@astrale-os/cli 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/types/admin/instance/model.d.ts

@@ -24,17 +24,16 @@ export interface DomainInstallReceipt {
     readonly installedRevision?: string;
     readonly error?: string;
 }
-export declare class AdminInstanceNotFoundError extends Error {
+export declare class AdminInstanceNotFoundError extends AstraleError {
     readonly identifier: string;
-    readonly name = "NotFoundError";
     constructor(identifier: string);
 }
-export declare class AdminHostNotFoundError extends Error {
+export declare class AdminHostNotFoundError extends AstraleError {
     readonly identifier: string;
-    readonly name = "NotFoundError";
     constructor(identifier: string);
 }
 /** Match an owner-scoped Instance by slug, canonical Node Path, or bare Node id. */
 export declare function findOwnedInstance(instances: readonly OwnedInstanceInfo[], identifier: string): OwnedInstanceInfo | undefined;
 /** Human-readable location of an Instance (state, region, and Host Path). */
 export declare function formatInstanceLocation(info: InstanceInfo): string;
+import { AstraleError } from '../../errors';

package/dist/types/errors.d.ts

@@ -1,7 +1,7 @@
 export declare class AstraleError extends Error {
     code: string;
     hint?: string;
-    constructor(code: string, message: string, hint?: string);
+    constructor(code: string, message: string, hint?: string, options?: ErrorOptions);
 }
 export declare class AuthError extends AstraleError {
     constructor(message: string, hint?: string);

package/dist/types/lib/idp.d.ts

@@ -322,6 +322,7 @@ export declare function fetchOidcMetadata(issuer: string): Promise<OidcMetadata>
 export declare function workosAuthKitMetadata(apiHost?: string, clientId?: string): OidcMetadata;
 export declare function builtinIdpConfig(name: string, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | null;
 export declare function workosClientIdFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function legacyBuiltinWorkosReplacement(existing: IdpConfig, clientIdOverride?: string, env?: NodeJS.ProcessEnv): IdpConfig | undefined;
 export declare function postForm(url: string, params: URLSearchParams): Promise<TokenResponse>;
 export declare function postJson(url: string, bodyInput: Record<string, string>): Promise<TokenResponse>;
 export declare function tokenExpiresAt(token: TokenResponse): string | undefined;

package/dist/types/lib/instance-target.d.ts

@@ -1,5 +1,5 @@
-import type { InstanceInfo } from '../admin/instance/model';
 import type { AstraleConfig } from './config';
+import { type InstanceInfo } from '../admin/instance/model';
 import { type AdminTargetCommandOpts, type ResolvedAdminTarget } from './admin-target';
 import { type InstanceStore } from './instance';
 export type InstanceTargetRequest = {

package/dist/types/lib/log.d.ts

@@ -11,8 +11,8 @@ export declare const log: {
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
 export declare function fatal(e: unknown, opts?: MachineOpts): never;
-/** Admit expected invalid input and exit through {@link fatal}. */
-export declare function failClosed(error: unknown, opts?: MachineOpts): never;
+/** Project only a caller-authored admission failure into the CLI input family. */
+export declare function failInput(error: unknown, opts?: MachineOpts): never;
 /** Shortcut for stub commands that aren't wired in v1 (§15). */
 export declare function fatalNotImplemented(feature: string, hint?: string): never;
 /**

package/dist/types/lib/update.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { AstraleError } from '../errors';
 export declare const DEFAULT_UPDATE_CHANNEL = "beta";
 export declare const InstallMetadataSchema: z.ZodObject<{
     method: z.ZodLiteral<"script">;
@@ -73,8 +74,26 @@ export type UpdateRequest = {
     currentVersion: string;
     platform?: Platform;
     installPath?: string;
+    execution?: UpdateExecution;
 };
+export type UpdateExecution = {
+    kind: 'standalone';
+    executable: string;
+} | {
+    kind: 'package-managed';
+    executable: string;
+};
+declare const admittedScriptInstall: unique symbol;
+export type AdmittedScriptInstall = Readonly<{
+    metadata: InstallMetadata;
+    executable: string;
+    [admittedScriptInstall]: true;
+}>;
 export type UpdateResult = {
+    status: 'managed';
+    currentVersion: string;
+    executable: string;
+} | {
     status: 'up-to-date';
     currentVersion: string;
     latestVersion: string;
@@ -93,9 +112,20 @@ export type UpdateResult = {
 };
 export declare function detectPlatform(): Platform;
 export declare function platformKey(platform: Platform): string;
+export declare function classifyUpdateExecution(input: {
+    bunVersion?: string;
+    executable: string;
+    entry?: string;
+}): UpdateExecution;
+export declare function detectUpdateExecution(): UpdateExecution;
+export declare function packageManagedUpdateError(executable: string): AstraleError;
 export declare function readInstallMetadata(path?: string): Promise<InstallMetadata>;
+export declare function admitScriptInstall(meta: InstallMetadata, execution: Extract<UpdateExecution, {
+    kind: 'standalone';
+}>): Promise<AdmittedScriptInstall>;
 export declare function writeInstallMetadata(meta: InstallMetadata, path?: string): Promise<void>;
 export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
 export declare function fetchManifest(base: string): Promise<UpdateManifest>;
 export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
 export declare function updateAstrale(req: UpdateRequest): Promise<UpdateResult>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -62,11 +62,9 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "@astrale-os/kernel-client": ">=0.6.0-beta.4 <1.0.0",
-    "@astrale-os/kernel-protocol": ">=0.5.0-beta.3 <1.0.0",
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
-    "@astrale-os/sdk": ">=0.5.0-beta.9 <1.0.0",
-    "@astrale-os/shell": ">=0.3.8-beta.2 <1.0.0",
+    "@astrale-os/sdk": ">=0.5.0-beta.17 <1.0.0",
+    "@astrale-os/shell": ">=0.4.0 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "~20.3.1",
     "@commitlint/config-conventional": "~20.3.1",
@@ -108,7 +106,7 @@
     "lint:fix": "oxlint --fix .",
     "format": "pnpm exec oxfmt --write .",
     "format:check": "pnpm exec oxfmt --check .",
-    "test": "bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
+    "test": "node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
     "test:studio": "pnpm --dir studio test",
     "test:watch": "bun test --watch src"
   }

package/src/__tests__/fixtures/publication.ts

@@ -0,0 +1,20 @@
+import type { schema } from '@astrale-os/sdk/schema'
+
+import { defineApplication } from '@astrale-os/sdk/application'
+import { compile } from '@astrale-os/sdk/deployment/build'
+import { addressing, assemble } from '@astrale-os/sdk/deployment/release'
+import { defineRuntime } from '@astrale-os/sdk/runtime'
+
+/** Build a canonical empty-runtime Release for cross-boundary CLI tests. */
+export function releaseFor<const Schema extends schema.DomainSchema>(
+  source: Schema,
+  issuer: string,
+) {
+  const runtime = defineRuntime<Schema>()({
+    integrations: {},
+    initialize: () => ({ providers: {} }),
+    actions: [],
+    workflows: [],
+  })
+  return assemble(compile(defineApplication({ schema: source, runtime })), addressing(issuer))
+}

package/src/admin/__tests__/binding.test.ts

@@ -1,38 +1,31 @@
-import type { ClientSession } from '@astrale-os/kernel-client/session'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
 
-import { defineDomain } from '@astrale-os/sdk'
-import { issuer } from '@astrale-os/sdk/auth'
-import { createDeployment } from '@astrale-os/sdk/deployment'
-import { defineSchema } from '@astrale-os/sdk/schema/v1'
+import { bundle, defineSchema, schema as schemaApi } from '@astrale-os/sdk/schema'
 import { expect, mock, test } from 'bun:test'
 
+import { releaseFor } from '../../__tests__/fixtures/publication'
 import { bindAdmin } from '../binding'
 
 const schema = defineSchema('admin.astrale.ai', {})
-const deployment = createDeployment({
-  definition: defineDomain({
-    schema,
-    handlers: { functions: {}, classes: {}, interfaces: {} },
-  }),
-  issuer: issuer.accept('https://admin.beta.astrale.ai'),
-  bundleHref: 'https://admin.beta.astrale.ai/domain.bundle.json',
-  bindings: { callables: [] },
-})
+const release = releaseFor(schema, 'https://admin.beta.astrale.ai')
 
 test('binds the installed Admin Domain instead of the source Kernel publication', async () => {
-  const installed = mock(async () => ({
+  const installation = mock(async () => ({
     state: 'ready' as const,
     target: 'sha256:admin-target' as const,
-    source: { kind: 'remote' as const, publication: deployment.publication },
-    bundle: deployment.bundle,
+    source: { kind: 'remote' as const, publication: release.publication },
+    bundle: bundle.create(schema),
     readiness: 'sha256:admin-readiness' as const,
     capabilities: { requested: [], materialized: [] },
   }))
-  const session = { installed } as unknown as ClientSession
+  const session = {
+    installation,
+    bind: (domain: unknown) => ({ domain, graph: {} }),
+  } as unknown as ClientSession
 
   const binding = await bindAdmin(session)
 
-  expect(installed).toHaveBeenCalledWith('admin.astrale.ai')
-  expect(binding.$.origin).toBe('admin.astrale.ai')
-  expect(String(binding.$.publication?.identity.issuer)).toBe('https://admin.beta.astrale.ai')
+  expect(installation).toHaveBeenCalledWith('admin.astrale.ai')
+  expect(binding.domain.origin).toBe('admin.astrale.ai')
+  expect(binding.domain.revision).toBe(schemaApi.revision(schema))
 })

package/src/admin/__tests__/fixture.ts

@@ -0,0 +1,101 @@
+import type { ClientSession } from '@astrale-os/sdk/client/session'
+import type { CallableReference } from '@astrale-os/sdk/client/session'
+
+import {
+  callableAddress,
+  core,
+  defineSchema,
+  edgeClass,
+  method,
+  nodeClass,
+  property,
+  schema,
+} from '@astrale-os/sdk/schema'
+import { mock } from 'bun:test'
+
+import type { AdminBinding } from '../binding'
+
+const operation = () =>
+  method({
+    auth: 'authenticated',
+    input: { type: 'object', additionalProperties: true },
+    output: { type: 'object', additionalProperties: true },
+  })
+
+const Domain = nodeClass({
+  properties: {
+    origin: property({ type: 'string' }, { required: true }),
+    name: property({ type: 'string' }, { required: true }),
+    discoveryUrl: property({ type: 'string' }, { required: true }),
+    description: property({ type: 'string' }),
+    createdAt: property({ type: 'string' }, { required: true }),
+    updatedAt: property({ type: 'string' }, { required: true }),
+  },
+  methods: { configureDefault: operation() },
+})
+const Fleet = nodeClass({
+  methods: {
+    publishDomain: operation(),
+    listInstances: operation(),
+    createInstance: operation(),
+  },
+})
+const Host = nodeClass({
+  properties: {
+    id: property({ type: 'string' }, { required: true }),
+    state: property({ type: 'string' }, { required: true }),
+  },
+  methods: { createInstance: operation() },
+})
+const Instance = nodeClass({
+  methods: {
+    status: operation(),
+    delete: operation(),
+    installDomain: operation(),
+  },
+})
+const fleet_installs_domain_by_default = edgeClass.directed({
+  source: { as: 'fleet', accepts: [Fleet], outgoing: '0..*' },
+  target: { as: 'domain', accepts: [Domain], incoming: '0..*' },
+})
+const fleet_reserves_admin_host = edgeClass.directed({
+  source: { as: 'fleet', accepts: [Fleet], outgoing: '0..1' },
+  target: { as: 'host', accepts: [Host], incoming: '0..1' },
+})
+
+export const AdminTestSchema = defineSchema('admin.astrale.ai', {
+  classes: {
+    Domain,
+    Fleet,
+    Host,
+    Instance,
+    fleet_installs_domain_by_default,
+    fleet_reserves_admin_host,
+  },
+  core: { nodes: { fleet: core.node(() => Fleet, {}) }, edges: [] },
+})
+
+export const AdminTestDomain = schema.resolve(AdminTestSchema)
+
+export function adminBinding(): AdminBinding {
+  return { domain: AdminTestDomain, graph: {} } as unknown as AdminBinding
+}
+
+export function adminSession(
+  implementation?: (
+    method: { readonly owner: string; readonly name: string },
+    receiver: unknown,
+    input: unknown,
+  ) => unknown,
+) {
+  const invoke = mock(async (reference: CallableReference, input: unknown) => {
+    const address = callableAddress(reference.callable)
+    if (address.kind !== 'method') throw new Error('Expected an Admin Method.')
+    return implementation?.(
+      { owner: address.owner.name, name: address.name },
+      reference.target,
+      input,
+    )
+  })
+  return { invoke, session: { invoke } as unknown as ClientSession }
+}

package/src/admin/binding.ts

@@ -1,7 +1,16 @@
-import type { DomainBinding } from '@astrale-os/kernel-client/domain'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
+import type { Input } from '@astrale-os/sdk/client'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
+import type {
+  ResolvedClass,
+  ResolvedCoreDefinition,
+  ResolvedMethod,
+  ResolvedProperty,
+} from '@astrale-os/sdk/schema'
+import type { DomainBinding } from '@astrale-os/shell'
 
-import { bind } from '@astrale-os/kernel-client/domain'
+import { reference } from '@astrale-os/sdk/client/session'
+import { Path } from '@astrale-os/sdk/graph/path'
+import { bindDomain } from '@astrale-os/shell'
 
 const ADMIN_ORIGIN = 'admin.astrale.ai'
 
@@ -9,10 +18,81 @@ export type AdminBinding = DomainBinding
 
 /** Bind the exact Admin revision installed on this source Kernel. */
 export async function bindAdmin(session: ClientSession): Promise<AdminBinding> {
-  const installed = await session.installed(ADMIN_ORIGIN)
-  const binding = bind(session, installed)
-  if (binding.$.publication?.origin !== ADMIN_ORIGIN || binding.$.origin !== ADMIN_ORIGIN) {
+  const installed = await session.installation(ADMIN_ORIGIN)
+  return requireAdminBinding(await bindDomain(session, installed.bundle.root))
+}
+
+/** Admit an injected dynamic binding as the Admin Domain. */
+export function requireAdminBinding(binding: AdminBinding): AdminBinding {
+  if (binding.domain.origin !== ADMIN_ORIGIN) {
     throw new TypeError('Configured Admin target does not serve the Admin Domain.')
   }
   return binding
 }
+
+/** Resolve one required Admin Class without rebuilding its schema contract. */
+export function requireAdminClass(
+  binding: AdminBinding,
+  name: string,
+  kind: 'node',
+): ResolvedClass<'node'>
+export function requireAdminClass(
+  binding: AdminBinding,
+  name: string,
+  kind: 'edge',
+): ResolvedClass<'edge'>
+export function requireAdminClass(
+  binding: AdminBinding,
+  name: string,
+  kind: 'node' | 'edge',
+): ResolvedClass<'node'> | ResolvedClass<'edge'> {
+  const selected = binding.domain.classes[name]
+  if (selected?.kind !== kind) throw new TypeError(`Admin ${name} is not a ${kind} Class.`)
+  return selected
+}
+
+/** Resolve one required Admin Core Node as its canonical projection Path. */
+export function requireAdminCore(binding: AdminBinding, name: string): Path {
+  const selected = binding.domain.core.nodes[name] as ResolvedCoreDefinition | undefined
+  if (selected === undefined) throw new TypeError(`Admin has no Core Node ${name}.`)
+  return Path.project(selected.ref)
+}
+
+/** Resolve one effective Property by unambiguous member name. */
+export function requireAdminProperty(
+  owner: ResolvedClass,
+  name: string,
+): ResolvedProperty<unknown> {
+  const selected = [...owner.properties].find((property) => property.name === name)
+  if (selected === undefined) {
+    throw new TypeError(`Admin ${owner.ref.name}.${name} Property is absent.`)
+  }
+  return selected
+}
+
+/** Invoke one resolved executable instance Method through Kernel Client. */
+export async function invokeAdminMethod(
+  session: ClientSession,
+  binding: AdminBinding,
+  owner: ResolvedClass<'node'>,
+  name: string,
+  receiver: Path,
+  input: Input,
+): Promise<unknown> {
+  const method = [...owner.methods].find((candidate) => candidate.name === name)
+  if (method === undefined || !isExecutableInstanceMethod(method)) {
+    throw new TypeError(`Admin ${owner.ref.name}.${name} is not an executable instance Method.`)
+  }
+  return session.invoke(reference(binding.domain, method)(receiver), input)
+}
+
+type ExecutableInstanceMethod = ResolvedMethod<
+  unknown,
+  unknown,
+  false,
+  Exclude<ResolvedMethod['inheritance'], 'abstract'>
+>
+
+function isExecutableInstanceMethod(method: ResolvedMethod): method is ExecutableInstanceMethod {
+  return method.static === false && method.inheritance !== 'abstract'
+}

package/src/admin/catalog/.spec/api.d.ts

@@ -1,5 +1,5 @@
-import type { DomainBinding } from '@astrale-os/kernel-client/domain'
-import type { ClientSession } from '@astrale-os/kernel-client/session'
+import type { ClientSession } from '@astrale-os/sdk/client/session'
+import type { DomainBinding } from '@astrale-os/shell'
 
 import type { AdminGraphApi } from '../../graph/.spec/api.js'
 

package/src/admin/catalog/__tests__/client.test.ts

@@ -1,41 +1,25 @@
 import type { Node } from '@astrale-os/sdk/graph/node'
 import type { QueryAST } from '@astrale-os/sdk/query'
 
-import { ClassPath } from '@astrale-os/sdk/graph/class'
 import { NodeId } from '@astrale-os/sdk/graph/node'
-import { Path } from '@astrale-os/sdk/graph/path'
 import { describe, expect, mock, test } from 'bun:test'
 
-import type { AdminBinding } from '../../binding'
 import type { AdminGraphApi } from '../../graph'
 
+import { AdminTestDomain, adminBinding, adminSession } from '../../__tests__/fixture'
 import { connectAdminCatalog } from '../client'
 
-function definition(name: string) {
-  return {
-    name,
-    $: {
-      method(method: string) {
-        return { owner: name, name: method }
-      },
-      property(property: string) {
-        return { key: property }
-      },
-    },
-  }
-}
-
 function domainNode(id: string, origin: string): Node {
   return {
     id: NodeId(id),
-    class: ClassPath.from('admin.astrale.ai', 'Domain'),
-    props: {
+    class: AdminTestDomain.classes.Domain.key,
+    props: AdminTestDomain.classes.Domain.properties.from({
       origin,
       name: origin.split('.')[0]!,
       discoveryUrl: `https://${origin}`,
       createdAt: '2026-08-12T00:00:00.000Z',
       updatedAt: '2026-08-12T00:00:00.000Z',
-    } as never,
+    }),
   }
 }
 
@@ -44,24 +28,16 @@ function fixture(input: {
   defaults?: readonly Node[]
   invoke?: (method: { owner: string; name: string }, receiver: unknown, value: unknown) => unknown
 }) {
-  const Domain = definition('Domain')
-  const Fleet = definition('Fleet')
-  const invoke = mock(async (method: unknown, receiver: unknown, value: unknown) =>
-    input.invoke?.(method as { owner: string; name: string }, receiver, value),
-  )
-  const binding = {
-    $: {
-      publication: { origin: 'admin.astrale.ai' },
-      origin: 'admin.astrale.ai',
-      class(name: string) {
-        if (name === 'Domain') return Domain
-        if (name === 'Fleet') return Fleet
-        throw new Error(`Unexpected class ${name}`)
-      },
-      core: { nodes: { fleet: { path: Path.id(NodeId('fleet')) } } },
-      invoke,
-    },
-  } as unknown as AdminBinding
+  const calls: Array<{
+    method: { owner: string; name: string }
+    receiver: string
+    value: unknown
+  }> = []
+  const remote = adminSession((method, receiver, value) => {
+    calls.push({ method, receiver: String(receiver), value })
+    return input.invoke?.(method, receiver, value)
+  })
+  const binding = adminBinding()
   const query = mock(async (_ast: QueryAST) => ({
     result: {
       kind: 'nodes' as const,
@@ -79,10 +55,11 @@ function fixture(input: {
   }))
   const graph = { query, neighbors } as unknown as AdminGraphApi
   return {
-    invoke,
+    invoke: remote.invoke,
+    calls,
     connect: () =>
       connectAdminCatalog(
-        { session: {} as never, graph },
+        { session: remote.session, graph },
         {
           bind: async () => binding,
           operationId: (kind) => `cli.domain.${kind}:test`,
@@ -130,16 +107,10 @@ describe('V2 Admin Domain catalog adapter', () => {
         installByDefault: true,
       }),
     ).resolves.toMatchObject({ changed: true, isNew: true, entry: { installByDefault: true } })
-    expect(
-      contract.invoke.mock.calls.map(([method, receiver, value]) => ({
-        method,
-        receiver: String(receiver),
-        value,
-      })),
-    ).toEqual([
+    expect(contract.calls).toEqual([
       {
         method: { owner: 'Fleet', name: 'publishDomain' },
-        receiver: '@fleet',
+        receiver: '/:admin.astrale.ai:core.fleet::publishDomain',
         value: {
           operationId: 'cli.domain.publish:test',
           origin: 'crm.acme.dev',
@@ -149,7 +120,7 @@ describe('V2 Admin Domain catalog adapter', () => {
       },
       {
         method: { owner: 'Domain', name: 'configureDefault' },
-        receiver: '@crm-domain',
+        receiver: '@crm-domain::configureDefault',
         value: {
           operationId: 'cli.domain.configure-default:test',
           enabled: true,