@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/state/.spec/laws/state.ts

@@ -1,73 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_STATE_PATHS_CAPTURED = defineLaw({
-  id: 'CLI-STATE-PATHS-CAPTURED',
-  statement:
-    'Path construction applies explicit-home then environment then platform-home precedence once; later environment mutation cannot change the returned coordinates.',
-  tests: [{ file: '__tests__/paths.test.ts', id: 'TEST-CLI-STATE-PATHS-CAPTURED' }],
-})
-
-export const CLI_STATE_ATOMIC_REPLACEMENT = defineLaw({
-  id: 'CLI-STATE-ATOMIC-REPLACEMENT',
-  statement:
-    'A successful replacement publishes one complete mode-0600 file and leaves no temporary file; a failed replacement never publishes partial content.',
-  tests: [
-    { file: '__tests__/files.test.ts', id: 'TEST-CLI-STATE-ATOMIC-WRITE' },
-    { file: '__tests__/files.test.ts', id: 'TEST-CLI-STATE-ATOMIC-WRITE-FAILURE' },
-  ],
-})
-
-export const CLI_STATE_LOCK_BOUNDED = defineLaw({
-  id: 'CLI-STATE-LOCK-BOUNDED',
-  statement:
-    'Contending transitions serialize, abandoned locks are recoverable, acquisition is bounded, and every acquired lock is released after success or failure.',
-  tests: [
-    { file: '__tests__/files.test.ts', id: 'TEST-CLI-STATE-LOCK-SERIALIZES' },
-    { file: '__tests__/files.test.ts', id: 'TEST-CLI-STATE-LOCK-RECOVERS' },
-    { file: '__tests__/files.test.ts', id: 'TEST-CLI-STATE-LOCK-RELEASES-AND-BOUNDS' },
-  ],
-})
-
-export const CLI_STATE_IDENTITY_READ_SAFE = defineLaw({
-  id: 'CLI-STATE-IDENTITY-READ-SAFE',
-  statement:
-    'Missing, legacy, and current identity files decode without a write; malformed or unsupported-version files fail without replacement.',
-  tests: [
-    { file: '__tests__/identities.test.ts', id: 'TEST-CLI-STATE-IDENTITY-READ-SAFE' },
-    { file: '__tests__/identities.test.ts', id: 'TEST-CLI-STATE-IDENTITY-FAILS-CLOSED' },
-  ],
-})
-
-export const CLI_STATE_IDENTITY_MIGRATION = defineLaw({
-  id: 'CLI-STATE-IDENTITY-MIGRATION',
-  statement:
-    'The first successful mutation of legacy identity state preserves its exact bytes once before publishing V1; concurrent mutations reread and retain every committed transition.',
-  tests: [
-    { file: '__tests__/identities.test.ts', id: 'TEST-CLI-STATE-IDENTITY-MIGRATES' },
-    { file: '__tests__/identities.test.ts', id: 'TEST-CLI-STATE-IDENTITY-CONCURRENT' },
-  ],
-})
-
-export const CLI_STATE_EXCHANGE_CACHE = defineLaw({
-  id: 'CLI-STATE-EXCHANGE-CACHE',
-  statement:
-    'The durable exchange Artifact partitions Domain credentials by exact Kernel issuer, Domain issuer, and registered User, requires the sole nested Kernel proof subject to equal that User, admits matching token claims and expiry, refreshes under process and file-lock singleflight, and publishes only owner-private atomic state.',
-  tests: [
-    {
-      file: '__tests__/exchange-credentials.test.ts',
-      id: 'TEST-CLI-EXCHANGE-CACHE-EXACT-KEY-AND-PRIVATE-MODE',
-    },
-    {
-      file: '__tests__/exchange-credentials.test.ts',
-      id: 'TEST-CLI-EXCHANGE-CACHE-SINGLEFLIGHT-CROSS-INSTANCE',
-    },
-    {
-      file: '__tests__/exchange-credentials.test.ts',
-      id: 'TEST-CLI-EXCHANGE-CACHE-REJECTS-STALE-OR-MISBOUND',
-    },
-    {
-      file: '__tests__/exchange-credentials.test.ts',
-      id: 'TEST-CLI-EXCHANGE-CACHE-LIFECYCLE-INVALIDATION',
-    },
-  ],
-})

package/src/state/.spec/layout.ts

@@ -1,15 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: [
-    '__tests__/',
-    'exchange-credentials.ts',
-    'files.ts',
-    'identities.ts',
-    'index.ts',
-    'paths.ts',
-    'session-routes.ts',
-    'tsconfig.json',
-  ],
-  exact: true,
-})

package/src/state/__tests__/exchange-credentials.test.ts

@@ -1,341 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { ExchangeCredentialCache } from '../exchange-credentials'
-
-let directory: string
-let path: string
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'astrale-exchange-cache-'))
-  path = join(directory, 'private', 'credentials.json')
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-describe('exchange credential cache', () => {
-  /** @evidence TEST-CLI-EXCHANGE-CACHE-EXACT-KEY-AND-PRIVATE-MODE */
-  test('partitions by Kernel, Domain, and source identity under private filesystem modes', async () => {
-    const cache = new ExchangeCredentialCache(path)
-    const now = () => 100
-    const first = key('https://kernel-a.example', 'https://domain.example', 'user-a')
-    const partitions = [
-      first,
-      key('https://kernel-b.example', first.domainIssuer, first.sourceSubject),
-      key(first.kernelIssuer, 'https://other-domain.example', first.sourceSubject),
-      key(
-        first.kernelIssuer,
-        first.domainIssuer,
-        first.sourceSubject,
-        'https://other-source.example',
-      ),
-      key(first.kernelIssuer, first.domainIssuer, 'user-b'),
-    ]
-    let refreshes = 0
-
-    const resolve = (candidate: typeof first) =>
-      cache.getOrRefresh(
-        candidate,
-        30,
-        async () => {
-          refreshes += 1
-          return entry(candidate, 200)
-        },
-        now,
-      )
-
-    for (const candidate of partitions) {
-      await expect(resolve(candidate)).resolves.toBe(token(candidate, 200))
-      await expect(resolve(candidate)).resolves.toBe(token(candidate, 200))
-    }
-    expect(refreshes).toBe(partitions.length)
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect((await stat(join(directory, 'private'))).mode & 0o777).toBe(0o700)
-  })
-
-  /** @evidence TEST-CLI-EXCHANGE-CACHE-SINGLEFLIGHT-CROSS-INSTANCE */
-  test('singleflights refreshes in-process and through the cross-process file lock', async () => {
-    const left = new ExchangeCredentialCache(path)
-    const right = new ExchangeCredentialCache(path)
-    const candidate = key('https://kernel.example', 'https://domain.example', 'user')
-    let refreshes = 0
-    const refresh = async () => {
-      refreshes += 1
-      await new Promise((resolve) => setTimeout(resolve, 10))
-      return entry(candidate, 200)
-    }
-
-    const values = await Promise.all([
-      left.getOrRefresh(candidate, 30, refresh, () => 100),
-      left.getOrRefresh(candidate, 30, refresh, () => 100),
-      right.getOrRefresh(candidate, 30, refresh, () => 100),
-    ])
-    expect(new Set(values).size).toBe(1)
-    expect(refreshes).toBe(1)
-  })
-
-  /** @evidence TEST-CLI-EXCHANGE-CACHE-REJECTS-STALE-OR-MISBOUND */
-  test('removes stale entries and rejects a freshly returned misbound token', async () => {
-    const cache = new ExchangeCredentialCache(path)
-    const candidate = key('https://kernel.example', 'https://domain.example', 'user')
-    await cache.getOrRefresh(
-      candidate,
-      30,
-      async () => entry(candidate, 120),
-      () => 50,
-    )
-    let refreshes = 0
-    await cache.getOrRefresh(
-      candidate,
-      30,
-      async () => {
-        refreshes += 1
-        return entry(candidate, 220)
-      },
-      () => 100,
-    )
-    expect(refreshes).toBe(1)
-
-    await expect(
-      cache.getOrRefresh(
-        key('https://other-kernel.example', candidate.domainIssuer, candidate.sourceSubject),
-        30,
-        async () => entry(candidate, 220),
-        () => 100,
-      ),
-    ).rejects.toThrow(/inconsistent with its cache key/i)
-
-    await expect(
-      cache.getOrRefresh(
-        key(candidate.kernelIssuer, candidate.domainIssuer, 'other-source'),
-        30,
-        async () => entry(candidate, 220),
-        () => 100,
-      ),
-    ).rejects.toThrow(/inconsistent with its cache key/i)
-
-    for (const malformed of ['outer-delegation', 'proof-without-delegation'] as const) {
-      const malformedCandidate = key(
-        candidate.kernelIssuer,
-        candidate.domainIssuer,
-        `user-${malformed}`,
-      )
-      await expect(
-        cache.getOrRefresh(
-          malformedCandidate,
-          30,
-          async () => entry(malformedCandidate, 220, malformed),
-          () => 100,
-        ),
-      ).rejects.toThrow(/inconsistent with its cache key/i)
-    }
-  })
-
-  /** @evidence TEST-CLI-EXCHANGE-CACHE-LIFECYCLE-INVALIDATION */
-  test('invalidates one Kernel or the entire cache', async () => {
-    const cache = new ExchangeCredentialCache(path)
-    const a = key('https://kernel-a.example', 'https://domain.example', 'user')
-    const b = key('https://kernel-b.example', 'https://domain.example', 'user')
-    for (const candidate of [a, b]) {
-      await cache.getOrRefresh(
-        candidate,
-        30,
-        async () => entry(candidate, 200),
-        () => 100,
-      )
-    }
-    await cache.deleteKernel(a.kernelIssuer)
-    expect(await readFile(path, 'utf8')).not.toContain(a.kernelIssuer)
-    expect(await readFile(path, 'utf8')).toContain(b.kernelIssuer)
-    await cache.clear()
-    expect(JSON.parse(await readFile(path, 'utf8')).entries).toEqual({})
-  })
-
-  test('discards the V1 cache and writes only V2 after a fresh exact exchange', async () => {
-    await mkdir(join(directory, 'private'))
-    await writeFile(
-      path,
-      JSON.stringify({
-        version: 1,
-        entries: { legacy: { credential: 'legacy', expiresAt: 999 } },
-      }),
-    )
-    const cache = new ExchangeCredentialCache(path)
-    const candidate = key('https://kernel.example', 'https://domain.example', 'source-user')
-    let refreshes = 0
-    await cache.getOrRefresh(
-      candidate,
-      30,
-      async () => {
-        refreshes += 1
-        return entry(candidate, 200)
-      },
-      () => 100,
-    )
-    expect(refreshes).toBe(1)
-    const stored = JSON.parse(await readFile(path, 'utf8'))
-    expect(stored.version).toBe(2)
-    expect(JSON.stringify(stored)).not.toContain('legacy')
-  })
-
-  test('refreshes a valid cached credential that cannot cover the requested invocation', async () => {
-    const cache = new ExchangeCredentialCache(path)
-    const candidate = key('https://kernel.example', 'https://domain.example', 'user')
-    await cache.getOrRefresh(
-      candidate,
-      30,
-      async () => entry(candidate, 250),
-      () => 100,
-    )
-    let refreshes = 0
-
-    await expect(
-      cache.getOrRefresh(
-        candidate,
-        185,
-        async () => {
-          refreshes += 1
-          return entry(candidate, 300)
-        },
-        () => 100,
-      ),
-    ).resolves.toBe(token(candidate, 300))
-    expect(refreshes).toBe(1)
-
-    await expect(
-      cache.getOrRefresh(
-        candidate,
-        201,
-        async () => entry(candidate, 190),
-        () => 100,
-      ),
-    ).rejects.toThrow(/required lifetime/i)
-  })
-
-  test('rejects a long outer token whose carried proof cannot cover the requested invocation', async () => {
-    const cache = new ExchangeCredentialCache(path)
-    const candidate = key('https://kernel.example', 'https://domain.example', 'user')
-
-    await expect(
-      cache.getOrRefresh(
-        candidate,
-        185,
-        async () => entry(candidate, 300, undefined, 150),
-        () => 100,
-      ),
-    ).rejects.toThrow(/required lifetime/i)
-  })
-
-  test('serializes concurrent short and long callers without serving a short carrier to the long caller', async () => {
-    for (const firstKind of ['short', 'long'] as const) {
-      const concurrentPath = join(directory, firstKind, 'credentials.json')
-      const firstCache = new ExchangeCredentialCache(concurrentPath)
-      const secondCache = new ExchangeCredentialCache(concurrentPath)
-      const candidate = key('https://kernel.example', 'https://domain.example', firstKind)
-      let releaseFirst!: () => void
-      let markFirstStarted!: () => void
-      const firstStarted = new Promise<void>((resolve) => {
-        markFirstStarted = resolve
-      })
-      const release = new Promise<void>((resolve) => {
-        releaseFirst = resolve
-      })
-      let refreshes = 0
-      const firstMinimum = firstKind === 'short' ? 30 : 185
-      const firstExpiration = firstKind === 'short' ? 200 : 300
-      const first = firstCache.getOrRefresh(
-        candidate,
-        firstMinimum,
-        async () => {
-          refreshes += 1
-          markFirstStarted()
-          await release
-          return entry(candidate, firstExpiration)
-        },
-        () => 100,
-      )
-      await firstStarted
-      const secondMinimum = firstKind === 'short' ? 185 : 30
-      const secondExpiration = firstKind === 'short' ? 300 : 200
-      const second = secondCache.getOrRefresh(
-        candidate,
-        secondMinimum,
-        async () => {
-          refreshes += 1
-          return entry(candidate, secondExpiration)
-        },
-        () => 100,
-      )
-      releaseFirst()
-
-      const [firstValue, secondValue] = await Promise.all([first, second])
-      const longValue = firstKind === 'long' ? firstValue : secondValue
-      expect(longValue).toBe(token(candidate, 300))
-      expect(refreshes).toBe(firstKind === 'short' ? 2 : 1)
-    }
-  })
-})
-
-function key(
-  kernelIssuer: string,
-  domainIssuer: string,
-  sourceSubject: string,
-  sourceIssuer = 'https://source.example',
-) {
-  return {
-    kernelIssuer,
-    domainIssuer,
-    sourceIssuer,
-    sourceSubject,
-  }
-}
-
-function entry(
-  candidate: ReturnType<typeof key>,
-  expiresAt: number,
-  malformed?: 'outer-delegation' | 'proof-without-delegation',
-  proofExpiresAt = expiresAt,
-) {
-  return {
-    credential: token(candidate, expiresAt, malformed, proofExpiresAt),
-    expiresAt,
-    user: candidate.sourceSubject,
-    sourceIssuer: candidate.sourceIssuer,
-    sourceSubject: candidate.sourceSubject,
-  }
-}
-
-function token(
-  candidate: ReturnType<typeof key>,
-  exp: number,
-  malformed?: 'outer-delegation' | 'proof-without-delegation',
-  proofExp = exp,
-): string {
-  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url')
-  const proof = `${encode({ alg: 'EdDSA', typ: 'JWT' })}.${encode({
-    iss: candidate.kernelIssuer,
-    sub: candidate.sourceSubject,
-    aud: candidate.kernelIssuer,
-    exp: proofExp,
-    ...(malformed === 'proof-without-delegation'
-      ? {}
-      : {
-          delegation: {
-            v: 1,
-            expr: { kind: 'identity', id: candidate.sourceSubject },
-          },
-        }),
-  })}.signature`
-  return `${encode({ alg: 'EdDSA', typ: 'JWT' })}.${encode({
-    iss: candidate.domainIssuer,
-    sub: 'domain',
-    aud: candidate.kernelIssuer,
-    exp,
-    grant: { v: 1, expr: { kind: 'identity', credential: proof } },
-    ...(malformed === 'outer-delegation' ? { delegation: { credential: proof } } : {}),
-  })}.signature`
-}

package/src/state/__tests__/files.test.ts

@@ -1,136 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import {
-  access,
-  mkdir,
-  mkdtemp,
-  readdir,
-  readFile,
-  rm,
-  stat,
-  utimes,
-  writeFile,
-} from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { atomicWrite, atomicWriteSync, withFileLock } from '../files'
-
-let temporaryDirectory: string
-
-beforeEach(async () => {
-  temporaryDirectory = await mkdtemp(join(tmpdir(), 'astrale-state-files-'))
-})
-
-afterEach(async () => {
-  await rm(temporaryDirectory, { recursive: true, force: true })
-})
-
-describe('atomicWrite', () => {
-  /** @evidence TEST-CLI-STATE-ATOMIC-WRITE */
-  test('publishes a synced mode-0600 file without temporary residue', async () => {
-    const path = join(temporaryDirectory, 'nested', 'state.json')
-
-    await atomicWrite(path, '{"value":1}')
-
-    expect(await readFile(path, 'utf-8')).toBe('{"value":1}')
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect(await readdir(join(temporaryDirectory, 'nested'))).toEqual(['state.json'])
-  })
-
-  /** @evidence TEST-CLI-STATE-ATOMIC-WRITE-FAILURE */
-  test('does not disturb the target or retain a temporary file after failure', async () => {
-    const path = join(temporaryDirectory, 'target')
-    await mkdir(path)
-    await writeFile(join(path, 'retained'), 'stable')
-
-    await expect(atomicWrite(path, 'replacement')).rejects.toThrow()
-
-    expect(await readFile(join(path, 'retained'), 'utf-8')).toBe('stable')
-    expect((await readdir(temporaryDirectory)).sort()).toEqual(['target'])
-  })
-})
-
-describe('atomicWriteSync', () => {
-  test('publishes a synced mode-0600 file without temporary residue', async () => {
-    const path = join(temporaryDirectory, 'sync', 'state.json')
-
-    atomicWriteSync(path, '{"value":1}')
-
-    expect(await readFile(path, 'utf-8')).toBe('{"value":1}')
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect(await readdir(join(temporaryDirectory, 'sync'))).toEqual(['state.json'])
-  })
-
-  test('does not disturb the target or retain a temporary file after failure', async () => {
-    const path = join(temporaryDirectory, 'sync-target')
-    await mkdir(path)
-    await writeFile(join(path, 'retained'), 'stable')
-
-    expect(() => atomicWriteSync(path, 'replacement')).toThrow()
-
-    expect(await readFile(join(path, 'retained'), 'utf-8')).toBe('stable')
-    expect((await readdir(temporaryDirectory)).sort()).toEqual(['sync-target'])
-  })
-})
-
-describe('withFileLock', () => {
-  /** @evidence TEST-CLI-STATE-LOCK-SERIALIZES */
-  test('serializes contending read-modify-write transitions', async () => {
-    const lockPath = join(temporaryDirectory, 'counter.lock')
-    const counterPath = join(temporaryDirectory, 'counter')
-    await writeFile(counterPath, '0')
-
-    const bump = () =>
-      withFileLock(
-        lockPath,
-        async () => {
-          const value = Number(await readFile(counterPath, 'utf-8'))
-          await new Promise((resolve) => setTimeout(resolve, 2))
-          await writeFile(counterPath, String(value + 1))
-        },
-        { pollIntervalMs: 2 },
-      )
-    await Promise.all(Array.from({ length: 20 }, bump))
-
-    expect(await readFile(counterPath, 'utf-8')).toBe('20')
-  })
-
-  /** @evidence TEST-CLI-STATE-LOCK-RECOVERS */
-  test('recovers stale and dead-owner locks', async () => {
-    const stalePath = join(temporaryDirectory, 'stale.lock')
-    await writeFile(stalePath, JSON.stringify({ pid: process.pid }))
-    const past = new Date(Date.now() - 60_000)
-    await utimes(stalePath, past, past)
-    await expect(withFileLock(stalePath, async () => 'stale', { pollIntervalMs: 2 })).resolves.toBe(
-      'stale',
-    )
-
-    const deadPath = join(temporaryDirectory, 'dead.lock')
-    await writeFile(deadPath, JSON.stringify({ pid: 99_999_999 }))
-    await expect(withFileLock(deadPath, async () => 'dead', { pollIntervalMs: 2 })).resolves.toBe(
-      'dead',
-    )
-  })
-
-  /** @evidence TEST-CLI-STATE-LOCK-RELEASES-AND-BOUNDS */
-  test('releases after failure and bounds acquisition behind a live owner', async () => {
-    const releasedPath = join(temporaryDirectory, 'released.lock')
-    await expect(
-      withFileLock(releasedPath, async () => {
-        throw new Error('transition failed')
-      }),
-    ).rejects.toThrow('transition failed')
-    await expect(access(releasedPath)).rejects.toThrow()
-    await expect(withFileLock(releasedPath, async () => 'next')).resolves.toBe('next')
-
-    const heldPath = join(temporaryDirectory, 'held.lock')
-    await writeFile(heldPath, JSON.stringify({ pid: process.pid }))
-    await expect(
-      withFileLock(heldPath, async () => 'unreachable', {
-        pollIntervalMs: 10,
-        staleAfterMs: 60_000,
-        timeoutMs: 40,
-      }),
-    ).rejects.toThrow('Timed out')
-  })
-})

package/src/state/__tests__/fixtures/identity-transition.ts

@@ -1,37 +0,0 @@
-import { updateIdentityStore } from '../../identities'
-
-const [action, name, argument] = process.argv.slice(2)
-
-if (action === 'default' && name !== undefined) {
-  await updateIdentityStore((current) => {
-    if (!current.identities[name]) throw new Error(`Identity "${name}" not found`)
-    return { next: { ...current, default: name }, value: undefined }
-  })
-} else if (action === 'registration' && name !== undefined && argument !== undefined) {
-  await updateIdentityStore((current) => {
-    const identity = current.identities[name]
-    if (!identity) throw new Error(`Identity "${name}" not found`)
-    return {
-      next: {
-        ...current,
-        identities: {
-          ...current.identities,
-          [name]: {
-            ...identity,
-            registrations: {
-              ...identity.registrations,
-              [argument]: {
-                iss: `https://${argument}.example.test`,
-                sub: `${name}-${argument}`,
-                registeredAt: '2025-01-01T00:00:00.000Z',
-              },
-            },
-          },
-        },
-      },
-      value: undefined,
-    }
-  })
-} else {
-  throw new Error('Invalid identity-transition fixture arguments')
-}

package/src/state/__tests__/fixtures/session-route-process.ts

@@ -1,93 +0,0 @@
-import type { Transport } from '@astrale-os/sdk/client'
-
-import { issuer } from '@astrale-os/sdk/auth'
-import { call, Client } from '@astrale-os/sdk/client'
-import { ClientSession } from '@astrale-os/sdk/client/session'
-import { NodeId } from '@astrale-os/sdk/graph/node'
-import { Path } from '@astrale-os/sdk/graph/path'
-import { invocation } from '@astrale-os/sdk/invocation'
-
-import { FileSessionRouteStore } from '../../session-routes'
-
-const routePath = process.argv[2]
-if (routePath === undefined) throw new Error('route artifact path is required')
-
-const sourceEndpoint = 'https://source.kernel.test/invoke'
-const sourceIssuer = issuer.accept('https://source.kernel.test')
-const destinationEndpoint = 'https://destination.application.test/invoke'
-const target = Path.id(NodeId('session-route-fresh-process'))
-let sourceAttempts = 0
-let destinationAttempts = 0
-
-const route = invocation.acceptRoute({
-  endpoint: { http: destinationEndpoint },
-  via: {
-    kind: 'via',
-    issuer: sourceIssuer,
-    publication: {
-      origin: 'destination.application.test',
-      identity: {
-        issuer: 'https://destination.application.test',
-        subject: 'destination.application.test',
-      },
-      revision: `sha256:${'1'.padStart(64, '0')}`,
-      etag: `sha256:${'1'.padStart(64, '0')}`,
-    },
-  },
-})
-const carrier = `e30.${Buffer.from(
-  JSON.stringify({ exp: Math.floor(Date.now() / 1_000) + 600 }),
-).toString('base64url')}.signature`
-const sourceDispatch: Transport['dispatch'] = async () => {
-  sourceAttempts += 1
-  return {
-    kind: 'redirect',
-    invocation: { source: sourceIssuer, id: 'source-invocation' },
-    redirect: { route, credential: carrier },
-  }
-}
-const destinationDispatch: Transport['dispatch'] = async () => {
-  destinationAttempts += 1
-  return {
-    kind: 'value',
-    value: 'done',
-    invocation: { source: sourceIssuer, id: 'destination-invocation' },
-  }
-}
-const source = new Client({ transport: { dispatch: sourceDispatch } })
-const destination = new Client({ transport: { dispatch: destinationDispatch } })
-const session = new ClientSession({
-  kernel: sourceIssuer,
-  fetch: async () =>
-    new Response(
-      JSON.stringify({
-        protocol: 'astrale-invocation',
-        version: 1,
-        issuer: sourceIssuer,
-        endpoints: { http: sourceEndpoint },
-      }),
-      { headers: { 'content-type': 'application/json' } },
-    ),
-  pool: {
-    clientFor(
-      target: Parameters<
-        NonNullable<ConstructorParameters<typeof ClientSession>[0]['pool']>['clientFor']
-      >[0],
-    ) {
-      const url = target.transport === 'auto' ? target.endpoints.http : target.url
-      return url === sourceEndpoint ? source : destination
-    },
-  },
-  auth: { ttlSeconds: 120, resolve: () => ({ credential: 'source-credential' }) },
-  routeStore: new FileSessionRouteStore(routePath),
-  policy: { maximumRouteAgeMs: 60_000 },
-})
-
-try {
-  const value = await session.call(call(target, null))
-  console.log(JSON.stringify({ value, sourceAttempts, destinationAttempts }))
-} finally {
-  session.close()
-  source.close()
-  destination.close()
-}