@aopslabs/aops 0.2.0

package/dist/commands/commercial-license.js

@@ -0,0 +1,594 @@
+import { ENTITLEMENT_LEASE_ALGORITHM, ENTITLEMENT_LEASE_PURPOSE, CommercialArtifactError, createInstallationPossessionProof, readVerifiedActiveCommercialArtifact, resolveManagedInstallationLayout, retainVerifiedEntitlementRevocationEpoch, RELEASE_MANIFEST_PURPOSE, verifyEntitlementLease, verifyInstallationPossessionProof, verifyOfflineActivationChallenge, verifyOfflineActivationResponse, } from '@aopslabs/artifact-trust-contracts';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { Command } from 'commander';
+const CONFIG_OBJECT_TYPE_V1 = 'aops-commercial-admission-config-v1';
+const CONFIG_OBJECT_TYPE_V2 = 'aops-commercial-admission-config-v2';
+const CONFIG_KEYS_V1 = Object.freeze([
+    'domain',
+    'entitlementEpoch',
+    'extensionNamespace',
+    'hostInstanceId',
+    'installationId',
+    'issuer',
+    'leaseFile',
+    'leaseMode',
+    'leaseTrustBundle',
+    'minimumRevocationEpoch',
+    'objectType',
+    'productId',
+    'releaseTrustBundle',
+    'schemaVersion',
+    'storeRoot',
+    'tenantId',
+    'target',
+]);
+const CONFIG_KEYS_V2 = Object.freeze([
+    ...CONFIG_KEYS_V1,
+    'activationChallengeDigest',
+    'installationKeyThumbprint',
+    'installationPrivateKeyFile',
+]);
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+function commercialIntegrityReadOptions(storeRoot) {
+    const layout = resolveManagedInstallationLayout();
+    if (path.resolve(storeRoot) !== path.resolve(layout.storeRoot)) {
+        return Object.freeze({ verificationMode: 'full' });
+    }
+    return Object.freeze({
+        integrityStateRoot: layout.stateRoot,
+        verificationMode: 'routine',
+    });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, expected, reason) {
+    const actual = Object.keys(value).sort();
+    const sorted = [...expected].sort();
+    if (actual.length !== sorted.length || actual.some((key, index) => key !== sorted[index])) {
+        throw new Error(reason);
+    }
+}
+function configPath(options) {
+    return path.resolve(options.config?.trim() ||
+        process.env.AOPS_COMMERCIAL_ADMISSION_CONFIG?.trim() ||
+        path.join(os.homedir(), '.aops', 'commercial-admission.json'));
+}
+function safeFile(filePath, reason) {
+    if (!path.isAbsolute(filePath))
+        throw new Error(reason);
+    const stat = lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error(reason);
+    return realpathSync.native(filePath);
+}
+function parseJsonFile(filePath, reason) {
+    try {
+        return JSON.parse(readFileSync(safeFile(filePath, reason), 'utf8'));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === reason)
+            throw error;
+        throw new Error(reason);
+    }
+}
+export function parseReleaseTrustBundleFile(filePath) {
+    const value = parseJsonFile(filePath, 'release_trust_bundle_invalid');
+    if (!isRecord(value))
+        throw new Error('release_trust_bundle_invalid');
+    exactKeys(value, ['schemaVersion', 'objectType', 'purpose', 'keys'], 'release_trust_bundle_invalid');
+    if (value.schemaVersion !== 1 ||
+        value.objectType !== 'aops-release-trust-bundle-v1' ||
+        value.purpose !== RELEASE_MANIFEST_PURPOSE ||
+        !Array.isArray(value.keys) ||
+        value.keys.length === 0)
+        throw new Error('release_trust_bundle_invalid');
+    return Object.freeze(value.keys.map((candidate) => {
+        if (!isRecord(candidate))
+            throw new Error('release_trust_bundle_invalid');
+        const actualKeys = Object.keys(candidate).sort();
+        const legacyKeys = ['alg', 'kid', 'publicKeyPem', 'purpose'];
+        const rotatingKeys = [
+            'alg', 'kid', 'notAfter', 'notBefore', 'publicKeyPem', 'purpose', 'status',
+        ];
+        const rotating = actualKeys.length === rotatingKeys.length &&
+            actualKeys.every((key, index) => key === rotatingKeys[index]);
+        if (!rotating &&
+            (actualKeys.length !== legacyKeys.length ||
+                actualKeys.some((key, index) => key !== legacyKeys[index])))
+            throw new Error('release_trust_bundle_invalid');
+        if (candidate.alg !== 'EdDSA' ||
+            candidate.purpose !== RELEASE_MANIFEST_PURPOSE ||
+            typeof candidate.kid !== 'string' ||
+            typeof candidate.publicKeyPem !== 'string' ||
+            (rotating &&
+                !['active', 'verify-only', 'retired', 'revoked'].includes(String(candidate.status))) ||
+            (rotating &&
+                candidate.notBefore !== null &&
+                typeof candidate.notBefore !== 'string') ||
+            (rotating &&
+                candidate.notAfter !== null &&
+                typeof candidate.notAfter !== 'string'))
+            throw new Error('release_trust_bundle_invalid');
+        if (candidate.kid.toLowerCase().includes('test-ephemeral')) {
+            throw new Error('release_trust_test_key_refused');
+        }
+        return Object.freeze({
+            alg: 'EdDSA',
+            purpose: RELEASE_MANIFEST_PURPOSE,
+            kid: candidate.kid,
+            publicKeyPem: candidate.publicKeyPem,
+            ...(rotating ? {
+                status: candidate.status,
+                ...(candidate.notBefore === null
+                    ? {}
+                    : { notBefore: candidate.notBefore }),
+                ...(candidate.notAfter === null
+                    ? {}
+                    : { notAfter: candidate.notAfter }),
+            } : {}),
+        });
+    }));
+}
+export function parseLeaseTrustBundleFile(filePath) {
+    const value = parseJsonFile(filePath, 'lease_trust_bundle_invalid');
+    if (!isRecord(value))
+        throw new Error('lease_trust_bundle_invalid');
+    exactKeys(value, ['schemaVersion', 'objectType', 'purpose', 'keys'], 'lease_trust_bundle_invalid');
+    if (value.schemaVersion !== 1 ||
+        value.objectType !== 'aops-entitlement-lease-trust-bundle-v1' ||
+        value.purpose !== ENTITLEMENT_LEASE_PURPOSE ||
+        !Array.isArray(value.keys) ||
+        value.keys.length === 0)
+        throw new Error('lease_trust_bundle_invalid');
+    return Object.freeze(value.keys.map((candidate) => {
+        if (!isRecord(candidate))
+            throw new Error('lease_trust_bundle_invalid');
+        exactKeys(candidate, ['alg', 'kid', 'notAfter', 'notBefore', 'publicKeyPem', 'purpose', 'status'], 'lease_trust_bundle_invalid');
+        if (candidate.alg !== ENTITLEMENT_LEASE_ALGORITHM ||
+            candidate.purpose !== ENTITLEMENT_LEASE_PURPOSE ||
+            typeof candidate.kid !== 'string' ||
+            typeof candidate.publicKeyPem !== 'string' ||
+            (candidate.status !== 'active' && candidate.status !== 'verify-only') ||
+            (candidate.notBefore !== null && typeof candidate.notBefore !== 'string') ||
+            (candidate.notAfter !== null && typeof candidate.notAfter !== 'string'))
+            throw new Error('lease_trust_bundle_invalid');
+        return Object.freeze({
+            alg: ENTITLEMENT_LEASE_ALGORITHM,
+            purpose: ENTITLEMENT_LEASE_PURPOSE,
+            kid: candidate.kid,
+            publicKeyPem: candidate.publicKeyPem,
+            status: candidate.status,
+            ...(candidate.notBefore === null ? {} : { notBefore: candidate.notBefore }),
+            ...(candidate.notAfter === null ? {} : { notAfter: candidate.notAfter }),
+        });
+    }));
+}
+function integer(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+        throw new Error('commercial_license_epoch_invalid');
+    return parsed;
+}
+function digestHex(value, reason) {
+    const normalized = value.startsWith('sha256:') ? value.slice('sha256:'.length) : value;
+    if (!SHA256_HEX.test(normalized))
+        throw new Error(reason);
+    return normalized;
+}
+function parseConfig(value) {
+    if (!isRecord(value))
+        throw new Error('commercial_admission_config_invalid');
+    if ((value.schemaVersion !== 1 && value.schemaVersion !== 2) ||
+        value.objectType !== (value.schemaVersion === 1 ? CONFIG_OBJECT_TYPE_V1 : CONFIG_OBJECT_TYPE_V2)) {
+        throw new Error('commercial_admission_config_invalid');
+    }
+    exactKeys(value, value.schemaVersion === 1 ? CONFIG_KEYS_V1 : CONFIG_KEYS_V2, 'commercial_admission_config_invalid');
+    return value;
+}
+function verifyConfig(config, now = new Date(), activationChallengeToken, requireRetainedRevocationEpoch = false, persistRevocationEpoch = false) {
+    const requiredText = (key) => {
+        const value = config[key];
+        if (typeof value !== 'string' || value !== value.trim() || value.length === 0) {
+            throw new Error('commercial_admission_config_invalid');
+        }
+        return value;
+    };
+    const domain = requiredText('domain').toLowerCase();
+    const productId = requiredText('productId');
+    const selectedStoreRoot = requiredText('storeRoot');
+    const active = readVerifiedActiveCommercialArtifact({
+        storeRoot: selectedStoreRoot,
+        ...commercialIntegrityReadOptions(selectedStoreRoot),
+        trustKeys: parseReleaseTrustBundleFile(requiredText('releaseTrustBundle')),
+        now,
+        expectedIdentity: {
+            installationId: requiredText('installationId'),
+            hostInstanceId: requiredText('hostInstanceId'),
+        },
+    });
+    if (!active)
+        throw new Error('commercial_artifact_not_active');
+    const extension = active.manifest.envelope.payload.extensions[requiredText('extensionNamespace')];
+    if (!isRecord(extension) ||
+        extension.releaseTier !== 'commercial' ||
+        !Array.isArray(extension.productIds) ||
+        !extension.productIds.includes(productId) ||
+        !Array.isArray(extension.operationFeatures))
+        throw new Error('commercial_release_extension_invalid');
+    const token = readFileSync(safeFile(requiredText('leaseFile'), 'entitlement_lease_file_invalid'), 'utf8').trim();
+    const entitlementEpoch = config.entitlementEpoch;
+    const minimumRevocationEpoch = config.minimumRevocationEpoch;
+    const leaseMode = config.leaseMode;
+    const schemaVersion = config.schemaVersion;
+    if ((schemaVersion !== 1 && schemaVersion !== 2) ||
+        (entitlementEpoch !== null && (!Number.isSafeInteger(entitlementEpoch) || Number(entitlementEpoch) < 0)) ||
+        (minimumRevocationEpoch !== null &&
+            (!Number.isSafeInteger(minimumRevocationEpoch) || Number(minimumRevocationEpoch) < 0)) ||
+        (leaseMode !== null && leaseMode !== 'online' && leaseMode !== 'offline'))
+        throw new Error('commercial_admission_config_invalid');
+    if (schemaVersion === 2 && leaseMode !== 'offline') {
+        throw new Error('commercial_admission_config_invalid');
+    }
+    const activationChallengeDigest = schemaVersion === 2
+        ? requiredText('activationChallengeDigest')
+        : null;
+    const installationKeyThumbprint = schemaVersion === 2
+        ? requiredText('installationKeyThumbprint')
+        : null;
+    const installationPrivateKeyFile = schemaVersion === 2
+        ? requiredText('installationPrivateKeyFile')
+        : null;
+    if ((activationChallengeDigest !== null && !SHA256_HEX.test(activationChallengeDigest)) ||
+        (installationKeyThumbprint !== null && !SHA256_HEX.test(installationKeyThumbprint)))
+        throw new Error('commercial_admission_config_invalid');
+    const lease = verifyEntitlementLease({
+        token,
+        trustKeys: parseLeaseTrustBundleFile(requiredText('leaseTrustBundle')),
+        issuer: requiredText('issuer'),
+        now,
+        expected: {
+            tenantId: requiredText('tenantId'),
+            installationId: requiredText('installationId'),
+            productId,
+            domain,
+            manifestDigest: active.manifest.manifestDigest,
+            closureDigest: active.receipt.closureDigest,
+            ...(entitlementEpoch === null ? {} : { entitlementEpoch: Number(entitlementEpoch) }),
+            ...(minimumRevocationEpoch === null ? {} : {
+                minimumRevocationEpoch: Number(minimumRevocationEpoch),
+            }),
+            ...(leaseMode === null ? {} : { leaseMode }),
+            ...(installationKeyThumbprint === null ? {} : { installationKeyThumbprint }),
+            ...(activationChallengeDigest === null ? {} : { activationChallengeDigest }),
+        },
+    });
+    retainVerifiedEntitlementRevocationEpoch({
+        storeRoot: requiredText('storeRoot'),
+        hostInstanceId: requiredText('hostInstanceId'),
+        lease,
+        requireExisting: requireRetainedRevocationEpoch,
+        persist: persistRevocationEpoch,
+    });
+    if (schemaVersion === 2) {
+        if (lease.claims.schemaVersion !== 2 ||
+            activationChallengeDigest === null ||
+            installationKeyThumbprint === null ||
+            installationPrivateKeyFile === null)
+            throw new Error('commercial_installation_possession_invalid');
+        if (activationChallengeToken !== undefined) {
+            const activation = verifyOfflineActivationResponse({
+                response: {
+                    schemaVersion: 1,
+                    objectType: 'aops-offline-activation-response',
+                    challengeDigest: activationChallengeDigest,
+                    lease: token,
+                },
+                challengeToken: activationChallengeToken,
+                leaseTrustKeys: parseLeaseTrustBundleFile(requiredText('leaseTrustBundle')),
+                issuer: requiredText('issuer'),
+                now,
+                expected: {
+                    domain,
+                    ...(entitlementEpoch === null ? {} : {
+                        entitlementEpoch: Number(entitlementEpoch),
+                    }),
+                    ...(minimumRevocationEpoch === null ? {} : {
+                        minimumRevocationEpoch: Number(minimumRevocationEpoch),
+                    }),
+                },
+            });
+            if (activation.challenge.payload.hostInstanceId !== requiredText('hostInstanceId')) {
+                throw new Error('commercial_installation_possession_invalid');
+            }
+        }
+        const nonce = randomBytes(32).toString('base64url');
+        const iat = Math.floor(now.getTime() / 1000);
+        const privateKeyPem = readFileSync(safeFile(installationPrivateKeyFile, 'commercial_installation_private_key_invalid'), 'utf8');
+        const receiptBinding = {
+            receiptId: active.receipt.receiptId,
+            releaseId: active.receipt.releaseId,
+            manifestDigest: digestHex(active.receipt.manifestDigest, 'commercial_installation_possession_invalid'),
+            closureDigest: digestHex(active.receipt.closureDigest, 'commercial_installation_possession_invalid'),
+        };
+        const proof = createInstallationPossessionProof({
+            privateKeyPem,
+            proofId: randomUUID(),
+            nonce,
+            installationId: requiredText('installationId'),
+            hostInstanceId: requiredText('hostInstanceId'),
+            leaseToken: token,
+            activationChallengeDigest,
+            receiptBinding,
+            iat,
+            exp: iat + 2 * 60,
+        });
+        verifyInstallationPossessionProof({
+            token: proof.token,
+            now,
+            expected: {
+                nonce,
+                installationId: requiredText('installationId'),
+                hostInstanceId: requiredText('hostInstanceId'),
+                installationKeyThumbprint,
+                leaseToken: token,
+                activationChallengeDigest,
+                ...receiptBinding,
+            },
+        });
+    }
+    return {
+        active,
+        lease,
+        domain,
+        productId,
+        target: requiredText('target'),
+    };
+}
+function print(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function licenseDiagnostic(error) {
+    if (error instanceof CommercialArtifactError) {
+        return Object.freeze({
+            stage: error.stage,
+            decision: error.decision,
+            reason: error.reason,
+            next: error.decision === 'quarantine'
+                ? 'Reinstall a trusted artifact candidate, then run aops license status.'
+                : 'Repair the verified artifact evidence, then run aops license status.',
+        });
+    }
+    const reason = error instanceof Error ? error.message : String(error);
+    if (reason.startsWith('lease-') || reason.includes('lease_') || reason.includes('entitlement_')) {
+        return Object.freeze({
+            stage: 'entitlement-lease',
+            decision: 'deny',
+            reason,
+            next: 'Obtain a current lease for the selected target, then run aops license activate.',
+        });
+    }
+    if (reason.includes('trust_bundle')) {
+        return Object.freeze({
+            stage: 'trust-bundle',
+            decision: 'deny',
+            reason,
+            next: 'Repair the host-pinned trust bundle, then run aops license status.',
+        });
+    }
+    if (reason.includes('artifact') || reason.includes('release_extension')) {
+        return Object.freeze({
+            stage: 'commercial-artifact',
+            decision: 'deny',
+            reason,
+            next: 'Install a verified compatible artifact, then run aops license status.',
+        });
+    }
+    return Object.freeze({
+        stage: 'configuration',
+        decision: 'deny',
+        reason,
+        next: 'Run aops license activate --help and repair the user-owned admission config.',
+    });
+}
+function handleError(error) {
+    const diagnostic = licenseDiagnostic(error);
+    print({
+        ok: false,
+        schemaVersion: 1,
+        contract: 'aops-license-error-v1',
+        action: 'commercial-license',
+        stage: diagnostic.stage,
+        decision: diagnostic.decision,
+        reason: diagnostic.reason,
+        next: diagnostic.next,
+    });
+    process.exitCode = 1;
+}
+export function runCommercialLicenseStatus(options = {}) {
+    const target = configPath(options);
+    if (!existsSync(target)) {
+        print({
+            ok: true,
+            schemaVersion: 1,
+            contract: 'aops-license-status-v1',
+            action: 'commercial-license.status',
+            state: 'community-free',
+            commercialConfigured: false,
+            config: target,
+            next: 'aops license activate --help',
+        });
+        return;
+    }
+    try {
+        const verified = verifyConfig(parseConfig(parseJsonFile(target, 'commercial_admission_config_invalid')), new Date(), undefined, true, false);
+        print({
+            ok: true,
+            schemaVersion: 1,
+            contract: 'aops-license-status-v1',
+            action: 'commercial-license.status',
+            state: verified.lease.mode,
+            commercialConfigured: true,
+            config: target,
+            target: verified.target,
+            domain: verified.domain,
+            productId: verified.productId,
+            releaseId: verified.active.receipt.releaseId,
+            manifestDigest: verified.active.manifest.manifestDigest,
+            leaseId: verified.lease.claims.jti,
+            entitlementEpoch: verified.lease.claims.entitlementEpoch,
+            revocationEpoch: verified.lease.claims.revocationEpoch,
+            refreshDue: verified.lease.refreshDue,
+            refreshAfter: verified.lease.claims.refreshAfter,
+            fullUntil: verified.lease.claims.fullUntil,
+            expiresAt: verified.lease.claims.exp,
+            next: verified.lease.mode === 'degraded' || verified.lease.refreshDue
+                ? 'Obtain a refreshed lease for the selected target.'
+                : 'No action required.',
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function runCommercialLicenseActivate(options) {
+    try {
+        const target = configPath(options);
+        const existingConfig = existsSync(target);
+        if (existingConfig) {
+            const stat = lstatSync(target);
+            if (stat.isSymbolicLink() || !stat.isFile()) {
+                throw new Error('commercial_admission_config_unsafe');
+            }
+        }
+        const domain = options.domain.trim().toLowerCase();
+        const leaseMode = options.leaseMode ?? null;
+        const offline = leaseMode === 'offline';
+        if ((offline && (!options.activationChallengeFile || !options.installationPrivateKeyFile)) ||
+            (!offline && (options.activationChallengeFile || options.installationPrivateKeyFile)))
+            throw new Error('commercial_offline_activation_evidence_required');
+        const tenantId = options.tenantId.trim();
+        const installationId = options.installationId.trim();
+        const hostInstanceId = options.hostInstanceId.trim();
+        const productId = options.productId.trim();
+        let activationChallengeToken;
+        let activationChallengeDigest;
+        let installationKeyThumbprint;
+        let installationPrivateKeyFile;
+        if (offline) {
+            const challengeFile = safeFile(path.resolve(options.activationChallengeFile), 'offline_activation_challenge_file_invalid');
+            activationChallengeToken = readFileSync(challengeFile, 'utf8').trim();
+            const challenge = verifyOfflineActivationChallenge({
+                token: activationChallengeToken,
+                expected: { tenantId, productId },
+            });
+            if (challenge.payload.installationId !== installationId ||
+                challenge.payload.hostInstanceId !== hostInstanceId)
+                throw new Error('commercial_installation_possession_invalid');
+            activationChallengeDigest = challenge.challengeDigest;
+            installationKeyThumbprint = challenge.installationKeyThumbprint;
+            installationPrivateKeyFile = safeFile(path.resolve(options.installationPrivateKeyFile), 'commercial_installation_private_key_invalid');
+        }
+        const commonConfig = Object.freeze({
+            target: options.target.trim(),
+            storeRoot: path.resolve(options.storeRoot),
+            releaseTrustBundle: safeFile(path.resolve(options.releaseTrustBundle), 'release_trust_bundle_invalid'),
+            leaseFile: safeFile(path.resolve(options.leaseFile), 'entitlement_lease_file_invalid'),
+            leaseTrustBundle: safeFile(path.resolve(options.leaseTrustBundle), 'lease_trust_bundle_invalid'),
+            issuer: options.issuer.trim(),
+            tenantId,
+            installationId,
+            hostInstanceId,
+            productId,
+            domain,
+            extensionNamespace: options.extensionNamespace?.trim() || `com.aopslab.${domain}`,
+            entitlementEpoch: integer(options.entitlementEpoch, null),
+            minimumRevocationEpoch: integer(options.minimumRevocationEpoch, 0),
+            leaseMode,
+        });
+        const config = Object.freeze(offline
+            ? {
+                schemaVersion: 2,
+                objectType: CONFIG_OBJECT_TYPE_V2,
+                ...commonConfig,
+                activationChallengeDigest,
+                installationKeyThumbprint,
+                installationPrivateKeyFile,
+            }
+            : {
+                schemaVersion: 1,
+                objectType: CONFIG_OBJECT_TYPE_V1,
+                ...commonConfig,
+            });
+        const verified = verifyConfig(config, new Date(), activationChallengeToken, existingConfig, true);
+        const parent = path.dirname(target);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const temporary = path.join(parent, `.commercial-admission-${randomUUID()}.tmp`);
+        writeFileSync(temporary, `${JSON.stringify(config, null, 2)}\n`, {
+            flag: 'wx',
+            mode: 0o600,
+        });
+        renameSync(temporary, target);
+        chmodSync(target, 0o600);
+        print({
+            ok: true,
+            schemaVersion: 1,
+            contract: 'aops-license-activate-v1',
+            action: 'commercial-license.activate',
+            decision: 'configured',
+            config: target,
+            target: verified.target,
+            domain: verified.domain,
+            productId: verified.productId,
+            state: verified.lease.mode,
+            expiresAt: verified.lease.claims.exp,
+            next: [
+                `Set AOPS_COMMERCIAL_ADMISSION_CONFIG to ${target}`,
+                'Restart AOPS Server',
+                'Run aops license status',
+            ],
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function makeCommercialLicenseCommand() {
+    const command = new Command('license')
+        .description('Verify and configure commercial domain admission without placing lease tokens in argv');
+    command
+        .command('status')
+        .description('Re-verify configured release, CAS receipt, and entitlement lease')
+        .option('--config <path>', 'User-owned commercial admission config')
+        .option('--json', 'Print JSON output')
+        .action((options) => runCommercialLicenseStatus(options));
+    command
+        .command('activate')
+        .description('Verify external evidence and atomically write a user-owned admission config')
+        .option('--config <path>', 'User-owned commercial admission config')
+        .requiredOption('--store-root <path>', 'Host-owned commercial artifact store')
+        .requiredOption('--target <name>', 'Selected remote licensing target binding')
+        .requiredOption('--release-trust-bundle <path>', 'Host-pinned release trust bundle')
+        .requiredOption('--lease-file <path>', 'Lease token file; token values are refused on argv')
+        .requiredOption('--lease-trust-bundle <path>', 'Host-pinned lease trust bundle')
+        .requiredOption('--issuer <issuer>', 'Expected lease issuer')
+        .requiredOption('--tenant-id <id>', 'Expected tenant identity')
+        .requiredOption('--installation-id <id>', 'Expected installation identity')
+        .requiredOption('--host-instance-id <id>', 'Expected host instance identity')
+        .requiredOption('--product-id <id>', 'Expected commercial product')
+        .requiredOption('--domain <id>', 'Commercial domain id')
+        .option('--activation-challenge-file <path>', 'Offline only: installation-signed challenge file used to bind the lease')
+        .option('--installation-private-key-file <path>', 'Offline only: user-owned Ed25519 private key file; key bytes never enter argv/config')
+        .option('--extension-namespace <namespace>', 'Signed release extension namespace')
+        .option('--entitlement-epoch <epoch>', 'Require one exact entitlement epoch')
+        .option('--minimum-revocation-epoch <epoch>', 'Minimum accepted revocation epoch', '0')
+        .option('--lease-mode <mode>', 'Require online or offline lease mode')
+        .option('--json', 'Print JSON output')
+        .action((options) => runCommercialLicenseActivate(options));
+    return command;
+}

package/dist/commands/community-auth.js

@@ -0,0 +1,62 @@
+import { Command } from 'commander';
+import { runAuthLogin, runAuthLogout, runAuthStatus } from './auth/login.js';
+import { runLegacyAuthExport } from './auth/legacy-export.js';
+const SECRET_ARGV = new Set([
+    '--password',
+    '--access-token',
+    '--refresh-token',
+    '--admin-key',
+    '--repo-url',
+    '--pg-url',
+    '--webhook-secret',
+    '--jwt-secret',
+    '--jwt-enc-secret',
+]);
+export function guardCommunitySecretArgv(argv) {
+    for (const token of argv.slice(2)) {
+        const flag = token.split('=', 1)[0]?.toLowerCase();
+        if (SECRET_ARGV.has(flag)) {
+            throw new Error(`community_secret_argv_refused:${flag}:use_interactive_prompt_secure_store_or_environment`);
+        }
+    }
+}
+export function makeCommunityAuthCommand() {
+    const command = new Command('auth').description('Authenticate the CLI to a named remote-session target');
+    command.command('login')
+        .description('Login with browser approval and store target-bound encrypted tokens')
+        .option('--target <name>', 'Named target; default is the active target')
+        .option('--api-base-url <url>', 'Server URL; must match --target when both are supplied')
+        .option('--timeout-ms <ms>', 'Request timeout', (value) => Number.parseInt(value, 10))
+        .option('--yes', 'Non-interactive mode; combine with --browser for browser-approved headless login')
+        .option('--browser', 'Open the same-origin approval page and wait headlessly')
+        .option('--json', 'Output JSON')
+        .action(runAuthLogin);
+    command.command('logout')
+        .description('Revoke the remote session, then remove encrypted credentials for one target')
+        .option('--target <name>', 'Named target; default is the active target')
+        .option('--timeout-ms <ms>', 'Request timeout', (value) => Number.parseInt(value, 10))
+        .option('--local-only', 'Skip remote revocation and explicitly clear only local credentials')
+        .option('--json', 'Output JSON')
+        .action(runAuthLogout);
+    command.command('status')
+        .description('Verify the selected target and current authenticated principal')
+        .option('--target <name>', 'Named target; default is the active target')
+        .option('--timeout-ms <ms>', 'Request timeout', (value) => Number.parseInt(value, 10))
+        .option('--json', 'Output JSON')
+        .action(runAuthStatus);
+    command.command('legacy-export')
+        .description('Export historical local identity/tenant/role metadata without credentials')
+        .option('--env-path <path>', 'Private server env containing AOPS_PG_URL')
+        .option('--out <path>', 'New private output file; never overwrites an existing file')
+        .option('--apply', 'Write --out; without --out the deterministic export is printed')
+        .option('--confirm', 'Confirm the explicit historical metadata export')
+        .option('--json', 'Return a JSON write receipt when --out is used')
+        .addHelpText('after', `
+The old Community AuthV2 tables remain untouched and read-only. Password
+hashes, refresh/session/token rows, verification secrets, and email action
+tokens are never exported. Every migrated user must authenticate again through
+the remote-session device flow.
+`)
+        .action(runLegacyAuthExport);
+    return command;
+}