@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/lib/__tests__/instance-target.test.ts

@@ -1,213 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { AstraleConfig } from '../config'
-import type { InstanceStore } from '../instance'
-
-import { AdminInstanceNotFoundError } from '../../admin/instance/model'
-import { AstraleError } from '../../errors'
-import { DEFAULT_CONFIG } from '../config'
-import {
-  couldBeConfiguredAdminInstance,
-  isManagedInstanceNotFound,
-  resolveInstanceTarget,
-} from '../instance-target'
-
-const store: InstanceStore = {
-  active: 'active-bookmark',
-  instances: {
-    'active-bookmark': {
-      url: 'https://active.example.com/api',
-      issuer: 'https://active-issuer.example.com',
-      defaultIdentity: 'active-id',
-    },
-    admin: {
-      url: 'https://bookmarked-admin.example.com/api',
-      issuer: 'https://bookmarked-admin-issuer.example.com',
-      domainIssuer: 'https://bookmarked-admin-domain.example.com',
-    },
-  },
-}
-
-const emptyStore: InstanceStore = {
-  active: '',
-  instances: {},
-}
-
-const directAdminConfig: AstraleConfig = {
-  ...DEFAULT_CONFIG,
-  admin: {
-    name: 'admin',
-    url: 'https://admin.eu.astrale.ai/api',
-    kernelIssuer: 'https://admin.eu.astrale.ai/api',
-    domainIssuer: 'https://admin.beta.astrale.ai',
-  },
-}
-
-describe('resolveInstanceTarget', () => {
-  test('bookmark names win over configured admin and managed lookup', async () => {
-    const managedCalls: string[] = []
-
-    await expect(
-      resolveInstanceTarget(
-        { source: 'name', name: 'admin' },
-        {
-          config: directAdminConfig,
-          instances: store,
-          managed: async (slug) => {
-            managedCalls.push(slug)
-            throw new Error('should not run')
-          },
-        },
-      ),
-    ).resolves.toMatchObject({
-      name: 'admin',
-      source: 'bookmark',
-      url: 'https://bookmarked-admin.example.com/api',
-    })
-    expect(managedCalls).toEqual([])
-  })
-
-  test('configured admin resolves before managed lookup', async () => {
-    const managedCalls: string[] = []
-
-    await expect(
-      resolveInstanceTarget(
-        { source: 'name', name: 'admin' },
-        {
-          config: directAdminConfig,
-          instances: emptyStore,
-          managed: async (slug) => {
-            managedCalls.push(slug)
-            throw new Error('should not run')
-          },
-        },
-      ),
-    ).resolves.toMatchObject({
-      name: 'admin',
-      source: 'admin',
-      url: 'https://admin.eu.astrale.ai/api',
-      kernelIssuer: 'https://admin.eu.astrale.ai/api',
-      domainIssuer: 'https://admin.beta.astrale.ai',
-    })
-    expect(managedCalls).toEqual([])
-  })
-
-  test('active resolves through the same named-instance path', async () => {
-    await expect(
-      resolveInstanceTarget({ source: 'active' }, { config: DEFAULT_CONFIG, instances: store }),
-    ).resolves.toMatchObject({
-      name: 'active-bookmark',
-      source: 'bookmark',
-      defaultIdentity: 'active-id',
-    })
-  })
-
-  test('managed slug resolves through the injected managed lookup', async () => {
-    await expect(
-      resolveInstanceTarget(
-        { source: 'name', name: 'bryan' },
-        {
-          config: DEFAULT_CONFIG,
-          instances: emptyStore,
-          managed: async (slug) => ({
-            id: 'node-1',
-            slug,
-            url: `https://${slug}.eu.astrale.ai`,
-            state: 'ready',
-          }),
-        },
-      ),
-    ).resolves.toEqual({
-      name: 'bryan',
-      source: 'managed',
-      url: 'https://bryan.eu.astrale.ai/api',
-      kernelIssuer: 'https://bryan.eu.astrale.ai/api',
-    })
-  })
-
-  test('unknown slugs surface the original instance-not-found error', async () => {
-    await expect(
-      resolveInstanceTarget(
-        { source: 'name', name: 'missing' },
-        {
-          config: DEFAULT_CONFIG,
-          instances: emptyStore,
-          managed: async () => {
-            throw new AdminInstanceNotFoundError('missing')
-          },
-        },
-      ),
-    ).rejects.toThrow('Instance "missing" is not bookmarked')
-  })
-
-  test('url targets do not receive an instance name by default', async () => {
-    await expect(
-      resolveInstanceTarget(
-        { source: 'url', url: 'https://kernel.example.com/api' },
-        { config: DEFAULT_CONFIG },
-      ),
-    ).resolves.toEqual({
-      source: 'url',
-      url: 'https://kernel.example.com/api',
-      kernelIssuer: 'https://kernel.example.com/api',
-      name: undefined,
-    })
-  })
-})
-
-describe('instance target helpers', () => {
-  test('recognizes direct and bookmarked admin config names', () => {
-    expect(couldBeConfiguredAdminInstance('admin', directAdminConfig)).toBe(true)
-    expect(
-      couldBeConfiguredAdminInstance('ops-admin', {
-        ...DEFAULT_CONFIG,
-        admin: { instance: 'ops-admin' },
-      }),
-    ).toBe(true)
-    expect(couldBeConfiguredAdminInstance('bryan', directAdminConfig)).toBe(false)
-  })
-
-  test('treats the owner-scoped Admin error as managed lookup not-found', () => {
-    expect(isManagedInstanceNotFound(new AdminInstanceNotFoundError('admin'))).toBe(true)
-  })
-
-  test('does not hide non-not-found managed lookup failures', () => {
-    const auth = new Error('permission denied')
-    auth.name = 'PermissionDeniedError'
-
-    expect(isManagedInstanceNotFound(auth)).toBe(false)
-  })
-
-  test('recognizes an owner-scoped lookup miss', () => {
-    expect(
-      isManagedInstanceNotFound(
-        new AstraleError('INSTANCE_NOT_FOUND', 'No owned instance matches "missing".'),
-      ),
-    ).toBe(true)
-  })
-})
-
-describe('isManagedInstanceNotFound: unknown errors', () => {
-  test('does not infer a miss from an InternalKernelError message', () => {
-    const e = new Error('DISPATCH_FAILED: handler crashed')
-    e.name = 'InternalKernelError'
-    expect(isManagedInstanceNotFound(e)).toBe(false)
-  })
-
-  test('maps Admin token-exchange failure to INSTANCE_NOT_FOUND', async () => {
-    const managed = async () => {
-      throw new AstraleError(
-        'TOKEN_EXCHANGE_SOURCE_INVALID',
-        'The source identity credential has no valid expiration.',
-      )
-    }
-    const opts = {
-      config: DEFAULT_CONFIG,
-      instances: { instances: {} },
-      managed,
-    } as unknown as Parameters<typeof resolveInstanceTarget>[1]
-    await expect(
-      resolveInstanceTarget({ source: 'name', name: 'ghost' }, opts),
-    ).rejects.toMatchObject({ code: 'INSTANCE_NOT_FOUND' })
-  })
-})

package/src/lib/__tests__/instance.test.ts

@@ -1,192 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import {
-  findBookmarkTrustConflicts,
-  InstanceStoreSchema,
-  normalizeInstanceKernelUrl,
-  sanitizeStore,
-} from '../instance'
-
-describe('InstanceStoreSchema', () => {
-  test('parses valid store with url', () => {
-    const result = InstanceStoreSchema.parse({
-      active: 'prod',
-      instances: {
-        prod: { url: 'https://prod.example.com', createdAt: '2024-01-01T00:00:00Z' },
-      },
-    })
-    expect(result.active).toBe('prod')
-    expect(result.instances.prod.url).toBe('https://prod.example.com')
-  })
-
-  test('parses legacy instance without url for migration compatibility', () => {
-    const result = InstanceStoreSchema.parse({
-      active: 'dev',
-      instances: {
-        dev: { createdAt: '2024-01-01T00:00:00Z' },
-      },
-    })
-    expect(result.instances.dev.url).toBeUndefined()
-  })
-
-  test('parses multiple instances', () => {
-    const result = InstanceStoreSchema.parse({
-      active: 'prod',
-      instances: {
-        local: { url: 'https://local.example.com', createdAt: '2024-01-01T00:00:00Z' },
-        prod: { url: 'https://prod.example.com', createdAt: '2024-06-01T00:00:00Z' },
-      },
-    })
-    expect(Object.keys(result.instances)).toHaveLength(2)
-  })
-
-  test('rejects missing active field', () => {
-    expect(() =>
-      InstanceStoreSchema.parse({
-        instances: { m: { createdAt: '2024-01-01' } },
-      }),
-    ).toThrow()
-  })
-
-  test('accepts instance without createdAt (optional at schema level)', () => {
-    // `createdAt` is intentionally optional on InstanceEntrySchema: only
-    // `createdAt` is metadata; the connection URL is the only required
-    // field for a usable bookmark.
-    const result = InstanceStoreSchema.parse({
-      active: 'm',
-      instances: { m: { url: 'http://test' } },
-    })
-    expect(result.instances.m.createdAt).toBeUndefined()
-  })
-
-  test('accepts empty instances record', () => {
-    const result = InstanceStoreSchema.parse({
-      active: 'none',
-      instances: {},
-    })
-    expect(Object.keys(result.instances)).toHaveLength(0)
-  })
-
-  test('normalizes region-routed managed instance roots to the kernel api URL', () => {
-    expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai')).toBe(
-      'https://testmarc.eu.astrale.ai/api',
-    )
-    expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai/')).toBe(
-      'https://testmarc.eu.astrale.ai/api',
-    )
-    expect(normalizeInstanceKernelUrl('https://testmarc.eu.beta.astrale.ai')).toBe(
-      'https://testmarc.eu.beta.astrale.ai/api',
-    )
-    expect(normalizeInstanceKernelUrl('https://shell.beta.astrale.ai')).toBe(
-      'https://shell.beta.astrale.ai',
-    )
-  })
-
-  test('does not rewrite explicit kernel or non-managed URLs', () => {
-    expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai/api')).toBe(
-      'https://testmarc.eu.astrale.ai/api',
-    )
-    expect(normalizeInstanceKernelUrl('https://localhost:8443/kernel/host')).toBe(
-      'https://localhost:8443/kernel/host',
-    )
-    expect(normalizeInstanceKernelUrl('https://scw-admin.astrale.ai')).toBe(
-      'https://scw-admin.astrale.ai',
-    )
-    expect(normalizeInstanceKernelUrl('https://testmarc.svc.eu.astrale.ai')).toBe(
-      'https://testmarc.svc.eu.astrale.ai',
-    )
-    expect(normalizeInstanceKernelUrl('https://testmarc.eu.astrale.ai?debug=1')).toBe(
-      'https://testmarc.eu.astrale.ai?debug=1',
-    )
-  })
-})
-
-describe('sanitizeStore — read must not rewrite', () => {
-  test('an already-normalized store reports changed=false', () => {
-    // `changed` was computed via OBJECT IDENTITY (always true), so every
-    // read rewrote instances.json fire-and-forget — concurrent astrale
-    // processes clobbered each other's `active` from stale snapshots and
-    // calls silently targeted the wrong instance.
-    const store = {
-      active: 'a',
-      instances: {
-        a: { url: 'https://a.example/api', kind: 'bookmark' as const },
-      },
-    }
-    const { changed } = sanitizeStore(store)
-    expect(changed).toBe(false)
-  })
-
-  test('a dangling active pointer is preserved (not silently re-aimed)', () => {
-    const store = {
-      active: 'ghost',
-      instances: { a: { url: 'https://a.example/api', kind: 'bookmark' as const } },
-    }
-    const { store: out } = sanitizeStore(store)
-    expect(out.active).toBe('ghost')
-  })
-
-  test('organizationId survives sanitize without flagging a rewrite', () => {
-    // The org id captured at `instance create` is what makes token scoping
-    // immune to the router's eventually-consistent /auth/org — losing it on
-    // a read (or rewriting the file for it) would re-open the stale-org race.
-    const store = {
-      active: 'a',
-      instances: {
-        a: {
-          url: 'https://a.example/api',
-          kind: 'bookmark' as const,
-          organizationId: 'org_123',
-        },
-      },
-    }
-    const { store: out, changed } = sanitizeStore(store)
-    expect(out.instances.a.organizationId).toBe('org_123')
-    expect(changed).toBe(false)
-  })
-})
-
-describe('bookmark TLS trust collisions', () => {
-  test('finds the same normalized URL with a different CA configuration', () => {
-    const store = InstanceStoreSchema.parse({
-      active: 'stable',
-      instances: {
-        stable: {
-          url: 'https://local.example/kernel/',
-          caFile: '/certs/stable.pem',
-        },
-        alias: {
-          url: 'https://local.example/kernel',
-          caFile: '/certs/old.pem',
-        },
-        other: {
-          url: 'https://other.example/kernel',
-          caFile: '/certs/old.pem',
-        },
-      },
-    })
-
-    expect(
-      findBookmarkTrustConflicts(
-        store,
-        'stable',
-        'https://local.example/kernel',
-        '/certs/stable.pem',
-      ),
-    ).toEqual([{ name: 'alias', caFile: '/certs/old.pem' }])
-  })
-
-  test('treats custom CA versus system trust as a meaningful difference', () => {
-    const store = InstanceStoreSchema.parse({
-      active: 'custom',
-      instances: {
-        custom: { url: 'https://local.example', caFile: '/certs/local.pem' },
-        system: { url: 'https://local.example' },
-      },
-    })
-
-    expect(
-      findBookmarkTrustConflicts(store, 'custom', 'https://local.example', '/certs/local.pem'),
-    ).toEqual([{ name: 'system', caFile: null }])
-  })
-})

package/src/lib/__tests__/local-status.test.ts

@@ -1,202 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { IdentityStore } from '../../identity/index'
-import type { IdpSession } from '../idp'
-import type { InstanceStore } from '../instance'
-
-import { DEFAULT_ADMIN_TARGET_URL } from '../admin-target'
-import { buildLocalStatus, decodeJwtExpiration } from '../local-status'
-
-describe('local status snapshot', () => {
-  test('summarizes active bookmark and key identity registration', async () => {
-    const instances: InstanceStore = {
-      active: 'staging',
-      instances: {
-        staging: { url: 'https://kernel.example.com', issuer: 'https://issuer.example.com' },
-      },
-    }
-    const identities: IdentityStore = {
-      default: 'alice',
-      identities: {
-        alice: {
-          subject: 'alice',
-          source: 'key',
-          createdAt: '2026-01-01T00:00:00.000Z',
-          registrations: {
-            staging: {
-              iss: 'https://kernel.example.com/iss/thumbprint',
-              sub: 'node-1',
-              registeredAt: '2026-01-02T00:00:00.000Z',
-            },
-            admin: {
-              iss: 'https://admin.eu.astrale.ai/api/iss/thumbprint',
-              sub: 'admin-node-1',
-              registeredAt: '2026-01-02T00:00:00.000Z',
-            },
-          },
-        },
-      },
-    }
-
-    const status = await buildLocalStatus(instances, identities, async () => null)
-
-    expect(status.instance?.active).toBe('staging')
-    expect(status.instance?.url).toBe('https://kernel.example.com')
-    expect('error' in status.admin).toBe(false)
-    if (!('error' in status.admin)) {
-      expect(status.admin.url).toBe(DEFAULT_ADMIN_TARGET_URL)
-    }
-    expect(status.identity?.name).toBe('alice')
-    expect(status.identity?.source).toBe('key')
-    expect(status.identity?.session).toBeNull()
-  })
-
-  test('keeps a refreshable cached IdP session ready when the access token is stale', async () => {
-    const instances: InstanceStore = {
-      active: '',
-      instances: {},
-    }
-    const identities: IdentityStore = {
-      default: 'workos-user',
-      identities: {
-        'workos-user': {
-          subject: 'user_123',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://idp.example.com',
-          createdAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }
-    const session: IdpSession = {
-      identity: 'workos-user',
-      idp: 'workos',
-      issuer: 'https://idp.example.com',
-      subject: 'user_123',
-      access_token: 'redacted',
-      refresh_token: 'redacted-refresh',
-      expires_at: '2000-01-01T00:00:00.000Z',
-      updatedAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    const status = await buildLocalStatus(instances, identities, async () => session)
-
-    expect(status.instance).toBeNull()
-    expect(status.identity?.source).toBe('idp')
-    expect(status.identity?.session?.cached).toBe(true)
-    expect(status.identity?.session?.requiresLogin).toBe(false)
-    expect(status.identity?.session?.hasRefreshToken).toBe(true)
-  })
-
-  test('requires login when the cached IdP access token is stale and cannot refresh', async () => {
-    const instances: InstanceStore = {
-      active: '',
-      instances: {},
-    }
-    const identities: IdentityStore = {
-      default: 'workos-user',
-      identities: {
-        'workos-user': {
-          subject: 'user_123',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://idp.example.com',
-          createdAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }
-    const session: IdpSession = {
-      identity: 'workos-user',
-      idp: 'workos',
-      issuer: 'https://idp.example.com',
-      subject: 'user_123',
-      access_token: 'redacted',
-      expires_at: '2000-01-01T00:00:00.000Z',
-      updatedAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    const status = await buildLocalStatus(instances, identities, async () => session)
-
-    expect(status.identity?.session?.cached).toBe(true)
-    expect(status.identity?.session?.requiresLogin).toBe(true)
-    expect(status.identity?.session?.hasRefreshToken).toBe(false)
-  })
-
-  test('summarizes active managed slug without requiring a local bookmark', async () => {
-    const instances: InstanceStore = {
-      active: 'testmarc',
-      instances: {},
-    }
-    const identities: IdentityStore = {
-      default: 'workos-user',
-      identities: {
-        'workos-user': {
-          subject: 'user_123',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://idp.example.com',
-          createdAt: '2026-01-01T00:00:00.000Z',
-        },
-      },
-    }
-
-    const status = await buildLocalStatus(instances, identities, async () => null)
-
-    expect(status.instance).toEqual({
-      active: 'testmarc',
-      url: '',
-      issuer: null,
-      defaultIdentity: null,
-    })
-  })
-
-  test('falls back to identity exp claim when IdP session has no expires_at', async () => {
-    const identities: IdentityStore = {
-      default: 'workos-user',
-      identities: {
-        'workos-user': {
-          subject: 'user_123',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://idp.example.com',
-          createdAt: '2026-01-01T00:00:00.000Z',
-          claims: { exp: 946684800 },
-        },
-      },
-    }
-    const session: IdpSession = {
-      identity: 'workos-user',
-      idp: 'workos',
-      issuer: 'https://idp.example.com',
-      subject: 'user_123',
-      access_token: 'redacted',
-      updatedAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    const status = await buildLocalStatus(
-      { active: '', instances: {} },
-      identities,
-      async () => session,
-    )
-
-    expect(status.identity?.session?.requiresLogin).toBe(true)
-  })
-})
-
-describe('decodeJwtExpiration', () => {
-  test('decodes exp without exposing token content', async () => {
-    const b64u = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url')
-    const token = `${b64u({ alg: 'none' })}.${b64u({ exp: 946684800 })}.signature`
-
-    const expiration = decodeJwtExpiration(token, Date.parse('2026-01-01T00:00:00.000Z'))
-
-    expect(expiration).toEqual({
-      expiresAt: '2000-01-01T00:00:00.000Z',
-      expired: true,
-    })
-  })
-})

package/src/lib/__tests__/log-errors.test.ts

@@ -1,64 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-
-import { AstraleError } from '../../errors'
-import { failInput, fatal } from '../log'
-
-class ExitError extends Error {}
-
-let stderr = ''
-let exit: typeof process.exit
-let write: typeof process.stderr.write
-
-beforeEach(() => {
-  stderr = ''
-  exit = process.exit
-  write = process.stderr.write
-  process.exit = (() => {
-    throw new ExitError()
-  }) as typeof process.exit
-  process.stderr.write = ((chunk: string | Uint8Array) => {
-    stderr += String(chunk)
-    return true
-  }) as typeof process.stderr.write
-})
-
-afterEach(() => {
-  process.exit = exit
-  process.stderr.write = write
-})
-
-describe('terminal error safety', () => {
-  test('renders an empty aggregate as an honest non-blank unexpected failure', () => {
-    expect(() => fatal(new AggregateError([], ''), { json: true })).toThrow(ExitError)
-    expect(JSON.parse(stderr)).toEqual({
-      error: 'UNEXPECTED_ERROR',
-      message: 'The CLI encountered an unexpected internal failure.',
-    })
-  })
-
-  test('retains unknown failure evidence only under explicit debug output', () => {
-    const failure = new AggregateError([new Error('provider rejected organization scope')], '')
-
-    expect(() => fatal(failure, { json: true, debug: true })).toThrow(ExitError)
-
-    expect(stderr).toContain(
-      '{"error":"UNEXPECTED_ERROR","message":"The CLI encountered an unexpected internal failure."}',
-    )
-    expect(stderr).toContain('aggregate: Error: provider rejected organization scope')
-  })
-
-  test('rejects blank admitted CLI diagnostics', () => {
-    expect(() => new AstraleError('INVALID_INPUT', '  ')).toThrow(TypeError)
-  })
-
-  test('labels only expected admission failures as invalid input', () => {
-    expect(() => failInput(new TypeError('Authored value is invalid.'), { json: true })).toThrow(
-      ExitError,
-    )
-    expect(JSON.parse(stderr)).toMatchObject({ error: 'INVALID_INPUT' })
-
-    stderr = ''
-    expect(() => failInput(new AggregateError([], ''), { json: true })).toThrow(ExitError)
-    expect(JSON.parse(stderr)).toMatchObject({ error: 'UNEXPECTED_ERROR' })
-  })
-})

package/src/lib/__tests__/log.test.ts

@@ -1,31 +0,0 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
-
-import { log } from '../log'
-
-describe('log diagnostics', () => {
-  let stdout: string[]
-  let stderr: string[]
-  let originalLog: typeof console.log
-  let originalError: typeof console.error
-
-  beforeEach(() => {
-    stdout = []
-    stderr = []
-    originalLog = console.log
-    originalError = console.error
-    console.log = mock((...values: unknown[]) => stdout.push(values.map(String).join(' ')))
-    console.error = mock((...values: unknown[]) => stderr.push(values.map(String).join(' ')))
-  })
-
-  afterEach(() => {
-    console.log = originalLog
-    console.error = originalError
-  })
-
-  test('warnings use stderr so machine-readable stdout remains one value', () => {
-    log.warn('identity override consented')
-
-    expect(stdout).toEqual([])
-    expect(stderr.join('\n')).toContain('identity override consented')
-  })
-})