@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/src/connection/__tests__/exchange.test.ts

@@ -1,295 +0,0 @@
-import type { Fetch } from '@astrale-os/sdk/client'
-
-import { issuer } from '@astrale-os/sdk/auth'
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { ExchangeCredentialCache } from '../../state/exchange-credentials'
-import { createExchangeCredentialResolver } from '../exchange'
-
-const KERNEL = issuer.accept('https://kernel.example')
-const DOMAIN = issuer.accept('https://admin.example')
-const TARGET = { url: `${KERNEL}/api`, kernelIssuer: KERNEL, domainIssuer: DOMAIN }
-const INVOCATION = `${KERNEL}/invoke`
-const EXPIRES_AT = Math.floor(Date.now() / 1_000) + 500
-const SOURCE_EXPIRES_AT = Math.floor(Date.now() / 1_000) + 120
-const SOURCE_TOKEN = token(
-  issuer.accept('https://workos.example'),
-  KERNEL,
-  'user-1',
-  SOURCE_EXPIRES_AT,
-)
-let directory: string
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'astrale-exchange-'))
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-describe('Domain token exchange', () => {
-  /** @evidence TEST-CLI-EXCHANGE-WHOAMI-DELEGATE-EXCHANGE-CACHE */
-  test('runs the exact User to Kernel to Domain journey and reuses the bound token', async () => {
-    const observed: Array<{
-      url: string
-      init: RequestInit | undefined
-      body?: Record<string, any>
-    }> = []
-    const exchanged = token(DOMAIN, KERNEL, 'user-1', EXPIRES_AT)
-    const fetch: Fetch = async (input, init) => {
-      const url = String(input)
-      if (url === INVOCATION) {
-        const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
-        observed.push({ url, init, body })
-        const index = observed.filter((entry) => entry.url === INVOCATION).length
-        return invocationResponse(
-          body.requestId,
-          index === 1
-            ? { id: 'user-1' }
-            : index === 2
-              ? 'kernel-destination-envelope'
-              : { id: 'user-1' },
-          new Headers(init?.headers).get('accept')!,
-        )
-      }
-      observed.push({ url, init })
-      if (url.endsWith('/.well-known/openid-configuration')) {
-        return jsonResponse(configuration(true))
-      }
-      if (url.endsWith('/.well-known/astrale/token')) {
-        expect(init?.body).toBeUndefined()
-        expect(new Headers(init?.headers).get('authorization')).toBe(
-          'Bearer kernel-destination-envelope',
-        )
-        return jsonResponse(
-          { token: exchanged, expiresAt: EXPIRES_AT },
-          200,
-          'application/vnd.astrale+json',
-        )
-      }
-      throw new Error(`unexpected URL ${url}`)
-    }
-    const sourceAudiences: string[] = []
-    const resolver = createExchangeCredentialResolver(
-      TARGET,
-      {
-        async resolve(audience) {
-          sourceAudiences.push(audience)
-          return SOURCE_TOKEN
-        },
-      },
-      fetch,
-      5_000,
-      new ExchangeCredentialCache(join(directory, 'credentials.json')),
-    )
-
-    expect(await resolver.resolve(KERNEL, new AbortController().signal)).toBe(exchanged)
-    await expect(resolver.resolve(KERNEL, new AbortController().signal)).resolves.toBe(exchanged)
-
-    const kernelRequests = observed.filter((entry) => entry.url === INVOCATION)
-    expect(kernelRequests).toHaveLength(3)
-    expect(kernelRequests[0]!.body).toMatchObject({
-      credential: SOURCE_TOKEN,
-      call: { input: {} },
-    })
-    expect(kernelRequests[1]!.body).toMatchObject({
-      credential: SOURCE_TOKEN,
-      call: {
-        input: {
-          audience: DOMAIN,
-          attenuation: { kind: 'identity', self: true },
-        },
-      },
-    })
-    const delegatedTtl = kernelRequests[1]!.body!.call.input.ttlSeconds
-    expect(delegatedTtl).toBeGreaterThan(0)
-    expect(delegatedTtl).toBeLessThan(120)
-    expect(sourceAudiences).toEqual([KERNEL, KERNEL])
-    expect(
-      observed.filter((entry) => entry.url.endsWith('/.well-known/astrale/token')),
-    ).toHaveLength(1)
-  })
-
-  /** @evidence TEST-CLI-EXCHANGE-NO-LEGACY-FALLBACK */
-  test('fails closed when issuer discovery does not advertise exchange', async () => {
-    const fetch: Fetch = async (input, init) => {
-      const url = String(input)
-      if (url === INVOCATION) {
-        const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
-        return invocationResponse(
-          body.requestId,
-          body.call.input && Object.keys(body.call.input).length === 0
-            ? { id: 'user-1' }
-            : 'kernel-destination-envelope',
-          new Headers(init?.headers).get('accept')!,
-        )
-      }
-      if (url.endsWith('/.well-known/openid-configuration'))
-        return jsonResponse(configuration(false))
-      throw new Error('exchange endpoint must not be called')
-    }
-    const resolver = createExchangeCredentialResolver(
-      TARGET,
-      { resolve: async () => SOURCE_TOKEN },
-      fetch,
-      5_000,
-      new ExchangeCredentialCache(join(directory, 'credentials.json')),
-    )
-    await expect(resolver.resolve(KERNEL, new AbortController().signal)).rejects.toMatchObject({
-      code: 'TOKEN_EXCHANGE_UNSUPPORTED',
-    })
-  })
-
-  test('rejects an exchanged token bound to another Kernel', async () => {
-    const wrong = token(DOMAIN, issuer.accept('https://other-kernel.example'), 'user-1', EXPIRES_AT)
-    const fetch = exchangeFetch(wrong)
-    const resolver = createExchangeCredentialResolver(
-      TARGET,
-      { resolve: async () => SOURCE_TOKEN },
-      fetch,
-      5_000,
-      new ExchangeCredentialCache(join(directory, 'credentials.json')),
-    )
-    await expect(resolver.resolve(KERNEL, new AbortController().signal)).rejects.toMatchObject({
-      code: 'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-    })
-  })
-
-  test('rejects success responses without no-store or with malformed fields', async () => {
-    const exchanged = token(DOMAIN, KERNEL, 'user-1', EXPIRES_AT)
-    const cache = () => new ExchangeCredentialCache(join(directory, crypto.randomUUID()))
-    const resolver = (fetch: Fetch) =>
-      createExchangeCredentialResolver(
-        TARGET,
-        { resolve: async () => SOURCE_TOKEN },
-        fetch,
-        5_000,
-        cache(),
-      )
-
-    await expect(
-      resolver(exchangeFetch(exchanged, { cacheControl: false })).resolve(
-        KERNEL,
-        new AbortController().signal,
-      ),
-    ).rejects.toMatchObject({
-      code: 'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      message: 'Token exchange response is missing Cache-Control: no-store.',
-    })
-    await expect(
-      resolver(exchangeFetch(exchanged, { body: { token: 7, expiresAt: 'soon' } })).resolve(
-        KERNEL,
-        new AbortController().signal,
-      ),
-    ).rejects.toMatchObject({
-      code: 'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      message: 'Token exchange returned an invalid success response.',
-    })
-  })
-
-  test('normalizes native issuer Fetch failures without exposing their message', async () => {
-    const native = new AggregateError([new Error('private DNS state')], '')
-    const resolver = createExchangeCredentialResolver(
-      TARGET,
-      { resolve: async () => SOURCE_TOKEN },
-      async (input, init) => {
-        if (String(input) === INVOCATION) {
-          const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
-          return invocationResponse(
-            body.requestId,
-            body.call.input && Object.keys(body.call.input).length === 0
-              ? { id: 'user-1' }
-              : 'kernel-destination-envelope',
-            new Headers(init?.headers).get('accept')!,
-          )
-        }
-        throw native
-      },
-      5_000,
-      new ExchangeCredentialCache(join(directory, 'native-failure.json')),
-    )
-
-    await expect(resolver.resolve(KERNEL, new AbortController().signal)).rejects.toMatchObject({
-      code: 'TOKEN_EXCHANGE_UNAVAILABLE',
-      message: 'Domain issuer discovery could not be reached.',
-      cause: native,
-    })
-  })
-})
-
-function exchangeFetch(
-  exchanged: string,
-  options: { readonly body?: unknown; readonly cacheControl?: boolean } = {},
-): Fetch {
-  return async (input, init) => {
-    const url = String(input)
-    if (url === INVOCATION) {
-      const body = JSON.parse(await new Response(init?.body).text()) as Record<string, any>
-      return invocationResponse(
-        body.requestId,
-        body.call.input && Object.keys(body.call.input).length === 0
-          ? { id: 'user-1' }
-          : 'kernel-destination-envelope',
-        new Headers(init?.headers).get('accept')!,
-      )
-    }
-    if (url.endsWith('/.well-known/openid-configuration')) return jsonResponse(configuration(true))
-    const response = new Response(
-      JSON.stringify(options.body ?? { token: exchanged, expiresAt: EXPIRES_AT }),
-      {
-        status: 200,
-        headers: {
-          'content-type': 'application/vnd.astrale+json',
-          ...(options.cacheControl === false ? {} : { 'cache-control': 'no-store' }),
-        },
-      },
-    )
-    return response
-  }
-}
-
-function configuration(enabled: boolean) {
-  return {
-    issuer: DOMAIN,
-    jwks_uri: `${DOMAIN}/.well-known/jwks.json`,
-    subject_types_supported: ['public'],
-    id_token_signing_alg_values_supported: ['EdDSA'],
-    ...(enabled ? { token_exchange_endpoint: `${DOMAIN}/.well-known/astrale/token` } : {}),
-  }
-}
-
-function invocationResponse(requestId: unknown, result: unknown, contentType: string): Response {
-  const invocation = { source: KERNEL, id: `exchange-${String(requestId)}` }
-  return new Response(JSON.stringify({ requestId, invocation, result }), {
-    headers: { 'content-type': contentType, 'cache-control': 'no-store' },
-  })
-}
-
-function jsonResponse(value: unknown, status = 200, contentType = 'application/json'): Response {
-  return new Response(JSON.stringify(value), {
-    status,
-    headers: { 'content-type': contentType, 'cache-control': 'no-store' },
-  })
-}
-
-function token(iss: string, aud: string, user: string, exp: number): string {
-  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url')
-  const proof = `${encode({ alg: 'EdDSA', typ: 'JWT' })}.${encode({
-    iss: aud,
-    sub: user,
-    aud,
-    exp,
-    delegation: { v: 1, expr: { kind: 'identity', id: user } },
-  })}.signature`
-  return `${encode({ alg: 'EdDSA', typ: 'JWT' })}.${encode({
-    iss,
-    sub: 'admin-domain',
-    aud,
-    exp,
-    grant: { v: 1, expr: { kind: 'identity', credential: proof } },
-  })}.signature`
-}

package/src/connection/__tests__/failure-fixtures.ts

@@ -1,39 +0,0 @@
-import { ClientError, TransportError } from '@astrale-os/sdk/client'
-
-import type { TransportDiagnosticContext } from '../failure/model'
-
-type CompatibleTransportPhase = TransportError['phase'] | 'unknown'
-
-export function transportFailure(
-  message: string,
-  phase: CompatibleTransportPhase,
-  context: TransportDiagnosticContext,
-): TransportError {
-  const error = new Error(message) as TransportError & {
-    context: TransportDiagnosticContext
-  }
-  Object.setPrototypeOf(error, TransportError.prototype)
-  Object.assign(error, { name: 'TransportError', phase, context })
-  return error
-}
-
-export function legacyTransportFailure(
-  message: string,
-  phase: CompatibleTransportPhase,
-  delivery: 'not-sent' | 'unknown',
-): TransportError {
-  const error = new Error(message) as TransportError & { delivery: typeof delivery }
-  Object.setPrototypeOf(error, TransportError.prototype)
-  Object.assign(error, { name: 'TransportError', phase, delivery })
-  return error
-}
-
-export function sessionFailure(
-  message: string,
-  failure: 'cancelled' | 'closed' | 'timeout',
-): ClientError {
-  const error = new Error(message) as ClientError & { failure: typeof failure }
-  Object.setPrototypeOf(error, ClientError.prototype)
-  Object.assign(error, { name: 'SessionError', failure })
-  return error
-}

package/src/connection/__tests__/failure-safety.test.ts

@@ -1,75 +0,0 @@
-import { expect, test } from 'bun:test'
-
-import { formatKernelError } from '../errors'
-import { legacyTransportFailure, sessionFailure, transportFailure } from './failure-fixtures'
-
-/** @evidence TEST-CLI-CONNECTION-FAILURE-SAFETY */
-test('unknown and empty native failures never become ordinary diagnostics', async () => {
-  for (const failure of [new Error('private provider detail'), new Error(''), { secret: true }]) {
-    const output = await capture(() => formatKernelError(failure, true))
-    expect(JSON.parse(output)).toEqual({
-      error: 'UNEXPECTED_ERROR',
-      message: 'The CLI encountered an unexpected internal failure.',
-    })
-    expect(output).not.toContain('private provider detail')
-  }
-})
-
-test('Aggregate children are available only under explicit debug output', async () => {
-  const failure = new AggregateError([new Error('first private'), new Error('second private')], '')
-  const ordinary = await capture(() => formatKernelError(failure, true))
-  expect(ordinary).not.toContain('first private')
-  expect(ordinary).not.toContain('second private')
-
-  const debug = await capture(() => formatKernelError(failure, true, '', true))
-  expect(debug).toContain('aggregate: Error: first private')
-  expect(debug).toContain('aggregate: Error: second private')
-})
-
-test('Session and acquisition failures remain typed without unsafe recovery advice', async () => {
-  const session = await capture(() =>
-    formatKernelError(sessionFailure('Session operation timed out.', 'timeout'), true),
-  )
-  expect(JSON.parse(session)).toEqual({ error: 'TIMEOUT', message: 'Session operation timed out.' })
-
-  const acquisition = await capture(() =>
-    formatKernelError(
-      transportFailure('Publication failed.', 'unknown', {
-        kind: 'acquisition',
-        resource: 'publication',
-      }),
-      true,
-      '',
-      false,
-      { recovery: { operation: 'must-not-leak', retry: 'must-not-leak' } },
-    ),
-  )
-  expect(JSON.parse(acquisition)).toMatchObject({
-    error: 'TRANSPORT_ERROR',
-    transport: { kind: 'acquisition', resource: 'publication' },
-  })
-  expect(acquisition).not.toContain('must-not-leak')
-
-  const legacy = await capture(() =>
-    formatKernelError(legacyTransportFailure('Legacy send failed.', 'send', 'not-sent'), true),
-  )
-  expect(JSON.parse(legacy)).toMatchObject({
-    error: 'TRANSPORT_ERROR',
-    transport: { kind: 'invocation', delivery: 'not-sent' },
-  })
-})
-
-async function capture(action: () => Promise<void>): Promise<string> {
-  const writes: string[] = []
-  const original = process.stderr.write
-  process.stderr.write = ((chunk: string | Uint8Array) => {
-    writes.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk))
-    return true
-  }) as typeof process.stderr.write
-  try {
-    await action()
-    return writes.join('')
-  } finally {
-    process.stderr.write = original
-  }
-}

package/src/connection/__tests__/fixtures/localhost-cert.pem

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDJTCCAg2gAwIBAgIULD/vMZdJ/u94wRaoyRt5crvKLL0wDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgxMTE0MDUxNFoXDTM2MDgw
-ODE0MDUxNFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEApheXGRylshfFubAJ1sBoecE9q+giTVJZlAKqXE+Cp/wn
-CQv/uOMQtus6ikSjDmyk8/qiSRAGZYzmZjjt5ICttav7Kb0krdRAnOSB9zd4+hEP
-jq7O5IcAlriey8KKZInugB7GD7HDVGKYPrJpJrOmfxXW0s1Vj55nehP3vn59obfH
-EE4mJ50SV9k/VS5AZ3nJHQwKyGjIKvkHI9Ll0++Wu5/ny84TwYkgY8RYwMwfj2Z0
-ltqGo7bsanwk3JFfrphBSYteAxcgF0Y//Vv557RnM2+zX7W6K1FD7s7Nen4/vx01
-cEacj59lNTDANUNJNNj+cCpol4Ie7Krk0deq/Ih3KQIDAQABo28wbTAdBgNVHQ4E
-FgQU7+UbkfznwiPgzxoBtkPHay+Ifu8wHwYDVR0jBBgwFoAU7+UbkfznwiPgzxoB
-tkPHay+Ifu8wDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SH
-BH8AAAEwDQYJKoZIhvcNAQELBQADggEBAGsPr3yfMuVyCuPQMCaUAWY8Qulepl1V
-NIvqyEAb94F1L8Mfh3UNPF9UljBGcI1RBL8e21iNF7vnR0WBF2SSTlf18/qcErVA
-4A7AwlqIVUXjERN9wKesCS/w92CBswLxq/6KrnLahngoBW/tDJ/uzZLXvSdCnYG7
-NMZMpIB0rLdT6GYr1KT/hUSKOKLqC5x0WtEAdoIOqCyYaZrxso4gIicPMWTS3Eho
-9wzXiIHOme9rtlEPnDPVseuIw2ADRPQHAHXiIlyUcJwmt01mgAKPoMp3wCgTaj2H
-NO7KMXAdJgGmmrCkP3dOWri81NlQVoOrbE432bAfKE7S+KehDYJpeAU=
------END CERTIFICATE-----

package/src/connection/__tests__/fixtures/localhost-key.base64

@@ -1 +0,0 @@
-LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ21GNWNaSEtXeUY4VzUKc0FuV3dHaDV3VDJyNkNKTlVsbVVBcXBjVDRLbi9DY0pDLys0NHhDMjZ6cUtSS01PYktUeitxSkpFQVpsak9abQpPTzNrZ0syMXEvc3B2U1N0MUVDYzVJSDNOM2o2RVErT3JzN2tod0NXdUo3THdvcGtpZTZBSHNZUHNjTlVZcGcrCnNta21zNlovRmRiU3pWV1BubWQ2RS9lK2ZuMmh0OGNRVGlZbm5SSlgyVDlWTGtCbmVja2REQXJJYU1ncStRY2oKMHVYVDc1YTduK2ZMemhQQmlTQmp4RmpBekIrUFpuU1cyb2FqdHV4cWZDVGNrVit1bUVGSmkxNERGeUFYUmovOQpXL25udEdjemI3TmZ0Ym9yVVVQdXpzMTZmaisvSFRWd1JweVBuMlUxTU1BMVEwazAyUDV3S21pWGdoN3NxdVRSCjE2cjhpSGNwQWdNQkFBRUNnZ0VBRHZPRnJ3V0VwdXo3NkJUQU5mdzVDMmpKVCszRUZMaktob2ZjNVJWbE9oRDUKUkplM2ErSEkwZWFIN1FWenRpc3lpQ0h5Tk9pRDR1VlZvak1TdXlTWVBvZmVRcW9ib0toQUxyOWxNYWRsTlFHUApLSFYwKzE1cHY2ZWI1OVM1MTRZUkdhaHJoT01vSmJNQWFIaHYvY05qUkFKbnhhOGxPaG4wejZqM2ZzYnRNVDd3Ck11dFpVMm85RWRjc09iUHBnemlnZVFEbmw0NVlNbFVsLzY5b2lSR2w0NWw1a2xyaUtMdk9YQWcydWJXTFR0QWYKWVJjeW9mOEdySmFXL1F5ZmRGVVloRUUydVNqUHNyMkFLMVNsMlBDZ1FZNmRNOUZZaDVkckZSNDU1R0VDUm94MApoaFVZS1NQRFhVU1VESUNMcVZ2UTdlOEhTMlVvUXZiaUdRRndMZHp3d1FLQmdRRGJYUVBMNlA5UDRZQ2tUZFFtCnQ4TTNvSlNYbXZHd2JRcTd2WVU5K3ZSYkMyYWRHekljaWYyT1E5OFFsc0R3Yy9XQ2psT01GalJjdTk3NVBueGsKR0RTZXZFdHpjR0JidkwzS094VzJybHo0NnVKOGw2MTkyMkE0a3BUbTNHREdBNFFabE9UZ2tWSkZyWHR5WDVXaApBQ1FkY0twWURFSXRYZm5kUXV5dGZ4anNzUUtCZ1FEQjFQQ2x3bkZqOHFMa2RMZ2xlODczLzJsdC9taGZFcnA5CmNJYkxtdFY3allsZDlzZExJb3RUL2ZyOU9odjUvKzdIUFBGNmQrb3pBcUpQSnBmVjhnNUpWMWhON1pRVWY4eW8KSldTbTZyRWphL0hWRCtsVENBLy9neU1DcFRGTXRhU2wraFBhcVpRb2ZWRm1BRm9OWjFrR0oxdm9iaEhhVmlwSwpQTHFrVGFIditRS0JnUUNydmtFd3JuVGxwNW0rQ2FrbHZ3MjZTYURNcVdTOFNrTHpCY2lCNUM3WDhTOGZwYUV3Ck11RXZOdmczMXErc0VqMlBQN3N0bkZ6V2xjaFd2NU5JRXFOdis5L2V1NGJWakFuVGdUclkwZDY4aTdsUzdyWEkKS2E5RjI0MTB5ZW1DWGxKWWJQaGMwYW5tSDVMYzB2VWxIaVVvWDRNZWVFcC9sbW4vejF2WjRmNHpvUUtCZ0V3MQpVN1JvWWJxaFFFaEFWOUpzL2kvbFhPZGhPbG4rL0JHcnQyTy82YVdkUFdBVFVjSUp2K3Z6Rk1hUkhVVEt5bS9OClYwZ0djNjlBbnQ0dDEwN0h6N1FvUWxESlV3cElRUWZ2UThhWXliS2FrMGRvN1J5M004c0xIUzNDRTBNTXU4S0MKTTJJcWdGVDNDSlRwR0g3aW5rN2NGTGVxNXh3SCtyS2JjK3A3bDJySkFvR0JBSmIxVDRpZFZPdmFZRFlINE1pUwpmUUpGU29QaFZqaklURmU2aG5hNkN0akNHdXoySGNqdXpRMWVFcVhRbzVIYkxRaGdYQnpsM3pUZllYTDJMWGhWCk9WRDB3UmJ2MFAyUk5nNXpqUERQMU8vL2ZISDFkc1hFUzNCZ2t6M3czUnduZXhucXZIRTU5Vm5VQ01yUnFOREYKeXAwVkQzM1F6aWhuRFdScWxhVUxSTit4Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K

package/src/connection/__tests__/managed.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { ConnectionContext } from '../session'
-import type { AdminConnectionOptions } from '../target'
-
-import { lookupManagedInstance } from '../session'
-
-describe('implicit managed target owner discovery', () => {
-  test('keeps target credentials out of the admin inventory lookup', async () => {
-    const owned = {
-      id: 'owned-id',
-      slug: 'owned',
-      url: 'https://owned.eu.astrale.ai',
-      state: 'ready',
-    } as const
-    let capturedOptions: AdminConnectionOptions | undefined
-    const openAdmin = async <Value>(
-      options: AdminConnectionOptions,
-      action: (context: ConnectionContext) => Promise<Value>,
-    ): Promise<Value> => {
-      capturedOptions = options
-      return action({} as ConnectionContext)
-    }
-    const connect = async () => ({ list: async () => [owned] }) as never
-
-    await lookupManagedInstance(
-      'owned',
-      {
-        as: 'target-identity',
-        creds: 'target-delegation',
-        timeout: '45000',
-      },
-      openAdmin,
-      connect,
-    )
-
-    expect(capturedOptions).toEqual({ timeout: '45000' })
-  })
-})

package/src/connection/__tests__/reasons.test.ts

@@ -1,78 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { functionInputIssues, queryInputRepair } from '../reasons'
-
-describe('public reason presentation admission', () => {
-  /** @evidence TEST-CLI-CONNECTION-ADMITS-BOUNDED-REASONS */
-  test('admits bounded public callable issues and filters unsafe additions', () => {
-    expect(
-      functionInputIssues({
-        code: 'FUNCTION_INPUT_INVALID',
-        details: {
-          issues: [
-            {
-              code: 'VALUE_SCHEMA_INSTANCE_INVALID',
-              path: '/issuer',
-              message: 'Object is missing required property issuer.',
-            },
-            {
-              code: 'VALUE_SCHEMA_INSTANCE_INVALID',
-              path: '/slug',
-              message: 'Object is missing required property slug.',
-            },
-            {
-              code: 'VALUE_SCHEMA_INSTANCE_INVALID',
-              path: '/unsafe',
-              message: 'private\ndiagnostic',
-            },
-          ],
-        },
-      }),
-    ).toEqual([
-      {
-        code: 'VALUE_SCHEMA_INSTANCE_INVALID',
-        path: '/issuer',
-        message: 'Object is missing required property issuer.',
-      },
-      {
-        code: 'VALUE_SCHEMA_INSTANCE_INVALID',
-        path: '/slug',
-        message: 'Object is missing required property slug.',
-      },
-    ])
-  })
-
-  test('admits exact Query repair variants and rejects unbounded additions', () => {
-    expect(
-      queryInputRepair({
-        code: 'QUERY_INPUT_INVALID',
-        details: {
-          phase: 'plan',
-          issue: 'QUERY_DEFINITION_NOT_EDGE',
-          path: '/steps/0/via/0',
-        },
-      }),
-    ).toEqual({
-      phase: 'plan',
-      issue: 'QUERY_DEFINITION_NOT_EDGE',
-      path: '/steps/0/via/0',
-    })
-    expect(
-      queryInputRepair({
-        code: 'QUERY_INPUT_INVALID',
-        details: { phase: 'limit', limit: 'steps', maximum: 4, actual: 5 },
-      }),
-    ).toEqual({ phase: 'limit', limit: 'steps', maximum: 4, actual: 5 })
-    expect(
-      queryInputRepair({
-        code: 'QUERY_INPUT_INVALID',
-        details: {
-          phase: 'plan',
-          issue: 'QUERY_DEFINITION_NOT_EDGE',
-          path: '/steps/0/via/0',
-          provider: 'private',
-        },
-      }),
-    ).toBeUndefined()
-  })
-})

package/src/connection/__tests__/self.test.ts

@@ -1,71 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-import { SignJWT } from 'jose'
-import { webcrypto } from 'node:crypto'
-
-import type { ConnectionContext } from '../session'
-
-import { expandSelfInCall, resolveSelfIdAuthenticated } from '../self'
-
-const context = Object.freeze({}) as ConnectionContext
-
-describe('resolveSelfIdAuthenticated', () => {
-  /** @evidence TEST-CLI-SELF-USES-AUTHENTICATED-EFFECTIVE-PRINCIPAL */
-  test('uses child whoami for a manager-to-child Management carrier', async () => {
-    const key = await generateEs256()
-    const credential = await new SignJWT({ carrier: 'management' })
-      .setProtectedHeader({ alg: 'ES256' })
-      .setIssuer('https://manager.example')
-      .setSubject('manager-principal')
-      .setAudience('https://child.example')
-      .sign(key)
-    const resolved = await resolveSelfIdAuthenticated(context, {
-      whoami: async (received) => {
-        expect(received).toBe(context)
-        return { id: 'child-kernel-principal', slug: 'child' }
-      },
-    })
-
-    expect(resolved).toEqual({ id: 'child-kernel-principal', slug: 'child' })
-  })
-
-  test('resolves an imported root without requiring a local registration', async () => {
-    await expect(
-      resolveSelfIdAuthenticated(context, {
-        whoami: async () => ({ id: 'manager-kernel-principal' }),
-      }),
-    ).resolves.toEqual({ id: 'manager-kernel-principal' })
-  })
-
-  test('fails closed when authenticated whoami returns no NodeId', async () => {
-    await expect(
-      resolveSelfIdAuthenticated(context, { whoami: async () => ({ id: '   ' }) }),
-    ).rejects.toMatchObject({ code: 'SELF_RESOLUTION_FAILED' })
-  })
-})
-
-describe('expandSelfInCall', () => {
-  test('expands only top-level string values after local parameter admission', async () => {
-    const callContext = {
-      auth: { whoami: async () => ({ id: 'caller-id' }) },
-      target: {},
-    } as ConnectionContext
-    const expanded = await expandSelfInCall(
-      '/:people.example.dev:class.Person:get',
-      { owner: '@self', count: 2, nested: { owner: '@self' } },
-      callContext,
-    )
-    expect(expanded.parameters).toEqual({
-      owner: '@caller-id',
-      count: 2,
-      nested: { owner: '@self' },
-    })
-  })
-})
-
-async function generateEs256(): Promise<CryptoKey> {
-  const pair = await webcrypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, [
-    'sign',
-    'verify',
-  ])
-  return pair.privateKey
-}