 256 } })
   })
 
   test('publishes through Fleet then configures the Domain default explicitly', async () => {
@@ -130,16 +166,9 @@ describe('V2 Admin Domain catalog adapter', () => {
         installByDefault: true,
       }),
     ).resolves.toMatchObject({ changed: true, isNew: true, entry: { installByDefault: true } })
-    expect(
-      contract.invoke.mock.calls.map(([method, receiver, value]) => ({
-        method,
-        receiver: String(receiver),
-        value,
-      })),
-    ).toEqual([
+    expect(contract.calls).toEqual([
       {
-        method: { owner: 'Fleet', name: 'publishDomain' },
-        receiver: '@fleet',
+        target: '/:admin.astrale.ai:core.fleet::publishDomain',
         value: {
           operationId: 'cli.domain.publish:test',
           origin: 'crm.acme.dev',
@@ -148,8 +177,7 @@ describe('V2 Admin Domain catalog adapter', () => {
         },
       },
       {
-        method: { owner: 'Domain', name: 'configureDefault' },
-        receiver: '@crm-domain',
+        target: '@crm-domain::configureDefault',
         value: {
           operationId: 'cli.domain.configure-default:test',
           enabled: true,
@@ -166,6 +194,52 @@ describe('V2 Admin Domain catalog adapter', () => {
     await expect(
       api.publish({ origin: 'crm.acme.dev', name: 'crm', url: 'https://crm.acme.dev' }),
     ).resolves.toMatchObject({ changed: false, isNew: false })
-    expect(contract.invoke).not.toHaveBeenCalled()
+    expect(contract.call).not.toHaveBeenCalled()
+    expect(contract.reflection).not.toHaveBeenCalled()
+  })
+
+  test('connects without schema discovery or graph I/O', async () => {
+    const contract = fixture({})
+
+    await contract.connect()
+
+    expect(contract.call).not.toHaveBeenCalled()
+    expect(contract.reflection).not.toHaveBeenCalled()
+    expect(contract.query).not.toHaveBeenCalled()
+    expect(contract.neighbors).not.toHaveBeenCalled()
+  })
+
+  test('rejects malformed graph records and publication summaries', async () => {
+    const invalidNode = {
+      id: NodeId('invalid-domain'),
+      class: 'admin.astrale.ai:Domain' as Node['class'],
+      props: normalizeProperties({
+        [domainProperties.origin]: 'invalid.example.dev',
+        [domainProperties.name]: 'invalid',
+        [domainProperties.discoveryUrl]: 'https://invalid.example.dev',
+        [domainProperties.createdAt]: '2026-08-12T00:00:00.000Z',
+      }),
+    }
+    await expect((await fixture({ domains: [invalidNode] }).connect()).list()).rejects.toThrow(
+      'Admin Domain.updatedAt is invalid.',
+    )
+
+    const malformed = fixture({ invoke: () => ({ id: '@domain-only' }) })
+    await expect(
+      (await malformed.connect()).publish({
+        origin: 'crm.acme.dev',
+        name: 'crm',
+        url: 'https://crm.acme.dev',
+      }),
+    ).rejects.toThrow('Admin Domain origin is invalid.')
+
+    const malformedPath = fixture({ invoke: () => ({ ...summary('crm.acme.dev'), id: 'bad' }) })
+    await expect(
+      (await malformedPath.connect()).publish({
+        origin: 'crm.acme.dev',
+        name: 'crm',
+        url: 'https://crm.acme.dev',
+      }),
+    ).rejects.toThrow('Admin Domain id is invalid.')
   })
 })

package/src/admin/catalog/client.ts

@@ -1,10 +1,10 @@
-import type { ClientSession } from '@astrale-os/kernel-client/session'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
 import type { Node } from '@astrale-os/sdk/graph/node'
 
 import { Path } from '@astrale-os/sdk/graph/path'
 import { Query } from '@astrale-os/sdk/query'
 
-import { bindAdmin, type AdminBinding } from '../binding'
+import { AdminContract, callAdminMethod } from '../contract'
 import { readAllNodes, type AdminGraphApi } from '../graph'
 import {
   AdminDomainNotFoundError,
@@ -13,16 +13,9 @@ import {
   type PublishDomainResult,
 } from './model'
 
-const ADMIN_ORIGIN = 'admin.astrale.ai'
 const PAGE_SIZE = 256
 const MAXIMUM_DOMAINS = 10_000
 const MAXIMUM_PAGES = Math.ceil(MAXIMUM_DOMAINS / PAGE_SIZE) + 1
-const DomainRef = Object.freeze({ origin: ADMIN_ORIGIN, kind: 'class' as const, name: 'Domain' })
-const fleetInstallsByDefault = Object.freeze({
-  origin: ADMIN_ORIGIN,
-  kind: 'class' as const,
-  name: 'fleet_installs_domain_by_default',
-})
 
 export interface AdminCatalogContext {
   readonly session: ClientSession
@@ -36,30 +29,21 @@ export interface AdminCatalogApi {
 }
 
 export interface AdminCatalogDependencies {
-  readonly bind?: (session: ClientSession) => Promise<AdminBinding>
   readonly operationId?: (kind: 'publish' | 'configure-default') => string
 }
 
-/** Bind the discovered Admin revision and expose its Domain catalog journey. */
+/** Connect the Domain catalog journey without schema discovery or reflection. */
 export async function connectAdminCatalog(
   context: AdminCatalogContext,
   dependencies: AdminCatalogDependencies = {},
 ): Promise<AdminCatalogApi> {
-  const binding = await (dependencies.bind ?? bindAdmin)(context.session)
-  if (binding.$.publication?.origin !== ADMIN_ORIGIN || binding.$.origin !== ADMIN_ORIGIN) {
-    throw new TypeError('Configured Admin target does not serve the Admin Domain.')
-  }
-  const Domain = binding.$.class('Domain')
-  const Fleet = binding.$.class('Fleet')
-  const fleet = binding.$.core.nodes.fleet?.path
-  if (fleet === undefined) throw new TypeError('Admin Domain has no singleton Fleet receiver.')
   const operationId = dependencies.operationId ?? defaultOperationId
 
   const list = async (): Promise<DomainInfo[]> => {
     const [nodes, defaultsPage] = await Promise.all([
       readAllNodes(
         context.graph,
-        Query.from({ kind: 'node', definitions: [DomainRef] }).select({
+        Query.from({ nodes: [AdminContract.classes.Domain] }).select({
           kind: 'nodes',
           projection: { kind: 'value' },
         }),
@@ -69,16 +53,20 @@ export async function connectAdminCatalog(
           maximumPages: MAXIMUM_PAGES,
         },
       ),
-      context.graph.neighbors(fleet, fleetInstallsByDefault, {
-        direction: 'outgoing',
-        page: { size: PAGE_SIZE },
-      }),
+      context.graph.neighbors(
+        AdminContract.fleet,
+        AdminContract.edges.fleetInstallsDomainByDefault,
+        {
+          direction: 'outgoing',
+          page: { size: PAGE_SIZE },
+        },
+      ),
     ])
     const defaults = await defaultsPage.collect({ maximumPages: MAXIMUM_PAGES })
     if (defaults.cursor !== null)
       throw new TypeError('Admin default Domain catalog exceeded its bound.')
     const defaultIds = new Set(defaults.nodes.map((node) => String(node.id)))
-    return nodes.map((node) => domainFromNode(Domain, node, defaultIds.has(String(node.id))))
+    return nodes.map((node) => domainFromNode(node, defaultIds.has(String(node.id))))
   }
 
   const requireDomain = async (identifier: string): Promise<DomainInfo> => {
@@ -107,13 +95,13 @@ export async function connectAdminCatalog(
       let entry = existing
       if (registryChanged) {
         entry = domainFromSummary(
-          await binding.$.invoke(Fleet.$.method('publishDomain') as never, fleet, {
+          await callAdminMethod(context.session, AdminContract.fleet, 'publishDomain', {
             operationId: operationId('publish'),
             origin: input.origin,
             name: input.name,
             discoveryUrl: input.url,
             ...(description === undefined ? {} : { description }),
-          } as never),
+          }),
           existing?.installByDefault === true,
         )
       }
@@ -124,14 +112,10 @@ export async function connectAdminCatalog(
         (entry.installByDefault ?? false) !== input.installByDefault
       if (defaultChanged) {
         entry = domainFromSummary(
-          await binding.$.invoke(
-            Domain.$.method('configureDefault') as never,
-            Path.parse(entry.id),
-            {
-              operationId: operationId('configure-default'),
-              enabled: input.installByDefault,
-            } as never,
-          ),
+          await callAdminMethod(context.session, Path.parse(entry.id), 'configureDefault', {
+            operationId: operationId('configure-default'),
+            enabled: input.installByDefault,
+          }),
           input.installByDefault === true,
         )
       }
@@ -144,29 +128,23 @@ export async function connectAdminCatalog(
   })
 }
 
-type DynamicDefinition = ReturnType<AdminBinding['$']['class']>
-
-function domainFromNode(
-  definition: DynamicDefinition,
-  node: Node,
-  installByDefault: boolean,
-): DomainInfo {
+function domainFromNode(node: Node, installByDefault: boolean): DomainInfo {
   return Object.freeze({
     id: Path.id(node.id).raw,
-    origin: requiredProperty(definition, node, 'origin'),
-    name: requiredProperty(definition, node, 'name'),
-    url: requiredProperty(definition, node, 'discoveryUrl'),
-    ...optionalProperty(definition, node, 'description'),
+    origin: requiredProperty(node, 'origin'),
+    name: requiredProperty(node, 'name'),
+    url: requiredProperty(node, 'discoveryUrl'),
+    ...optionalProperty(node, 'description'),
     ...(installByDefault ? { installByDefault: true } : {}),
-    createdAt: requiredProperty(definition, node, 'createdAt'),
-    updatedAt: requiredProperty(definition, node, 'updatedAt'),
+    createdAt: requiredProperty(node, 'createdAt'),
+    updatedAt: requiredProperty(node, 'updatedAt'),
   })
 }
 
 function domainFromSummary(input: unknown, installByDefault: boolean): DomainInfo {
   const value = record(input, 'Admin Domain summary')
   return Object.freeze({
-    id: requiredString(value.id, 'Admin Domain id'),
+    id: requiredNodePath(value.id, 'Admin Domain id'),
     origin: requiredString(value.origin, 'Admin Domain origin'),
     name: requiredString(value.name, 'Admin Domain name'),
     url: requiredString(value.discoveryUrl, 'Admin Domain discovery URL'),
@@ -179,16 +157,15 @@ function domainFromSummary(input: unknown, installByDefault: boolean): DomainInf
   })
 }
 
-function requiredProperty(definition: DynamicDefinition, node: Node, name: string): string {
-  return requiredString(node.props[definition.$.property(name).key], `Admin Domain.${name}`)
+function requiredProperty(node: Node, name: keyof typeof AdminContract.properties.domain): string {
+  return requiredString(node.props[AdminContract.properties.domain[name]], `Admin Domain.${name}`)
 }
 
 function optionalProperty(
-  definition: DynamicDefinition,
   node: Node,
-  name: string,
+  name: keyof typeof AdminContract.properties.domain,
 ): Readonly<Record<string, string>> {
-  const value = node.props[definition.$.property(name).key]
+  const value = node.props[AdminContract.properties.domain[name]]
   return value === undefined ? {} : { [name]: requiredString(value, `Admin Domain.${name}`) }
 }
 
@@ -197,6 +174,15 @@ function requiredString(input: unknown, label: string): string {
   return input
 }
 
+function requiredNodePath(input: unknown, label: string): string {
+  const value = requiredString(input, label)
+  try {
+    return Path.parse(value).raw
+  } catch {
+    throw new TypeError(`${label} is invalid.`)
+  }
+}
+
 function record(input: unknown, label: string): Readonly<Record<string, unknown>> {
   if (typeof input !== 'object' || input === null || Array.isArray(input)) {
     throw new TypeError(`${label} is invalid.`)