@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/src/keys/pair.ts

@@ -1,219 +0,0 @@
-import { compactVerify, CompactSign, exportJWK, generateKeyPair, importJWK, type JWK } from 'jose'
-import { randomUUID } from 'node:crypto'
-import { access, mkdir, readFile, unlink } from 'node:fs/promises'
-import { dirname, join, resolve } from 'node:path'
-
-import { AstraleError } from '../errors'
-import { atomicWrite, KEYS_DIR } from '../state/index'
-import { inferAlg } from './algorithm'
-
-const LEGACY_MANAGER_PRIVATE = 'manager.private.jwk'
-const LEGACY_MANAGER_PUBLIC = 'manager.public.jwk'
-
-export type KeypairPaths = {
-  readonly privatePath: string
-  readonly publicPath: string
-}
-
-export interface Keypair {
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-  readonly kid?: string
-}
-
-export interface KeypairInput {
-  readonly privateJwk: unknown
-  readonly publicJwk: unknown
-}
-
-/** Preserve manager filenames and confine every subject file to the selected key directory. */
-export function keypairPaths(subject: string, keysDir: string = KEYS_DIR): KeypairPaths {
-  if (
-    subject.length === 0 ||
-    subject.includes('\0') ||
-    subject.includes('/') ||
-    subject.includes('\\')
-  ) {
-    throw invalidKeySubject(subject)
-  }
-  const filenames =
-    subject === 'manager'
-      ? { private: LEGACY_MANAGER_PRIVATE, public: LEGACY_MANAGER_PUBLIC }
-      : { private: `${subject}.private.jwk`, public: `${subject}.public.jwk` }
-
-  return {
-    privatePath: confinedKeyPath(keysDir, filenames.private, subject),
-    publicPath: confinedKeyPath(keysDir, filenames.public, subject),
-  }
-}
-
-function confinedKeyPath(keysDir: string, filename: string, subject: string): string {
-  const path = join(keysDir, filename)
-  if (dirname(resolve(path)) !== resolve(keysDir)) throw invalidKeySubject(subject)
-  return path
-}
-
-function invalidKeySubject(subject: string): AstraleError {
-  return new AstraleError(
-    'INVALID_KEY_SUBJECT',
-    `Identity subject ${JSON.stringify(subject)} cannot name a key file.`,
-    'Use a non-empty subject without path separators.',
-  )
-}
-
-function invalidKeypair(message: string): AstraleError {
-  return new AstraleError('INVALID_KEYPAIR', message, 'Import a supported matching keypair.')
-}
-
-function acceptJwk(input: unknown, role: 'private' | 'public'): JWK {
-  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
-    throw invalidKeypair(`The ${role} JWK must be an object.`)
-  }
-  const jwk = { ...input } as JWK
-  if (jwk.kid !== undefined && (typeof jwk.kid !== 'string' || jwk.kid.length === 0)) {
-    throw invalidKeypair(`The ${role} JWK kid must be a non-empty string when present.`)
-  }
-  return jwk
-}
-
-export async function acceptKeypair(input: KeypairInput): Promise<Keypair> {
-  const privateJwk = acceptJwk(input.privateJwk, 'private')
-  const publicJwk = acceptJwk(input.publicJwk, 'public')
-  if (!Object.hasOwn(privateJwk, 'd')) {
-    throw invalidKeypair('The private JWK does not contain private key material.')
-  }
-  if (Object.hasOwn(publicJwk, 'd')) {
-    throw invalidKeypair('The public JWK must not contain private key material.')
-  }
-
-  const privateAlg = inferAlg(privateJwk as Record<string, unknown>)
-  const publicAlg = inferAlg(publicJwk as Record<string, unknown>)
-  if (privateAlg !== publicAlg) {
-    throw invalidKeypair(
-      `The private and public JWK algorithms differ (${privateAlg} versus ${publicAlg}).`,
-    )
-  }
-  if (privateJwk.kid && publicJwk.kid && privateJwk.kid !== publicJwk.kid) {
-    throw invalidKeypair('The private and public JWK key IDs differ.')
-  }
-
-  try {
-    const [privateKey, publicKey] = await Promise.all([
-      importJWK(privateJwk, privateAlg),
-      importJWK(publicJwk, publicAlg),
-    ])
-    const proof = await new CompactSign(new TextEncoder().encode('astrale-keypair-proof'))
-      .setProtectedHeader({ alg: privateAlg })
-      .sign(privateKey)
-    await compactVerify(proof, publicKey, { algorithms: [publicAlg] })
-  } catch {
-    throw invalidKeypair('The private and public JWKs do not form a valid matching pair.')
-  }
-
-  return { privateJwk, publicJwk, kid: privateJwk.kid ?? publicJwk.kid }
-}
-
-export async function fileExists(path: string): Promise<boolean> {
-  try {
-    await access(path)
-    return true
-  } catch (error) {
-    if ((error as { code?: string }).code === 'ENOENT') return false
-    throw error
-  }
-}
-
-export async function listIdentityKeys(keysDir: string = KEYS_DIR): Promise<string[]> {
-  try {
-    const { readdir } = await import('node:fs/promises')
-    const entries = await readdir(keysDir)
-    const names = new Set<string>()
-    for (const entry of entries) {
-      if (entry === LEGACY_MANAGER_PRIVATE) names.add('manager')
-      else if (entry.endsWith('.private.jwk')) names.add(entry.replace(/\.private\.jwk$/, ''))
-    }
-    return Array.from(names).sort()
-  } catch (error) {
-    if ((error as { code?: string }).code === 'ENOENT') return []
-    throw error
-  }
-}
-
-export async function generateEd25519Jwk(
-  kid: string,
-): Promise<{ readonly privateJwk: JWK; readonly publicJwk: JWK }> {
-  const { publicKey, privateKey } = await generateKeyPair('EdDSA', {
-    crv: 'Ed25519',
-    extractable: true,
-  })
-  const privateJwk = await exportJWK(privateKey)
-  const publicJwk = await exportJWK(publicKey)
-  privateJwk.alg = 'EdDSA'
-  publicJwk.alg = 'EdDSA'
-  privateJwk.kid = kid
-  publicJwk.kid = kid
-  return { privateJwk, publicJwk }
-}
-
-export async function persistKeypair(
-  subject: string,
-  opts?: { readonly keysDir?: string; readonly kid?: string },
-): Promise<{ readonly publicJwk: JWK; readonly privateJwk: JWK; readonly kid: string }> {
-  const keysDir = opts?.keysDir ?? KEYS_DIR
-  const { publicKey, privateKey } = await generateKeyPair('ES256', { extractable: true })
-  const publicJwk = await exportJWK(publicKey)
-  const privateJwk = await exportJWK(privateKey)
-  const kid = opts?.kid ?? `${subject}-key-${randomUUID().slice(0, 8)}`
-  publicJwk.kid = kid
-  privateJwk.kid = kid
-  publicJwk.alg = 'ES256'
-  privateJwk.alg = 'ES256'
-
-  await writeKeypair(subject, { privateJwk, publicJwk, kid }, keysDir)
-  return { publicJwk, privateJwk, kid }
-}
-
-export async function readKeypair(subject: string, keysDir: string = KEYS_DIR): Promise<Keypair> {
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-  try {
-    const [privateRaw, publicRaw] = await Promise.all([
-      readFile(privatePath, 'utf-8'),
-      readFile(publicPath, 'utf-8'),
-    ])
-    return await acceptKeypair({
-      privateJwk: JSON.parse(privateRaw) as unknown,
-      publicJwk: JSON.parse(publicRaw) as unknown,
-    })
-  } catch (error) {
-    if (error instanceof AstraleError) throw error
-    throw invalidKeypair(`Could not read the keypair for identity ${JSON.stringify(subject)}.`)
-  }
-}
-
-export async function importKeypair(
-  subject: string,
-  input: KeypairInput,
-  keysDir: string = KEYS_DIR,
-): Promise<Keypair> {
-  const pair = await acceptKeypair(input)
-  await writeKeypair(subject, pair, keysDir)
-  return pair
-}
-
-async function writeKeypair(subject: string, pair: Keypair, keysDir: string): Promise<void> {
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-  await mkdir(keysDir, { recursive: true })
-  await atomicWrite(privatePath, JSON.stringify(pair.privateJwk, null, 2))
-  await atomicWrite(publicPath, JSON.stringify(pair.publicJwk, null, 2))
-}
-
-export async function removeKeypair(subject: string, keysDir: string = KEYS_DIR): Promise<void> {
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-  for (const path of [privatePath, publicPath]) {
-    try {
-      await unlink(path)
-    } catch (error) {
-      if ((error as { code?: string }).code !== 'ENOENT') throw error
-    }
-  }
-}

package/src/keys/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/lib/__tests__/admin-target.test.ts

@@ -1,184 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { InstanceStore } from '../instance'
-
-import {
-  DEFAULT_ADMIN_TARGET_NAME,
-  DEFAULT_ADMIN_DOMAIN_ISSUER,
-  DEFAULT_ADMIN_TARGET_URL,
-  defaultAdminTargetForChannel,
-  resolveAdminTargetFromStore,
-} from '../admin-target'
-import { DEFAULT_CONFIG, type AstraleConfig } from '../config'
-
-const instances: InstanceStore = {
-  active: 'primary',
-  instances: {
-    primary: {
-      url: 'https://primary.example.com',
-      issuer: 'https://primary-issuer.example.com',
-    },
-    admin: {
-      url: 'https://bookmarked-admin.example.com',
-      issuer: 'https://bookmarked-issuer.example.com',
-      domainIssuer: 'https://bookmarked-domain.example.com',
-      defaultIdentity: 'admin-workos',
-    },
-    alias: {
-      url: 'https://alias-admin.example.com',
-      domainIssuer: 'https://alias-domain.example.com',
-      name: 'named-admin',
-    },
-  },
-}
-
-describe('resolveAdminTargetFromStore', () => {
-  test('derives hosted Admin defaults from the release channel', () => {
-    expect(defaultAdminTargetForChannel('beta')).toEqual({
-      url: 'https://admin.eu.beta.astrale.ai/api',
-      domainIssuer: 'https://admin.beta.astrale.ai',
-    })
-    expect(defaultAdminTargetForChannel('stable')).toEqual({
-      url: 'https://admin.eu.astrale.ai/api',
-      domainIssuer: 'https://admin.astrale.ai',
-    })
-  })
-
-  test('uses hosted admin default without active instance coupling', () => {
-    expect(resolveAdminTargetFromStore({}, DEFAULT_CONFIG, instances)).toEqual({
-      name: DEFAULT_ADMIN_TARGET_NAME,
-      registrationSlug: DEFAULT_ADMIN_TARGET_NAME,
-      url: DEFAULT_ADMIN_TARGET_URL,
-      kernelIssuer: DEFAULT_ADMIN_TARGET_URL,
-      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
-      source: 'default',
-      configured: false,
-    })
-  })
-
-  test('uses configured admin bookmark', () => {
-    const config: AstraleConfig = {
-      ...DEFAULT_CONFIG,
-      admin: { instance: 'admin' },
-    }
-
-    expect(resolveAdminTargetFromStore({}, config, instances)).toEqual({
-      name: 'admin',
-      registrationSlug: 'admin',
-      url: 'https://bookmarked-admin.example.com',
-      kernelIssuer: 'https://bookmarked-issuer.example.com',
-      domainIssuer: 'https://bookmarked-domain.example.com',
-      defaultIdentity: 'admin-workos',
-      source: 'config-instance',
-      configured: true,
-    })
-  })
-
-  test('keeps an exact beta Domain issuer separate from the Admin Kernel target', () => {
-    const config: AstraleConfig = {
-      ...DEFAULT_CONFIG,
-      admin: {
-        url: 'https://admin.eu.beta.astrale.ai/api',
-        kernelIssuer: 'https://admin.eu.beta.astrale.ai/api',
-        domainIssuer: 'https://admin.beta.astrale.ai',
-      },
-    }
-
-    expect(resolveAdminTargetFromStore({}, config, instances)).toMatchObject({
-      url: 'https://admin.eu.beta.astrale.ai/api',
-      kernelIssuer: 'https://admin.eu.beta.astrale.ai/api',
-      domainIssuer: 'https://admin.beta.astrale.ai',
-      source: 'config-url',
-      configured: true,
-    })
-
-    expect(
-      resolveAdminTargetFromStore(
-        { adminUrl: 'https://override.eu.beta.astrale.ai/api' },
-        config,
-        instances,
-      ),
-    ).toMatchObject({
-      url: 'https://override.eu.beta.astrale.ai/api',
-      domainIssuer: 'https://admin.beta.astrale.ai',
-    })
-  })
-
-  test('allows explicit admin bookmark and admin url overrides', () => {
-    expect(
-      resolveAdminTargetFromStore({ admin: 'alias' }, DEFAULT_CONFIG, instances),
-    ).toMatchObject({
-      name: 'alias',
-      url: 'https://alias-admin.example.com',
-      kernelIssuer: 'https://alias-admin.example.com',
-      domainIssuer: 'https://alias-domain.example.com',
-      source: 'admin',
-    })
-
-    expect(
-      resolveAdminTargetFromStore(
-        {
-          adminUrl: 'https://override-admin.example.com',
-          domainIssuer: 'https://override-domain.example.com',
-        },
-        DEFAULT_CONFIG,
-        instances,
-      ),
-    ).toMatchObject({
-      name: 'admin',
-      url: 'https://override-admin.example.com',
-      kernelIssuer: 'https://override-admin.example.com',
-      domainIssuer: 'https://override-domain.example.com',
-      source: 'admin-url',
-    })
-  })
-
-  test('accepts -i and --url as admin target overrides', () => {
-    expect(
-      resolveAdminTargetFromStore({ instance: 'admin' }, DEFAULT_CONFIG, instances),
-    ).toMatchObject({
-      name: 'admin',
-      url: 'https://bookmarked-admin.example.com',
-      source: 'admin',
-    })
-
-    expect(
-      resolveAdminTargetFromStore(
-        {
-          url: 'https://override.example.com',
-          domainIssuer: 'https://override-domain.example.com',
-        },
-        DEFAULT_CONFIG,
-        instances,
-      ),
-    ).toMatchObject({
-      name: 'admin',
-      url: 'https://override.example.com',
-      domainIssuer: 'https://override-domain.example.com',
-      source: 'admin-url',
-    })
-  })
-
-  test('rejects conflicting admin target overrides', () => {
-    expect(() =>
-      resolveAdminTargetFromStore(
-        { admin: 'admin', adminUrl: 'https://override-admin.example.com' },
-        DEFAULT_CONFIG,
-        instances,
-      ),
-    ).toThrow('Choose one admin target override')
-  })
-
-  test('retains configured Domain evidence instead of inferring it from the Kernel issuer', () => {
-    expect(
-      resolveAdminTargetFromStore(
-        { adminUrl: 'https://override-admin.example.com' },
-        DEFAULT_CONFIG,
-        instances,
-      ),
-    ).toMatchObject({
-      kernelIssuer: 'https://override-admin.example.com',
-      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
-    })
-  })
-})

package/src/lib/__tests__/binary.test.ts

@@ -1,55 +0,0 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
-import { readFile, unlink } from 'node:fs/promises'
-
-import { presentBinary, type BinaryLike } from '../binary'
-
-const png = (): BinaryLike => ({
-  mediaType: 'image/png',
-  body: new Uint8Array([1, 2, 3, 4]),
-})
-
-describe('presentBinary', () => {
-  let chunks: Buffer[] = []
-  let originalWrite: typeof process.stdout.write
-
-  beforeEach(() => {
-    chunks = []
-    originalWrite = process.stdout.write.bind(process.stdout)
-    process.stdout.write = mock((chunk: string | Uint8Array) => {
-      chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : Buffer.from(chunk))
-      return true
-    }) as typeof process.stdout.write
-  })
-
-  afterEach(() => {
-    process.stdout.write = originalWrite
-  })
-
-  test('--raw writes the raw bytes to stdout', async () => {
-    await presentBinary(png(), { raw: true })
-    expect(Array.from(Buffer.concat(chunks))).toEqual([1, 2, 3, 4])
-  })
-
-  test('--json writes a base64-wrapped JSON envelope', async () => {
-    await presentBinary(png(), { json: true })
-    const obj = JSON.parse(Buffer.concat(chunks).toString())
-    expect(obj.contentType).toBe('image/png')
-    expect([...Buffer.from(obj.bodyBase64, 'base64')]).toEqual([1, 2, 3, 4])
-  })
-
-  test('--json inlines text for text-like content types', async () => {
-    await presentBinary(
-      { mediaType: 'text/plain', body: new TextEncoder().encode('hi') },
-      { json: true },
-    )
-    const obj = JSON.parse(Buffer.concat(chunks).toString())
-    expect(obj.body).toBe('hi')
-  })
-
-  test('-o writes raw bytes to a file', async () => {
-    const tmp = `${process.env.TMPDIR ?? '/tmp'}/astrale-bin-test-${process.pid}.bin`
-    await presentBinary(png(), {}, { outFile: tmp })
-    expect([...(await readFile(tmp))]).toEqual([1, 2, 3, 4])
-    await unlink(tmp)
-  })
-})

package/src/lib/__tests__/command-dx.test.ts

@@ -1,102 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-import { CommanderError } from 'commander'
-
-import { buildProgram } from '../../program/index'
-import { collectCommandCatalog, renderCommanderError } from '../command-dx'
-
-// `renderCommanderError` styles commands with `chalk.bold`, which emits ANSI
-// codes only when chalk detects a color-capable stdout (TTY). Strip them so the
-// assertions are deterministic whether the suite runs under a TTY or in CI.
-// (Built from a char code so the regex source carries no literal control char.)
-const ANSI_RE = new RegExp(String.fromCharCode(27) + '\\[[0-9;]*m', 'g')
-const stripAnsi = (s: string): string => s.replace(ANSI_RE, '')
-
-function dx(
-  program: Awaited<ReturnType<typeof buildProgram>>,
-  error: CommanderError,
-  argv: string[],
-) {
-  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv))) as {
-    error: string
-    message: string
-    detail: string
-  }
-  expect(rendered.error).toBe('USAGE_ERROR')
-  return rendered
-}
-
-describe('command DX suggestions', () => {
-  test('collects command paths from the registered program tree', async () => {
-    const program = await buildProgram()
-    const usages = collectCommandCatalog(program).map((entry) => entry.usage)
-
-    expect(usages).toContain('identity use <name>')
-    expect(usages).toContain('instance use [name]')
-    expect(usages).toContain('admin status')
-    expect(usages).toContain('admin use [bookmark]')
-    expect(usages).toContain('use <name>')
-    expect(usages).toContain('update')
-    expect(usages).toContain('query [sources...]')
-    expect(usages).toContain('get <target>')
-    expect(usages).toContain('introspect <target>')
-    expect(usages).toContain('status')
-    expect(usages).not.toContain('ls <source>')
-    expect(usages).not.toContain('describe <target>')
-  })
-
-  test('explains shared verbs as namespaced commands, not arity errors', async () => {
-    const program = await buildProgram()
-    const error = new CommanderError(
-      1,
-      'commander.excessArguments',
-      'error: too many arguments. Expected 0 arguments but got 2.',
-    )
-    const rendered = dx(program, error, ['delete', 'demo-system'])
-
-    expect(rendered.message).toContain('Unknown command: astrale delete demo-system')
-    expect(rendered.detail).toContain('"delete" is available under:')
-    expect(rendered.detail).toContain('astrale identity delete <name>')
-    expect(rendered.detail).toContain('astrale instance delete <id>')
-    expect(rendered.detail).not.toContain('too many arguments')
-  })
-
-  test('points retired describe at get', async () => {
-    const program = await buildProgram()
-    const error = new CommanderError(
-      1,
-      'commander.unknownCommand',
-      "error: unknown command 'describe'",
-    )
-    const rendered = dx(program, error, ['describe', '@note'])
-
-    expect(rendered.message).toContain('Unknown command: astrale describe @note')
-    expect(rendered.detail).toContain('astrale describe` was removed')
-    expect(rendered.detail).toContain('astrale get <target>')
-    expect(rendered.detail).not.toContain('Did you mean:')
-  })
-
-  test('points retired ls at query', async () => {
-    const program = await buildProgram()
-    const error = new CommanderError(1, 'commander.unknownCommand', "error: unknown command 'ls'")
-    const rendered = dx(program, error, ['ls', '@note'])
-
-    expect(rendered.message).toContain('Unknown command: astrale ls @note')
-    expect(rendered.detail).toContain('astrale ls` was removed')
-    expect(rendered.detail).toContain('astrale query <source> --edge <class>')
-    expect(rendered.detail).not.toContain('Did you mean:')
-  })
-
-  test('suggests nearest command for typo paths', async () => {
-    const program = await buildProgram()
-    const error = new CommanderError(
-      1,
-      'commander.excessArguments',
-      'error: too many arguments. Expected 0 arguments but got 2.',
-    )
-    const rendered = dx(program, error, ['indetityl', 'ist'])
-
-    expect(rendered.message).toContain('Unknown command: astrale indetityl ist')
-    expect(rendered.detail).toContain('Did you mean:')
-    expect(rendered.detail).toContain('astrale identity list')
-  })
-})

package/src/lib/__tests__/concurrency.test.ts

@@ -1,62 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { mapBounded } from '../concurrency'
-
-const tick = (ms: number) => new Promise((r) => setTimeout(r, ms))
-
-describe('mapBounded', () => {
-  test('preserves input order regardless of completion order', async () => {
-    const out = await mapBounded([30, 10, 20, 0], 4, async (ms, i) => {
-      await tick(ms)
-      return i
-    })
-    expect(out).toEqual([0, 1, 2, 3])
-  })
-
-  test('never exceeds the concurrency bound', async () => {
-    let inFlight = 0
-    let peak = 0
-    await mapBounded(
-      Array.from({ length: 12 }, (_, i) => i),
-      3,
-      async () => {
-        inFlight++
-        peak = Math.max(peak, inFlight)
-        await tick(5)
-        inFlight--
-      },
-    )
-    expect(peak).toBeLessThanOrEqual(3)
-  })
-
-  test('processes every item exactly once', async () => {
-    const seen: number[] = []
-    await mapBounded([1, 2, 3, 4, 5], 2, async (n) => {
-      seen.push(n)
-    })
-    expect(seen.sort((a, b) => a - b)).toEqual([1, 2, 3, 4, 5])
-  })
-
-  test('empty input → empty output, fn never called', async () => {
-    let called = false
-    const out = await mapBounded([], 4, async () => {
-      called = true
-    })
-    expect(out).toEqual([])
-    expect(called).toBe(false)
-  })
-
-  test('limit below 1 is clamped (still makes progress)', async () => {
-    const out = await mapBounded([1, 2, 3], 0, async (n) => n * 2)
-    expect(out).toEqual([2, 4, 6])
-  })
-
-  test('a rejection propagates', async () => {
-    await expect(
-      mapBounded([1, 2, 3], 2, async (n) => {
-        if (n === 2) throw new Error('boom')
-        return n
-      }),
-    ).rejects.toThrow('boom')
-  })
-})

package/src/lib/__tests__/config.test.ts

@@ -1,54 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { DEFAULT_ADMIN_DOMAIN_ISSUER, DEFAULT_ADMIN_TARGET_URL } from '../admin-target'
-import { AstraleConfigSchema } from '../config'
-
-describe('AstraleConfigSchema', () => {
-  test('parses valid config', () => {
-    const result = AstraleConfigSchema.parse({
-      issuer: 'https://test.astrale.ai',
-    })
-    expect(result.issuer).toBe('https://test.astrale.ai')
-    expect(result.admin.url).toBe(DEFAULT_ADMIN_TARGET_URL)
-  })
-
-  test('applies defaults for empty object', () => {
-    const result = AstraleConfigSchema.parse({})
-    expect(result.issuer).toBe('https://unregistered.invalid')
-    expect(result.admin).toEqual({
-      name: 'admin',
-      url: DEFAULT_ADMIN_TARGET_URL,
-      kernelIssuer: DEFAULT_ADMIN_TARGET_URL,
-      domainIssuer: DEFAULT_ADMIN_DOMAIN_ISSUER,
-    })
-  })
-
-  test('rejects non-url issuer', () => {
-    expect(() => AstraleConfigSchema.parse({ issuer: 'not-a-url' })).toThrow()
-  })
-
-  test('strips removed local-runtime config keys', () => {
-    const result = AstraleConfigSchema.parse({
-      issuer: 'https://test.astrale.ai',
-      managerPort: 9000,
-      removedRuntimeKey: true,
-    })
-    expect('managerPort' in result).toBe(false)
-    expect('removedRuntimeKey' in result).toBe(false)
-  })
-
-  test('accepts configured admin bookmark', () => {
-    const result = AstraleConfigSchema.parse({
-      admin: { instance: 'staging-admin' },
-    })
-    expect(result.admin).toEqual({ instance: 'staging-admin' })
-  })
-
-  test('rejects admin config with url and instance together', () => {
-    expect(() =>
-      AstraleConfigSchema.parse({
-        admin: { url: DEFAULT_ADMIN_TARGET_URL, instance: 'admin' },
-      }),
-    ).toThrow()
-  })
-})