@astrale-os/cli 1.0.0-beta.30 → 1.0.0-beta.32

package/dist/public/connect-core.js

@@ -22743,6 +22743,20 @@ function date4(params) {
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/lib/credential-lifetime.ts
+function remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds = Math.ceil(Date.now() / 1000)) {
+  if (!Number.isSafeInteger(expiresAtEpochSeconds) || !Number.isSafeInteger(nowEpochSeconds)) {
+    throw new TypeError("Credential expiration and current time must be safe epoch seconds.");
+  }
+  return expiresAtEpochSeconds - nowEpochSeconds - 1;
+}
+function credentialLifetimeCovers(expiresAtEpochSeconds, minimumRemainingSeconds, nowEpochSeconds) {
+  if (!Number.isSafeInteger(minimumRemainingSeconds) || minimumRemainingSeconds < 1) {
+    throw new TypeError("Credential minimum lifetime must be a positive safe integer.");
+  }
+  return remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds) >= minimumRemainingSeconds;
+}
+
 // src/state/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -24130,18 +24144,25 @@ function isSessionExpired(session, skewMs = 60000) {
     return false;
   return new Date(expiresAt).getTime() <= Date.now() + skewMs;
 }
-function accessTokenForAudience(session, audience) {
+function accessTokenForAudience(session, audience, minimumRemainingMs = 60000) {
   if (audience === undefined) {
-    return isSessionExpired(session) ? undefined : session.access_token;
+    return tokenHasMinimumLifetime(session, minimumRemainingMs) ? session.access_token : undefined;
   }
   const entry = session.tokens?.[audience];
-  if (entry && !isSessionExpired(entry))
+  if (entry && tokenHasMinimumLifetime(entry, minimumRemainingMs))
     return entry.access_token;
-  if (!isSessionExpired(session) && tokenAudienceMatches(session.access_token, audience)) {
+  if (tokenHasMinimumLifetime(session, minimumRemainingMs) && tokenAudienceMatches(session.access_token, audience)) {
     return session.access_token;
   }
   return;
 }
+function tokenHasMinimumLifetime(value2, minimumRemainingMs) {
+  const expiration = decodeTokenClaims(value2.access_token)?.exp;
+  if (typeof expiration === "number" && Number.isSafeInteger(expiration)) {
+    return credentialLifetimeCovers(expiration, Math.ceil(minimumRemainingMs / 1000));
+  }
+  return !isSessionExpired(value2, minimumRemainingMs);
+}
 function withCachedToken(tokens, accessToken, expiresAt) {
   const next = {};
   for (const [aud2, entry] of Object.entries(tokens ?? {})) {
@@ -25047,10 +25068,11 @@ function idpSessionLockPath(identityName) {
   return `${idpSessionPath(identityName)}.lock`;
 }
 async function ensureFreshSession(identityName, opts = {}) {
+  const minimumRemainingMs = minimumLifetimeMs(opts.minimumRemainingSeconds);
   const session = await readIdpSession(identityName);
   if (!session)
     throw new IdpSessionMissingError(identityName);
-  if (accessTokenForAudience(session, opts.audience))
+  if (accessTokenForAudience(session, opts.audience, minimumRemainingMs))
     return session;
   if (!session.refresh_token)
     throw new IdpSessionNoRefreshTokenError(identityName);
@@ -25058,7 +25080,7 @@ async function ensureFreshSession(identityName, opts = {}) {
     const current = await readIdpSession(identityName);
     if (!current)
       throw new IdpSessionMissingError(identityName);
-    if (accessTokenForAudience(current, opts.audience))
+    if (accessTokenForAudience(current, opts.audience, minimumRemainingMs))
       return current;
     const bookmarkOrg = opts.organizationId ?? (opts.audience ? await orgIdForAudience(opts.audience) : undefined);
     const organizationId = bookmarkOrg ?? (opts.audience ? await (opts.resolveOrganizationId ?? fetchOrgHint)(opts.audience) : undefined);
@@ -25077,23 +25099,30 @@ async function ensureFreshSession(identityName, opts = {}) {
           });
         }
       }
-      const rescued = await rescueAfterInvalidGrant(identityName, current, opts.audience, e);
+      const rescued = await rescueAfterInvalidGrant(identityName, current, opts.audience, minimumRemainingMs, e);
       if (rescued)
         return rescued;
       throw e;
     }
   });
 }
-async function rescueAfterInvalidGrant(identityName, seen, audience, error51) {
+async function rescueAfterInvalidGrant(identityName, seen, audience, minimumRemainingMs, error51) {
   if (!(error51 instanceof OAuthTokenError) || error51.code !== "invalid_grant")
     return;
   const latest = await readIdpSession(identityName).catch(() => null);
   if (!latest || latest.updatedAt === seen.updatedAt)
     return;
-  if (!accessTokenForAudience(latest, audience))
+  if (!accessTokenForAudience(latest, audience, minimumRemainingMs))
     return;
   return latest;
 }
+function minimumLifetimeMs(input) {
+  const seconds = input ?? 60;
+  if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > Math.floor(Number.MAX_SAFE_INTEGER / 1000)) {
+    throw new TypeError("IdP session minimum lifetime must be a positive safe integer.");
+  }
+  return seconds * 1000;
+}
 
 // src/connection/auth.ts
 async function resolveCredential(opts, config2, audience = config2.issuer, registrationKey) {
@@ -25108,14 +25137,14 @@ async function resolveCredential(opts, config2, audience = config2.issuer, regis
       resolvedIdentity = identity3;
       resolvedName = identityName;
       if ((identity3.source ?? "key") === "idp")
-        return await resolveIdpAccessToken(identityName, identity3, audience);
+        return await resolveIdpAccessToken(identityName, identity3, audience, opts.minimumRemainingSeconds);
       return await signAs(identity3.subject, KEYS_DIR, resolveKeyIdentityAuthOptions(identity3, config2, audience, registrationKey));
     }
     const identity2 = await getDefault();
     resolvedIdentity = identity2;
     resolvedName = identity2.name;
     if ((identity2.source ?? "key") === "idp") {
-      return await resolveIdpAccessToken(identity2.name, identity2, audience);
+      return await resolveIdpAccessToken(identity2.name, identity2, audience, opts.minimumRemainingSeconds);
     }
     return await signAs(identity2.subject, KEYS_DIR, resolveKeyIdentityAuthOptions(identity2, config2, audience, registrationKey));
   } catch (e) {
@@ -25157,10 +25186,10 @@ function resolveKeyIdentityAuthOptions(identity2, config2, audience = config2.is
 function systemIdentityIssuer(identity2, audience, config2) {
   return identity2.subject === "system" ? audience : config2.issuer;
 }
-async function resolveIdpAccessToken(identityName, identity2, audience) {
+async function resolveIdpAccessToken(identityName, identity2, audience, minimumRemainingSeconds) {
   let resolved;
   try {
-    resolved = await ensureFreshSession(identityName, { audience });
+    resolved = await ensureFreshSession(identityName, { audience, minimumRemainingSeconds });
   } catch (e) {
     if (e instanceof IdpSessionMissingError) {
       throw new Error(`No cached IdP session for "${identityName}". Run: astrale auth login --idp ${identity2.idp ?? "<idp>"}`);

package/dist/public/keys/index.js

@@ -15613,6 +15613,20 @@ function date4(params) {
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/lib/credential-lifetime.ts
+function remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds = Math.ceil(Date.now() / 1000)) {
+  if (!Number.isSafeInteger(expiresAtEpochSeconds) || !Number.isSafeInteger(nowEpochSeconds)) {
+    throw new TypeError("Credential expiration and current time must be safe epoch seconds.");
+  }
+  return expiresAtEpochSeconds - nowEpochSeconds - 1;
+}
+function credentialLifetimeCovers(expiresAtEpochSeconds, minimumRemainingSeconds, nowEpochSeconds) {
+  if (!Number.isSafeInteger(minimumRemainingSeconds) || minimumRemainingSeconds < 1) {
+    throw new TypeError("Credential minimum lifetime must be a positive safe integer.");
+  }
+  return remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds) >= minimumRemainingSeconds;
+}
+
 // src/state/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";

package/dist/public/paths/index.js

@@ -14446,6 +14446,20 @@ function date4(params) {
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/lib/credential-lifetime.ts
+function remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds = Math.ceil(Date.now() / 1000)) {
+  if (!Number.isSafeInteger(expiresAtEpochSeconds) || !Number.isSafeInteger(nowEpochSeconds)) {
+    throw new TypeError("Credential expiration and current time must be safe epoch seconds.");
+  }
+  return expiresAtEpochSeconds - nowEpochSeconds - 1;
+}
+function credentialLifetimeCovers(expiresAtEpochSeconds, minimumRemainingSeconds, nowEpochSeconds) {
+  if (!Number.isSafeInteger(minimumRemainingSeconds) || minimumRemainingSeconds < 1) {
+    throw new TypeError("Credential minimum lifetime must be a positive safe integer.");
+  }
+  return remainingCredentialLifetimeSeconds(expiresAtEpochSeconds, nowEpochSeconds) >= minimumRemainingSeconds;
+}
+
 // src/state/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";

package/dist/types/connection/auth.d.ts

@@ -26,6 +26,7 @@ export declare function resolveCredential(opts: {
     as?: string;
     creds?: string;
     defaultIdentity?: string;
+    minimumRemainingSeconds?: number;
 }, config: AstraleConfig, audience?: string, registrationKey?: string): Promise<string>;
 export declare function resolveKeyIdentityAuthOptions(identity: Identity, config: AstraleConfig, audience?: string, registrationKey?: string): KeyIdentityAuthOptions;
 export declare function classifyNoRefreshTokenError(requestedAudience: string, sourceAudience: string | undefined, error: IdpSessionNoRefreshTokenError): IdpSessionNoRefreshTokenError | IdpAudienceMismatchError;

package/dist/types/connection/credential.d.ts

@@ -7,7 +7,7 @@ export interface SourceCredentialResolver {
     resolve(audience: IssuerId, signal: AbortSignal): Promise<string>;
 }
 /** Resolve source authority; an omitted Session delegation preserves exact current authority. */
-export declare function createConnectionCredential(expectedSourceIssuer: IssuerId, source: SourceCredentialResolver): SessionAuth;
+export declare function createConnectionCredential(expectedSourceIssuer: IssuerId, source: SourceCredentialResolver, ttlSeconds?: number): SessionAuth;
 /** Bind CLI identity state and Core Auth delegation to one Session auth capability. */
 export declare function createCliCredential(target: ConnectionTarget, options: ConnectionOptions, config: AstraleConfig, fetch?: Fetch, timeoutMs?: number): SessionAuth | undefined;
 /** Reject contradictory explicit credential selections before identity or network access. */

package/dist/types/connection/lifetime.d.ts

@@ -0,0 +1,6 @@
+/** Cover the complete command deadline while preserving the existing short-command floor. */
+export declare function invocationCredentialTtlSeconds(timeoutMs: number): number;
+/** Leave the final carrier lifetime intact after source delegation and issuer exchange settle. */
+export declare function exchangeCredentialTtlSeconds(timeoutMs: number): number;
+/** Refresh a cached token before the final Session carrier can cross a second boundary. */
+export declare function cachedCredentialTtlSeconds(timeoutMs: number): number;

package/dist/types/lib/credential-lifetime.d.ts

@@ -0,0 +1,3 @@
+/** Whole seconds safely available after second-boundary rounding and carrier handoff. */
+export declare function remainingCredentialLifetimeSeconds(expiresAtEpochSeconds: number, nowEpochSeconds?: number): number;
+export declare function credentialLifetimeCovers(expiresAtEpochSeconds: number, minimumRemainingSeconds: number, nowEpochSeconds?: number): boolean;

package/dist/types/lib/idp-session.d.ts

@@ -12,6 +12,8 @@ export declare class IdpSessionNoRefreshTokenError extends Error {
 export type EnsureFreshSessionOptions = {
     audience?: string;
     organizationId?: string;
+    /** Minimum source-token lifetime required before the caller starts its operation. */
+    minimumRemainingSeconds?: number;
     /**
      * Org-hint resolver, consulted only when a refresh actually happens.
      * Defaults to `fetchOrgHint`; injectable for tests.

package/dist/types/lib/idp.d.ts

@@ -196,7 +196,7 @@ export declare function isSessionExpired(session: Pick<IdpSession, 'expires_at'>
  * top-level token's own `aud` claim. Without an `audience`, freshness of the
  * top-level token is the only requirement.
  */
-export declare function accessTokenForAudience(session: IdpSession, audience?: string): string | undefined;
+export declare function accessTokenForAudience(session: IdpSession, audience?: string, minimumRemainingMs?: number): string | undefined;
 /**
  * Fold a freshly minted access token into the per-audience map under every
  * `aud` it carries, dropping entries that have already expired.

package/dist/types/state/exchange-credentials.d.ts

@@ -21,7 +21,7 @@ export declare class ExchangeCredentialCache {
     private readonly path;
     private readonly refreshing;
     constructor(path?: string);
-    getOrRefresh(key: exchange.Key, refresh: () => Promise<exchange.Entry>, now?: () => number): Promise<string>;
+    getOrRefresh(key: exchange.Key, minimumRemainingSeconds: number, refresh: () => Promise<exchange.Entry>, now?: () => number): Promise<string>;
     deleteKernel(kernelIssuer: string): Promise<void>;
     clear(): Promise<void>;
     private getOrRefreshOnce;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.30",
+  "version": "1.0.0-beta.32",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",

package/src/commands/__tests__/read-commands.test.ts

@@ -195,7 +195,7 @@ describe('query command', () => {
 
     await queryCommand([], {
       json: true,
-      definition: '/:issues.astrale.ai:class.Issue',
+      class: '/:issues.astrale.ai:class.Issue',
       limit: '20',
     })
 
@@ -239,7 +239,7 @@ describe('query command', () => {
 
     await queryCommand([], {
       json: true,
-      definition: '/:issues.astrale.ai:class.Issue',
+      class: '/:issues.astrale.ai:class.Issue',
       limit: '1',
     })
 

package/src/commands/query.ts

@@ -14,7 +14,7 @@ import { isMachine, output } from '../lib/output'
 type QueryOpts = KernelCommandOpts & {
   ast?: string
   file?: string
-  definition?: string
+  class?: string
   edge?: string
   direction?: QueryDirection
   limit?: string
@@ -28,7 +28,7 @@ export async function queryCommand(sources: string[], opts: QueryOpts): Promise<
     input = {
       sources,
       ...(ast === undefined ? {} : { ast }),
-      definition: opts.definition,
+      class: opts.class,
       edge: opts.edge,
       direction: opts.direction,
       limit: opts.limit,
@@ -103,7 +103,7 @@ export default {
   description: 'Run one canonical Query V6 graph read',
   afterHelpText: `
 Behavior:
-  Positional Paths and --definition author a finite Query V6 read. --edge adds
+  Positional Paths and --class author a finite Query V6 read. --edge adds
   one exact Edge-Class expansion; --direction defaults to outgoing. --ast and
   --file accept a complete canonical astrale.graph.query/v6 document, including
   Property ordering and Node or Edge reference/value projections. --cursor resumes
@@ -115,7 +115,7 @@ Behavior:
 
 Examples:
   $ astrale query /:notes.example.dev:class.Note --limit 50
-  $ astrale query --definition /:notes.example.dev:class.Note --limit 50
+  $ astrale query --class /:notes.example.dev:class.Note --limit 50
   $ astrale query @note --edge /:notes.example.dev:class.references --direction outgoing --limit 25
   $ astrale query --file query.v6.json --cursor "$CURSOR"
 `,
@@ -124,7 +124,7 @@ Examples:
     { flags: '--ast <json>', description: 'Canonical Query V6 JSON document' },
     { flags: '-f, --file <path>', description: 'Read a canonical Query V6 document from a file' },
     {
-      flags: '--definition <path>',
+      flags: '--class <path>',
       description: 'Select Nodes satisfying one exact Class',
     },
     { flags: '--edge <class>', description: 'Expand one exact Edge Class' },

package/src/commands/update.ts

@@ -112,7 +112,8 @@ async function refreshSdkDeps(check: boolean, assumeYes = false): Promise<boolea
  * unified and NON-THROWING: an explicit package-managed result uses npm release
  * identity, while script-install failures remain script failures in `error`
  * instead of being recategorized. The SDK axis is already best-effort. Skills
- * report meaningful health/freshness states without exposing installer metadata.
+ * report meaningful health/freshness states. A current cohort also exposes its exact
+ * source revision, skill trees, and entrypoints without leaking installer-local paths.
  */
 export type StaleReport = {
   stale: boolean
@@ -237,7 +238,7 @@ Behavior:
   script installs only — if Astrale was installed by another package manager this
   command refuses so that manager stays in charge; downloads are checksum-verified
   before the binary is replaced. (2) The Astrale agent skills: installs every
-  top-level skill published from astrale-os/cli main, updates healthy older
+  top-level skill published from one resolved astrale-os/cli main commit, updates healthy older
   installs, repairs inconsistent installs, and verifies the result before
   reporting success. (3) SDK deps: inside a pnpm domain
   project, proposes any @astrale-os/* dependency with a newer release and, on

package/src/connection/.spec/architecture.md

@@ -31,8 +31,11 @@ current Grant for routing. Connection itself persists no credential or route; th
 owner persists exchanged source credentials and the separate Kernel Client route artifact. A valid exchanged credential is selected by the
 authenticated source issuer and subject before any live `whoami`; cache misses alone resolve the
 registered Kernel User and perform delegation plus Domain exchange.
-Exchange authority is bounded to five minutes and never outlives the current source credential,
-matching the CLI route-age ceiling without forcing an unrelated two-minute refresh cycle.
+Exchange and destination-carrier authority cover the selected command timeout plus one bounded
+receipt margin, never outlive the current source credential, and retain the existing one-minute
+floor for short commands. A cached or freshly exchanged credential that cannot cover that lifetime
+is refreshed or rejected before destination dispatch, so a long durable mutation does not first
+discover expired callback authority after its provider effect commits.
 
 Every ClientSession receives the CLI-owned `state/session-routes` representation capability. Kernel
 Client still owns route keying, admission, expiry, and one safe stale/miss recovery; Connection does

package/src/connection/.spec/flows/session.ts

@@ -24,8 +24,9 @@ declare const resolveSourceCredential: (
 ) => Promise<string>
 /** Bind source authority without learning or minting destination credentials. */
 function createConnectionAuth(target: ConnectionTarget, options: ConnectionOptions): SessionAuth {
+  const ttlSeconds = Math.max(60, Math.ceil(resolveTimeoutMs(options.timeout) / 1_000) + 5)
   return {
-    ttlSeconds: 3_600,
+    ttlSeconds,
     async resolve(_call: Call, signal: AbortSignal) {
       return {
         credential: await resolveSourceCredential(target, options, target.issuer, signal),

package/src/connection/.spec/laws/connection.ts

@@ -135,12 +135,20 @@ export const CLI_CONNECTION_TERMINAL_CLOSE = defineLaw({
 export const CLI_CONNECTION_TIMEOUT = defineLaw({
   id: 'CLI-CONNECTION-TIMEOUT',
   statement:
-    'The CLI accepts only a positive integer timeout before constructing a Client Session and applies it to both source-Auth and Session operations.',
+    'The CLI accepts only a positive integer timeout before constructing a Client Session, applies it to source-Auth and Session operations, and requires exchanged and destination-carrier authority to cover that timeout plus the bounded receipt margin before destination dispatch.',
   tests: [
     {
       file: '__tests__/session.test.ts',
       id: 'TEST-CLI-CONNECTION-REJECTS-INVALID-TIMEOUT-BEFORE-OPEN',
     },
+    {
+      file: '__tests__/credential.test.ts',
+      id: 'TEST-CLI-CONNECTION-CARRIER-COVERS-COMMAND-TIMEOUT',
+    },
+    {
+      file: '__tests__/exchange.test.ts',
+      id: 'TEST-CLI-EXCHANGE-REJECTS-INSUFFICIENT-LIFETIME',
+    },
   ],
 })
 

package/src/connection/.spec/layout.ts

@@ -11,6 +11,7 @@ export default defineLayout({
     'failure/',
     'exchange.ts',
     'index.ts',
+    'lifetime.ts',
     'reasons.ts',
     'self.ts',
     'session.ts',

package/src/connection/__tests__/credential.test.ts

@@ -3,9 +3,13 @@ import type { SessionAuth } from '@astrale-os/sdk/client/session'
 import { issuer, type IssuerId } from '@astrale-os/sdk/auth'
 import { Path } from '@astrale-os/sdk/graph/path'
 import { describe, expect, test } from 'bun:test'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 
 import type { AstraleConfig } from '../../lib/config'
 
+import { persistKeypair, signAs } from '../../keys/index'
 import { bindCredentialIdentity } from '../auth'
 import { createCliCredential, createConnectionCredential } from '../credential'
 
@@ -77,6 +81,117 @@ describe('connection credential', () => {
     expect(resolved.delegate?.ttlSeconds).toBeLessThan(120)
   })
 
+  /** @evidence TEST-CLI-CONNECTION-CARRIER-COVERS-COMMAND-TIMEOUT */
+  test('covers a long command deadline with one destination carrier', async () => {
+    const expiresAt = Math.ceil(Date.now() / 1_000) + 300
+    const auth = createConnectionCredential(SOURCE, { resolve: async () => token(expiresAt) }, 185)
+
+    await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).resolves.toMatchObject({
+      credential: token(expiresAt),
+      delegate: { ttlSeconds: 185 },
+    })
+    expect(auth.ttlSeconds).toBe(185)
+  })
+
+  test('real local-key credentials cover the supported long-operation carrier', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'astrale-carrier-key-'))
+    try {
+      await persistKeypair('alice', { keysDir: directory })
+      const source = await signAs('alice', directory, {
+        issuer: SOURCE,
+        audience: SOURCE,
+      })
+      const auth = createConnectionCredential(SOURCE, { resolve: async () => source }, 185)
+
+      await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).resolves.toMatchObject({
+        credential: source,
+        delegate: { ttlSeconds: 185 },
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('real five-minute local-key credentials reject a 600-second carrier before dispatch', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'astrale-carrier-ceiling-key-'))
+    try {
+      await persistKeypair('alice', { keysDir: directory })
+      const source = await signAs('alice', directory, {
+        issuer: SOURCE,
+        audience: SOURCE,
+      })
+      const auth = createConnectionCredential(SOURCE, { resolve: async () => source }, 605)
+
+      await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).rejects.toMatchObject({
+        code: 'CREDENTIAL_LIFETIME_INSUFFICIENT',
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('derives every destination carrier lifetime from the selected CLI timeout', () => {
+    for (const target of [
+      { url: `${SOURCE}/invoke`, kernelIssuer: SOURCE },
+      {
+        url: `${SOURCE}/invoke`,
+        kernelIssuer: SOURCE,
+        domainIssuer: issuer.accept('https://admin.example'),
+      },
+    ]) {
+      const auth = createCliCredential(target, {}, config, globalThis.fetch, 180_000)
+      expect(auth?.ttlSeconds).toBe(185)
+    }
+  })
+
+  test('rejects a long command before dispatch when its source bearer is too short', async () => {
+    const expiresAt = Math.ceil(Date.now() / 1_000) + 120
+    const auth = createConnectionCredential(SOURCE, { resolve: async () => token(expiresAt) }, 185)
+
+    await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).rejects.toMatchObject({
+      code: 'CREDENTIAL_LIFETIME_INSUFFICIENT',
+    })
+  })
+
+  test('rejects an inspectable short or expired bearer before a default command dispatch', async () => {
+    for (const expiresAt of [
+      Math.ceil(Date.now() / 1_000) + 30,
+      Math.ceil(Date.now() / 1_000) - 30,
+    ]) {
+      const auth = createConnectionCredential(SOURCE, {
+        resolve: async () => token(expiresAt),
+      })
+      await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).rejects.toMatchObject({
+        code: 'CREDENTIAL_LIFETIME_INSUFFICIENT',
+      })
+    }
+  })
+
+  test('rejects a too-short explicit Domain bearer before exchange or destination I/O', async () => {
+    let fetches = 0
+    const expiresAt = Math.ceil(Date.now() / 1_000) + 120
+    const auth = createCliCredential(
+      {
+        url: `${SOURCE}/invoke`,
+        kernelIssuer: SOURCE,
+        domainIssuer: issuer.accept('https://admin.example'),
+      },
+      { creds: token(expiresAt) },
+      config,
+      async () => {
+        fetches += 1
+        throw new Error('network must remain untouched')
+      },
+      180_000,
+    )
+    if (auth === undefined) throw new Error('expected authenticated credential')
+
+    await expect(auth.resolve(TARGET_CALL, new AbortController().signal)).rejects.toMatchObject({
+      code: 'CREDENTIAL_LIFETIME_INSUFFICIENT',
+    })
+    expect(fetches).toBe(0)
+  })
+
   /** @evidence TEST-CLI-CONNECTION-USES-RAW-SOURCE-CREDENTIAL */
   test('binds explicit CLI credentials to source-Kernel auth only', async () => {
     const auth = createCliCredential(