@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/connect-core.ts

@@ -1,42 +0,0 @@
-/**
- * Temporary compatibility surface for the observed `@astrale-os/connect-host`
- * consumer. Keep this file as re-exports only: CLI state and connection owners
- * remain authoritative, and no Kernel Client implementation type is exposed.
- */
-
-export { getDefault, getIdentity, readIdentities } from './identity/registry'
-export type { Identity, IdentityStore } from './identity/registry'
-
-export { listIdentityKeys, signAs } from './keys/index'
-
-export {
-  normalizeInstanceKernelUrl,
-  orgIdForAudience,
-  readInstances,
-  resetInstancesMemo,
-  resolveInstance,
-} from './lib/instance'
-export type { InstanceEntry, InstanceStore, ResolvedInstance } from './lib/instance'
-
-export { resolveInstanceTarget } from './lib/instance-target'
-export type { ResolvedInstanceTarget } from './lib/instance-target'
-
-export { readConfig } from './lib/config'
-export type { AstraleConfig } from './lib/config'
-
-export {
-  IdpOrgMembershipError,
-  IdpRefreshTransientError,
-  resolveCredential,
-} from './connection/auth'
-
-export { loginViaIdp, resolveIdpName } from './lib/login-flow'
-export type { DeviceVerification, LoginFlowOpts, LoginResult } from './lib/login-flow'
-
-export { isSessionExpired, readIdpSession } from './lib/idp'
-export type { IdpSession } from './lib/idp'
-
-export { AuthError } from './errors'
-export { fetchWithCaFile } from './lib/ca-fetch'
-
-export { createPaths, paths } from './state/index'

package/src/connection/.spec/api.d.ts

@@ -1,110 +0,0 @@
-import type { IssuerId } from '@astrale-os/sdk/auth'
-import type { AuthApi } from '@astrale-os/sdk/auth'
-import type { Call, GraphApi } from '@astrale-os/sdk/client'
-import type { ClientSession } from '@astrale-os/sdk/client/session'
-
-/** Existing CLI connection flags accepted by Kernel-touching commands. */
-export interface ConnectionOptions {
-  readonly url?: string
-  readonly instance?: string
-  readonly timeout?: string
-  readonly as?: string
-  readonly creds?: string
-  /** Omit caller credentials even when local or bookmark defaults exist. */
-  readonly anonymous?: boolean
-}
-
-/** Existing Admin-target overrides accepted only by Admin Domain operations. */
-export interface AdminConnectionOptions extends ConnectionOptions {
-  readonly admin?: string
-  readonly adminUrl?: string
-  readonly domainIssuer?: string
-}
-
-/** Exact source Kernel selected from flags and local CLI state. */
-export interface ConnectionTarget {
-  readonly url: string
-  readonly issuer: IssuerId
-  /** Installed Domain issuer; presence activates standard token exchange. */
-  readonly domainIssuer?: IssuerId
-  readonly slug?: string
-  readonly defaultIdentity?: string
-  readonly caFile?: string
-}
-
-/** Stable local identity-registration key for the exact selected source Kernel. */
-export function registrationKeyForTarget(target: ConnectionTarget): string
-
-/** Narrow capabilities available during one scoped CLI connection. */
-export interface ConnectionContext {
-  readonly session: ClientSession
-  readonly graph: GraphApi
-  readonly auth: AuthApi
-  readonly target: ConnectionTarget
-}
-
-/** Existing output and diagnostic flags shared by commands that open a Kernel connection. */
-export interface KernelCommandOpts extends ConnectionOptions {
-  readonly raw?: boolean
-  readonly json?: boolean
-  readonly format?: 'yaml' | 'json'
-  readonly debug?: boolean
-}
-
-/** Detached metadata used only to improve an error after a caller-authored @self expansion. */
-export interface SelfExpansionMeta {
-  readonly original: string
-  readonly expanded: string
-  readonly selfId: string
-  readonly slug?: string
-}
-
-/** Parse caller-authored path text and retain one portable input in the public Call shape. */
-export function createPathCall(path: string, input: unknown): Call
-
-/** Resolve one ordinary CLI target, run an action, and close every owned Client resource. */
-export function withClientSession<Value>(
-  options: ConnectionOptions,
-  action: (context: ConnectionContext) => Promise<Value>,
-): Promise<Value>
-
-/** Resolve the configured Admin Domain target under the same scoped lifecycle. */
-export function withAdminClientSession<Value>(
-  options: AdminConnectionOptions,
-  action: (context: ConnectionContext) => Promise<Value>,
-): Promise<Value>
-
-/** Expand @self through the effective principal returned by authenticated Identity.whoami. */
-export function expandSelfInPath(
-  path: string,
-  context: ConnectionContext,
-): Promise<{ readonly path: string; readonly meta?: SelfExpansionMeta }>
-
-/** Expand @self once across one Call path and its CLI-authored string parameters. */
-export function expandSelfInCall(
-  path: string,
-  parameters: Readonly<Record<string, unknown>>,
-  context: ConnectionContext,
-): Promise<{
-  readonly path: string
-  readonly parameters: Readonly<Record<string, unknown>>
-  readonly meta?: SelfExpansionMeta
-}>
-
-/** Preserve stale-registration evidence while an expanded request is executed. */
-export function withSelfHint<Value>(
-  action: () => Promise<Value>,
-  meta: SelfExpansionMeta | undefined,
-): Promise<Value>
-
-/** Run one command through the canonical progress, connection, presentation, and error boundary. */
-export function runKernelCommand<Value>(input: {
-  readonly opts: KernelCommandOpts
-  readonly label: string
-  readonly fn: (context: ConnectionContext) => Promise<Value>
-  readonly format?: (
-    result: Value,
-    options: KernelCommandOpts,
-    machine: boolean,
-  ) => void | Promise<void>
-}): Promise<void>

package/src/connection/.spec/architecture.md

@@ -1,58 +0,0 @@
-# CLI connection architecture
-
-The private `connection` module owns one scoped bridge from existing CLI flags and local identity
-state to the public Kernel Client. It selects the exact source Kernel URL and issuer, either omits
-credentials for an explicit anonymous selection or resolves fresh source-Kernel authority for each
-Call, binds Graph and Auth helpers, and closes every owned Client resource when the command action
-terminates.
-
-When a target also names an exact Domain issuer, the connection owner performs the client-mediated
-`whoami -> delegate(attenuation) -> issuer exchange` journey. The resulting Domain token crosses
-into ClientSession as an opaque credential; connection does not authorize Domain operations.
-
-```mermaid
-flowchart LR
-  F[CLI flags and local state] --> T[Connection target]
-  T --> H[ClientSession]
-  C[CLI credential sources] --> R[SessionAuth]
-  R --> H
-  H --> G[GraphApi]
-  H --> A[AuthApi]
-  H --> X[Command action]
-  G --> X
-  A --> X
-```
-
-ClientSession owns source admission, Publication discovery, redirect witnessing, route caching, transport
-selection, and the single safe stale-route recovery. The CLI does not reproduce those rules or
-discover destination identity. `SessionAuth.resolve(call, signal)` returns source-Kernel authority and
-ClientSession supplies an audience-free Delegate with omitted attenuation, preserving the exact
-current Grant for routing. Connection itself persists no credential or route; the separate state
-owner persists exchanged source credentials and the separate Kernel Client route artifact. A valid exchanged credential is selected by the
-authenticated source issuer and subject before any live `whoami`; cache misses alone resolve the
-registered Kernel User and perform delegation plus Domain exchange.
-Exchange and destination-carrier authority cover the selected command timeout plus one bounded
-receipt margin, never outlive the current source credential, and retain the existing one-minute
-floor for short commands. A cached or freshly exchanged credential that cannot cover that lifetime
-is refreshed or rejected before destination dispatch, so a long durable mutation does not first
-discover expired callback authority after its provider effect commits.
-
-Every ClientSession receives the CLI-owned `state/session-routes` representation capability. Kernel
-Client still owns route keying, admission, expiry, and one safe stale/miss recovery; Connection does
-not reproduce routing or add an Admin-only bypass.
-
-`--anonymous` deliberately suppresses ambient and bookmark-default identities by omitting the
-`SessionAuth` capability. It cannot be combined with `--as` or `--creds`; contradictory selections fail
-before local identity state or a connection is opened. Public and optional callables can then
-observe a genuinely anonymous caller, while required callables reject the request at the Kernel.
-
-The target, timeout, and optional CA file are resolved before constructing the session. The CA file
-customizes only the Fetch capability passed to Client. `withClientSession` and
-`withAdminClientSession` are terminal lifecycle boundaries: success, failure, and cancellation all
-close both the Client Session and its direct source-Auth client.
-
-The command boundary projects typed Client failure identity, transport context, phase, and
-invocation-only delivery evidence without inspecting a private cause message. Unknown native
-failures become one honest unexpected diagnostic; their bounded cause graph is visible only under
-explicit debug output. Every admitted Kernel reason remains available in machine output, while
-human repair details require a bounded public Function issue or exact Query reason variant.

package/src/connection/.spec/capabilities/connection.ts

@@ -1,13 +0,0 @@
-import { defineCapability } from '@astrale-os/spec/authoring'
-
-export const CLI_CONNECTION = defineCapability({
-  id: 'CLI-CONNECTION',
-  statement:
-    'Selects one exact source Kernel and exposes scoped public Host, Graph, and Auth capabilities with terminal cleanup.',
-})
-
-export const CLI_AUTH = defineCapability({
-  id: 'CLI-AUTH',
-  statement:
-    'Pins the selected source issuer, explicitly admits either credential-less or target-bound authenticated sessions, and delegates remote destinations without forwarding a prior bearer.',
-})

package/src/connection/.spec/examples/call.ts

@@ -1,7 +0,0 @@
-import { createPathCall, withClientSession } from '../api.js'
-
-const result = await withClientSession({ instance: 'staging', as: 'alice' }, ({ session }) =>
-  session.call(createPathCall('/:notes.example.dev:function.search', { text: 'astrale' })),
-)
-
-console.log(result)

package/src/connection/.spec/flows/command.ts

@@ -1,20 +0,0 @@
-import type { ConnectionContext, KernelCommandOpts } from '../api.js'
-
-declare const open: <Value>(
-  options: KernelCommandOpts,
-  action: (context: ConnectionContext) => Promise<Value>,
-) => Promise<Value>
-declare const present: <Value>(value: Value) => void | Promise<void>
-declare const mapExpectedFailure: (error: unknown) => Promise<void>
-
-/** One command owns progress and error presentation around one terminal ClientSession lifecycle. */
-export async function runKernelCommand<Value>(
-  options: KernelCommandOpts,
-  action: (context: ConnectionContext) => Promise<Value>,
-): Promise<void> {
-  try {
-    await present(await open(options, action))
-  } catch (error) {
-    await mapExpectedFailure(error)
-  }
-}

package/src/connection/.spec/flows/session.ts

@@ -1,62 +0,0 @@
-import type { Call } from '@astrale-os/sdk/client'
-import type { SessionAuth } from '@astrale-os/sdk/client/session'
-
-import type { ConnectionContext, ConnectionOptions, ConnectionTarget } from '../api.js'
-
-interface OwnedConnection {
-  readonly context: ConnectionContext
-  close(): void
-}
-
-declare const resolveTarget: (options: ConnectionOptions) => Promise<ConnectionTarget>
-declare const resolveTimeoutMs: (input: string | undefined) => number
-declare const createClientConnection: (
-  target: ConnectionTarget,
-  timeoutMs: number,
-  auth: SessionAuth | undefined,
-) => OwnedConnection
-declare const validateCredentialSelection: (options: ConnectionOptions) => void
-declare const resolveSourceCredential: (
-  target: ConnectionTarget,
-  options: ConnectionOptions,
-  audience: string,
-  signal: AbortSignal,
-) => Promise<string>
-/** Bind source authority without learning or minting destination credentials. */
-function createConnectionAuth(target: ConnectionTarget, options: ConnectionOptions): SessionAuth {
-  const ttlSeconds = Math.max(60, Math.ceil(resolveTimeoutMs(options.timeout) / 1_000) + 5)
-  return {
-    ttlSeconds,
-    async resolve(_call: Call, signal: AbortSignal) {
-      return {
-        credential: await resolveSourceCredential(target, options, target.issuer, signal),
-      }
-    },
-  }
-}
-
-/** Open one Client Session with a call-scoped source-authority resolver bound once. */
-function openConnection(
-  target: ConnectionTarget,
-  timeoutMs: number,
-  options: ConnectionOptions,
-): OwnedConnection {
-  const auth = options.anonymous === true ? undefined : createConnectionAuth(target, options)
-  return createClientConnection(target, timeoutMs, auth)
-}
-
-/** One terminal command-scoped connection lifecycle. */
-export async function withClientSession<Value>(
-  options: ConnectionOptions,
-  action: (context: ConnectionContext) => Promise<Value>,
-): Promise<Value> {
-  validateCredentialSelection(options)
-  const timeoutMs = resolveTimeoutMs(options.timeout)
-  const target = await resolveTarget(options)
-  const connection = openConnection(target, timeoutMs, options)
-  try {
-    return await action(connection.context)
-  } finally {
-    connection.close()
-  }
-}

package/src/connection/.spec/laws/connection.ts

@@ -1,213 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_CONNECTION_TARGET = defineLaw({
-  id: 'CLI-CONNECTION-TARGET',
-  statement:
-    'Explicit URL, explicit instance, active bookmark, managed lookup, and Admin target selection preserve the existing precedence while returning the exact invocation URL and issuer separately.',
-  tests: [
-    {
-      file: '__tests__/target.test.ts',
-      id: 'TEST-CLI-CONNECTION-SELECTS-EXACT-TARGET',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_DOMAIN_EXCHANGE = defineLaw({
-  id: 'CLI-CONNECTION-DOMAIN-EXCHANGE',
-  statement:
-    'A target with an explicit Domain issuer resolves the source credential, authenticates whoami at the exact Kernel, requests explicit self attenuation for that User and Domain audience, posts the resulting envelope to the discovered standard endpoint, and returns only a Domain token bound back to the same Kernel; there is no inferred issuer or legacy broker fallback.',
-  tests: [
-    {
-      file: '__tests__/exchange.test.ts',
-      id: 'TEST-CLI-EXCHANGE-WHOAMI-DELEGATE-EXCHANGE-CACHE',
-    },
-    {
-      file: '__tests__/exchange.test.ts',
-      id: 'TEST-CLI-EXCHANGE-NO-LEGACY-FALLBACK',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_HOP_CREDENTIAL = defineLaw({
-  id: 'CLI-CONNECTION-HOP-CREDENTIAL',
-  statement:
-    'A source hop resolves a fresh credential only when its session-pinned issuer equals the selected source issuer; a destination hop requires the same selected resolver and returns a fresh delegation for the witnessed Publication issuer, never the source credential, with its TTL bounded strictly inside any source JWT expiry.',
-  tests: [
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-RESOLVES-CREDENTIAL-PER-HOP',
-    },
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-DELEGATES-VIA-SOURCE-AUTH',
-    },
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-REJECTS-HOP-SOURCE-ISSUER-MISMATCH',
-    },
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-BOUNDS-DELEGATION-TO-SOURCE-EXPIRY',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_EXPLICIT_ANONYMOUS = defineLaw({
-  id: 'CLI-CONNECTION-EXPLICIT-ANONYMOUS',
-  statement:
-    'An explicit anonymous selection suppresses ambient, bookmark-default, and local credentials by omitting the Host credential capability; it is rejected before connection construction when combined with --as or --creds.',
-  tests: [
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-OMITS-EXPLICIT-ANONYMOUS-CREDENTIAL',
-    },
-    {
-      file: '__tests__/session.test.ts',
-      id: 'TEST-CLI-CONNECTION-REJECTS-ANONYMOUS-CREDENTIAL-CONFLICT',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_SOURCE_ISSUER = defineLaw({
-  id: 'CLI-CONNECTION-SOURCE-ISSUER',
-  statement:
-    'CLI constructs ClientSession once with sourceIssuer equal to the selected ConnectionTarget issuer independently from its invocation URL, so path-multiplexed Kernels do not substitute root Publication discovery; every credential hop repeats that pin.',
-  tests: [
-    {
-      file: '__tests__/session.test.ts',
-      id: 'TEST-CLI-CONNECTION-PINS-SOURCE-ISSUER',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_ISSUER_DISCOVERY = defineLaw({
-  id: 'CLI-CONNECTION-ISSUER-DISCOVERY',
-  statement:
-    'When invocation URL and issuer differ, liveness probes resolve OIDC metadata at the pinned issuer and reject metadata that declares any other issuer before fetching its keys.',
-  tests: [
-    {
-      file: '../lib/__tests__/meta.test.ts',
-      id: 'TEST-CLI-CONNECTION-PROBES-PINNED-ISSUER',
-    },
-    {
-      file: '../lib/__tests__/meta.test.ts',
-      id: 'TEST-CLI-CONNECTION-REJECTS-DISCOVERY-ISSUER-MISMATCH',
-    },
-  ],
-})
-
-export const CLI_AUTH_REGISTRATION_TARGET = defineLaw({
-  id: 'CLI-AUTH-REGISTRATION-TARGET',
-  statement:
-    'Key identity registration lookup uses the same target key for bookmark, managed, Admin, and direct URL calls that identity registration stores.',
-  tests: [
-    {
-      file: '__tests__/auth.test.ts',
-      id: 'TEST-CLI-AUTH-USES-DIRECT-URL-REGISTRATION',
-    },
-  ],
-})
-
-export const CLI_SELF_AUTHENTICATED_PRINCIPAL = defineLaw({
-  id: 'CLI-SELF-AUTHENTICATED-PRINCIPAL',
-  statement:
-    '@self resolves inside the command-owned Client Session from authenticated Identity.whoami on the selected target, so resolution and dispatch share one lifecycle and delegated carriers never use an unverified JWT subject or stale local registration.',
-  tests: [
-    {
-      file: '__tests__/self.test.ts',
-      id: 'TEST-CLI-SELF-USES-AUTHENTICATED-EFFECTIVE-PRINCIPAL',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_TERMINAL_CLOSE = defineLaw({
-  id: 'CLI-CONNECTION-TERMINAL-CLOSE',
-  statement:
-    'The Client Session and direct source-Auth client close exactly once after action success, failure, or cancellation.',
-  tests: [
-    {
-      file: '__tests__/session.test.ts',
-      id: 'TEST-CLI-CONNECTION-CLOSES-OWNED-CLIENTS',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_TIMEOUT = defineLaw({
-  id: 'CLI-CONNECTION-TIMEOUT',
-  statement:
-    'The CLI accepts only a positive integer timeout before constructing a Client Session, applies it to source-Auth and Session operations, and requires exchanged and destination-carrier authority to cover that timeout plus the bounded receipt margin before destination dispatch.',
-  tests: [
-    {
-      file: '__tests__/session.test.ts',
-      id: 'TEST-CLI-CONNECTION-REJECTS-INVALID-TIMEOUT-BEFORE-OPEN',
-    },
-    {
-      file: '__tests__/credential.test.ts',
-      id: 'TEST-CLI-CONNECTION-CARRIER-COVERS-COMMAND-TIMEOUT',
-    },
-    {
-      file: '__tests__/exchange.test.ts',
-      id: 'TEST-CLI-EXCHANGE-REJECTS-INSUFFICIENT-LIFETIME',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_CA_SCOPE = defineLaw({
-  id: 'CLI-CONNECTION-CA-SCOPE',
-  statement:
-    'A selected bookmark CA file changes only the Fetch capability owned by this connection and leaves non-HTTPS requests on the injected fallback Fetch.',
-  tests: [
-    {
-      file: '__tests__/ca-fetch.test.ts',
-      id: 'TEST-CLI-CONNECTION-SCOPES-CUSTOM-CA-TO-HTTPS-FETCH',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_CALL_SHAPE = defineLaw({
-  id: 'CLI-CONNECTION-CALL-SHAPE',
-  statement:
-    'Caller-authored path text and input enter Client as exactly one public Call; the CLI retains no optional callable hint, caller ETag, or second dispatch representation.',
-  tests: [
-    {
-      file: '__tests__/call.test.ts',
-      id: 'TEST-CLI-CONNECTION-CREATES-ONE-CANONICAL-CALL',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_PUBLIC_SEMANTIC_REASON = defineLaw({
-  id: 'CLI-CONNECTION-PUBLIC-SEMANTIC-REASON',
-  statement:
-    'Machine-mode Kernel command failures preserve the admitted ResponseError code and public semantic reason so scripts can distinguish conflicts such as revision guards and required data migrations without parsing prose.',
-  tests: [
-    {
-      file: '__tests__/errors.test.ts',
-      id: 'TEST-CLI-CONNECTION-PRESERVES-PUBLIC-SEMANTIC-REASON',
-    },
-  ],
-})
-
-export const CLI_CONNECTION_TYPED_ERROR_PRESENTATION = defineLaw({
-  id: 'CLI-CONNECTION-TYPED-ERROR-PRESENTATION',
-  statement:
-    'The command boundary maps typed Client failure identity, transport context, phase, and invocation-only delivery evidence without parsing a private cause; acquisition never receives retry advice, unknown native failures have one non-blank unexpected diagnostic, and raw causes appear only under explicit debug output.',
-  tests: [
-    {
-      file: '__tests__/errors.test.ts',
-      id: 'TEST-CLI-CONNECTION-MAPS-TYPED-TRANSPORT',
-    },
-    {
-      file: '__tests__/errors.test.ts',
-      id: 'TEST-CLI-CONNECTION-PRESENTS-BOUNDED-REPAIRS',
-    },
-    {
-      file: '__tests__/reasons.test.ts',
-      id: 'TEST-CLI-CONNECTION-ADMITS-BOUNDED-REASONS',
-    },
-    {
-      file: '__tests__/failure-safety.test.ts',
-      id: 'TEST-CLI-CONNECTION-FAILURE-SAFETY',
-    },
-  ],
-})

package/src/connection/.spec/layout.ts

@@ -1,22 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: [
-    '__tests__/',
-    'auth.ts',
-    'call.ts',
-    'command.ts',
-    'credential.ts',
-    'errors.ts',
-    'failure/',
-    'exchange.ts',
-    'index.ts',
-    'lifetime.ts',
-    'reasons.ts',
-    'self.ts',
-    'session.ts',
-    'target.ts',
-    'tsconfig.json',
-  ],
-  exact: true,
-})

package/src/connection/__tests__/auth.test.ts

@@ -1,129 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { Identity } from '../../identity/index'
-import type { AstraleConfig } from '../../lib/config'
-
-import { IdpAudienceMismatchError } from '../../lib/idp'
-import { IdpSessionNoRefreshTokenError } from '../../lib/idp-session'
-import { classifyNoRefreshTokenError, resolveKeyIdentityAuthOptions } from '../auth'
-
-const config: AstraleConfig = {
-  issuer: 'https://unregistered.invalid',
-  admin: {
-    name: 'admin',
-    url: 'https://admin.eu.astrale.ai/api',
-    kernelIssuer: 'https://admin.eu.astrale.ai/api',
-  },
-  telemetry: { enabled: true },
-  browser: {},
-}
-
-describe('resolveKeyIdentityAuthOptions', () => {
-  test('uses key identity issuer before global config issuer', () => {
-    const identity: Identity = {
-      subject: 'system',
-      source: 'key',
-      mode: 'local',
-      issuer: 'https://51-15-255-161.sslip.io',
-      createdAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    expect(
-      resolveKeyIdentityAuthOptions(identity, config, 'https://51-15-255-161.sslip.io', 'scw-e2e'),
-    ).toEqual({
-      issuer: 'https://51-15-255-161.sslip.io',
-      subject: undefined,
-      audience: 'https://51-15-255-161.sslip.io',
-    })
-  })
-
-  test('uses target audience as issuer for imported system bootstrap identities', () => {
-    const identity: Identity = {
-      subject: 'system',
-      source: 'key',
-      mode: 'local',
-      createdAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    expect(
-      resolveKeyIdentityAuthOptions(identity, config, 'https://51-15-255-161.sslip.io', 'scw-e2e'),
-    ).toEqual({
-      issuer: 'https://51-15-255-161.sslip.io',
-      subject: undefined,
-      audience: 'https://51-15-255-161.sslip.io',
-    })
-  })
-
-  test('registration issuer and subject still override identity issuer', () => {
-    const identity: Identity = {
-      subject: 'alice',
-      source: 'key',
-      mode: 'local',
-      issuer: 'https://identity.example.com',
-      createdAt: '2026-01-01T00:00:00.000Z',
-      registrations: {
-        prod: {
-          iss: 'https://prod.example.com/iss/thumbprint',
-          sub: 'node-1',
-          registeredAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }
-
-    expect(
-      resolveKeyIdentityAuthOptions(identity, config, 'https://prod.example.com', 'prod'),
-    ).toEqual({
-      issuer: 'https://prod.example.com/iss/thumbprint',
-      subject: 'node-1',
-      audience: 'https://prod.example.com',
-    })
-  })
-
-  /** @evidence TEST-CLI-AUTH-USES-DIRECT-URL-REGISTRATION */
-  test('uses a registration stored for a direct URL target', () => {
-    const url = 'https://kernel.example/invoke'
-    const identity: Identity = {
-      subject: 'alice',
-      source: 'key',
-      mode: 'local',
-      createdAt: '2026-01-01T00:00:00.000Z',
-      registrations: {
-        [url]: {
-          iss: 'https://kernel.example/identity/alice',
-          sub: 'alice-node',
-          registeredAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }
-
-    expect(resolveKeyIdentityAuthOptions(identity, config, 'https://kernel.example', url)).toEqual({
-      issuer: 'https://kernel.example/identity/alice',
-      subject: 'alice-node',
-      audience: 'https://kernel.example',
-    })
-  })
-})
-
-describe('classifyNoRefreshTokenError', () => {
-  test('preserves expiry when the non-refreshable session already targets the required audience', () => {
-    const expired = new IdpSessionNoRefreshTokenError('alice')
-
-    expect(
-      classifyNoRefreshTokenError('https://kernel.example', 'https://kernel.example', expired),
-    ).toBe(expired)
-  })
-
-  test('reports a real audience mismatch when the source audience differs', () => {
-    const result = classifyNoRefreshTokenError(
-      'https://child.example',
-      'https://manager.example',
-      new IdpSessionNoRefreshTokenError('alice'),
-    )
-
-    expect(result).toBeInstanceOf(IdpAudienceMismatchError)
-    expect(result).toMatchObject({
-      requested: 'https://child.example',
-      actual: 'https://manager.example',
-    })
-  })
-})