@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/commands/idp/refresh.ts

@@ -1,38 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import {
-  fetchOidcMetadata,
-  readIdpConfigOrBuiltin,
-  upsertIdpConfig,
-  workosAuthKitMetadata,
-} from '../../lib/idp'
-import { log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'refresh',
-  description: 'Refresh discovery metadata for an identity provider',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: { raw?: boolean; json?: boolean }) => {
-    const existing = await readIdpConfigOrBuiltin(name)
-    const metadata =
-      existing.client.token_response === 'workos-authkit'
-        ? workosAuthKitMetadata(existing.entry.issuer)
-        : await fetchOidcMetadata(existing.entry.issuer)
-    const idp = await upsertIdpConfig({
-      name,
-      metadata,
-      client: existing.client,
-      builtIn: existing.entry.builtIn,
-    })
-
-    if (isMachine(opts)) {
-      output(idp, opts)
-      return
-    }
-
-    log.success(`IdP "${name}" discovery metadata refreshed`)
-    log.dim(`  issuer: ${idp.metadata.issuer}`)
-  },
-} satisfies CommandDefinition

package/src/commands/idp/remove.ts

@@ -1,36 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdentities } from '../../identity/index'
-import { removeIdpConfig } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'remove',
-  aliases: ['rm'],
-  description: 'Remove an identity provider',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [
-    { flags: '--force', description: 'Remove even when IdP-backed identities exist' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (name: string, opts: { force?: boolean; raw?: boolean; json?: boolean }) => {
-    const store = await readIdentities()
-    const dependents = Object.entries(store.identities)
-      .filter(([, identity]) => identity.source === 'idp' && identity.idp === name)
-      .map(([identityName]) => identityName)
-
-    if (dependents.length > 0 && !opts.force) {
-      throw new Error(
-        `IdP "${name}" is used by identities: ${dependents.join(', ')}. Re-run with --force or delete those identities first.`,
-      )
-    }
-
-    await removeIdpConfig(name)
-    if (opts.raw || opts.json) {
-      output({ removed: name, dependentIdentities: dependents }, opts)
-      return
-    }
-    log.success(`IdP "${name}" removed`)
-  },
-} satisfies CommandDefinition

package/src/commands/idp/show.ts

@@ -1,29 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdpConfigOrBuiltin } from '../../lib/idp'
-import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'show',
-  description: 'Show an identity provider configuration',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [
-    { flags: '--format <type>', description: 'Output format', choices: ['yaml', 'json'] },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (
-    name: string,
-    opts: { raw?: boolean; json?: boolean; format?: 'yaml' | 'json' },
-  ) => {
-    const idp = await readIdpConfigOrBuiltin(name)
-    output(
-      {
-        name: idp.name,
-        entry: idp.entry,
-        metadata: idp.metadata,
-        client: idp.client,
-      },
-      opts,
-    )
-  },
-} satisfies CommandDefinition

package/src/commands/instance/active.ts

@@ -1,73 +0,0 @@
-import chalk from 'chalk'
-
-import type { CommandDefinition } from '../../program/index'
-
-import { listOwnedInstances } from '../../lib/admin-instance'
-import { findOwnedInstance } from '../../lib/admin-instance'
-import { getActive, normalizeInstanceKernelUrl } from '../../lib/instance'
-import { log } from '../../lib/log'
-import { RAW_OUTPUT_OPTIONS, isMachine, output, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'active',
-  description: 'Show the currently active instance',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: RawOutputOpts) => {
-    try {
-      const isRaw = isMachine(opts)
-      const active = await resolveActiveForDisplay()
-      const { name } = active
-      const url = active.url ?? null
-      const createdAt = active.createdAt ?? null
-      const issuer = active.issuer ?? null
-      const defaultIdentity = active.defaultIdentity ?? null
-      const caFile = active.caFile ?? null
-
-      if (isRaw) {
-        output({ name, url, issuer, defaultIdentity, caFile, createdAt }, opts)
-        return
-      }
-
-      console.log(`${chalk.bold(name)} (${url ?? 'local'})`)
-      if (issuer && issuer !== url) log.dim(`  issuer:   ${issuer}`)
-      if (defaultIdentity) log.dim(`  identity: ${defaultIdentity}`)
-      if (caFile) log.dim(`  ca:       ${caFile}`)
-    } catch (e) {
-      log.error(e instanceof Error ? e.message : String(e))
-      process.exit(1)
-    }
-  },
-} satisfies CommandDefinition
-
-async function resolveActiveForDisplay(): Promise<{
-  name: string
-  url?: string
-  issuer?: string
-  defaultIdentity?: string
-  caFile?: string
-  createdAt?: string
-}> {
-  const active = await getActive()
-  if (active.url) {
-    return {
-      name: active.name,
-      url: active.url,
-      issuer: active.issuer,
-      defaultIdentity: active.defaultIdentity,
-      caFile: active.caFile,
-      createdAt: active.createdAt,
-    }
-  }
-
-  try {
-    const managed = findOwnedInstance(await listOwnedInstances({}), active.name)
-    if (!managed) return { name: active.name }
-    return {
-      name: managed.slug,
-      url: normalizeInstanceKernelUrl(managed.url),
-      createdAt: managed.createdAt,
-    }
-  } catch {
-    return { name: active.name }
-  }
-}

package/src/commands/instance/bookmark.ts

@@ -1,101 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { fetchWithCaFile } from '../../lib/ca-fetch'
-import {
-  findBookmarkTrustConflicts,
-  normalizeInstanceKernelUrl,
-  readInstances,
-  setActive,
-  upsertInstance,
-} from '../../lib/instance'
-import { fatal, log } from '../../lib/log'
-import { checkIssuerReachability } from '../../lib/meta'
-
-export default {
-  name: 'bookmark',
-  description: 'Register a reference to an existing remote instance',
-  arguments: [{ name: 'name', description: 'Bookmark name (free, required)', required: true }],
-  options: [
-    { flags: '--url <url>', description: 'URL of the remote instance (required)' },
-    { flags: '--issuer <url>', description: 'Kernel issuer/audience if different from URL' },
-    {
-      flags: '--domain-issuer <url>',
-      description: 'Product Domain issuer for standard token exchange',
-    },
-    { flags: '--ca <path>', description: 'CA certificate file to trust for this bookmark' },
-    {
-      flags: '--as <identity>',
-      description: 'Default identity for this bookmark',
-    },
-    { flags: '--use', description: 'Set as active instance after bookmarking' },
-    { flags: '--skip-probe', description: 'Skip the OIDC + JWKS liveness probe (still recorded)' },
-  ],
-  action: async (
-    name: string,
-    opts: {
-      url?: string
-      issuer?: string
-      domainIssuer?: string
-      ca?: string
-      as?: string
-      use?: boolean
-      skipProbe?: boolean
-    },
-  ) => {
-    try {
-      if (!opts.url) fatal(new Error('Missing required flag: --url <url>'))
-      const url = normalizeInstanceKernelUrl(opts.url)
-      const store = await readInstances()
-      const expectedIssuer = opts.issuer
-        ? normalizeInstanceKernelUrl(opts.issuer)
-        : store.instances[name]?.issuer
-      const effectiveCa = opts.ca ?? store.instances[name]?.caFile
-      const trustConflicts = findBookmarkTrustConflicts(store, name, url, effectiveCa)
-      if (trustConflicts.length > 0) {
-        log.warn(
-          `TLS trust differs for the same Kernel URL ${url}: ` +
-            `"${name}" uses ${describeCa(effectiveCa)}, while ${trustConflicts
-              .map((conflict) => `"${conflict.name}" uses ${describeCa(conflict.caFile)}`)
-              .join(', ')}. Remove or update stale bookmarks to avoid certificate surprises.`,
-        )
-      }
-
-      if (!opts.skipProbe) {
-        try {
-          const { issuer, keys } = await checkIssuerReachability(
-            url,
-            expectedIssuer,
-            effectiveCa ? fetchWithCaFile(effectiveCa) : undefined,
-          )
-          log.dim(`  iss=${issuer} keys=${keys.length}`)
-        } catch (e) {
-          log.dim('  (re-run with --skip-probe to bookmark anyway.)')
-          fatal(e)
-        }
-      }
-
-      const { entry, created } = await upsertInstance(name, {
-        url,
-        issuer: expectedIssuer,
-        domainIssuer: opts.domainIssuer,
-        caFile: opts.ca,
-        name,
-        kind: 'bookmark',
-        mode: 'remote',
-        defaultIdentity: opts.as,
-      })
-      log.success(`${created ? 'Bookmarked' : 'Updated bookmark'} "${name}" → ${entry.url}`)
-      if (opts.as) log.dim(`  default identity: ${opts.as}`)
-      if (opts.use) {
-        await setActive(name)
-        log.success(`Active instance: ${name}`)
-      }
-    } catch (e) {
-      fatal(e)
-    }
-  },
-} satisfies CommandDefinition
-
-function describeCa(caFile: string | null | undefined): string {
-  return caFile ? `CA ${caFile}` : 'the system trust store'
-}

package/src/commands/instance/create.ts

@@ -1,61 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { formatKernelError } from '../../connection/errors'
-import { ADMIN_TARGET_OPTIONS } from '../../lib/admin-target'
-import { isMachine, output } from '../../lib/output'
-import { promptText } from '../../lib/prompt'
-import { provisionInstance, type ProvisionOpts } from '../../lib/provision-instance'
-import { validateSlug } from '../../lib/validation'
-
-/** inquirer `validate` for a slug: true when valid, else the human message. */
-function slugError(value: string): true | string {
-  try {
-    validateSlug(value)
-    return true
-  } catch (e) {
-    return e instanceof Error ? e.message : 'Invalid slug'
-  }
-}
-
-export default {
-  name: 'create',
-  description: 'Provision an instance through the Admin control plane',
-  afterHelpText: `
-Behavior:
-  Requests a new Instance from the configured Admin Domain. The caller must be
-  logged in with WorkOS. Admin owns infrastructure placement. The new instance
-  becomes the active instance.
-
-  Run with no slug in a terminal and it prompts for one (validated live). With
-  no TTY — or --ci / --no-prompt — the slug argument is required up front, so
-  piped / CI / agent runs fail fast instead of waiting on input.
-
-Examples:
-  $ astrale auth login
-  $ astrale instance create demo
-`,
-  arguments: [{ name: 'id', description: 'Instance slug', required: false }],
-  options: [...ADMIN_TARGET_OPTIONS],
-  action: async (id: string | undefined, opts: ProvisionOpts) => {
-    try {
-      // Interactive (TTY only): prompt for the slug when omitted, with live
-      // validation. No TTY / --ci / --no-prompt / CI → the slug arg is required
-      // (fail fast, never hang a piped / agent / LLM run).
-      const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-      if (!id && interactive) id = await promptText('Instance slug', { validate: slugError })
-      if (!id) {
-        throw new Error('`instance create` needs a slug, e.g. `astrale instance create demo`.')
-      }
-
-      const { created } = await provisionInstance(id, opts)
-
-      if (isMachine(opts)) {
-        output(created, opts)
-        return
-      }
-    } catch (e) {
-      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
-      process.exit(1)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/instance/delete.ts

@@ -1,69 +0,0 @@
-import type { KernelCommandOpts } from '../../connection'
-import type { CommandDefinition } from '../../program/index'
-
-import { AdminInstanceNotFoundError } from '../../admin/instance'
-import { formatKernelError } from '../../connection/errors'
-import { deleteOwnedInstance } from '../../lib/admin-instance'
-import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { clearActive, readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
-import { log, withSpinner } from '../../lib/log'
-import { isMachine, output } from '../../lib/output'
-
-type DeleteOpts = KernelCommandOpts &
-  AdminTargetCommandOpts & {
-    keepBookmark?: boolean
-  }
-
-export default {
-  name: 'delete',
-  description: 'Delete an admin-managed instance through the admin kernel',
-  afterHelpText: `
-Behavior:
-  Calls Instance.delete on the configured admin kernel: best-effort decommission
-  of the instance's route and tenant reservation, then removes the Instance
-  projection. A same-name local bookmark is removed after the delete succeeds
-  unless --keep-bookmark is passed.
-`,
-  arguments: [{ name: 'id', description: 'Instance slug', required: true }],
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    { flags: '--keep-bookmark', description: 'Do not remove a same-name local bookmark' },
-  ],
-  action: async (id: string, opts: DeleteOpts) => {
-    // Teardown walks services + deprovisions — same saga-sized budget as create.
-    opts = { ...opts, timeout: opts.timeout ?? '240000' }
-    try {
-      const result = await withSpinner(
-        `Deleting instance ${id}`,
-        !isMachine(opts),
-        () => deleteOwnedInstance(opts, id),
-        { success: (deleted) => `Deleted instance: ${deleted.slug}` },
-      )
-
-      if (!opts.keepBookmark) {
-        const store = await readInstances()
-        const key = resolveInstanceKey(store, id)
-        if (key) await removeInstance(key)
-      }
-      await clearActive(id)
-
-      if (isMachine(opts)) {
-        output(result, opts)
-        return
-      }
-    } catch (e) {
-      // Bookmark-only id → no admin Instance → kernel NOT_FOUND. Point to
-      // `forget` (local drop) instead of surfacing the raw path error.
-      if (
-        e instanceof AdminInstanceNotFoundError &&
-        resolveInstanceKey(await readInstances(), id)
-      ) {
-        log.error(`No admin-managed instance "${id}".`)
-        log.dim(`  hint: it's a local bookmark — drop it with: astrale instance forget ${id}`)
-        process.exit(1)
-      }
-      await formatKernelError(e, isMachine(opts), undefined, opts.debug)
-      process.exit(1)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/instance/forget.ts

@@ -1,26 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { readInstances, removeInstance, resolveInstanceKey } from '../../lib/instance'
-import { fatal, log } from '../../lib/log'
-
-export default {
-  name: 'forget',
-  description: 'Drop a bookmark reference (never destructive kernel-side)',
-  afterHelpText: `
-Behavior:
-  Drops a bookmark reference only — never touches the remote kernel.
-  To destructively remove an admin-managed instance use \`astrale instance delete\`.
-`,
-  arguments: [{ name: 'name', description: 'Bookmark name (slug or name)', required: true }],
-  action: async (name: string) => {
-    try {
-      const store = await readInstances()
-      const key = resolveInstanceKey(store, name)
-      if (!key) fatal(new Error(`Instance "${name}" not found`))
-      await removeInstance(key!)
-      log.success(`Forgot bookmark "${name}" (no kernel-side change)`)
-    } catch (e) {
-      fatal(e)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/instance/list.ts

@@ -1,197 +0,0 @@
-import chalk from 'chalk'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { Column } from '../../lib/output'
-import type { CommandDefinition } from '../../program/index'
-
-import { AstraleError } from '../../errors'
-import { listOwnedInstances } from '../../lib/admin-instance'
-import {
-  formatInstanceState,
-  type InstanceInfo,
-  type OwnedInstanceInfo,
-} from '../../lib/admin-instance'
-import { ADMIN_TARGET_OPTIONS, type AdminTargetCommandOpts } from '../../lib/admin-target'
-import { normalizeInstanceKernelUrl, readInstances } from '../../lib/instance'
-import { fatal, log, withSpinner } from '../../lib/log'
-import { isMachine, output, type RawOutputOpts } from '../../lib/output'
-import { renderTable } from '../../lib/table'
-
-type ListOpts = KernelCommandOpts &
-  AdminTargetCommandOpts &
-  RawOutputOpts & {
-    bookmarked?: boolean
-    adminOnly?: boolean
-  }
-
-export type Bookmark = {
-  name: string
-  url: string | null
-  issuer: string | null
-  active: boolean
-  defaultIdentity: string | null
-  caFile: string | null
-  createdAt: string | null
-}
-
-const COLUMNS: Column[] = [
-  { key: 'name', header: 'NAME', color: chalk.bold },
-  { key: 'kind', header: 'KIND', color: chalk.dim },
-  { key: 'url', header: 'URL', color: chalk.dim },
-  { key: 'extra', header: '', color: chalk.dim },
-]
-
-export default {
-  name: 'list',
-  description: 'List admin-managed instances and local bookmarks',
-  options: [
-    ...ADMIN_TARGET_OPTIONS,
-    { flags: '--bookmarked', description: 'Only show locally bookmarked kernel connections' },
-    { flags: '--admin-only', description: 'Only show instances returned by the admin kernel' },
-  ],
-  action: async (opts: ListOpts) => {
-    try {
-      const store = await readInstances()
-      const bookmarks: Bookmark[] = Object.entries(store.instances).map(([name, entry]) => ({
-        name,
-        url: entry.url ?? null,
-        issuer: entry.issuer ?? null,
-        active: name === store.active,
-        defaultIdentity: entry.defaultIdentity ?? null,
-        caFile: entry.caFile ?? null,
-        createdAt: entry.createdAt ?? null,
-      }))
-
-      let managed: OwnedInstanceInfo[] = []
-      if (!opts.bookmarked) {
-        try {
-          managed = await withSpinner('Fetching instances', !isMachine(opts), () =>
-            listOwnedInstances(opts),
-          )
-        } catch (error) {
-          throw adminInventoryUnavailable(error)
-        }
-      }
-      if (isMachine(opts)) {
-        output(
-          {
-            active: store.active || null,
-            ...(opts.adminOnly ? {} : { bookmarks }),
-            ...(opts.bookmarked ? {} : { instances: managed }),
-          },
-          opts,
-        )
-        return
-      }
-
-      const rows = buildInstanceRows(managed, bookmarks, {
-        managed: !opts.bookmarked,
-        bookmarks: !opts.adminOnly,
-      })
-
-      if (rows.length === 0) {
-        log.dim('  No instances. Run: astrale instance bookmark <name> --url <url>')
-        return
-      }
-      process.stdout.write(renderTable(rows, { columns: COLUMNS }) + '\n')
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition
-
-/**
- * One row per instance. A bookmark that points at a managed instance (same
- * name and same kernel URL) merges into the managed row — carrying the active
- * marker — instead of listing the instance twice.
- */
-export function buildInstanceRows(
-  managed: InstanceInfo[],
-  bookmarks: Bookmark[],
-  show: { managed: boolean; bookmarks: boolean },
-): Array<Record<string, string>> {
-  const rows: Array<Record<string, string>> = []
-  const merged = new Set<string>()
-
-  const bookmarkByName = new Map<string, Bookmark & { url: string }>()
-  if (show.managed && show.bookmarks) {
-    for (const bookmark of bookmarks) {
-      if (bookmark.url === null) continue
-      bookmarkByName.set(bookmark.name, {
-        ...bookmark,
-        url: normalizeInstanceKernelUrl(bookmark.url),
-      })
-    }
-  }
-
-  if (show.managed) {
-    for (const item of managed) {
-      const candidate = item.url ? bookmarkByName.get(item.slug) : undefined
-      const twin =
-        candidate && item.url && candidate.url === normalizeInstanceKernelUrl(item.url)
-          ? candidate
-          : undefined
-      if (twin) merged.add(item.slug)
-      rows.push({
-        name: twin?.active ? `${item.slug} ${chalk.green('*')}` : item.slug,
-        kind: 'managed',
-        url: item.url ?? '',
-        extra: [formatInstanceState(item), twin ? formatBookmarkConnection(twin) : '']
-          .filter(Boolean)
-          .join(' · '),
-      })
-    }
-  }
-
-  if (show.bookmarks) {
-    for (const item of bookmarks) {
-      if (merged.has(item.name)) continue
-      rows.push({
-        name: item.active ? `${item.name} ${chalk.green('*')}` : item.name,
-        kind: 'bookmark',
-        url: String(item.url ?? ''),
-        extra: formatBookmarkConnection(item),
-      })
-    }
-  }
-
-  return rows
-}
-
-function formatBookmarkConnection(bookmark: Bookmark): string {
-  return [
-    bookmark.issuer && bookmark.issuer !== bookmark.url ? `issuer=${bookmark.issuer}` : '',
-    bookmark.caFile ? `ca=${bookmark.caFile}` : '',
-    bookmark.defaultIdentity ? `identity=${bookmark.defaultIdentity}` : '',
-  ]
-    .filter(Boolean)
-    .join(' · ')
-}
-
-const ADMIN_INVENTORY_CODES = new Set([
-  'TOKEN_EXCHANGE_SOURCE_INVALID',
-  'TOKEN_EXCHANGE_SOURCE_EXPIRED',
-  'TOKEN_EXCHANGE_UNSUPPORTED',
-  'TOKEN_EXCHANGE_DISCOVERY_FAILED',
-  'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-  'TOKEN_EXCHANGE_INSECURE',
-  'ADMIN_DOMAIN_ISSUER_MISSING',
-])
-
-/** Admin-managed inventory is not available without a deployed Admin Domain + IdP identity. */
-export function adminInventoryUnavailable(cause: unknown): AstraleError {
-  const code = cause instanceof AstraleError ? cause.code : undefined
-  if (code !== undefined && ADMIN_INVENTORY_CODES.has(code)) {
-    return new AstraleError(
-      'ADMIN_INVENTORY_UNAVAILABLE',
-      'Managed instance listing needs the Admin Domain and an IdP-backed identity. Admin is not deployed in this environment.',
-      'Use `astrale instance list --bookmarked` for local kernel bookmarks. Key-backed identities cannot mint an Admin Domain token.',
-    )
-  }
-  if (cause instanceof AstraleError) return cause
-  return new AstraleError(
-    'ADMIN_INVENTORY_UNAVAILABLE',
-    cause instanceof Error ? cause.message : String(cause),
-    'Use `astrale instance list --bookmarked` for local kernel bookmarks.',
-  )
-}