@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/src/errors.ts

@@ -1,66 +0,0 @@
-export class AstraleError extends Error {
-  code: string
-  hint?: string
-
-  constructor(code: string, message: string, hint?: string, options?: ErrorOptions) {
-    if (message.trim() === '') throw new TypeError('CLI error message must be non-blank.')
-    super(message, options)
-    this.name = 'AstraleError'
-    this.code = code
-    this.hint = hint
-  }
-}
-
-export class AuthError extends AstraleError {
-  constructor(message: string, hint?: string) {
-    super('AUTH_ERROR', message, hint ?? 'Run `astrale identity create <name>` to set up keys')
-  }
-}
-
-// ── Typed errors (DESIGN.md §4.6, §4.7, §5.1, §10, §11, §12) ─────────
-
-export class IssuerUnreachableError extends AstraleError {
-  constructor(url: string, hint?: string) {
-    super(
-      'ISSUER_UNREACHABLE',
-      `Issuer endpoint "${url}" not reachable`,
-      hint ?? 'Check the target URL and issuer configuration',
-    )
-  }
-}
-
-export class ReservedSlugError extends AstraleError {
-  constructor(slug: string) {
-    super('RESERVED_SLUG', `Slug "${slug}" is reserved`, 'Pick a different slug')
-  }
-}
-
-export class IdentifierCollisionError extends AstraleError {
-  constructor(identifier: string, existingEntity: string) {
-    super(
-      'IDENTIFIER_COLLISION',
-      `Identifier "${identifier}" collides with existing ${existingEntity}`,
-      'Slug and name share the same CLI namespace (§4.7). Pick a unique value.',
-    )
-  }
-}
-
-export class IdentityKeyMissingError extends AstraleError {
-  constructor(subject: string) {
-    super(
-      'IDENTITY_KEY_MISSING',
-      `No private key on disk for identity "${subject}"`,
-      `Run \`astrale identity create ${subject}\` to generate one.`,
-    )
-  }
-}
-
-export class NotImplementedError extends AstraleError {
-  constructor(feature: string, hint?: string) {
-    super(
-      'NOT_IMPLEMENTED',
-      `"${feature}" is not implemented in v1`,
-      hint ?? 'Track the design implementation progress for updates',
-    )
-  }
-}

package/src/graph/.spec/api.d.ts

@@ -1,41 +0,0 @@
-import type { ClassKey, ClassRef } from '@astrale-os/sdk/graph/class'
-import type { MutationAST } from '@astrale-os/sdk/mutation'
-import type { QueryAST, QueryDirection } from '@astrale-os/sdk/query'
-
-/** Admit one canonical Domain-rooted Class Path into its DSL coordinate. */
-export function classReference(input: string, label: string): ClassRef
-
-/** Admit one canonical Domain-rooted Class Path into its exact string identity. */
-export function classKey(input: string, label: string): ClassKey
-
-/** Untrusted CLI fields used to author or admit one exact Query V6 request. */
-export interface QueryCommandInput {
-  readonly sources: readonly string[]
-  readonly definition?: string
-  readonly ast?: unknown
-  readonly edge?: string
-  readonly direction?: QueryDirection
-  readonly limit?: string
-  readonly cursor?: string
-}
-
-/** Canonical query plus caller-bound pagination kept outside the AST. */
-export interface PreparedQuery {
-  readonly ast: QueryAST
-  readonly page: Readonly<{ readonly size: number; readonly after?: string }>
-}
-
-/** Admit canonical Query V6 or author its supported Path/Class/one-edge CLI subset. */
-export function prepareQuery(input: QueryCommandInput): PreparedQuery
-
-/** Admit canonical Mutation V3 or its exact authoring input; legacy PatchData is rejected. */
-export function prepareMutation(input: unknown): MutationAST
-
-/** Return the user-facing leaf of one exact qualified Property key. */
-export function unqualifyProperty(key: string): string
-
-/** Read one property by exact key first, then by its qualified leaf name. */
-export function nodeProperty(
-  node: { readonly props: Readonly<Record<string, unknown>> } | null | undefined,
-  name: string,
-): unknown

package/src/graph/.spec/laws/documents.ts

@@ -1,24 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_GRAPH_QUERY_V5 = defineLaw({
-  id: 'CLI-GRAPH-QUERY-V5',
-  statement:
-    'CLI query input becomes exactly one canonical Query V5 document with an explicit finite limit; exact Property ordering and Node or Edge projection profiles are admitted through the canonical AST surface, while legacy versions and unsupported selector combinations fail before a Graph call.',
-  tests: [
-    { file: '__tests__/query.test.ts', id: 'TEST-CLI-GRAPH-AUTHORS-QUERY-V5' },
-    { file: '__tests__/query.test.ts', id: 'TEST-CLI-GRAPH-AUTHORS-DEFINITION-QUERY' },
-    { file: '__tests__/query.test.ts', id: 'TEST-CLI-GRAPH-ADMITS-QUERY-V5-ORDERING' },
-    { file: '__tests__/query.test.ts', id: 'TEST-CLI-GRAPH-ADMITS-QUERY-V5-PROJECTIONS' },
-    { file: '__tests__/query.test.ts', id: 'TEST-CLI-GRAPH-REJECTS-LEGACY-QUERY' },
-  ],
-})
-
-export const CLI_GRAPH_MUTATION_V2 = defineLaw({
-  id: 'CLI-GRAPH-MUTATION-V2',
-  statement:
-    'CLI mutation input is admitted as canonical Mutation V2 or its exact authoring input; PatchData and other historical shapes never reach GraphApi.mutate.',
-  tests: [
-    { file: '__tests__/mutation.test.ts', id: 'TEST-CLI-GRAPH-ADMITS-MUTATION-V2' },
-    { file: '__tests__/mutation.test.ts', id: 'TEST-CLI-GRAPH-REJECTS-PATCH-DATA' },
-  ],
-})

package/src/graph/.spec/laws/projection.ts

@@ -1,13 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_GRAPH_PROPERTY_PROJECTION = defineLaw({
-  id: 'CLI-GRAPH-PROPERTY-PROJECTION',
-  statement:
-    'An exact property key wins over a qualified leaf-name match; otherwise the first canonical property with that leaf is presented without rewriting the Node.',
-  tests: [
-    {
-      file: '__tests__/projection.test.ts',
-      id: 'TEST-CLI-GRAPH-PROJECTS-QUALIFIED-PROPERTIES',
-    },
-  ],
-})

package/src/graph/.spec/layout.ts

@@ -1,14 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: [
-    '__tests__/',
-    'class.ts',
-    'index.ts',
-    'mutation.ts',
-    'projection.ts',
-    'query.ts',
-    'tsconfig.json',
-  ],
-  exact: true,
-})

package/src/graph/__tests__/mutation.test.ts

@@ -1,51 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { prepareMutation } from '../mutation'
-
-describe('prepareMutation', () => {
-  /** @evidence TEST-CLI-GRAPH-ADMITS-MUTATION-V3 */
-  test('creates one canonical Mutation V3 document from exact authoring input', () => {
-    expect(
-      JSON.parse(
-        JSON.stringify(
-          prepareMutation({
-            preconditions: [],
-            operations: [
-              {
-                op: 'node.create',
-                as: 'note',
-                class: 'notes.example.dev:class.Note',
-                props: {},
-              },
-            ],
-          }),
-        ),
-      ),
-    ).toEqual({
-      format: 'astrale.graph.mutation',
-      version: 'v3',
-      preconditions: [],
-      operations: [
-        {
-          op: 'node.create',
-          as: 'note',
-          class: 'notes.example.dev:class.Note',
-          props: {},
-        },
-      ],
-    })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-REJECTS-PATCH-DATA */
-  test('rejects legacy PatchData instead of narrowing it', () => {
-    expect(() => prepareMutation({ nodes: { create: [] }, edges: { create: [] } })).toThrow(
-      /Legacy PatchData/,
-    )
-  })
-
-  test('rejects an empty operations list in CLI language', () => {
-    expect(() => prepareMutation({ preconditions: [], operations: [] })).toThrow(
-      'Mutation V3 requires at least one operation',
-    )
-  })
-})

package/src/graph/__tests__/projection.test.ts

@@ -1,22 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { nodeProperty, unqualifyProperty } from '../projection'
-
-describe('graph presentation properties', () => {
-  /** @evidence TEST-CLI-GRAPH-PROJECTS-QUALIFIED-PROPERTIES */
-  test('prefers exact keys and otherwise projects a qualified leaf', () => {
-    const node = {
-      props: {
-        name: 'exact',
-        '/:example.test:class.Widget.property.name': 'qualified',
-        '/:example.test:class.Widget.property.description': 'shown',
-      },
-    }
-
-    expect(nodeProperty(node, 'name')).toBe('exact')
-    expect(nodeProperty(node, 'description')).toBe('shown')
-    expect(unqualifyProperty('/:example.test:class.Widget.property.description')).toBe(
-      'description',
-    )
-  })
-})

package/src/graph/__tests__/query.test.ts

@@ -1,173 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { prepareQuery } from '../query'
-
-describe('prepareQuery', () => {
-  /** @evidence TEST-CLI-GRAPH-AUTHORS-QUERY-V6 */
-  test('authors the supported Path and exact-edge subset as canonical Query V6', () => {
-    const prepared = prepareQuery({
-      sources: ['/:notes.example.dev:class.Note'],
-      edge: '/:notes.example.dev:class.references',
-      direction: 'incoming',
-      limit: '25',
-      cursor: 'next-page',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared))).toEqual({
-      ast: {
-        format: 'astrale.graph.query',
-        version: 'v6',
-        source: {
-          kind: 'node',
-          terms: [{ kind: 'path', path: '/:notes.example.dev:class.Note' }],
-          binding: 'n0',
-        },
-        steps: [
-          {
-            op: 'expand',
-            from: 'n0',
-            via: [{ origin: 'notes.example.dev', kind: 'class', name: 'references' }],
-            direction: 'incoming',
-            bindings: { edge: 'e0', node: 'n1' },
-          },
-        ],
-        select: { kind: 'graph', binding: 'n1' },
-      },
-      page: { size: 25, after: 'next-page' },
-    })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-AUTHORS-DEFINITION-QUERY */
-  test('authors an exact Class source without backend query text', () => {
-    const prepared = prepareQuery({
-      sources: [],
-      definition: '/:issues.astrale.ai:class.Issue',
-      limit: '201',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared.ast))).toEqual({
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source: {
-        kind: 'node',
-        terms: [
-          {
-            kind: 'class',
-            class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
-          },
-        ],
-        binding: 'n0',
-      },
-      steps: [],
-      select: { kind: 'graph', binding: 'n0' },
-    })
-    expect(prepared.page).toEqual({ size: 201 })
-  })
-
-  test('unions positional Paths and one Class source in authored order', () => {
-    const prepared = prepareQuery({
-      sources: ['@note'],
-      definition: '/:issues.astrale.ai:class.Issue',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared.ast.source))).toEqual({
-      kind: 'node',
-      terms: [
-        { kind: 'path', path: '@note' },
-        {
-          kind: 'class',
-          class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
-        },
-      ],
-      binding: 'n0',
-    })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-ADMITS-QUERY-V6-ORDERING */
-  test('admits one exact Property-ordered Query V6 document', () => {
-    const ast = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source: {
-        kind: 'node',
-        terms: [
-          {
-            kind: 'class',
-            class: { origin: 'notes.example.dev', kind: 'class', name: 'Note' },
-          },
-        ],
-        binding: 'n0',
-      },
-      steps: [],
-      select: {
-        kind: 'graph',
-        binding: 'n0',
-        order: {
-          property: 'notes.example.dev:class.Note.property.sequence',
-          direction: 'desc',
-          unranked: 'last',
-        },
-      },
-    }
-
-    const prepared = prepareQuery({ sources: [], ast, limit: '3' })
-    expect(JSON.parse(JSON.stringify(prepared.ast))).toEqual(ast)
-    expect(prepared.page).toEqual({ size: 3 })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-ADMITS-QUERY-V6-PROJECTIONS */
-  test('admits exact Node and Edge projection profiles in Query V6 documents', () => {
-    const source = {
-      terms: [{ kind: 'path', path: '/:notes.example.dev:class.Note' }],
-      binding: 'n0',
-      kind: 'node',
-    } as const
-    const node = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source,
-      steps: [],
-      select: { kind: 'nodes', binding: 'n0', projection: { kind: 'reference' } },
-    }
-    const edge = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source,
-      steps: [
-        {
-          op: 'expand',
-          from: 'n0',
-          via: [{ origin: 'notes.example.dev', kind: 'class', name: 'references' }],
-          direction: 'outgoing',
-          bindings: { edge: 'e0', node: 'n1' },
-        },
-      ],
-      select: {
-        kind: 'edges',
-        binding: 'e0',
-        projection: { edge: 'value', source: 'reference', target: 'value' },
-      },
-    }
-
-    expect(
-      JSON.parse(JSON.stringify(prepareQuery({ sources: [], ast: node, limit: '5' }).ast)),
-    ).toEqual(node)
-    expect(
-      JSON.parse(JSON.stringify(prepareQuery({ sources: [], ast: edge, limit: '5' }).ast)),
-    ).toEqual(edge)
-  })
-
-  /** @evidence TEST-CLI-GRAPH-REJECTS-LEGACY-QUERY */
-  test('rejects V1 queries and unsupported combinations locally', () => {
-    expect(() => prepareQuery({ sources: [], ast: { version: 1, from: ['/'] } })).toThrow()
-    expect(() =>
-      prepareQuery({ sources: ['/:notes.example.dev:class.Note'], direction: 'incident' }),
-    ).toThrow('--direction requires --edge')
-    expect(() =>
-      prepareQuery({ sources: ['/:notes.example.dev:class.Note'], limit: 'all' }),
-    ).toThrow('--limit must be a positive integer')
-    expect(() =>
-      prepareQuery({ sources: [], definition: '/:notes.example.dev:view.note' }),
-    ).toThrow('--definition must be one canonical Class Path')
-  })
-})

package/src/graph/class.ts

@@ -1,30 +0,0 @@
-import type { ClassKey as ClassKeyValue, ClassRef } from '@astrale-os/sdk/graph/class'
-
-import { ClassKey } from '@astrale-os/sdk/graph/class'
-import { Path } from '@astrale-os/sdk/graph/path'
-
-/** Admit one canonical Domain-rooted Class Path into its DSL coordinate. */
-export function classReference(input: string, label: string): ClassRef {
-  const path = Path.parse(input)
-  const step = path.ast.steps[0]
-  if (
-    path.ast.anchor.kind !== 'domain' ||
-    path.ast.steps.length !== 1 ||
-    step?.kind !== 'projection' ||
-    step.projection.kind !== 'class'
-  ) {
-    throw new TypeError(`${label} must be one canonical Class Path`)
-  }
-  return ClassKey.ref(
-    ClassKey.of({
-      origin: path.ast.anchor.origin,
-      kind: 'class',
-      name: step.projection.name,
-    }),
-  )
-}
-
-/** Admit one canonical Domain-rooted Class Path into its exact string identity. */
-export function classKey(input: string, label: string): ClassKeyValue {
-  return ClassKey.of(classReference(input, label))
-}

package/src/graph/index.ts

@@ -1,4 +0,0 @@
-export { classKey, classReference } from './class'
-export { prepareMutation } from './mutation'
-export { nodeProperty, unqualifyProperty } from './projection'
-export { prepareQuery, type PreparedQuery, type QueryCommandInput } from './query'

package/src/graph/mutation.ts

@@ -1,46 +0,0 @@
-import type { MutationAST as MutationASTValue, MutationInput } from '@astrale-os/sdk/mutation'
-
-import { MutationAST } from '@astrale-os/sdk/mutation'
-
-/** Admit the canonical document or Core's exact rich authoring input at the CLI JSON boundary. */
-export function prepareMutation(input: unknown): MutationASTValue {
-  if (isLegacyPatchData(input)) {
-    throw new TypeError(
-      'Legacy PatchData { nodes, edges } is not Mutation V3. Author { preconditions, operations } or a canonical astrale.graph.mutation/v3 document.',
-    )
-  }
-  if (hasEmptyOperations(input)) {
-    throw new TypeError('Mutation V3 requires at least one operation')
-  }
-  if (isCanonicalCandidate(input)) return MutationAST.decode(input)
-  return MutationAST.create(input as MutationInput)
-}
-
-function hasEmptyOperations(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    Array.isArray((input as { operations?: unknown }).operations) &&
-    (input as { operations: unknown[] }).operations.length === 0
-  )
-}
-
-function isCanonicalCandidate(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    (Object.hasOwn(input, 'format') || Object.hasOwn(input, 'version'))
-  )
-}
-
-function isLegacyPatchData(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    !Object.hasOwn(input, 'operations') &&
-    (Object.hasOwn(input, 'nodes') || Object.hasOwn(input, 'edges'))
-  )
-}

package/src/graph/projection.ts

@@ -1,21 +0,0 @@
-/** Strip a fully-qualified Property key to the leaf used by CLI presentation. */
-export function unqualifyProperty(key: string): string {
-  const property = key.lastIndexOf('.property.')
-  if (property >= 0) return key.slice(property + '.property.'.length)
-  const slash = key.lastIndexOf('/')
-  return slash >= 0 ? key.slice(slash + 1) : key
-}
-
-/** Read an exact key first, then one canonical qualified key with the requested leaf. */
-export function nodeProperty(
-  node: { readonly props: Readonly<Record<string, unknown>> } | null | undefined,
-  name: string,
-): unknown {
-  const props = node?.props
-  if (props === undefined) return undefined
-  if (Object.hasOwn(props, name)) return props[name]
-  for (const [key, value] of Object.entries(props)) {
-    if (unqualifyProperty(key) === name) return value
-  }
-  return undefined
-}

package/src/graph/query.ts

@@ -1,97 +0,0 @@
-import type {
-  NodeQueryBuilder,
-  QueryAST as QueryASTValue,
-  QueryDirection,
-  QueryNodeInput,
-} from '@astrale-os/sdk/query'
-
-import { Path } from '@astrale-os/sdk/graph/path'
-import { Query, QueryAST } from '@astrale-os/sdk/query'
-
-import { classReference } from './class'
-
-export interface QueryCommandInput {
-  readonly sources: readonly string[]
-  readonly definition?: string
-  readonly ast?: unknown
-  readonly edge?: string
-  readonly direction?: QueryDirection
-  readonly limit?: string
-  readonly cursor?: string
-}
-
-export interface PreparedQuery {
-  readonly ast: QueryASTValue
-  readonly page: Readonly<{ readonly size: number; readonly after?: string }>
-}
-
-const DEFAULT_LIMIT = 100
-
-/** Admit canonical Query V6 or author the intentionally small Path/Definition/one-edge subset. */
-export function prepareQuery(input: QueryCommandInput): PreparedQuery {
-  const limit = positiveInteger(input.limit, '--limit', DEFAULT_LIMIT)
-  if (input.ast !== undefined) {
-    if (
-      input.sources.length > 0 ||
-      input.definition !== undefined ||
-      input.edge !== undefined ||
-      input.direction !== undefined
-    ) {
-      throw new TypeError(
-        '--ast/--file cannot be combined with sources, --definition, --edge, or --direction',
-      )
-    }
-    return withPage(QueryAST.decode(input.ast), limit, input.cursor)
-  }
-
-  if (input.sources.length === 0 && input.definition === undefined) {
-    throw new TypeError(
-      'query requires a Path source, --definition, or a canonical Query V6 document',
-    )
-  }
-  if (input.direction !== undefined && input.edge === undefined) {
-    throw new TypeError('--direction requires --edge')
-  }
-
-  const paths = input.sources.map((source) => Path.parse(source))
-  const definition =
-    input.definition === undefined ? undefined : classReference(input.definition, '--definition')
-  const nodes = definition === undefined ? paths : [...paths, definition]
-  const query: NodeQueryBuilder<unknown> = Query.from({
-    nodes: nodes as [QueryNodeInput, ...QueryNodeInput[]],
-  })
-  const ast =
-    input.edge === undefined
-      ? query.select({ kind: 'graph', binding: query.node })
-      : expanded(query, input.edge, input.direction)
-  return withPage(ast, limit, input.cursor)
-}
-
-function expanded(
-  query: NodeQueryBuilder<unknown>,
-  edge: string,
-  direction: QueryDirection | undefined,
-): QueryASTValue {
-  const result = query.expand({
-    via: [classReference(edge, '--edge')],
-    direction: direction ?? 'outgoing',
-  })
-  return result.select({ kind: 'graph', binding: result.node })
-}
-
-function positiveInteger(raw: string | undefined, name: string, fallback: number): number {
-  if (raw === undefined) return fallback
-  if (!/^\d+$/.test(raw)) throw new TypeError(`${name} must be a positive integer`)
-  const value = Number.parseInt(raw, 10)
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new TypeError(`${name} must be a positive integer`)
-  }
-  return value
-}
-
-function withPage(ast: QueryASTValue, size: number, cursor: string | undefined): PreparedQuery {
-  return Object.freeze({
-    ast,
-    page: Object.freeze({ size, ...(cursor === undefined ? {} : { after: cursor }) }),
-  })
-}

package/src/graph/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/identity/.history/ard/bootstrap-root-transfer.md

@@ -1,57 +0,0 @@
-# Bootstrap root transfer and child authority
-
-Status: resolved
-Impact: high
-Selection: identity-export-v1-and-authenticated-management-delegation
-
-## Context
-
-A production Host creates the manager Kernel's signing material before the CLI has any local state.
-Qualification may mount that generated secret into the operator environment, but it must not
-manufacture the CLI registry or key files. The Host producer and CLI importer previously agreed only
-through coincident TypeScript object shapes. The root-to-child journey was also distributed across
-Host, Runtime, Client, and CLI behavior, leaving room to confuse a manager-signed Management carrier
-with the effective child principal.
-
-## Decision
-
-https://schemas.astrale.ai/cli/identity-export/1 is the portable JSON Schema for the plaintext
-IdentityExport V1 envelope. CLI Identity owns and publishes that schema. Structural schema admission
-does not prove a keypair: identity import additionally proves that the private and public JWKs form
-one pair before publishing either keys or registry state.
-
-The Host secret generator emits one schema-conforming identity.json with mode 0600. The platform
-runner imports it through:
-
-    astrale identity import <identity.json> --name platform-root
-
-The imported root is the manager Kernel principal. It is never provisioned or registered as an
-application identity. The manager bookmark uses the non-reserved alias platform-manager, pins the
-manager issuer, and selects platform-root as its default identity. Manager identity is proved by the
-authenticated public Identity.whoami syscall, not local CLI status.
-
-Because this credential is issued by the target Kernel itself, CLI signing carries the imported
-subject as an already-resolved identity Grant. The external-primary `{ identity: self }` form is not
-valid for a self-issued Kernel bearer and cannot be substituted at this boundary.
-
-Child creation is the public receiver call
-/:host.astrale.ai:core.manager::createInstance. Once its Operation and Instance status report a
-ready route and issuer, the canonical child credential is minted at the manager:
-
-    astrale token -i platform-manager --for platform-root --audience <child-issuer> --raw
-
-That token is a manager-to-child Management carrier. Its outer JWT subject names the manager
-principal; child Runtime maps it to the child Kernel principal. Child calls therefore keep the token
-as --creds, and @self resolves through the child's authenticated Identity.whoami. The child bookmark
-pins the child issuer and carries no --as platform-root default.
-
-## Consequences
-
-- Bootstrap crosses one explicit file contract and one supported CLI command; no CLI state file is
-  fabricated.
-- Direct manager signing and child Management delegation remain distinct.
-- No consumer may infer the effective principal from an unverified JWT subject or cached
-  registration.
-- The portable schema is structural and versioned; cryptographic pair proof remains CLI admission.
-- A future encrypted Host-to-CLI bootstrap format requires a new explicit deployment decision. CLI's
-  interactive compact-JWE export remains an operator transfer representation, not Host output.