@astrale-os/cli 1.0.0-beta.3 → 1.0.0-beta.31

package/src/admin/instance/index.ts

@@ -5,10 +5,9 @@ export {
   type AdminInstanceDependencies,
 } from './client'
 export {
-  AdminHostNotFoundError,
   AdminInstanceNotFoundError,
   findOwnedInstance,
-  formatInstanceLocation,
+  formatInstanceState,
   type DomainInstallReceipt,
   type InstanceInfo,
   type InstanceState,

package/src/admin/instance/model.ts

@@ -7,10 +7,11 @@ export interface InstanceInfo {
   readonly url: string
   readonly hostId?: string
   readonly region?: string
-  readonly state?: InstanceState
+  readonly state: InstanceState
   readonly phase?: string
   readonly error?: string | null
   readonly createdAt?: string
+  readonly updatedAt?: string
   readonly organizationId?: string
 }
 
@@ -28,19 +29,13 @@ export interface DomainInstallReceipt {
   readonly error?: string
 }
 
-export class AdminInstanceNotFoundError extends Error {
-  readonly name = 'NotFoundError'
-
-  constructor(readonly identifier: string) {
-    super(`No owned Admin Instance matches ${JSON.stringify(identifier)}.`)
-  }
-}
-
-export class AdminHostNotFoundError extends Error {
-  readonly name = 'NotFoundError'
-
+export class AdminInstanceNotFoundError extends AstraleError {
   constructor(readonly identifier: string) {
-    super(`No caller-usable Admin Host matches ${JSON.stringify(identifier)}.`)
+    super(
+      'INSTANCE_NOT_FOUND',
+      `No owned Admin Instance matches ${JSON.stringify(identifier)}.`,
+      'Run `astrale instance list` to see your instances.',
+    )
   }
 }
 
@@ -57,9 +52,8 @@ export function findOwnedInstance(
   )
 }
 
-/** Human-readable location of an Instance (state, region, and Host Path). */
-export function formatInstanceLocation(info: InstanceInfo): string {
-  return [info.state && info.state !== 'ready' ? info.state : undefined, info.region, info.hostId]
-    .filter(Boolean)
-    .join(' · ')
+/** Human-readable non-ready lifecycle state for one Instance. */
+export function formatInstanceState(info: InstanceInfo): string {
+  return info.state === 'ready' ? '' : `${info.state}${info.phase ? ` (${info.phase})` : ''}`
 }
+import { AstraleError } from '../../errors'

package/src/commands/__tests__/admin-instance.test.ts

@@ -4,7 +4,10 @@ import type { IdentityStore } from '../../identity/index'
 
 import { AuthError } from '../../errors'
 import { findOwnedInstance, type OwnedInstanceInfo } from '../../lib/admin-instance'
-import { assertAlphaCreateIdentity } from '../instance/create'
+import {
+  assertInstanceCreateIdentity,
+  selectInstanceCreateIdentity,
+} from '../../lib/provision-instance'
 
 describe('admin-backed instance commands', () => {
   test('findOwnedInstance matches owner inventory by slug or stable node id', () => {
@@ -14,8 +17,6 @@ describe('admin-backed instance commands', () => {
       url: 'https://demo.eu.astrale.ai',
       state: 'failed',
       organizationId: 'org_123',
-      hostId: 'host-1',
-      region: 'eu',
       phase: 'installing:default-domains',
       error: 'postInstall failed',
       createdAt: '2026-07-16T00:00:00.000Z',
@@ -39,8 +40,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store)).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store)).toThrow('WorkOS login required')
+    expect(() => assertInstanceCreateIdentity(store)).toThrow(AuthError)
+    expect(() => assertInstanceCreateIdentity(store)).toThrow('WorkOS login required')
   })
 
   test('instance create preflight accepts IdP-backed identities', () => {
@@ -58,7 +59,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store)).not.toThrow()
+    expect(() => assertInstanceCreateIdentity(store)).not.toThrow()
+    expect(selectInstanceCreateIdentity(store)).toBe('bryan')
   })
 
   test('--as selection must also be IdP-backed', () => {
@@ -82,7 +84,8 @@ describe('admin-backed instance commands', () => {
       },
     }
 
-    expect(() => assertAlphaCreateIdentity(store, { as: 'local' })).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store, { as: 'workos' })).not.toThrow()
+    expect(() => assertInstanceCreateIdentity(store, { as: 'local' })).toThrow(AuthError)
+    expect(() => assertInstanceCreateIdentity(store, { as: 'workos' })).not.toThrow()
+    expect(selectInstanceCreateIdentity(store, { as: 'workos' })).toBe('workos')
   })
 })

package/src/commands/__tests__/call-describe.test.ts

@@ -1,34 +1,47 @@
 import { Path } from '@astrale-os/sdk/graph/path'
+import { bundle, defineSchema, func, method, nodeClass } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
-import { describeCallableFromSchema } from '../call-describe'
+import { describeCallableFromBundle } from '../call-describe'
 
-const schema = {
-  classes: {
-    Manager: {
-      methods: {
-        createInstance: {
-          auth: 'authorized',
-          description: 'Create one child Instance.',
-          input: { type: 'object', required: ['operationId', 'slug'] },
-          output: { mode: 'value' },
-        },
-      },
-    },
+const createInstance = method({
+  auth: 'authenticated',
+  description: 'Create one child Instance.',
+  input: {
+    type: 'object',
+    properties: { operationId: { type: 'string' }, slug: { type: 'string' } },
+    required: ['operationId', 'slug'],
+    additionalProperties: false,
   },
-  functions: {
-    journal: {
-      description: 'Read the authorized Kernel journal.',
-      input: { type: 'object' },
-    },
+  output: { type: 'object', additionalProperties: true },
+  static: true,
+})
+const inspectInstance = method({
+  auth: 'authenticated',
+  description: 'Inspect one child Instance.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const journal = func({
+  auth: 'authenticated',
+  description: 'Read the authorized Kernel journal.',
+  input: { type: 'object', properties: {}, additionalProperties: false },
+  output: { type: 'object', additionalProperties: true },
+})
+const source = defineSchema('host.astrale.ai', {
+  classes: {
+    Manager: nodeClass({ methods: { createInstance } }),
+    Instance: nodeClass({ methods: { inspectInstance } }),
   },
-}
+  functions: { journal },
+})
+const installed = bundle.create(source)
 
-describe('describeCallableFromSchema', () => {
-  test('reads a static Class method from the Domain schema', () => {
-    const described = describeCallableFromSchema(
+describe('describeCallableFromBundle', () => {
+  test('reads a static Class method from the resolved Domain', () => {
+    const described = describeCallableFromBundle(
       Path.parse('/:host.astrale.ai:class.Manager:createInstance'),
-      schema,
+      installed,
     )
     expect(described).toMatchObject({
       origin: 'host.astrale.ai',
@@ -36,30 +49,30 @@ describe('describeCallableFromSchema', () => {
       method: 'createInstance',
       dispatch: 'static',
       description: 'Create one child Instance.',
-      auth: 'authorized',
+      auth: 'authenticated',
     })
     expect(described?.input).toMatchObject({ required: ['operationId', 'slug'] })
   })
 
-  test('finds an instance method when the receiver Path is not a Class projection', () => {
+  test('finds one instance method when the receiver Path is not a Class projection', () => {
     expect(
-      describeCallableFromSchema(
-        Path.parse('/:host.astrale.ai:core.manager::createInstance'),
-        schema,
+      describeCallableFromBundle(
+        Path.parse('/:host.astrale.ai:core.manager::inspectInstance'),
+        installed,
       ),
     ).toMatchObject({
       origin: 'host.astrale.ai',
-      class: 'Manager',
-      method: 'createInstance',
+      class: 'Instance',
+      method: 'inspectInstance',
       dispatch: 'instance',
     })
   })
 
-  test('reads a standalone Function from the Domain schema', () => {
+  test('reads a standalone Function from the resolved Domain', () => {
     expect(
-      describeCallableFromSchema(Path.parse('/:kernel.astrale.ai:function.journal'), schema),
+      describeCallableFromBundle(Path.parse('/:host.astrale.ai:function.journal'), installed),
     ).toMatchObject({
-      origin: 'kernel.astrale.ai',
+      origin: 'host.astrale.ai',
       function: 'journal',
       description: 'Read the authorized Kernel journal.',
     })

package/src/commands/__tests__/call.test.ts

@@ -26,4 +26,38 @@ describe('call command result lifetime', () => {
     if (materialized.kind !== 'stream') throw new Error('expected a materialized stream')
     expect(Object.isFrozen(materialized.values)).toBe(true)
   })
+
+  test('drains streaming binary bytes before the command session closes', async () => {
+    let sessionOpen = true
+    async function* body() {
+      for (const chunk of [new Uint8Array([1, 2]), new Uint8Array([3])]) {
+        if (!sessionOpen) throw new Error('session closed before binary consumption')
+        yield chunk
+      }
+    }
+
+    const materialized = await materializeCallResult({
+      kind: 'binary',
+      invocation: { source: 'https://kernel.test' as never, id: 'test-binary' },
+      value: {
+        body: body(),
+        mediaType: 'application/octet-stream',
+        status: 206,
+        headers: { 'content-range': 'bytes 0-2/3' },
+      },
+    })
+    sessionOpen = false
+
+    expect(materialized).toMatchObject({
+      kind: 'binary',
+      value: {
+        mediaType: 'application/octet-stream',
+        status: 206,
+        headers: { 'content-range': 'bytes 0-2/3' },
+      },
+    })
+    if (materialized.kind !== 'binary') throw new Error('expected materialized binary')
+    expect([...materialized.value.body]).toEqual([1, 2, 3])
+    expect(Object.isFrozen(materialized.value)).toBe(true)
+  })
 })

package/src/commands/__tests__/domain-install-operation.test.ts

@@ -1,9 +1,7 @@
-import { defineDomain } from '@astrale-os/sdk'
-import { issuer } from '@astrale-os/sdk/auth'
-import { createDeployment } from '@astrale-os/sdk/deployment'
-import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { afterEach, describe, expect, mock, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { installDirect } from '../domain/install'
 
 const GENERATED = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
@@ -12,16 +10,7 @@ const RETRY = '139137b5-af47-47ce-92b2-b64a2b0c63d7'
 const originalFetch = globalThis.fetch
 
 const schema = defineSchema('crm.test', {})
-const definition = defineDomain({
-  schema,
-  handlers: { functions: {}, classes: {}, interfaces: {} },
-})
-const deployed = createDeployment({
-  definition,
-  issuer: issuer.accept('https://crm.test'),
-  bundleHref: 'https://crm.test/domain.bundle.json',
-  bindings: { callables: [] },
-}).publication
+const deployed = releaseFor(schema, 'https://crm.test').publication
 
 function publicationResponse(): Response {
   return Response.json(deployed)
@@ -49,9 +38,7 @@ describe('direct domain install operation identity', () => {
           recovery = input.recovery
           requests.push(
             await input.fn({
-              session: {
-                call: async (call: { input: unknown }) => call.input,
-              },
+              session: { schema: { install: async (input: unknown) => input } },
             } as never),
           )
         },
@@ -62,7 +49,7 @@ describe('direct domain install operation identity', () => {
     expect(requests).toEqual([
       {
         operation: GENERATED,
-        domains: [{ source: { kind: 'remote', url: 'https://crm.test' } }],
+        domains: [{ publication: { url: 'https://crm.test' } }],
       },
     ])
     expect(recovery).toEqual({
@@ -89,9 +76,7 @@ describe('direct domain install operation identity', () => {
         runKernelCommand: async (input) => {
           requests.push(
             await input.fn({
-              session: {
-                call: async (call: { input: unknown }) => call.input,
-              },
+              session: { schema: { install: async (input: unknown) => input } },
             } as never),
           )
         },
@@ -103,11 +88,34 @@ describe('direct domain install operation identity', () => {
     expect(requests).toEqual([
       {
         operation: RETRY,
-        domains: [{ source: { kind: 'remote', url: 'https://crm.test' } }],
+        domains: [{ publication: { url: 'https://crm.test' } }],
       },
     ])
   })
 
+  test('keeps identity-override consent warnings out of machine output', async () => {
+    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
+    const originalError = console.error
+    const warnings: unknown[][] = []
+    console.error = (...args: unknown[]) => {
+      warnings.push(args)
+    }
+    try {
+      await installDirect(
+        'https://alias.test',
+        { direct: true, json: true, allowIdentityOverride: true },
+        {
+          createOperationId: () => GENERATED,
+          runKernelCommand: async () => undefined,
+        },
+      )
+    } finally {
+      console.error = originalError
+    }
+
+    expect(warnings).toEqual([])
+  })
+
   test('rejects a non-UUID operation before metadata or Kernel transport', async () => {
     const originalExit = process.exit
     const originalWrite = process.stderr.write

package/src/commands/__tests__/domain-install-owned.test.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '@astrale-os/kernel-client'
+import { ResponseError } from '@astrale-os/sdk/client'
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
 
 import type { OwnedInstanceInfo } from '../../lib/admin-instance'

package/src/commands/__tests__/domain-list.test.ts

@@ -1,11 +1,9 @@
-import { defineDomain } from '@astrale-os/sdk'
-import { issuer } from '@astrale-os/sdk/auth'
-import { createDeployment } from '@astrale-os/sdk/deployment'
-import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { defineSchema, schema as schemaApi } from '@astrale-os/sdk/schema'
 import { afterAll, describe, expect, test } from 'bun:test'
 
 import type { DomainInfo } from '../../lib/admin-domain'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { byDefaultThenName, domainProjection, probe, type DomainRow } from '../domain/list'
 
 const strip = (s: string): string => s.replace(/\[[0-9;]*m/g, '')
@@ -85,16 +83,7 @@ describe('domain list — canonical Publication check', () => {
 
   test('reports the admitted schema revision in machine data', async () => {
     const schema = defineSchema('catalog-check.example.dev', {})
-    const definition = defineDomain({
-      schema,
-      handlers: { functions: {}, classes: {}, interfaces: {} },
-    })
-    const deployed = createDeployment({
-      definition,
-      issuer: issuer.accept('https://catalog-check.example.dev'),
-      bundleHref: 'https://catalog-check.example.dev/domain.bundle.json',
-      bindings: { callables: [] },
-    }).publication
+    const deployed = releaseFor(schema, 'https://catalog-check.example.dev').publication
     const server = Bun.serve({
       port: 0,
       fetch(request) {
@@ -114,23 +103,14 @@ describe('domain list — canonical Publication check', () => {
       ),
     ).resolves.toMatchObject({
       reachable: true,
-      schemaRevision: definition.domain.$.revision,
+      schemaRevision: schemaApi.revision(schema),
       checkError: null,
     })
   })
 
   test('rejects a Publication whose origin differs from the catalog entry', async () => {
     const schema = defineSchema('deployed.example.dev', {})
-    const definition = defineDomain({
-      schema,
-      handlers: { functions: {}, classes: {}, interfaces: {} },
-    })
-    const deployed = createDeployment({
-      definition,
-      issuer: issuer.accept('https://deployed.example.dev'),
-      bundleHref: 'https://deployed.example.dev/domain.bundle.json',
-      bindings: { callables: [] },
-    }).publication
+    const deployed = releaseFor(schema, 'https://deployed.example.dev').publication
     const server = Bun.serve({
       port: 0,
       fetch: () => Response.json(deployed),

package/src/commands/__tests__/install-direct.test.ts

@@ -1,21 +1,128 @@
+import type { InstallResult } from '@astrale-os/sdk/client/schema'
+
+import { defineSchema, schema } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
-import { directInstallCallInput } from '../domain/install'
+import { directInstallCallInput, directInstallPresentation } from '../domain/install'
+
+const currentRevision = schema.revision(defineSchema('tasks.astrale.ai', {}))
 
 describe('directInstallCallInput', () => {
   test('sends the current remote install syscall, not a legacy url list', () => {
     const operation = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
-    expect(directInstallCallInput('https://tasks.example.test', operation, 'secret')).toEqual({
-      operation,
+    const input = directInstallCallInput('https://tasks.example.test', operation, 'secret')
+
+    expect(String(input.operation)).toBe(operation)
+    expect(input.domains).toEqual([
+      {
+        publication: {
+          url: 'https://tasks.example.test',
+          token: 'secret',
+        },
+      },
+    ])
+  })
+
+  test('presents a committed install from its receipt', () => {
+    const operation = directInstallCallInput(
+      'https://tasks.example.test',
+      '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8',
+    ).operation
+    const result = {
+      changed: true,
+      receipt: {
+        operation,
+        transitions: [
+          {
+            intent: {
+              transition: 'transition-1',
+              operation,
+              origin: 'tasks.astrale.ai',
+              previous: null,
+              generation: {
+                origin: 'tasks.astrale.ai',
+                revision: currentRevision,
+                generation: 'sha256:generation',
+              },
+            },
+            phase: 'cutover',
+            state: 'committed',
+          },
+        ],
+      },
+    } satisfies InstallResult
+
+    expect(directInstallPresentation(result, 'ignored')).toEqual({
+      operation: '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8',
+      origin: 'tasks.astrale.ai',
+      revision: currentRevision,
+      status: 'installed',
+    })
+  })
+
+  test('presents an idempotent install from the current Domain observation', () => {
+    const operation = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
+    const result = {
+      changed: false,
       domains: [
         {
-          source: {
-            kind: 'remote',
-            url: 'https://tasks.example.test',
-            token: 'secret',
-          },
+          origin: 'tasks.astrale.ai',
+          revision: currentRevision,
+          generation: 'sha256:generation',
+          publication: null,
+          readiness: 'sha256:readiness',
+          capabilities: { requested: {}, materialized: {} },
+          bindings: { callables: [], views: [] },
         },
       ],
+    } satisfies InstallResult
+
+    expect(directInstallPresentation(result, operation)).toEqual({
+      operation,
+      origin: 'tasks.astrale.ai',
+      revision: currentRevision,
+      status: 'already current',
     })
   })
+
+  test('rejects a changed result without a committed transition', () => {
+    const result = {
+      changed: true,
+      receipt: { operation: '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8', transitions: [] },
+    } as unknown as InstallResult
+
+    expect(() => directInstallPresentation(result, 'ignored')).toThrow(
+      'Kernel install returned no committed Domain transition.',
+    )
+  })
+
+  test('rejects a committed transition without an installed generation', () => {
+    const operation = directInstallCallInput(
+      'https://tasks.example.test',
+      '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8',
+    ).operation
+    const result = {
+      changed: true,
+      receipt: {
+        operation,
+        transitions: [
+          {
+            intent: {
+              transition: 'transition-1',
+              operation,
+              origin: 'tasks.astrale.ai',
+              previous: null,
+              generation: null,
+            },
+            phase: 'cutover',
+            state: 'committed',
+          },
+        ],
+      },
+    } satisfies InstallResult
+
+    expect(() => directInstallPresentation(result, 'ignored')).toThrow(
+      'Kernel install returned a committed transition without a Domain generation.',
+    )
+  })
 })

package/src/commands/__tests__/install-identity-override.test.ts

@@ -1,9 +1,7 @@
-import { defineDomain } from '@astrale-os/sdk'
-import { issuer } from '@astrale-os/sdk/auth'
-import { createDeployment } from '@astrale-os/sdk/deployment'
-import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { defineSchema } from '@astrale-os/sdk/schema'
 import { afterAll, describe, expect, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { domainRefFromTarget, isIdentityOverride, probeDeclaredOrigin } from '../domain/install'
 
 describe('admin-path target classification', () => {
@@ -47,16 +45,7 @@ describe('declared-origin Publication probe', () => {
 
   test('reads origin from a well-formed canonical Publication', async () => {
     const schema = defineSchema('crm.acme.dev', {})
-    const definition = defineDomain({
-      schema,
-      handlers: { functions: {}, classes: {}, interfaces: {} },
-    })
-    const deployed = createDeployment({
-      definition,
-      issuer: issuer.accept('https://crm.acme.dev'),
-      bundleHref: 'https://crm.acme.dev/domain.bundle.json',
-      bindings: { callables: [] },
-    }).publication
+    const deployed = releaseFor(schema, 'https://crm.acme.dev').publication
     const url = servePublication((req) =>
       new URL(req.url).pathname === '/.well-known/astrale/domain.json'
         ? Response.json(deployed)
@@ -65,11 +54,11 @@ describe('declared-origin Publication probe', () => {
     expect(await probeDeclaredOrigin(url)).toBe('crm.acme.dev')
   })
 
-  test('does not accept the removed pre-Kernel-V2 domainName shape', async () => {
-    const legacy = servePublication(() =>
+  test('does not accept a Publication without the canonical origin field', async () => {
+    const invalid = servePublication(() =>
       Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' }),
     )
-    expect(await probeDeclaredOrigin(legacy)).toBeUndefined()
+    expect(await probeDeclaredOrigin(invalid)).toBeUndefined()
   })
 
   test('degrades to undefined on invalid Publication, non-200, bad JSON, or dead host', async () => {

package/src/commands/__tests__/instance-list-rows.test.ts

@@ -5,7 +5,7 @@ import type { InstanceInfo } from '../../lib/admin-instance'
 import { buildInstanceRows, type Bookmark } from '../instance/list'
 
 const managed: InstanceInfo[] = [
-  { id: 'demo', slug: 'demo', url: 'https://demo.eu.astrale.ai', region: 'eu' },
+  { id: 'demo', slug: 'demo', url: 'https://demo.eu.astrale.ai', state: 'ready' },
 ]
 
 function bookmark(overrides: Partial<Bookmark> = {}): Bookmark {