@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/dist/types/lib/login-flow.d.ts

@@ -1,49 +0,0 @@
-import { type IdpSession } from './idp';
-/**
- * The IdP login flow, lifted out of the `auth login` command so it can be
- * driven from anywhere (the command renders the result; `astrale setup` runs it
- * as one hand-held step). The side effects — saving the session cache and
- * upserting the IdP-backed identity — live here so every caller gets identical
- * behavior; presentation (the device URL is logged here; success lines are the
- * caller's) does not.
- */
-export type LoginFlowOpts = {
-    idp?: string;
-    name?: string;
-    scope?: string;
-    audience?: string;
-    clientId?: string;
-    clientSecretEnv?: string;
-    clientCredentials?: boolean;
-    code?: string;
-    redirectUri?: string;
-    codeVerifier?: string;
-    /** Switch the default identity to the one we just logged in (default true). */
-    use?: boolean;
-    /**
-     * Optional device-flow presentation boundary. When supplied, the caller
-     * receives the verification coordinates instead of terminal log output.
-     */
-    onVerification?: (event: DeviceVerification) => void;
-};
-export type DeviceVerification = {
-    verificationUri: string;
-    verificationUriComplete?: string;
-    userCode?: string;
-    expiresIn?: number;
-    message?: string;
-};
-export type LoginResult = {
-    session: IdpSession;
-    identityName: string;
-    idpName: string;
-};
-/**
- * Authenticate against an IdP and persist the result. Throws on any failure
- * (no session is written) — notably BEFORE saving when an explicit `--audience`
- * does not match the minted access token, so a wrong-audience login never
- * leaves a half-written cache.
- */
-export declare function loginViaIdp(opts: LoginFlowOpts): Promise<LoginResult>;
-/** Resolve which IdP to use: explicit name, the sole configured one, or WorkOS. */
-export declare function resolveIdpName(name: string | undefined): Promise<string>;

package/dist/types/lib/meta.d.ts

@@ -1,36 +0,0 @@
-/**
- * Issuer reachability helpers — OIDC discovery + JWKS.
- *
- * Kernels don't expose `/meta`. They expose OIDC discovery at
- * `/.well-known/openid-configuration` (standard, returns `issuer` and
- * `jwks_uri`) and JWKS at `/.well-known/jwks.json`. These helpers probe
- * both to verify the issuer is alive and publishes at least one key.
- *
- * Domain deployment readiness uses the canonical Domain Publication; that is
- * outside this issuer-connectivity helper.
- */
-type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-export type DiscoveryDocument = {
-    /** OIDC issuer URL. */
-    issuer: string;
-    /** JWKS URI (defaults to `<issuer>/.well-known/jwks.json`). */
-    jwksUri: string;
-};
-export declare function fetchDiscovery(url: string, timeoutMs?: number, fetchImpl?: FetchLike): Promise<DiscoveryDocument>;
-export declare function fetchJwks(jwksUri: string, timeoutMs?: number, fetchImpl?: FetchLike): Promise<{
-    keys: Array<{
-        kid?: string;
-    }>;
-}>;
-/**
- * Discover the WorkOS organization an instance host pins
- */
-export declare function fetchOrgHint(url: string, timeoutMs?: number): Promise<string | undefined>;
-/** Verify the pinned issuer publishes self-consistent OIDC discovery and a non-empty JWKS. */
-export declare function checkIssuerReachability(url: string, issuerOverride?: string, fetchImpl?: FetchLike): Promise<{
-    issuer: string;
-    keys: Array<{
-        kid?: string;
-    }>;
-}>;
-export {};

package/dist/types/lib/output.d.ts

@@ -1,87 +0,0 @@
-import { type Column } from './table';
-export type { Column } from './table';
-export type OutputOpts = {
-    raw?: boolean;
-    json?: boolean;
-    format?: 'yaml' | 'json';
-};
-export type RawOutputOpts = Pick<OutputOpts, 'raw' | 'json'>;
-export type MachineOpts = RawOutputOpts & {
-    readonly ci?: boolean;
-};
-export declare const RAW_OUTPUT_OPTIONS: readonly [{
-    readonly flags: '--json';
-    readonly description: 'Always-valid JSON (for jq)';
-}, {
-    readonly flags: '--raw';
-    readonly description: 'Unwrapped: bare scalar / raw bytes / JSON for objects';
-}];
-/**
- * Is the consumer a machine (emit structured data, not a pretty view)?
- * True for `--json`, `--raw`, `--ci`, a process-wide `--ci/--json/--raw` on argv,
- * or any non-TTY stdout (pipe, redirect, agent).
- */
-export declare function isMachine(opts?: MachineOpts): boolean;
-/**
- * `--raw` = the *unwrapped* value (bare scalar, raw bytes). The raw-vs-json
- * distinction only manifests for scalars and binary; objects/arrays fall back
- * to JSON under either flag.
- */
-export declare function isUnwrapped(opts?: RawOutputOpts): boolean;
-/**
- * Write structured data to stdout in the appropriate format.
- *
- * Precedence:
- * - `--raw` / `--json` → plain JSON, no colors (machine-readable)
- * - explicit `--format yaml|json` → honor regardless of TTY, colors only on TTY
- * - default on TTY → highlighted YAML
- * - default on non-TTY → plain JSON
- *
- * Void-returning syscalls surface as `undefined` here; `JSON.stringify(undefined)`
- * itself returns `undefined`, which would print the bare string `undefined` and
- * break any caller doing `JSON.parse(stdout)`. Normalize to `null` (parseable
- * JSON, valid YAML) at the entry so every formatter branch is consistent.
- */
-export declare function output(data: unknown, opts: OutputOpts): void;
-export type PresentOpts = OutputOpts & {
-    denoise?: boolean;
-};
-/** One display row per item plus the columns and (optional) `-q` paths. */
-export type ListProjection = {
-    columns: Column[];
-    rows: Array<Record<string, string>>;
-    paths?: string[];
-};
-export type ListOpts = OutputOpts & {
-    quiet?: boolean;
-    count?: boolean;
-    long?: boolean;
-};
-/**
- * Strip heavy, low-signal keys (serialized schema blobs, SVG icons, code) at any
- * depth — so machine output is the kernel's data minus the noise, never a wall.
- */
-export declare function denoise(value: unknown): unknown;
-/**
- * Present a single kernel value, shape- and audience-aware.
- *
- * - scalar → `--raw` bare (no quotes, for `X=$(…)`) · `--json`/pipe JSON · TTY bare
- * - object → YAML on a TTY, JSON for machines (delegates to {@link output})
- * - array  → YAML/JSON fallback (use {@link presentList} for a table)
- *
- * `null`/`undefined` normalize to `null` (via `output`) so `JSON.parse(stdout)`
- * never breaks.
- */
-export declare function present(value: unknown, opts?: PresentOpts): void;
-/**
- * Present an array of objects.
- *
- * - `--count`     → just the number
- * - `-q/--quiet`  → one path per line (unix-pipeable)
- * - machine       → denoised JSON of the raw items (`-l` keeps full items)
- * - TTY           → an aligned table + a dim count footer
- *
- * Projection (columns/rows/paths) is for the human table and `-q` only; the
- * machine surface stays the kernel's own item fields.
- */
-export declare function presentList<T>(items: T[], opts: ListOpts, project: (items: T[]) => ListProjection): void;

package/dist/types/lib/proc.d.ts

@@ -1,43 +0,0 @@
-import { type ChildProcess, type StdioOptions } from 'node:child_process';
-export type RunResult = {
-    /** Exit code, or -1 when the process was killed by a signal. */
-    code: number;
-    stdout: string;
-    stderr: string;
-};
-/**
- * Spawn a child process and capture stdout/stderr as UTF-8 text.
- *
- * Uses `node:child_process` rather than `Bun.spawn` so the exact same code runs
- * under both the Bun-compiled standalone binary (Linux/macOS) and the Node/npm
- * build (Windows and any Node user). The promise rejects only when the process
- * fails to spawn (e.g. ENOENT); a non-zero exit resolves with that `code` so
- * callers can branch on it.
- */
-export declare function run(file: string, args?: string[], opts?: {
-    cwd?: string;
-}): Promise<RunResult>;
-/**
- * Spawn a child process with inherited stdio so its output streams live to the
- * user's terminal. Used for hand-held installs (npm / npx) where progress
- * matters and the output is for the human, not for parsing. Resolves with the
- * exit code; rejects only when the process fails to spawn (e.g. ENOENT).
- */
-export declare function runInherit(file: string, args?: string[], opts?: {
-    cwd?: string;
-}): Promise<number>;
-/**
- * Spawn a LONG-LIVED child and return the handle immediately so the caller can
- * supervise it (wait for exit, forward signals, tear down siblings). Unlike
- * run()/runInherit() — which resolve only once the child closes — this is for
- * servers the command keeps attached to (e.g. `astrale studio`'s Bun server and
- * Vite dev process). Same node:child_process basis (cross-runtime) and bare
- * PATH-name lookup convention. Default stdio streams stdout/stderr live but
- * ignores stdin, so two supervised children never contend for the TTY.
- */
-export declare function spawnHandle(file: string, args?: string[], opts?: {
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-    stdio?: StdioOptions;
-    detached?: boolean;
-}): ChildProcess;

package/dist/types/lib/table.d.ts

@@ -1,18 +0,0 @@
-/** A display column: which row key to read, its header, and an optional cell color. */
-export type Column = {
-    key: string;
-    header: string;
-    color?: (s: string) => string;
-};
-/**
- * Render an aligned, optionally-colored table.
- *
- * Cells may carry ANSI (e.g. a per-row status color) — widths are computed on
- * visible length so alignment stays correct. `Column.color` colors a whole
- * column of otherwise-plain cells. Columns empty across every row are dropped;
- * the last column is left unpadded so there's no trailing whitespace.
- */
-export declare function renderTable(rows: Array<Record<string, string>>, opts: {
-    columns: Column[];
-    showHeader?: boolean;
-}): string;

package/dist/types/lib/update.d.ts

@@ -1,131 +0,0 @@
-import { z } from 'zod';
-import { AstraleError } from '../errors';
-export declare const DEFAULT_UPDATE_CHANNEL = "beta";
-export declare const InstallMetadataSchema: z.ZodObject<{
-    method: z.ZodLiteral<"script">;
-    channel: z.ZodDefault<z.ZodString>;
-    version: z.ZodOptional<z.ZodString>;
-    repo: z.ZodDefault<z.ZodString>;
-    bin: z.ZodString;
-    installedAt: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    method: "script";
-    channel: string;
-    version?: string | undefined;
-    repo: string;
-    bin: string;
-    installedAt?: string | undefined;
-}, {
-    method: "script";
-    channel?: string | undefined;
-    version?: string | undefined;
-    repo?: string | undefined;
-    bin: string;
-    installedAt?: string | undefined;
-}>;
-export type InstallMetadata = z.infer<typeof InstallMetadataSchema>;
-export declare const UpdateManifestSchema: z.ZodObject<{
-    version: z.ZodString;
-    binaryVersion: z.ZodOptional<z.ZodString>;
-    channel: z.ZodString;
-    repo: z.ZodOptional<z.ZodString>;
-    assets: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
-        name: z.ZodString;
-        sha256: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        name: string;
-        sha256?: string | undefined;
-    }, {
-        name: string;
-        sha256?: string | undefined;
-    }>, z.ZodEffects<z.ZodString, {
-        name: string;
-    }, string>]>>;
-}, "strip", z.ZodTypeAny, {
-    version: string;
-    binaryVersion?: string | undefined;
-    channel: string;
-    repo?: string | undefined;
-    assets: Record<string, {
-        name: string;
-        sha256?: string | undefined;
-    } | {
-        name: string;
-    }>;
-}, {
-    version: string;
-    binaryVersion?: string | undefined;
-    channel: string;
-    repo?: string | undefined;
-    assets: Record<string, string | {
-        name: string;
-        sha256?: string | undefined;
-    }>;
-}>;
-export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;
-export type Platform = {
-    os: 'darwin' | 'linux';
-    arch: 'arm64' | 'x64';
-};
-export type UpdateRequest = {
-    check?: boolean;
-    channel?: string;
-    version?: string;
-    currentVersion: string;
-    platform?: Platform;
-    installPath?: string;
-    execution?: UpdateExecution;
-};
-export type UpdateExecution = {
-    kind: 'standalone';
-    executable: string;
-} | {
-    kind: 'package-managed';
-    executable: string;
-};
-declare const admittedScriptInstall: unique symbol;
-export type AdmittedScriptInstall = Readonly<{
-    metadata: InstallMetadata;
-    executable: string;
-    [admittedScriptInstall]: true;
-}>;
-export type UpdateResult = {
-    status: 'managed';
-    currentVersion: string;
-    executable: string;
-} | {
-    status: 'up-to-date';
-    currentVersion: string;
-    latestVersion: string;
-    channel: string;
-} | {
-    status: 'available';
-    currentVersion: string;
-    latestVersion: string;
-    channel: string;
-} | {
-    status: 'updated';
-    previousVersion: string;
-    currentVersion: string;
-    channel: string;
-    bin: string;
-};
-export declare function detectPlatform(): Platform;
-export declare function platformKey(platform: Platform): string;
-export declare function classifyUpdateExecution(input: {
-    bunVersion?: string;
-    executable: string;
-    entry?: string;
-}): UpdateExecution;
-export declare function detectUpdateExecution(): UpdateExecution;
-export declare function packageManagedUpdateError(executable: string): AstraleError;
-export declare function readInstallMetadata(path?: string): Promise<InstallMetadata>;
-export declare function admitScriptInstall(meta: InstallMetadata, execution: Extract<UpdateExecution, {
-    kind: 'standalone';
-}>): Promise<AdmittedScriptInstall>;
-export declare function writeInstallMetadata(meta: InstallMetadata, path?: string): Promise<void>;
-export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
-export declare function fetchManifest(base: string): Promise<UpdateManifest>;
-export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
-export declare function updateAstrale(req: UpdateRequest): Promise<UpdateResult>;
-export {};

package/dist/types/lib/validation.d.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod';
-declare const RESERVED_SLUGS: Set<string>;
-export { RESERVED_SLUGS };
-export declare function validateName(name: string, entity: string): void;
-export declare function validateSlug(slug: string): void;
-export declare function validateUrl(url: string): void;
-/** Non-throwing predicate form of `validateUrl`. */
-export declare function isHttpUrl(url: string): boolean;
-/** `local` = only this machine. `remote` = mirrored via astrale cloud (§2.7). */
-export declare const RegistryModeSchema: z.ZodEnum<["local", "remote"]>;
-export type RegistryMode = z.infer<typeof RegistryModeSchema>;

package/dist/types/paths/index.d.ts

@@ -1,2 +0,0 @@
-export { ASTRALE_HOME, CONFIG_PATH, DATA_DIR, IDENTITIES_PATH, IDPS_PATH, IDP_SESSIONS_DIR, INSTALL_PATH, INSTANCES_PATH, KEYS_DIR, createPaths, } from '../state/index';
-export type { PathEnvironment, Paths } from '../state/index';

package/dist/types/state/exchange-credentials.d.ts

@@ -1,25 +0,0 @@
-export declare namespace exchange {
-    interface Artifact {
-        readonly version: 1;
-        readonly entries: Record<string, Entry>;
-    }
-    interface Key {
-        readonly kernelIssuer: string;
-        readonly domainIssuer: string;
-        readonly user: string;
-    }
-    interface Entry {
-        readonly credential: string;
-        readonly expiresAt: number;
-    }
-}
-export declare class ExchangeCredentialCache {
-    private readonly path;
-    private readonly refreshing;
-    constructor(path?: string);
-    getOrRefresh(key: exchange.Key, refresh: () => Promise<exchange.Entry>, now?: () => number): Promise<string>;
-    deleteKernel(kernelIssuer: string): Promise<void>;
-    clear(): Promise<void>;
-    private getOrRefreshOnce;
-    private transition;
-}

package/dist/types/state/files.d.ts

@@ -1,9 +0,0 @@
-/** Atomically publish one complete private state file through a same-directory temporary file. */
-export declare function atomicWrite(path: string, data: string): Promise<void>;
-export interface FileLockOptions {
-    readonly pollIntervalMs?: number;
-    readonly staleAfterMs?: number;
-    readonly timeoutMs?: number;
-}
-/** Run one transition under a bounded cross-process create-exclusive lock. */
-export declare function withFileLock<Value>(lockPath: string, transition: () => Promise<Value>, options?: FileLockOptions): Promise<Value>;

package/dist/types/state/identities.d.ts

@@ -1,42 +0,0 @@
-import type { FileLockOptions } from './files';
-export type IdentitySource = 'key' | 'idp';
-export type IdentityMode = 'local' | 'remote';
-export interface Registration {
-    readonly iss: string;
-    readonly sub: string;
-    readonly registeredAt: string;
-}
-export interface Identity {
-    readonly subject: string;
-    readonly createdAt: string;
-    readonly source?: IdentitySource;
-    readonly mode?: IdentityMode;
-    readonly kid?: string;
-    readonly idp?: string;
-    readonly issuer?: string;
-    readonly audience?: string;
-    readonly claims?: Readonly<Record<string, unknown>>;
-    readonly registrations?: Readonly<Record<string, Registration>>;
-}
-export interface IdentityStore {
-    readonly default: string;
-    readonly identities: Readonly<Record<string, Identity>>;
-}
-export declare const IDENTITY_STORE_VERSION: 1;
-export type IdentityStateErrorCode = 'IDENTITY_STATE_INVALID' | 'IDENTITY_STATE_VERSION_UNSUPPORTED' | 'IDENTITY_STATE_UNREADABLE' | 'IDENTITY_STATE_BACKUP_CONFLICT';
-export declare class IdentityStateError extends Error {
-    readonly code: IdentityStateErrorCode;
-    readonly path: string;
-    constructor(code: IdentityStateErrorCode, path: string, message: string, cause?: unknown);
-}
-export interface IdentityStoreOptions {
-    readonly path?: string;
-    readonly now?: () => Date;
-    readonly lock?: FileLockOptions;
-}
-export interface IdentityUpdate<Value> {
-    readonly next: IdentityStore;
-    readonly value: Value;
-}
-export declare function readIdentityStore(options?: IdentityStoreOptions): Promise<IdentityStore>;
-export declare function updateIdentityStore<Value>(transition: (current: IdentityStore) => IdentityUpdate<Value> | Promise<IdentityUpdate<Value>>, options?: IdentityStoreOptions): Promise<Value>;

package/dist/types/state/index.d.ts

@@ -1,8 +0,0 @@
-export { atomicWrite, withFileLock } from './files';
-export type { FileLockOptions } from './files';
-export { ExchangeCredentialCache } from './exchange-credentials';
-export type { exchange } from './exchange-credentials';
-export { IDENTITY_STORE_VERSION, readIdentityStore, updateIdentityStore } from './identities';
-export type { Identity, IdentityMode, IdentitySource, IdentityStore, IdentityStoreOptions, IdentityUpdate, Registration, } from './identities';
-export { ASTRALE_HOME, CONFIG_PATH, DATA_DIR, IDENTITIES_PATH, IDPS_PATH, IDP_SESSIONS_DIR, EXCHANGE_CREDENTIALS_PATH, INSTALL_PATH, INSTANCES_PATH, KEYS_DIR, createPaths, paths, } from './paths';
-export type { PathEnvironment, Paths } from './paths';

package/dist/types/state/paths.d.ts

@@ -1,32 +0,0 @@
-export interface PathEnvironment {
-    readonly ASTRALE_HOME?: string;
-    readonly ASTRALE_KEYS_DIR?: string;
-    readonly ASTRALE_DATA_DIR?: string;
-}
-export interface Paths {
-    readonly home: string;
-    readonly keys: string;
-    readonly data: string;
-    readonly config: string;
-    readonly install: string;
-    readonly identities: string;
-    readonly instances: string;
-    readonly idps: string;
-    readonly idpSessionsDir: string;
-    readonly exchangeCredentials: string;
-    idpDir(name: string): string;
-    idpSession(identityName: string): string;
-}
-/** Resolve every CLI state path once from explicit input and the captured environment. */
-export declare function createPaths(home?: string, environment?: PathEnvironment): Paths;
-export declare const paths: Paths;
-export declare const ASTRALE_HOME: string;
-export declare const KEYS_DIR: string;
-export declare const DATA_DIR: string;
-export declare const CONFIG_PATH: string;
-export declare const INSTALL_PATH: string;
-export declare const IDENTITIES_PATH: string;
-export declare const INSTANCES_PATH: string;
-export declare const IDPS_PATH: string;
-export declare const IDP_SESSIONS_DIR: string;
-export declare const EXCHANGE_CREDENTIALS_PATH: string;

package/src/__tests__/fixtures/publication.ts

@@ -1,20 +0,0 @@
-import type { schema } from '@astrale-os/sdk/schema'
-
-import { defineApplication } from '@astrale-os/sdk/application'
-import { compile } from '@astrale-os/sdk/deployment/build'
-import { addressing, assemble } from '@astrale-os/sdk/deployment/release'
-import { defineRuntime } from '@astrale-os/sdk/runtime'
-
-/** Build a canonical empty-runtime Release for cross-boundary CLI tests. */
-export function releaseFor<const Schema extends schema.DomainSchema>(
-  source: Schema,
-  issuer: string,
-) {
-  const runtime = defineRuntime<Schema>()({
-    integrations: {},
-    initialize: () => ({ providers: {} }),
-    actions: [],
-    workflows: [],
-  })
-  return assemble(compile(defineApplication({ schema: source, runtime })), addressing(issuer))
-}

package/src/admin/.spec/api.d.ts

@@ -1,3 +0,0 @@
-/** CLI-private V2 Admin adapters; no package export or duplicate control-plane semantics. */
-export * as catalog from '../catalog/.spec/api.js'
-export * as instance from '../instance/.spec/api.js'

package/src/admin/.spec/architecture.md

@@ -1,15 +0,0 @@
-# CLI Admin adapters
-
-This private aggregate translates the frozen CLI command journey into the discovered V2
-`admin.astrale.ai` contract. It binds the exact served Domain revision through Kernel Client,
-uses `GraphApi` for policy-visible inventory, and invokes receiver-oriented Methods through
-`DomainBinding`. It does not import Admin implementation code, hard-code one schema revision, call
-Host directly, or persist remote graph truth.
-
-`instance` owns create/list/status/delete/install projection and explicitly excludes the reserved
-Admin Host from consumer placement. `catalog` owns Domain inventory, publication, and default-set
-configuration. `graph` is their bounded cursor helper and is not re-exported by the aggregate.
-
-Commander grammar, help text, output shapes, bookmark behavior, and current interactive host
-selection remain owned by the existing command surface; these adapters change only its remote
-semantic owner.

package/src/admin/.spec/icon.svg

@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#7c3aed" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round">
-  <path d="M12 3 4.5 7v10L12 21l7.5-4V7z"/><path d="M8 10h8M8 14h5"/><circle cx="17" cy="16" r="2.5"/>
-</svg>

package/src/admin/.spec/layout.ts

@@ -1,6 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: ['catalog/', 'graph/', 'index.ts', 'instance/'],
-  exact: true,
-})

package/src/admin/__tests__/binding.test.ts

@@ -1,31 +0,0 @@
-import type { ClientSession } from '@astrale-os/sdk/client/session'
-
-import { bundle, defineSchema, schema as schemaApi } from '@astrale-os/sdk/schema'
-import { expect, mock, test } from 'bun:test'
-
-import { releaseFor } from '../../__tests__/fixtures/publication'
-import { bindAdmin } from '../binding'
-
-const schema = defineSchema('admin.astrale.ai', {})
-const release = releaseFor(schema, 'https://admin.beta.astrale.ai')
-
-test('binds the installed Admin Domain instead of the source Kernel publication', async () => {
-  const installation = mock(async () => ({
-    state: 'ready' as const,
-    target: 'sha256:admin-target' as const,
-    source: { kind: 'remote' as const, publication: release.publication },
-    bundle: bundle.create(schema),
-    readiness: 'sha256:admin-readiness' as const,
-    capabilities: { requested: [], materialized: [] },
-  }))
-  const session = {
-    installation,
-    bind: (domain: unknown) => ({ domain, graph: {} }),
-  } as unknown as ClientSession
-
-  const binding = await bindAdmin(session)
-
-  expect(installation).toHaveBeenCalledWith('admin.astrale.ai')
-  expect(binding.domain.origin).toBe('admin.astrale.ai')
-  expect(binding.domain.revision).toBe(schemaApi.revision(schema))
-})