@astrale-os/cli 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/public/connect-core.js

@@ -47129,7 +47129,7 @@ function nonEmptyText(input, label) {
 }
 // node_modules/.pnpm/@astrale-os+kernel-protocol@0.5.0-beta.3_msgpackr@1.12.1_typescript@6.0.3/node_modules/@astrale-os/kernel-protocol/dist/routes/reservation.js
 var STATIC_RESERVED_PATHS = new Set([PATH]);
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
 var paths2 = exports_issuer2.paths;
 var acceptConfiguration2 = exports_issuer2.acceptConfiguration;
 var MEDIA_TYPE5 = exports_issuer2.exchange.MEDIA_TYPE;
@@ -52063,7 +52063,7 @@ var log = {
 };
 var IS_CI = !!(process.env.CI || process.env.CONTINUOUS_INTEGRATION || process.env.NO_SPINNER);
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/capability/define.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/capability/define.js
 var operations = new WeakSet;
 var definitions = new WeakSet;
 var providers = new WeakMap;
@@ -52192,7 +52192,7 @@ function isObject4(input) {
   return input !== null && typeof input === "object";
 }
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/capability/client.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/capability/client.js
 function captureCapabilityRequirements(requirements) {
   const source2 = acceptMap(requirements, "Capability requirements");
   const names = ownStringKeys2(source2, "Capability requirements");
@@ -52223,22 +52223,22 @@ function ownDataValue2(input, key, label) {
   return descriptor.value;
 }
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/view/admission.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/view/admission.js
 var admittedFrontendArtifacts = new WeakSet;
 function isCapturedFrontendArtifact(input) {
   return admittedFrontendArtifacts.has(input);
 }
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/workflow/binding.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/workflow/binding.js
 function isWorkflowBinding(input) {
   return input !== null && typeof input === "object" && input.kind === "workflow" && typeof input.workflow?.run === "function";
 }
 function isTriggeredHandler(input) {
   return input !== null && typeof input === "object" && input.kind === "handler" && typeof input.handler === "function";
 }
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/workflow/runner.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/workflow/runner.js
 var DIRECT_ACTIVATION = Object.freeze({ kind: "direct" });
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/handlers.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/handlers.js
 function acceptDomainHandlers(domain3, input) {
   const registry2 = record4(input, "handlers");
   exactKeys2(registry2, ["functions", "classes", "interfaces"], "handlers");
@@ -52320,7 +52320,7 @@ function compareText3(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/requirements.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/requirements.js
 var ClassOperationOrder2 = Object.freeze([
   "create",
   "read",
@@ -52405,7 +52405,7 @@ function compare7(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/define.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/domain/define.js
 function defineDomain(input) {
   const config2 = record5(input, "defineDomain input");
   const hasCapabilities = Object.hasOwn(config2, "capabilities");
@@ -52615,6 +52615,7 @@ var IdpSessionSchema = exports_external2.object({
 }).passthrough();
 var BUILTIN_WORKOS_IDP_NAME = "workos";
 var DEFAULT_WORKOS_API_HOST = "https://api.workos.com";
+var DEFAULT_WORKOS_CLIENT_ID = "client_01KC29HET5F3QAQ8GNTPZ7F320";
 var WORKOS_CLIENT_ID_ENV_NAMES = ["WORKOS_CLIENT_ID", "VITE_WORKOS_CLIENT_ID"];
 function idpDir(name) {
   return paths3.idpDir(name);
@@ -52747,7 +52748,7 @@ function builtinIdpConfig(name, clientIdOverride, env2 = process.env) {
   };
 }
 function workosClientIdFromEnv(env2 = process.env) {
-  return WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env2[name]?.trim()).find((value) => typeof value === "string" && value.length > 0);
+  return WORKOS_CLIENT_ID_ENV_NAMES.map((name) => env2[name]?.trim()).find((value) => typeof value === "string" && value.length > 0) ?? DEFAULT_WORKOS_CLIENT_ID;
 }
 async function postForm(url3, params) {
   const response2 = await fetch(url3, {
@@ -53261,10 +53262,46 @@ function isRegionRoutedInstanceRoot(url3) {
   const labels = url3.hostname.toLowerCase().split(".");
   return (labels.length === 4 || labels.length === 5) && /^[a-z]{2}(?:-[a-z0-9]+)*$/u.test(labels[1] ?? "") && labels.at(-2) === "astrale" && labels.at(-1) === "ai";
 }
+// src/lib/update.ts
+var DEFAULT_REPO = "astrale-os/cli";
+var DEFAULT_UPDATE_CHANNEL = "beta";
+var InstallMetadataSchema = exports_external2.object({
+  method: exports_external2.literal("script"),
+  channel: exports_external2.string().min(1).default(DEFAULT_UPDATE_CHANNEL),
+  version: exports_external2.string().min(1).optional(),
+  repo: exports_external2.string().min(1).default(DEFAULT_REPO),
+  bin: exports_external2.string().min(1),
+  installedAt: exports_external2.string().optional()
+});
+var ManifestAssetSchema = exports_external2.object({
+  name: exports_external2.string().min(1),
+  sha256: exports_external2.string().regex(/^[a-fA-F0-9]{64}$/).optional()
+});
+var UpdateManifestSchema = exports_external2.object({
+  version: exports_external2.string().min(1),
+  binaryVersion: exports_external2.string().min(1).optional(),
+  channel: exports_external2.string().min(1),
+  repo: exports_external2.string().min(1).optional(),
+  assets: exports_external2.record(exports_external2.string(), exports_external2.union([
+    ManifestAssetSchema,
+    exports_external2.string().min(1).transform((name) => ({ name }))
+  ]))
+});
+
 // src/lib/admin-target.ts
 var DEFAULT_ADMIN_TARGET_NAME = "admin";
-var DEFAULT_ADMIN_TARGET_URL = "https://admin.eu.astrale.ai/api";
-var DEFAULT_ADMIN_DOMAIN_ISSUER = "https://admin.beta.astrale.ai";
+function defaultAdminTargetForChannel(channel) {
+  return channel === "stable" ? {
+    url: "https://admin.eu.astrale.ai/api",
+    domainIssuer: "https://admin.astrale.ai"
+  } : {
+    url: "https://admin.eu.beta.astrale.ai/api",
+    domainIssuer: "https://admin.beta.astrale.ai"
+  };
+}
+var DEFAULT_ADMIN_TARGET = defaultAdminTargetForChannel(DEFAULT_UPDATE_CHANNEL);
+var DEFAULT_ADMIN_TARGET_URL = DEFAULT_ADMIN_TARGET.url;
+var DEFAULT_ADMIN_DOMAIN_ISSUER = DEFAULT_ADMIN_TARGET.domainIssuer;
 var DEFAULT_ADMIN_TARGET_CONFIG = {
   name: DEFAULT_ADMIN_TARGET_NAME,
   url: DEFAULT_ADMIN_TARGET_URL,

package/dist/public/keys/index.js

@@ -40188,7 +40188,7 @@ function nonEmptyText(input, label) {
 }
 // node_modules/.pnpm/@astrale-os+kernel-protocol@0.5.0-beta.3_msgpackr@1.12.1_typescript@6.0.3/node_modules/@astrale-os/kernel-protocol/dist/routes/reservation.js
 var STATIC_RESERVED_PATHS = new Set([PATH]);
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
 var paths2 = exports_issuer2.paths;
 var acceptConfiguration2 = exports_issuer2.acceptConfiguration;
 var MEDIA_TYPE5 = exports_issuer2.exchange.MEDIA_TYPE;

package/dist/public/paths/index.js

@@ -38780,7 +38780,7 @@ function nonEmptyText(input, label) {
 }
 // node_modules/.pnpm/@astrale-os+kernel-protocol@0.5.0-beta.3_msgpackr@1.12.1_typescript@6.0.3/node_modules/@astrale-os/kernel-protocol/dist/routes/reservation.js
 var STATIC_RESERVED_PATHS = new Set([PATH]);
-// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.4_@astrale-os+ox@0.1.2_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
+// node_modules/.pnpm/@astrale-os+sdk@0.5.0-beta.9_@astrale-os+ox@0.1.3_oxfmt@0.52.0_oxlint@1.79.0__msgpackr@1.12.1_oxlint@1.79.0/node_modules/@astrale-os/sdk/dist/auth/exchange.js
 var paths2 = exports_issuer2.paths;
 var acceptConfiguration2 = exports_issuer2.acceptConfiguration;
 var MEDIA_TYPE5 = exports_issuer2.exchange.MEDIA_TYPE;

package/dist/types/lib/admin-target.d.ts

@@ -2,8 +2,12 @@ import { z } from 'zod';
 import type { AstraleConfig } from './config';
 import type { InstanceStore } from './instance';
 export declare const DEFAULT_ADMIN_TARGET_NAME = "admin";
-export declare const DEFAULT_ADMIN_TARGET_URL = "https://admin.eu.astrale.ai/api";
-export declare const DEFAULT_ADMIN_DOMAIN_ISSUER = "https://admin.beta.astrale.ai";
+export declare function defaultAdminTargetForChannel(channel: string): {
+    readonly url: string;
+    readonly domainIssuer: string;
+};
+export declare const DEFAULT_ADMIN_TARGET_URL: string;
+export declare const DEFAULT_ADMIN_DOMAIN_ISSUER: string;
 export declare const DEFAULT_ADMIN_TARGET_CONFIG: {
     name: string;
     url: string;

package/dist/types/lib/proc.d.ts

@@ -0,0 +1,43 @@
+import { type ChildProcess, type StdioOptions } from 'node:child_process';
+export type RunResult = {
+    /** Exit code, or -1 when the process was killed by a signal. */
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Spawn a child process and capture stdout/stderr as UTF-8 text.
+ *
+ * Uses `node:child_process` rather than `Bun.spawn` so the exact same code runs
+ * under both the Bun-compiled standalone binary (Linux/macOS) and the Node/npm
+ * build (Windows and any Node user). The promise rejects only when the process
+ * fails to spawn (e.g. ENOENT); a non-zero exit resolves with that `code` so
+ * callers can branch on it.
+ */
+export declare function run(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<RunResult>;
+/**
+ * Spawn a child process with inherited stdio so its output streams live to the
+ * user's terminal. Used for hand-held installs (npm / npx) where progress
+ * matters and the output is for the human, not for parsing. Resolves with the
+ * exit code; rejects only when the process fails to spawn (e.g. ENOENT).
+ */
+export declare function runInherit(file: string, args?: string[], opts?: {
+    cwd?: string;
+}): Promise<number>;
+/**
+ * Spawn a LONG-LIVED child and return the handle immediately so the caller can
+ * supervise it (wait for exit, forward signals, tear down siblings). Unlike
+ * run()/runInherit() — which resolve only once the child closes — this is for
+ * servers the command keeps attached to (e.g. `astrale studio`'s Bun server and
+ * Vite dev process). Same node:child_process basis (cross-runtime) and bare
+ * PATH-name lookup convention. Default stdio streams stdout/stderr live but
+ * ignores stdin, so two supervised children never contend for the TTY.
+ */
+export declare function spawnHandle(file: string, args?: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    stdio?: StdioOptions;
+    detached?: boolean;
+}): ChildProcess;

package/dist/types/lib/update.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+export declare const DEFAULT_UPDATE_CHANNEL = "beta";
+export declare const InstallMetadataSchema: z.ZodObject<{
+    method: z.ZodLiteral<"script">;
+    channel: z.ZodDefault<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    repo: z.ZodDefault<z.ZodString>;
+    bin: z.ZodString;
+    installedAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    method: "script";
+    channel: string;
+    version?: string | undefined;
+    repo: string;
+    bin: string;
+    installedAt?: string | undefined;
+}, {
+    method: "script";
+    channel?: string | undefined;
+    version?: string | undefined;
+    repo?: string | undefined;
+    bin: string;
+    installedAt?: string | undefined;
+}>;
+export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
+export declare const UpdateManifestSchema: z.ZodObject<{
+    version: z.ZodString;
+    binaryVersion: z.ZodOptional<z.ZodString>;
+    channel: z.ZodString;
+    repo: z.ZodOptional<z.ZodString>;
+    assets: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+        name: z.ZodString;
+        sha256: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        sha256?: string | undefined;
+    }, {
+        name: string;
+        sha256?: string | undefined;
+    }>, z.ZodEffects<z.ZodString, {
+        name: string;
+    }, string>]>>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    binaryVersion?: string | undefined;
+    channel: string;
+    repo?: string | undefined;
+    assets: Record<string, {
+        name: string;
+        sha256?: string | undefined;
+    } | {
+        name: string;
+    }>;
+}, {
+    version: string;
+    binaryVersion?: string | undefined;
+    channel: string;
+    repo?: string | undefined;
+    assets: Record<string, string | {
+        name: string;
+        sha256?: string | undefined;
+    }>;
+}>;
+export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;
+export type Platform = {
+    os: 'darwin' | 'linux';
+    arch: 'arm64' | 'x64';
+};
+export type UpdateRequest = {
+    check?: boolean;
+    channel?: string;
+    version?: string;
+    currentVersion: string;
+    platform?: Platform;
+    installPath?: string;
+};
+export type UpdateResult = {
+    status: 'up-to-date';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'available';
+    currentVersion: string;
+    latestVersion: string;
+    channel: string;
+} | {
+    status: 'updated';
+    previousVersion: string;
+    currentVersion: string;
+    channel: string;
+    bin: string;
+};
+export declare function detectPlatform(): Platform;
+export declare function platformKey(platform: Platform): string;
+export declare function readInstallMetadata(path?: string): Promise<InstallMetadata>;
+export declare function writeInstallMetadata(meta: InstallMetadata, path?: string): Promise<void>;
+export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
+export declare function fetchManifest(base: string): Promise<UpdateManifest>;
+export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
+export declare function updateAstrale(req: UpdateRequest): Promise<UpdateResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -64,8 +64,8 @@
   "devDependencies": {
     "@astrale-os/kernel-client": ">=0.6.0-beta.4 <1.0.0",
     "@astrale-os/kernel-protocol": ">=0.5.0-beta.3 <1.0.0",
-    "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": ">=0.5.0-beta.4 <1.0.0",
+    "@astrale-os/ox": ">=0.1.3 <1.0.0",
+    "@astrale-os/sdk": ">=0.5.0-beta.9 <1.0.0",
     "@astrale-os/shell": ">=0.3.8-beta.2 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "~20.3.1",
@@ -102,7 +102,7 @@
   "scripts": {
     "preinstall": "node .check-workspace.cjs",
     "build": "bun scripts/build.ts",
-    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-private-ports-boundary.mjs",
+    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-public-dependency-boundary.mjs",
     "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",

package/src/admin/__tests__/binding.test.ts

@@ -0,0 +1,38 @@
+import type { ClientSession } from '@astrale-os/kernel-client/session'
+
+import { defineDomain } from '@astrale-os/sdk'
+import { issuer } from '@astrale-os/sdk/auth'
+import { createDeployment } from '@astrale-os/sdk/deployment'
+import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { expect, mock, test } from 'bun:test'
+
+import { bindAdmin } from '../binding'
+
+const schema = defineSchema('admin.astrale.ai', {})
+const deployment = createDeployment({
+  definition: defineDomain({
+    schema,
+    handlers: { functions: {}, classes: {}, interfaces: {} },
+  }),
+  issuer: issuer.accept('https://admin.beta.astrale.ai'),
+  bundleHref: 'https://admin.beta.astrale.ai/domain.bundle.json',
+  bindings: { callables: [] },
+})
+
+test('binds the installed Admin Domain instead of the source Kernel publication', async () => {
+  const installed = mock(async () => ({
+    state: 'ready' as const,
+    target: 'sha256:admin-target' as const,
+    source: { kind: 'remote' as const, publication: deployment.publication },
+    bundle: deployment.bundle,
+    readiness: 'sha256:admin-readiness' as const,
+    capabilities: { requested: [], materialized: [] },
+  }))
+  const session = { installed } as unknown as ClientSession
+
+  const binding = await bindAdmin(session)
+
+  expect(installed).toHaveBeenCalledWith('admin.astrale.ai')
+  expect(binding.$.origin).toBe('admin.astrale.ai')
+  expect(String(binding.$.publication?.identity.issuer)).toBe('https://admin.beta.astrale.ai')
+})

package/src/admin/binding.ts

@@ -1,168 +1,18 @@
-import type { Input, Result } from '@astrale-os/kernel-client'
-import type {
-  ClientSession,
-  SessionRequestOptions,
-  SessionSnapshot,
-} from '@astrale-os/kernel-client/session'
-import type {
-  Definition,
-  Domain as RichDomain,
-  InstanceMethod,
-  StaticMethod,
-} from '@astrale-os/sdk/domain'
-import type { PathLike } from '@astrale-os/sdk/graph/path'
-import type { Key } from '@astrale-os/sdk/schema'
+import type { DomainBinding } from '@astrale-os/kernel-client/domain'
+import type { ClientSession } from '@astrale-os/kernel-client/session'
 
-import { call } from '@astrale-os/kernel-client'
-import * as sessionModule from '@astrale-os/kernel-client/session'
-import { Domain } from '@astrale-os/sdk/domain'
-import { Path } from '@astrale-os/sdk/graph/path'
+import { bind } from '@astrale-os/kernel-client/domain'
 
 const ADMIN_ORIGIN = 'admin.astrale.ai'
 
-type DynamicCallable =
-  | (Definition<'function'> & { readonly path: NonNullable<Definition<'function'>['path']> })
-  | StaticMethod
-  | InstanceMethod
+export type AdminBinding = DomainBinding
 
-export interface AdminBindingOperations {
-  readonly installation: unknown
-  readonly publication: SessionSnapshot['publication']
-  invoke(
-    callable: DynamicCallable,
-    receiverOrInput: PathLike | Input,
-    inputOrOptions?: Input | SessionRequestOptions,
-    options?: SessionRequestOptions,
-  ): Promise<unknown>
-}
-
-export type AdminBinding = RichDomain & {
-  readonly $: RichDomain['$'] & AdminBindingOperations
-}
-
-interface CompatibleCallableReference {
-  readonly origin: typeof ADMIN_ORIGIN
-  readonly revision: SessionSnapshot['publication']['schema']['revision']
-  readonly callable: Key.Callable
-  readonly target: PathLike
-  readonly outputMode: DynamicCallable['definition']['output']['mode']
-}
-
-interface CompatibleSession {
-  readonly installation?: (origin: typeof ADMIN_ORIGIN) => Promise<unknown>
-  readonly installed?: (origin: typeof ADMIN_ORIGIN) => Promise<unknown>
-  readonly invoke?: (
-    reference: CompatibleCallableReference,
-    input: Input,
-    options?: SessionRequestOptions,
-  ) => Promise<unknown>
-}
-
-type LegacyDispatchBound = (
-  session: ClientSession,
-  request: ReturnType<typeof call>,
-  expected: {
-    readonly schema: { readonly revision: CompatibleCallableReference['revision'] }
-    readonly publication: {
-      readonly origin: SessionSnapshot['publication']['origin']
-      readonly identity: SessionSnapshot['publication']['identity']
-      readonly revision: CompatibleCallableReference['revision']
-      readonly etag: SessionSnapshot['publication']['etag']
-    }
-  },
-  options?: SessionRequestOptions,
-) => Promise<Result>
-
-/** Bind the Admin revision advertised by this exact Session snapshot. */
+/** Bind the exact Admin revision installed on this source Kernel. */
 export async function bindAdmin(session: ClientSession): Promise<AdminBinding> {
-  const snapshot = await session.snapshot()
-  if (
-    snapshot.publication.origin !== ADMIN_ORIGIN ||
-    snapshot.bundle.root.origin !== ADMIN_ORIGIN
-  ) {
+  const installed = await session.installed(ADMIN_ORIGIN)
+  const binding = bind(session, installed)
+  if (binding.$.publication?.origin !== ADMIN_ORIGIN || binding.$.origin !== ADMIN_ORIGIN) {
     throw new TypeError('Configured Admin target does not serve the Admin Domain.')
   }
-  const compatible = session as unknown as CompatibleSession
-  const resolveInstallation = compatible.installation ?? compatible.installed
-  if (resolveInstallation === undefined) {
-    throw new TypeError('Client Session cannot resolve an installed Admin Domain.')
-  }
-  const installation = await resolveInstallation.call(session, ADMIN_ORIGIN)
-  const domain = Domain.fromSchema(snapshot.bundle.root)
-  const invoke = ((
-    callable: DynamicCallable,
-    receiverOrInput: PathLike | Input,
-    inputOrOptions?: Input | SessionRequestOptions,
-    options?: SessionRequestOptions,
-  ) => {
-    const target =
-      'on' in callable ? callable.on(Path.from(receiverOrInput as PathLike)) : callable.path
-    const reference: CompatibleCallableReference = Object.freeze({
-      origin: ADMIN_ORIGIN,
-      revision: snapshot.publication.schema.revision,
-      callable: callable.key as Key.Callable,
-      target,
-      outputMode: callable.definition.output.mode,
-    })
-    return invokeCompatible(
-      session,
-      snapshot,
-      reference,
-      ('on' in callable ? inputOrOptions : receiverOrInput) as Input,
-      ('on' in callable ? options : inputOrOptions) as SessionRequestOptions | undefined,
-    )
-  }) as AdminBindingOperations['invoke']
-
-  return Object.freeze({
-    ...domain,
-    $: Object.freeze({
-      ...domain.$,
-      installation,
-      publication: snapshot.publication,
-      invoke,
-    }),
-  }) as AdminBinding
-}
-
-async function invokeCompatible(
-  session: ClientSession,
-  snapshot: SessionSnapshot,
-  reference: CompatibleCallableReference,
-  input: Input,
-  options: SessionRequestOptions | undefined,
-): Promise<unknown> {
-  const current = session as unknown as CompatibleSession
-  if (current.invoke !== undefined) return current.invoke(reference, input, options)
-
-  const dispatchBound = (sessionModule as unknown as { dispatchBound?: LegacyDispatchBound })
-    .dispatchBound
-  if (dispatchBound === undefined) {
-    throw new TypeError('Client Session cannot invoke an exact Admin publication.')
-  }
-  const result = await dispatchBound(
-    session,
-    call(reference.target, input),
-    {
-      schema: { revision: reference.revision },
-      publication: {
-        origin: snapshot.publication.origin,
-        identity: snapshot.publication.identity,
-        revision: snapshot.publication.schema.revision,
-        etag: snapshot.publication.etag,
-      },
-    },
-    options,
-  )
-  return requireOutput(reference.outputMode, result)
-}
-
-function requireOutput(
-  expected: CompatibleCallableReference['outputMode'],
-  result: Result,
-): unknown {
-  if (result.kind !== expected) {
-    if (result.kind === 'stream') void result.stream.cancel(`Admin callable declared ${expected}.`)
-    throw new TypeError(`Admin callable declared ${expected} output but returned ${result.kind}.`)
-  }
-  return result.kind === 'stream' ? result.stream : result.value
+  return binding
 }

package/src/lib/__tests__/admin-target.test.ts

@@ -6,6 +6,7 @@ import {
   DEFAULT_ADMIN_TARGET_NAME,
   DEFAULT_ADMIN_DOMAIN_ISSUER,
   DEFAULT_ADMIN_TARGET_URL,
+  defaultAdminTargetForChannel,
   resolveAdminTargetFromStore,
 } from '../admin-target'
 import { DEFAULT_CONFIG, type AstraleConfig } from '../config'
@@ -32,6 +33,17 @@ const instances: InstanceStore = {
 }
 
 describe('resolveAdminTargetFromStore', () => {
+  test('derives hosted Admin defaults from the release channel', () => {
+    expect(defaultAdminTargetForChannel('beta')).toEqual({
+      url: 'https://admin.eu.beta.astrale.ai/api',
+      domainIssuer: 'https://admin.beta.astrale.ai',
+    })
+    expect(defaultAdminTargetForChannel('stable')).toEqual({
+      url: 'https://admin.eu.astrale.ai/api',
+      domainIssuer: 'https://admin.astrale.ai',
+    })
+  })
+
   test('uses hosted admin default without active instance coupling', () => {
     expect(resolveAdminTargetFromStore({}, DEFAULT_CONFIG, instances)).toEqual({
       name: DEFAULT_ADMIN_TARGET_NAME,

package/src/lib/__tests__/idp.test.ts

@@ -63,8 +63,11 @@ describe('IdP schemas and token helpers', () => {
     expect(config?.client.token_request_format).toBe('json')
   })
 
-  test('does not invent a WorkOS environment when no client id is configured', () => {
-    expect(builtinIdpConfig('workos', undefined, {})).toBeNull()
+  test('builds the built-in WorkOS IdP with the public client id by default', () => {
+    const config = builtinIdpConfig('workos', undefined, {})
+
+    expect(config?.entry.builtIn).toBe(true)
+    expect(config?.client.client_id).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
   })
 
   test('reads WorkOS client id from WORKOS_CLIENT_ID before VITE_WORKOS_CLIENT_ID', () => {
@@ -75,8 +78,10 @@ describe('IdP schemas and token helpers', () => {
       }),
     ).toBe('client_primary')
     expect(workosClientIdFromEnv({ VITE_WORKOS_CLIENT_ID: 'client_vite' })).toBe('client_vite')
-    expect(workosClientIdFromEnv({})).toBeUndefined()
-    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBeUndefined()
+    expect(workosClientIdFromEnv({})).toBe('client_01KC29HET5F3QAQ8GNTPZ7F320')
+    expect(workosClientIdFromEnv({ WORKOS_CLIENT_ID: '   ' })).toBe(
+      'client_01KC29HET5F3QAQ8GNTPZ7F320',
+    )
   })
 
   test('stores client secret env names, not secret material', () => {

package/src/lib/admin-target.ts

@@ -5,11 +5,30 @@ import type { InstanceStore } from './instance'
 
 import { AstraleError } from '../errors'
 import { readInstances, resolveInstanceKey } from './instance'
+import { DEFAULT_UPDATE_CHANNEL } from './update'
 import { isHttpUrl } from './validation'
 
 export const DEFAULT_ADMIN_TARGET_NAME = 'admin'
-export const DEFAULT_ADMIN_TARGET_URL = 'https://admin.eu.astrale.ai/api'
-export const DEFAULT_ADMIN_DOMAIN_ISSUER = 'https://admin.beta.astrale.ai'
+
+export function defaultAdminTargetForChannel(channel: string): {
+  readonly url: string
+  readonly domainIssuer: string
+} {
+  return channel === 'stable'
+    ? {
+        url: 'https://admin.eu.astrale.ai/api',
+        domainIssuer: 'https://admin.astrale.ai',
+      }
+    : {
+        url: 'https://admin.eu.beta.astrale.ai/api',
+        domainIssuer: 'https://admin.beta.astrale.ai',
+      }
+}
+
+const DEFAULT_ADMIN_TARGET = defaultAdminTargetForChannel(DEFAULT_UPDATE_CHANNEL)
+
+export const DEFAULT_ADMIN_TARGET_URL = DEFAULT_ADMIN_TARGET.url
+export const DEFAULT_ADMIN_DOMAIN_ISSUER = DEFAULT_ADMIN_TARGET.domainIssuer
 
 export const DEFAULT_ADMIN_TARGET_CONFIG = {
   name: DEFAULT_ADMIN_TARGET_NAME,