@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/src/admin/instance/client.ts

@@ -1,290 +0,0 @@
-import type { ClientSession } from '@astrale-os/sdk/client/session'
-import type { Node } from '@astrale-os/sdk/graph/node'
-import type { ResolvedClass } from '@astrale-os/sdk/schema'
-
-import { Path } from '@astrale-os/sdk/graph/path'
-import { Query } from '@astrale-os/sdk/query'
-
-import {
-  bindAdmin,
-  invokeAdminMethod,
-  requireAdminBinding,
-  requireAdminClass,
-  requireAdminCore,
-  requireAdminProperty,
-  type AdminBinding,
-} from '../binding'
-import { readAllNodes, type AdminGraphApi } from '../graph'
-import {
-  AdminHostNotFoundError,
-  AdminInstanceNotFoundError,
-  findOwnedInstance,
-  type DomainInstallReceipt,
-  type InstanceInfo,
-  type InstanceState,
-  type OwnedInstanceInfo,
-} from './model'
-
-const PAGE_SIZE = 256
-const MAXIMUM_INSTANCES = 10_000
-const MAXIMUM_PAGES = Math.ceil(MAXIMUM_INSTANCES / PAGE_SIZE) + 1
-
-export interface AdminInstanceContext {
-  readonly session: ClientSession
-  readonly graph: AdminGraphApi
-}
-
-export interface AdminInstanceApi {
-  list(): Promise<OwnedInstanceInfo[]>
-  create(slug: string, hostId?: string): Promise<InstanceInfo>
-  status(identifier: string): Promise<InstanceInfo>
-  delete(identifier: string): Promise<InstanceInfo>
-  installDomain(identifier: string, domain: string): Promise<DomainInstallReceipt>
-}
-
-export interface AdminInstanceDependencies {
-  readonly bind?: (session: ClientSession) => Promise<AdminBinding>
-  readonly operationId?: (kind: 'create' | 'status' | 'delete' | 'install-domain') => string
-}
-
-/**
- * Bind one discovered Admin root revision and expose only the public Instance
- * product journey. No Host lifecycle method is present on this capability.
- */
-export async function connectAdminInstances(
-  context: AdminInstanceContext,
-  dependencies: AdminInstanceDependencies = {},
-): Promise<AdminInstanceApi> {
-  const binding = requireAdminBinding(await (dependencies.bind ?? bindAdmin)(context.session))
-
-  const Instance = requireAdminClass(binding, 'Instance', 'node')
-  const Host = requireAdminClass(binding, 'Host', 'node')
-  const Fleet = requireAdminClass(binding, 'Fleet', 'node')
-  const fleetReservesAdminHost = requireAdminClass(binding, 'fleet_reserves_admin_host', 'edge')
-  const fleet = requireAdminCore(binding, 'fleet')
-
-  const operationId = dependencies.operationId ?? defaultOperationId
-
-  const list = async (): Promise<OwnedInstanceInfo[]> => {
-    const result: unknown = await invokeAdminMethod(
-      context.session,
-      binding,
-      Fleet,
-      'listInstances',
-      fleet,
-      {},
-    )
-    if (!Array.isArray(result)) throw new TypeError('Admin Instance inventory is invalid.')
-    return result.map((value) => instanceFromSummary(value) as OwnedInstanceInfo)
-  }
-
-  const requireInstance = async (identifier: string): Promise<OwnedInstanceInfo> => {
-    const found = findOwnedInstance(await list(), identifier)
-    if (found === undefined) throw new AdminInstanceNotFoundError(identifier)
-    return found
-  }
-
-  const invokeInstance = async (
-    method: 'status' | 'delete',
-    identifier: string,
-  ): Promise<InstanceInfo> => {
-    const instance = await requireInstance(identifier)
-    const output = await invokeAdminMethod(
-      context.session,
-      binding,
-      Instance,
-      method,
-      Path.parse(instance.id),
-      { operationId: operationId(method) },
-    )
-    return instanceFromSummary(output)
-  }
-
-  return Object.freeze({
-    list,
-    async create(slug: string, hostId?: string) {
-      const input = Object.freeze({
-        operationId: operationId('create'),
-        slug,
-      })
-      if (hostId !== undefined) {
-        const selected = await hostInventory(context.graph, Host, fleetReservesAdminHost, fleet)
-        const host = selected.hosts.find(
-          (item) => item.id === hostId && item.state === 'ready' && item.path !== selected.reserved,
-        )
-        if (host === undefined) throw new AdminHostNotFoundError(hostId)
-        return instanceFromSummary(
-          await invokeAdminMethod(
-            context.session,
-            binding,
-            Host,
-            'createInstance',
-            Path.parse(host.path),
-            input,
-          ),
-        )
-      }
-
-      // Default placement belongs to Admin. Avoid a redundant Host graph read:
-      // it requires broader graph authority than this Fleet operation and can
-      // deny an otherwise authorized caller before the server selects a Host.
-      return instanceFromSummary(
-        await invokeAdminMethod(context.session, binding, Fleet, 'createInstance', fleet, input),
-      )
-    },
-    status: (identifier: string) => invokeInstance('status', identifier),
-    delete: (identifier: string) => invokeInstance('delete', identifier),
-    async installDomain(identifier: string, domain: string): Promise<DomainInstallReceipt> {
-      const instance = await requireInstance(identifier)
-      const output = await invokeAdminMethod(
-        context.session,
-        binding,
-        Instance,
-        'installDomain',
-        Path.parse(instance.id),
-        {
-          operationId: operationId('install-domain'),
-          domain: Path.parse(domain).raw,
-        },
-      )
-      return domainInstallReceipt(output)
-    },
-  })
-}
-
-interface HostInventoryItem {
-  readonly id: string
-  readonly nodeId: string
-  readonly path: string
-  readonly state: string
-}
-
-async function hostInventory(
-  graph: AdminGraphApi,
-  Host: ResolvedClass<'node'>,
-  fleetReservesAdminHost: ResolvedClass<'edge'>,
-  fleet: Path,
-): Promise<{ readonly hosts: readonly HostInventoryItem[]; readonly reserved?: string }> {
-  const [nodes, reservedPage] = await Promise.all([
-    readAllNodes(
-      graph,
-      Query.from({ nodes: [Host] }).select({
-        kind: 'nodes',
-        projection: { kind: 'value' },
-      }),
-      {
-        label: 'Admin Host inventory',
-        maximum: MAXIMUM_INSTANCES,
-        maximumPages: MAXIMUM_PAGES,
-      },
-    ),
-    graph.neighbors(fleet, fleetReservesAdminHost, {
-      direction: 'outgoing',
-      page: { size: 1 },
-    }),
-  ])
-  const reserved = reservedPage.first === null ? undefined : Path.id(reservedPage.first.id).raw
-  return Object.freeze({
-    hosts: Object.freeze(
-      nodes.map((node) =>
-        Object.freeze({
-          id: requiredStringProperty(Host, node, 'id'),
-          nodeId: String(node.id),
-          path: Path.id(node.id).raw,
-          state: requiredStringProperty(Host, node, 'state'),
-        }),
-      ),
-    ),
-    ...(reserved === undefined ? {} : { reserved }),
-  })
-}
-
-type DynamicDefinition = ResolvedClass<'node'>
-
-function instanceFromSummary(input: unknown): InstanceInfo {
-  const value = record(input, 'Admin Instance summary')
-  const failure = value.failure === undefined ? undefined : record(value.failure, 'Admin failure')
-  return Object.freeze({
-    id: requiredString(value.id, 'Admin Instance id'),
-    slug: requiredString(value.slug, 'Admin Instance slug'),
-    url: optionalStringValue(value.url) ?? '',
-    state: instanceState(value.state),
-    ...(value.hostId === undefined
-      ? {}
-      : { hostId: requiredString(value.hostId, 'Admin Host id') }),
-    ...(value.region === undefined ? {} : { region: requiredString(value.region, 'Admin region') }),
-    ...(value.phase === undefined
-      ? {}
-      : { phase: requiredString(value.phase, 'Admin Instance phase') }),
-    ...(failure === undefined
-      ? {}
-      : { error: requiredString(failure.message, 'Admin failure message') }),
-    ...(value.createdAt === undefined
-      ? {}
-      : { createdAt: requiredString(value.createdAt, 'Admin Instance creation time') }),
-    ...(value.organizationId === undefined
-      ? {}
-      : { organizationId: requiredString(value.organizationId, 'Admin organization id') }),
-  })
-}
-
-function domainInstallReceipt(input: unknown): DomainInstallReceipt {
-  const value = record(input, 'Admin Domain install receipt')
-  const failure = value.failure === undefined ? undefined : record(value.failure, 'Admin failure')
-  if (typeof value.ok !== 'boolean') throw new TypeError('Admin Domain install outcome is invalid.')
-  return Object.freeze({
-    domain: requiredString(value.domain, 'Admin Domain reference'),
-    instance: requiredString(value.instance, 'Admin Instance reference'),
-    origin: requiredString(value.origin, 'Installed Domain origin'),
-    ok: value.ok,
-    ...(value.installedRevision === undefined
-      ? {}
-      : {
-          installedRevision: requiredString(value.installedRevision, 'Installed Domain revision'),
-        }),
-    ...(failure === undefined
-      ? {}
-      : { error: requiredString(failure.message, 'Admin Domain install failure') }),
-  })
-}
-
-function requiredStringProperty(definition: DynamicDefinition, node: Node, name: string): string {
-  return requiredString(
-    node.props[requireAdminProperty(definition, name).key],
-    `Admin ${definition.ref.name}.${name}`,
-  )
-}
-
-function instanceState(input: unknown): InstanceState {
-  if (
-    input === 'provisioning' ||
-    input === 'ready' ||
-    input === 'deleting' ||
-    input === 'failed' ||
-    input === 'deleted'
-  ) {
-    return input
-  }
-  throw new TypeError('Admin Instance state is invalid.')
-}
-
-function requiredString(input: unknown, label: string): string {
-  if (typeof input !== 'string' || input.length === 0) throw new TypeError(`${label} is invalid.`)
-  return input
-}
-
-function optionalStringValue(input: unknown): string | undefined {
-  if (input === undefined) return undefined
-  return requiredString(input, 'Admin string value')
-}
-
-function record(input: unknown, label: string): Readonly<Record<string, unknown>> {
-  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
-    throw new TypeError(`${label} is invalid.`)
-  }
-  return input as Readonly<Record<string, unknown>>
-}
-
-function defaultOperationId(kind: 'create' | 'status' | 'delete' | 'install-domain'): string {
-  return `cli.instance.${kind}:${globalThis.crypto.randomUUID()}`
-}

package/src/admin/instance/index.ts

@@ -1,16 +0,0 @@
-export {
-  connectAdminInstances,
-  type AdminInstanceApi,
-  type AdminInstanceContext,
-  type AdminInstanceDependencies,
-} from './client'
-export {
-  AdminHostNotFoundError,
-  AdminInstanceNotFoundError,
-  findOwnedInstance,
-  formatInstanceLocation,
-  type DomainInstallReceipt,
-  type InstanceInfo,
-  type InstanceState,
-  type OwnedInstanceInfo,
-} from './model'

package/src/admin/instance/model.ts

@@ -1,66 +0,0 @@
-/** CLI-stable projection of one caller-visible Admin Instance. */
-export type InstanceState = 'provisioning' | 'ready' | 'deleting' | 'failed' | 'deleted'
-
-export interface InstanceInfo {
-  readonly id: string
-  readonly slug: string
-  readonly url: string
-  readonly hostId?: string
-  readonly region?: string
-  readonly state?: InstanceState
-  readonly phase?: string
-  readonly error?: string | null
-  readonly createdAt?: string
-  readonly organizationId?: string
-}
-
-/** An Instance returned through the caller-scoped Admin graph inventory. */
-export interface OwnedInstanceInfo extends InstanceInfo {
-  readonly state: InstanceState
-}
-
-export interface DomainInstallReceipt {
-  readonly domain: string
-  readonly instance: string
-  readonly origin: string
-  readonly ok: boolean
-  readonly installedRevision?: string
-  readonly error?: string
-}
-
-export class AdminInstanceNotFoundError extends AstraleError {
-  constructor(readonly identifier: string) {
-    super(
-      'INSTANCE_NOT_FOUND',
-      `No owned Admin Instance matches ${JSON.stringify(identifier)}.`,
-      'Run `astrale instance list` to see your instances.',
-    )
-  }
-}
-
-export class AdminHostNotFoundError extends AstraleError {
-  constructor(readonly identifier: string) {
-    super('HOST_NOT_FOUND', `No caller-usable Admin Host matches ${JSON.stringify(identifier)}.`)
-  }
-}
-
-/** Match an owner-scoped Instance by slug, canonical Node Path, or bare Node id. */
-export function findOwnedInstance(
-  instances: readonly OwnedInstanceInfo[],
-  identifier: string,
-): OwnedInstanceInfo | undefined {
-  return instances.find(
-    (instance) =>
-      instance.slug === identifier ||
-      instance.id === identifier ||
-      (instance.id.startsWith('@') && instance.id.slice(1) === identifier),
-  )
-}
-
-/** Human-readable location of an Instance (state, region, and Host Path). */
-export function formatInstanceLocation(info: InstanceInfo): string {
-  return [info.state && info.state !== 'ready' ? info.state : undefined, info.region, info.hostId]
-    .filter(Boolean)
-    .join(' · ')
-}
-import { AstraleError } from '../../errors'

package/src/admin/instance/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../tsconfig.json",
-  "compilerOptions": {
-    "types": ["@types/node"]
-  },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/commands/__tests__/admin-instance.test.ts

@@ -1,88 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { IdentityStore } from '../../identity/index'
-
-import { AuthError } from '../../errors'
-import { findOwnedInstance, type OwnedInstanceInfo } from '../../lib/admin-instance'
-import { assertAlphaCreateIdentity } from '../instance/create'
-
-describe('admin-backed instance commands', () => {
-  test('findOwnedInstance matches owner inventory by slug or stable node id', () => {
-    const owned = {
-      id: 'instance-node',
-      slug: 'demo',
-      url: 'https://demo.eu.astrale.ai',
-      state: 'failed',
-      organizationId: 'org_123',
-      hostId: 'host-1',
-      region: 'eu',
-      phase: 'installing:default-domains',
-      error: 'postInstall failed',
-      createdAt: '2026-07-16T00:00:00.000Z',
-    } satisfies OwnedInstanceInfo
-
-    expect(findOwnedInstance([owned], 'demo')).toBe(owned)
-    expect(findOwnedInstance([owned], 'instance-node')).toBe(owned)
-    expect(findOwnedInstance([owned], 'other')).toBeUndefined()
-  })
-
-  test('instance create preflight points fresh installs at WorkOS login', () => {
-    const store: IdentityStore = {
-      default: 'manager',
-      identities: {
-        manager: {
-          subject: 'manager',
-          createdAt: '2026-06-08T00:00:00.000Z',
-          source: 'key',
-          mode: 'local',
-        },
-      },
-    }
-
-    expect(() => assertAlphaCreateIdentity(store)).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store)).toThrow('WorkOS login required')
-  })
-
-  test('instance create preflight accepts IdP-backed identities', () => {
-    const store: IdentityStore = {
-      default: 'bryan',
-      identities: {
-        bryan: {
-          subject: 'user_123',
-          createdAt: '2026-06-08T00:00:00.000Z',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://auth.example.com',
-        },
-      },
-    }
-
-    expect(() => assertAlphaCreateIdentity(store)).not.toThrow()
-  })
-
-  test('--as selection must also be IdP-backed', () => {
-    const store: IdentityStore = {
-      default: 'local',
-      identities: {
-        local: {
-          subject: 'local',
-          createdAt: '2026-06-08T00:00:00.000Z',
-          source: 'key',
-          mode: 'local',
-        },
-        workos: {
-          subject: 'user_123',
-          createdAt: '2026-06-08T00:00:00.000Z',
-          source: 'idp',
-          mode: 'remote',
-          idp: 'workos',
-          issuer: 'https://auth.example.com',
-        },
-      },
-    }
-
-    expect(() => assertAlphaCreateIdentity(store, { as: 'local' })).toThrow(AuthError)
-    expect(() => assertAlphaCreateIdentity(store, { as: 'workos' })).not.toThrow()
-  })
-})

package/src/commands/__tests__/auth-login.test.ts

@@ -1,231 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-const cliRoot = join(import.meta.dir, '../../..')
-
-let tmp: string
-
-beforeEach(async () => {
-  tmp = await mkdtemp(join(tmpdir(), 'astrale-auth-login-'))
-})
-
-afterEach(async () => {
-  await rm(tmp, { recursive: true, force: true })
-})
-
-describe('auth login command', () => {
-  test('rejects requested audience when provider mints a different access-token aud', async () => {
-    const server = oauthServer({
-      accessToken: unsignedJwt({
-        iss: 'http://127.0.0.1',
-        sub: 'user_123',
-        aud: 'unknown/api',
-        exp: 1893456000,
-      }),
-    })
-    try {
-      await writeIdpConfig(server.url)
-
-      const result = await runAuthLogin(
-        '--idp',
-        'test',
-        '--name',
-        'alice',
-        '--client-credentials',
-        '--client-secret-env',
-        'TEST_CLIENT_SECRET',
-        '--audience',
-        'https://kernel.example.com',
-        '--raw',
-      )
-
-      expect(result.exitCode).toBe(1)
-      expect(result.stderr).toContain(
-        'IdP response access_token was not minted for requested audience https://kernel.example.com',
-      )
-      expect(
-        await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8').catch(() => null),
-      ).toBeNull()
-    } finally {
-      await server.stop()
-    }
-  })
-
-  test('stores the session when provider mints the requested access-token aud', async () => {
-    const server = oauthServer({
-      accessToken: unsignedJwt({
-        iss: 'http://127.0.0.1',
-        sub: 'user_123',
-        aud: 'https://kernel.example.com',
-        exp: 1893456000,
-      }),
-    })
-    try {
-      await writeIdpConfig(server.url)
-
-      const result = await runAuthLogin(
-        '--idp',
-        'test',
-        '--name',
-        'alice',
-        '--client-credentials',
-        '--client-secret-env',
-        'TEST_CLIENT_SECRET',
-        '--audience',
-        'https://kernel.example.com',
-        '--raw',
-      )
-
-      expect(result.exitCode).toBe(0)
-      const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
-      expect(session.audience).toBe('https://kernel.example.com')
-      expect(session.clientId).toBe('client_123')
-      expect(session.subject).toBe('user_123')
-    } finally {
-      await server.stop()
-    }
-  })
-
-  test('persists an explicit client id and reuses it for a named login', async () => {
-    const server = oauthServer({
-      accessToken: unsignedJwt({
-        iss: 'http://127.0.0.1',
-        sub: 'user_123',
-        exp: 1893456000,
-      }),
-    })
-    try {
-      await writeIdpConfig(server.url)
-
-      const explicit = await runAuthLogin(
-        '--idp',
-        'test',
-        '--name',
-        'alice',
-        '--client-id',
-        'client_override',
-        '--client-credentials',
-        '--client-secret-env',
-        'TEST_CLIENT_SECRET',
-        '--raw',
-      )
-      const reused = await runAuthLogin(
-        '--idp',
-        'test',
-        '--name',
-        'alice',
-        '--client-credentials',
-        '--client-secret-env',
-        'TEST_CLIENT_SECRET',
-        '--raw',
-      )
-
-      expect(explicit.exitCode).toBe(0)
-      expect(reused.exitCode).toBe(0)
-      expect(server.clientIds()).toEqual(['client_override', 'client_override'])
-      const session = JSON.parse(await readFile(join(tmp, 'idp-sessions', 'alice.json'), 'utf-8'))
-      expect(session.clientId).toBe('client_override')
-    } finally {
-      await server.stop()
-    }
-  })
-})
-
-async function writeIdpConfig(baseUrl: string): Promise<void> {
-  await mkdir(join(tmp, 'idps', 'test'), { recursive: true })
-  await writeFile(
-    join(tmp, 'idps', 'index.json'),
-    JSON.stringify(
-      {
-        idps: {
-          test: {
-            issuer: baseUrl,
-            createdAt: '2026-01-01T00:00:00.000Z',
-            updatedAt: '2026-01-01T00:00:00.000Z',
-          },
-        },
-      },
-      null,
-      2,
-    ) + '\n',
-  )
-  await writeFile(
-    join(tmp, 'idps', 'test', 'metadata.json'),
-    JSON.stringify(
-      {
-        issuer: baseUrl,
-        token_endpoint: `${baseUrl}/token`,
-        jwks_uri: `${baseUrl}/jwks`,
-      },
-      null,
-      2,
-    ) + '\n',
-  )
-  await writeFile(
-    join(tmp, 'idps', 'test', 'client.json'),
-    JSON.stringify(
-      {
-        client_id: 'client_123',
-        client_secret_env: 'TEST_CLIENT_SECRET',
-      },
-      null,
-      2,
-    ) + '\n',
-  )
-}
-
-function oauthServer(args: { accessToken: string }): {
-  url: string
-  clientIds: () => Array<string | null>
-  stop: () => Promise<void>
-} {
-  const clientIds: Array<string | null> = []
-  const server = Bun.serve({
-    port: 0,
-    fetch: async (request) => {
-      const url = new URL(request.url)
-      if (url.pathname !== '/token') return new Response('not found', { status: 404 })
-      const form = new URLSearchParams(await request.text())
-      clientIds.push(form.get('client_id'))
-      return Response.json({
-        access_token: args.accessToken,
-        token_type: 'Bearer',
-        expires_in: 3600,
-      })
-    },
-  })
-  return {
-    url: `http://${server.hostname}:${server.port}`,
-    clientIds: () => clientIds,
-    stop: () => server.stop(true),
-  }
-}
-
-async function runAuthLogin(...args: string[]): Promise<{
-  exitCode: number
-  stdout: string
-  stderr: string
-}> {
-  const proc = Bun.spawn({
-    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'auth', 'login', ...args],
-    env: { ...process.env, ASTRALE_HOME: tmp, TEST_CLIENT_SECRET: 'secret_123' },
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited,
-  ])
-  return { exitCode, stdout, stderr }
-}
-
-function unsignedJwt(payload: Record<string, unknown>): string {
-  return [base64url({ alg: 'none', typ: 'JWT' }), base64url(payload), ''].join('.')
-}
-
-function base64url(value: Record<string, unknown>): string {
-  return Buffer.from(JSON.stringify(value)).toString('base64url')
-}