@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/commands/__tests__/auth-token.test.ts

@@ -1,223 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-const cliRoot = join(import.meta.dir, '../../..')
-
-let tmp: string
-
-beforeEach(async () => {
-  tmp = await mkdtemp(join(tmpdir(), 'astrale-auth-token-'))
-  await mkdir(join(tmp, 'idp-sessions'), { recursive: true })
-  await writeFile(
-    join(tmp, 'identities.json'),
-    JSON.stringify(
-      {
-        default: 'alice',
-        identities: {
-          alice: {
-            subject: 'user_123',
-            createdAt: '2026-01-01T00:00:00.000Z',
-            source: 'idp',
-            mode: 'remote',
-            idp: 'workos',
-            issuer: 'https://api.workos.com',
-          },
-        },
-      },
-      null,
-      2,
-    ) + '\n',
-  )
-  await writeFile(
-    join(tmp, 'idp-sessions', 'alice.json'),
-    JSON.stringify(
-      {
-        identity: 'alice',
-        idp: 'workos',
-        issuer: 'https://api.workos.com',
-        subject: 'user_123',
-        access_token: 'access-token-123',
-        id_token: 'id-token-123',
-        token_type: 'Bearer',
-        scope: 'openid profile email',
-        expires_at: '2999-01-01T00:00:00.000Z',
-        updatedAt: '2026-01-01T00:00:00.000Z',
-      },
-      null,
-      2,
-    ) + '\n',
-  )
-})
-
-afterEach(async () => {
-  await rm(tmp, { recursive: true, force: true })
-})
-
-describe('auth token command', () => {
-  test('prints the active IdP access token with --raw', async () => {
-    const result = await runAuthToken('--raw')
-
-    expect(result.exitCode).toBe(0)
-    expect(result.stdout).toBe('access-token-123\n')
-    expect(result.stderr).toBe('')
-  })
-
-  test('can select by IdP and print id token metadata as JSON', async () => {
-    const result = await runAuthToken('--idp', 'workos', '--type', 'id', '--json')
-
-    expect(result.exitCode).toBe(0)
-    expect(result.stderr).toBe('')
-
-    const body = JSON.parse(result.stdout) as { identity: string; type: string; token: string }
-    expect(body.identity).toBe('alice')
-    expect(body.type).toBe('id')
-    expect(body.token).toBe('id-token-123')
-  })
-
-  test('two parallel CLI processes refresh a single-use token exactly once', async () => {
-    const server = rotationServer()
-    try {
-      await writeExpiredSessionWithIdp(server.url)
-
-      const [a, b] = await Promise.all([runAuthToken('--raw'), runAuthToken('--raw')])
-
-      expect(a.exitCode).toBe(0)
-      expect(b.exitCode).toBe(0)
-      expect(a.stdout).toBe(b.stdout)
-      expect(server.refreshCount()).toBe(1)
-    } finally {
-      await server.stop()
-    }
-  })
-
-  test('an IdP outage does not tell the user to re-login', async () => {
-    const server = rotationServer({ status: 503 })
-    try {
-      await writeExpiredSessionWithIdp(server.url)
-
-      const result = await runAuthToken('--raw')
-
-      expect(result.exitCode).toBe(1)
-      expect(result.stderr).not.toContain('astrale auth login')
-    } finally {
-      await server.stop()
-    }
-  })
-
-  test('--no-refresh prints the cached token without contacting the IdP', async () => {
-    const server = rotationServer()
-    try {
-      await writeExpiredSessionWithIdp(server.url)
-
-      const result = await runAuthToken('--raw', '--no-refresh')
-
-      expect(result.exitCode).toBe(0)
-      expect(result.stdout).toBe('expired-access-token\n')
-      expect(server.refreshCount()).toBe(0)
-    } finally {
-      await server.stop()
-    }
-  })
-})
-
-async function writeExpiredSessionWithIdp(baseUrl: string): Promise<void> {
-  await mkdir(join(tmp, 'idps', 'test'), { recursive: true })
-  await writeFile(
-    join(tmp, 'idps', 'index.json'),
-    JSON.stringify({
-      idps: {
-        test: {
-          issuer: baseUrl,
-          createdAt: '2026-01-01T00:00:00.000Z',
-          updatedAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }),
-  )
-  await writeFile(
-    join(tmp, 'idps', 'test', 'metadata.json'),
-    JSON.stringify({
-      issuer: baseUrl,
-      token_endpoint: `${baseUrl}/token`,
-      jwks_uri: `${baseUrl}/jwks`,
-    }),
-  )
-  await writeFile(join(tmp, 'idps', 'test', 'client.json'), JSON.stringify({ client_id: 'c_1' }))
-  await writeFile(
-    join(tmp, 'idp-sessions', 'alice.json'),
-    JSON.stringify({
-      identity: 'alice',
-      idp: 'test',
-      issuer: baseUrl,
-      subject: 'user_123',
-      access_token: 'expired-access-token',
-      refresh_token: 'rt-0',
-      token_type: 'Bearer',
-      expires_at: new Date(Date.now() - 3_600_000).toISOString(),
-      updatedAt: '2026-01-01T00:00:00.000Z',
-    }),
-  )
-}
-
-function rotationServer(opts?: { status?: number }): {
-  url: string
-  refreshCount: () => number
-  stop: () => Promise<void>
-} {
-  // WorkOS-style single-use rotation: presenting anything but the CURRENT
-  // refresh token is invalid_grant.
-  let current = 'rt-0'
-  let count = 0
-  const server = Bun.serve({
-    port: 0,
-    fetch: async (request) => {
-      const url = new URL(request.url)
-      if (url.pathname !== '/token') return new Response('not found', { status: 404 })
-      if (opts?.status) {
-        return Response.json({ error_description: 'unavailable' }, { status: opts.status })
-      }
-      const form = new URLSearchParams(await request.text())
-      if (form.get('refresh_token') !== current) {
-        return Response.json(
-          { error: 'invalid_grant', error_description: 'Refresh token already exchanged.' },
-          { status: 400 },
-        )
-      }
-      await new Promise((r) => setTimeout(r, 50))
-      count += 1
-      current = `rt-${count}`
-      return Response.json({
-        access_token: `rotated-access-${count}`,
-        refresh_token: current,
-        token_type: 'Bearer',
-        expires_in: 3600,
-      })
-    },
-  })
-  return {
-    url: `http://${server.hostname}:${server.port}`,
-    refreshCount: () => count,
-    stop: () => server.stop(true),
-  }
-}
-
-async function runAuthToken(...args: string[]): Promise<{
-  exitCode: number
-  stdout: string
-  stderr: string
-}> {
-  const proc = Bun.spawn({
-    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'auth', 'token', ...args],
-    env: { ...process.env, ASTRALE_HOME: tmp },
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
-  ])
-  return { exitCode, stdout, stderr }
-}

package/src/commands/__tests__/call-describe.test.ts

@@ -1,80 +0,0 @@
-import { Path } from '@astrale-os/sdk/graph/path'
-import { bundle, defineSchema, func, method, nodeClass } from '@astrale-os/sdk/schema'
-import { describe, expect, test } from 'bun:test'
-
-import { describeCallableFromBundle } from '../call-describe'
-
-const createInstance = method({
-  auth: 'authenticated',
-  description: 'Create one child Instance.',
-  input: {
-    type: 'object',
-    properties: { operationId: { type: 'string' }, slug: { type: 'string' } },
-    required: ['operationId', 'slug'],
-    additionalProperties: false,
-  },
-  output: { type: 'object', additionalProperties: true },
-  static: true,
-})
-const inspectInstance = method({
-  auth: 'authenticated',
-  description: 'Inspect one child Instance.',
-  input: { type: 'object', properties: {}, additionalProperties: false },
-  output: { type: 'object', additionalProperties: true },
-})
-const journal = func({
-  auth: 'authenticated',
-  description: 'Read the authorized Kernel journal.',
-  input: { type: 'object', properties: {}, additionalProperties: false },
-  output: { type: 'object', additionalProperties: true },
-})
-const source = defineSchema('host.astrale.ai', {
-  classes: {
-    Manager: nodeClass({ methods: { createInstance } }),
-    Instance: nodeClass({ methods: { inspectInstance } }),
-  },
-  functions: { journal },
-})
-const installed = bundle.create(source)
-
-describe('describeCallableFromBundle', () => {
-  test('reads a static Class method from the resolved Domain', () => {
-    const described = describeCallableFromBundle(
-      Path.parse('/:host.astrale.ai:class.Manager:createInstance'),
-      installed,
-    )
-    expect(described).toMatchObject({
-      origin: 'host.astrale.ai',
-      class: 'Manager',
-      method: 'createInstance',
-      dispatch: 'static',
-      description: 'Create one child Instance.',
-      auth: 'authenticated',
-    })
-    expect(described?.input).toMatchObject({ required: ['operationId', 'slug'] })
-  })
-
-  test('finds one instance method when the receiver Path is not a Class projection', () => {
-    expect(
-      describeCallableFromBundle(
-        Path.parse('/:host.astrale.ai:core.manager::inspectInstance'),
-        installed,
-      ),
-    ).toMatchObject({
-      origin: 'host.astrale.ai',
-      class: 'Instance',
-      method: 'inspectInstance',
-      dispatch: 'instance',
-    })
-  })
-
-  test('reads a standalone Function from the resolved Domain', () => {
-    expect(
-      describeCallableFromBundle(Path.parse('/:host.astrale.ai:function.journal'), installed),
-    ).toMatchObject({
-      origin: 'host.astrale.ai',
-      function: 'journal',
-      description: 'Read the authorized Kernel journal.',
-    })
-  })
-})

package/src/commands/__tests__/call.test.ts

@@ -1,63 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { materializeCallResult } from '../call'
-
-describe('call command result lifetime', () => {
-  /** @evidence TEST-CLI-CALL-DRAINS-STREAM-IN-CONNECTION-ACTION */
-  test('drains a session-backed stream before returning it for presentation', async () => {
-    let sessionOpen = true
-    async function* stream() {
-      for (const value of ['first', 'second']) {
-        if (!sessionOpen) throw new Error('session closed before stream consumption')
-        yield value
-      }
-    }
-
-    const sessionStream = Object.assign(stream(), { async cancel() {} })
-    const materialized = await materializeCallResult({
-      kind: 'stream',
-      invocation: { source: 'https://kernel.test' as never, id: 'test-stream' },
-      stream: sessionStream,
-    })
-    sessionOpen = false
-
-    expect(materialized).toEqual({ kind: 'stream', values: ['first', 'second'] })
-    expect(Object.isFrozen(materialized)).toBe(true)
-    if (materialized.kind !== 'stream') throw new Error('expected a materialized stream')
-    expect(Object.isFrozen(materialized.values)).toBe(true)
-  })
-
-  test('drains streaming binary bytes before the command session closes', async () => {
-    let sessionOpen = true
-    async function* body() {
-      for (const chunk of [new Uint8Array([1, 2]), new Uint8Array([3])]) {
-        if (!sessionOpen) throw new Error('session closed before binary consumption')
-        yield chunk
-      }
-    }
-
-    const materialized = await materializeCallResult({
-      kind: 'binary',
-      invocation: { source: 'https://kernel.test' as never, id: 'test-binary' },
-      value: {
-        body: body(),
-        mediaType: 'application/octet-stream',
-        status: 206,
-        headers: { 'content-range': 'bytes 0-2/3' },
-      },
-    })
-    sessionOpen = false
-
-    expect(materialized).toMatchObject({
-      kind: 'binary',
-      value: {
-        mediaType: 'application/octet-stream',
-        status: 206,
-        headers: { 'content-range': 'bytes 0-2/3' },
-      },
-    })
-    if (materialized.kind !== 'binary') throw new Error('expected materialized binary')
-    expect([...materialized.value.body]).toEqual([1, 2, 3])
-    expect(Object.isFrozen(materialized.value)).toBe(true)
-  })
-})

package/src/commands/__tests__/domain-install-operation.test.ts

@@ -1,145 +0,0 @@
-import { defineSchema } from '@astrale-os/sdk/schema'
-import { afterEach, describe, expect, mock, test } from 'bun:test'
-
-import { releaseFor } from '../../__tests__/fixtures/publication'
-import { installDirect } from '../domain/install'
-
-const GENERATED = '4a4c9a18-50f6-4d84-a7b7-2d83e3e45dc8'
-const RETRY = '139137b5-af47-47ce-92b2-b64a2b0c63d7'
-
-const originalFetch = globalThis.fetch
-
-const schema = defineSchema('crm.test', {})
-const deployed = releaseFor(schema, 'https://crm.test').publication
-
-function publicationResponse(): Response {
-  return Response.json(deployed)
-}
-
-class ExitError extends Error {}
-
-afterEach(() => {
-  globalThis.fetch = originalFetch
-})
-
-describe('direct domain install operation identity', () => {
-  test('generates one operation before transport and exposes it for recovery', async () => {
-    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
-    const create = mock(() => GENERATED)
-    const requests: unknown[] = []
-    let recovery: unknown
-
-    await installDirect(
-      'https://crm.test',
-      { direct: true, json: true },
-      {
-        createOperationId: create,
-        runKernelCommand: async (input) => {
-          recovery = input.recovery
-          requests.push(
-            await input.fn({
-              session: { schema: { install: async (input: unknown) => input } },
-            } as never),
-          )
-        },
-      },
-    )
-
-    expect(create).toHaveBeenCalledTimes(1)
-    expect(requests).toEqual([
-      {
-        operation: GENERATED,
-        domains: [{ publication: { url: 'https://crm.test' } }],
-      },
-    ])
-    expect(recovery).toEqual({
-      operation: GENERATED,
-      retry: `astrale domain install https://crm.test --direct --operation ${GENERATED}`,
-    })
-  })
-
-  test('accepts an explicit operation only as the exact retry identity', async () => {
-    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
-    const create = mock(() => GENERATED)
-    const accepted: string[] = []
-    const requests: unknown[] = []
-
-    await installDirect(
-      'https://crm.test',
-      { direct: true, operation: RETRY, json: true },
-      {
-        createOperationId: create,
-        acceptOperationId: (input) => {
-          accepted.push(String(input))
-          return RETRY
-        },
-        runKernelCommand: async (input) => {
-          requests.push(
-            await input.fn({
-              session: { schema: { install: async (input: unknown) => input } },
-            } as never),
-          )
-        },
-      },
-    )
-
-    expect(create).not.toHaveBeenCalled()
-    expect(accepted).toEqual([RETRY])
-    expect(requests).toEqual([
-      {
-        operation: RETRY,
-        domains: [{ publication: { url: 'https://crm.test' } }],
-      },
-    ])
-  })
-
-  test('keeps identity-override consent warnings out of machine output', async () => {
-    globalThis.fetch = mock(async () => publicationResponse()) as unknown as typeof fetch
-    const originalError = console.error
-    const warnings: unknown[][] = []
-    console.error = (...args: unknown[]) => {
-      warnings.push(args)
-    }
-    try {
-      await installDirect(
-        'https://alias.test',
-        { direct: true, json: true, allowIdentityOverride: true },
-        {
-          createOperationId: () => GENERATED,
-          runKernelCommand: async () => undefined,
-        },
-      )
-    } finally {
-      console.error = originalError
-    }
-
-    expect(warnings).toEqual([])
-  })
-
-  test('rejects a non-UUID operation before metadata or Kernel transport', async () => {
-    const originalExit = process.exit
-    const originalWrite = process.stderr.write
-    const fetch = mock(async () => publicationResponse())
-    const run = mock(async () => undefined)
-    globalThis.fetch = fetch as unknown as typeof globalThis.fetch
-    process.exit = (() => {
-      throw new ExitError('exit')
-    }) as typeof process.exit
-    process.stderr.write = (() => true) as typeof process.stderr.write
-    try {
-      await expect(
-        installDirect(
-          'https://crm.test',
-          { direct: true, operation: 'guessable-operation', json: true },
-          { runKernelCommand: run },
-        ),
-      ).rejects.toBeInstanceOf(ExitError)
-    } finally {
-      process.exit = originalExit
-      process.stderr.write = originalWrite
-    }
-
-    expect(fetch).not.toHaveBeenCalled()
-    expect(run).not.toHaveBeenCalled()
-  })
-})

package/src/commands/__tests__/domain-install-owned.test.ts

@@ -1,191 +0,0 @@
-import { ResponseError } from '@astrale-os/sdk/client'
-import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
-
-import type { OwnedInstanceInfo } from '../../lib/admin-instance'
-
-class ExitError extends Error {
-  constructor(readonly code: string | number | null | undefined) {
-    super(`process.exit(${String(code)})`)
-  }
-}
-
-const calls: Array<{ path: string; params: unknown }> = []
-let inventory: OwnedInstanceInfo[] = []
-const TEST_INVOCATION = {
-  source: 'https://kernel.test',
-  id: 'domain-install-owned',
-} as ConstructorParameters<typeof ResponseError>[2]
-
-const hostCall = mock(async (call: { target: string; input: unknown }): Promise<unknown> => {
-  const path = call.target
-  const params = call.input
-  calls.push({ path, params })
-  throw new Error(`Unexpected admin call: ${path}`)
-})
-
-mock.module('../../connection', () => ({
-  createPathCall: (path: string, input: unknown) => ({
-    target: path,
-    input,
-  }),
-  runKernelCommand: mock(),
-  withAdminClientSession: async (
-    _opts: unknown,
-    run: (ctx: { session: { call: typeof hostCall } }) => Promise<unknown>,
-  ) => run({ session: { call: hostCall } }),
-}))
-
-let stderr = ''
-let originalExit: typeof process.exit
-let originalStderrWrite: typeof process.stderr.write
-
-beforeEach(() => {
-  calls.length = 0
-  inventory = []
-  stderr = ''
-  hostCall.mockClear()
-  originalExit = process.exit
-  originalStderrWrite = process.stderr.write.bind(process.stderr)
-  process.exit = ((code?: string | number | null) => {
-    throw new ExitError(code)
-  }) as typeof process.exit
-  process.stderr.write = ((chunk: string | Uint8Array) => {
-    stderr += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8')
-    return true
-  }) as typeof process.stderr.write
-})
-
-afterEach(() => {
-  process.exit = originalExit
-  process.stderr.write = originalStderrWrite
-})
-
-async function runInstall(instance: string): Promise<void> {
-  const { installViaAdmin } = await import('../domain/install')
-  await installViaAdmin(
-    'crm.acme.dev',
-    {
-      instance,
-      json: true,
-      noPrompt: true,
-    },
-    { listInstances: async () => inventory },
-  )
-}
-
-describe('admin domain install owner boundary', () => {
-  test('rejects a foreign target after the V2 graph inventory without attempting an install', async () => {
-    inventory = [
-      {
-        id: 'owned-id',
-        slug: 'owned',
-        url: 'https://owned.eu.astrale.ai',
-        state: 'ready',
-      },
-    ]
-
-    await expect(runInstall('foreign')).rejects.toEqual(new ExitError(1))
-
-    expect(JSON.parse(stderr)).toMatchObject({
-      error: 'INSTANCE_NOT_MANAGED',
-      message: 'Instance "foreign" is not admin-managed (managed: owned).',
-    })
-    expect(calls).toEqual([])
-  })
-
-  test.each([
-    {
-      state: 'provisioning' as const,
-      phase: 'installing:default-domains',
-      error: undefined,
-    },
-    {
-      state: 'failed' as const,
-      phase: undefined,
-      error: 'postInstall failed',
-    },
-  ])('rejects an owned $state target before the install RPC', async (status) => {
-    inventory = [
-      {
-        id: `${status.state}-id`,
-        slug: 'owned',
-        url: 'https://owned.eu.astrale.ai',
-        ...status,
-      },
-    ]
-
-    await expect(runInstall('owned')).rejects.toEqual(new ExitError(1))
-
-    const payload = JSON.parse(stderr) as { error: string; message: string; hint?: string }
-    expect(payload.error).toBe('INSTANCE_NOT_READY')
-    expect(payload.message).toContain(`Instance "owned" is ${status.state}`)
-    expect(payload.hint).toBe(status.error ?? 'Run: astrale instance status owned')
-    expect(calls).toEqual([])
-    expect(calls).toEqual([])
-  })
-
-  test('preserves an incompatible issuer reason returned through Admin', async () => {
-    inventory = [
-      {
-        id: 'owned-id',
-        slug: 'owned',
-        url: 'https://owned.eu.astrale.ai',
-        state: 'ready',
-      },
-    ]
-    const domain = {
-      id: 'crm-id',
-      origin: 'crm.acme.dev',
-      name: 'CRM',
-      url: 'https://crm.acme.dev',
-      createdAt: '2026-08-20T00:00:00.000Z',
-      updatedAt: '2026-08-20T00:00:00.000Z',
-    }
-    const failure = new ResponseError(5001, 'Schema operation is not supported.', TEST_INVOCATION, {
-      code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
-      details: {
-        phase: 'upgrade',
-        origin: domain.origin,
-        issue: 'issuer-changed',
-        installedIssuer: 'https://old.example',
-        replacementIssuer: 'https://new.example',
-      },
-    })
-    const { installViaAdmin } = await import('../domain/install')
-
-    await expect(
-      installViaAdmin(
-        domain.origin,
-        {
-          instance: 'owned',
-          json: true,
-          noPrompt: true,
-        },
-        {
-          listInstances: async () => inventory,
-          listDomains: async () => [domain],
-          install: async () => {
-            throw failure
-          },
-        },
-      ),
-    ).rejects.toEqual(new ExitError(1))
-
-    expect(JSON.parse(stderr)).toEqual({
-      error: 'RESPONSE_ERROR',
-      code: 5001,
-      message: 'Schema operation is not supported.',
-      reason: {
-        code: 'SCHEMA_UPGRADE_INCOMPATIBLE',
-        details: {
-          phase: 'upgrade',
-          origin: 'crm.acme.dev',
-          issue: 'issuer-changed',
-          installedIssuer: 'https://old.example',
-          replacementIssuer: 'https://new.example',
-        },
-      },
-      hint: expect.stringContaining('astrale domain uninstall crm.acme.dev'),
-    })
-  })
-})