@aria-cli/tools 1.0.0

package/tests/network-runtime/local-control-invite-token.contract.test.ts

@@ -0,0 +1,146 @@
+import { describe, expect, it } from "vitest";
+
+describe("invite-token local-control contracts", () => {
+  it("exports canonical invite-token schemas from the shared runtime contract layer", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(runtime.CreateInviteRequestSchema).toBeDefined();
+    expect(runtime.CreateInviteResponseSchema).toBeDefined();
+    expect(runtime.AcceptInviteTokenRequestSchema).toBeDefined();
+    expect(runtime.AcceptInviteTokenResponseSchema).toBeDefined();
+    expect(runtime.PendingInviteViewSchema).toBeDefined();
+    expect(runtime.CancelInviteRequestSchema).toBeDefined();
+    expect(runtime.CancelInviteResponseSchema).toBeDefined();
+  });
+
+  it("models token-only first-trust create, accept, and cancel payloads", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.CreateInviteRequestSchema.parse({
+        inviteLabel: "Mom laptop",
+        durationMs: 3_600_000,
+      }),
+    ).toEqual({
+      inviteLabel: "Mom laptop",
+      durationMs: 3_600_000,
+    });
+
+    expect(
+      runtime.PendingInviteViewSchema.parse({
+        inviteId: "invite-123",
+        inviteLabel: "Mom laptop",
+        createdAt: "2026-03-14T00:00:00.000Z",
+        expiresAt: "2026-03-15T00:00:00.000Z",
+      }),
+    ).toEqual({
+      inviteId: "invite-123",
+      inviteLabel: "Mom laptop",
+      createdAt: "2026-03-14T00:00:00.000Z",
+      expiresAt: "2026-03-15T00:00:00.000Z",
+    });
+
+    expect(
+      runtime.CreateInviteResponseSchema.parse({
+        inviteToken: "aria-net-v5-token",
+        pendingInvite: {
+          inviteId: "invite-123",
+          inviteLabel: "Mom laptop",
+          createdAt: "2026-03-14T00:00:00.000Z",
+          expiresAt: "2026-03-15T00:00:00.000Z",
+        },
+      }),
+    ).toEqual({
+      inviteToken: "aria-net-v5-token",
+      pendingInvite: {
+        inviteId: "invite-123",
+        inviteLabel: "Mom laptop",
+        createdAt: "2026-03-14T00:00:00.000Z",
+        expiresAt: "2026-03-15T00:00:00.000Z",
+      },
+    });
+
+    expect(
+      runtime.AcceptInviteTokenRequestSchema.parse({
+        inviteToken: "aria-net-v5-token",
+      }),
+    ).toEqual({
+      inviteToken: "aria-net-v5-token",
+    });
+
+    expect(
+      runtime.AcceptInviteTokenResponseSchema.parse({
+        success: true,
+        nodeId: "node-bravo",
+        displayNameSnapshot: "bravo-node",
+      }),
+    ).toEqual({
+      success: true,
+      nodeId: "node-bravo",
+      displayNameSnapshot: "bravo-node",
+    });
+
+    expect(
+      runtime.CancelInviteRequestSchema.parse({
+        inviteId: "invite-123",
+      }),
+    ).toEqual({
+      inviteId: "invite-123",
+    });
+
+    expect(
+      runtime.CancelInviteResponseSchema.parse({
+        cancelled: true,
+        inviteId: "invite-123",
+      }),
+    ).toEqual({
+      cancelled: true,
+      inviteId: "invite-123",
+    });
+  });
+
+  it("rejects raw remote identity fields on product-surface invite-token requests", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(
+      runtime.AcceptInviteTokenRequestSchema.safeParse({
+        inviteToken: "aria-net-v5-token",
+        nodeId: "node-remote",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.AcceptInviteTokenRequestSchema.safeParse({
+        inviteToken: "aria-net-v5-token",
+        controlEndpoint: {
+          host: "203.0.113.10",
+          port: 3000,
+          tlsCaFingerprint: "a".repeat(64),
+          tlsServerIdentity: "b".repeat(64),
+          protocolVersion: 1,
+        },
+      }).success,
+    ).toBe(false);
+
+    expect(
+      runtime.CreateInviteRequestSchema.safeParse({
+        inviteLabel: "Mom laptop",
+        displayName: "not-allowed",
+        principalFingerprint: "c".repeat(64),
+      }).success,
+    ).toBe(false);
+  });
+
+  it("adds explicit invite-token methods to the local-control socket method surface", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(runtime.LocalControlSocketMethodSchema.parse("createInvite")).toBe("createInvite");
+    expect(runtime.LocalControlSocketMethodSchema.parse("acceptInviteToken")).toBe(
+      "acceptInviteToken",
+    );
+    expect(runtime.LocalControlSocketMethodSchema.parse("listPendingInvites")).toBe(
+      "listPendingInvites",
+    );
+    expect(runtime.LocalControlSocketMethodSchema.parse("cancelInvite")).toBe("cancelInvite");
+  });
+});

package/tests/network-runtime/node-store-contract.test.ts

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+
+describe("network runtime node-store contracts", () => {
+  it("exports canonical NodeStore and runtime journal schemas from the shared runtime contract layer", async () => {
+    const runtime = await import("../../src/network-runtime/index.js");
+
+    expect(runtime.RuntimeOwnerRecordSchema).toBeDefined();
+    expect(runtime.RuntimeEventKindSchema).toBeDefined();
+    expect(runtime.RuntimeEventSchema).toBeDefined();
+  });
+});

package/tests/network-runtime/pair-protocol-nodeid.contract.test.ts

@@ -0,0 +1,15 @@
+import { describe, expectTypeOf, it } from "vitest";
+import type {
+  JoinRequest,
+  NodeId,
+  NodePrincipalBindingRef,
+  TransportInviteToken,
+} from "../../src/index.js";
+
+describe("network runtime pair protocol nodeId contract", () => {
+  it("keeps the shared pair protocol surfaces keyed by NodeId", () => {
+    expectTypeOf<TransportInviteToken["nodeId"]>().toEqualTypeOf<NodeId>();
+    expectTypeOf<JoinRequest["nodeId"]>().toEqualTypeOf<NodeId>();
+    expectTypeOf<NodePrincipalBindingRef["nodeId"]>().toEqualTypeOf<NodeId>();
+  });
+});

package/tests/network-runtime/peer-state-machine.contract.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, it } from "vitest";
+import {
+  PeerIdentityStateSchema,
+  PeerMutationKindSchema,
+  PeerStateSnapshotSchema,
+  PeerTransportStateSchema,
+  canAttemptBestEffortTransport,
+  canAttemptDurableDelivery,
+  canCommitVerifiedPair,
+  canHeartbeat,
+  canRecordPendingPair,
+  canRefreshEndpoint,
+  comparePeerMutationPrecedence,
+  derivePeerStateFromLegacyStatus,
+  isValidPeerIdentityTransition,
+} from "../../src/index.js";
+
+describe("network runtime peer state machine", () => {
+  it("exports canonical peer identity and transport states", () => {
+    expect(PeerIdentityStateSchema.options).toEqual([
+      "invited",
+      "joining",
+      "paired_unverified",
+      "verified",
+      "revoked",
+    ]);
+    expect(PeerTransportStateSchema.options).toEqual([
+      "unknown",
+      "endpoint_known",
+      "connecting",
+      "connected",
+      "degraded",
+      "disconnected",
+    ]);
+  });
+
+  it("derives shared peer state from legacy registry rows", () => {
+    expect(
+      derivePeerStateFromLegacyStatus({
+        status: "pending",
+        endpointHost: null,
+        endpointPort: null,
+        lastHandshake: null,
+      }),
+    ).toEqual({
+      identityState: "invited",
+      transportState: "unknown",
+    });
+
+    expect(
+      derivePeerStateFromLegacyStatus({
+        status: "pending_verification",
+        endpointHost: "10.0.0.2",
+        endpointPort: 51820,
+        lastHandshake: null,
+      }),
+    ).toEqual({
+      identityState: "paired_unverified",
+      transportState: "endpoint_known",
+    });
+
+    expect(
+      derivePeerStateFromLegacyStatus({
+        status: "active",
+        endpointHost: "10.0.0.3",
+        endpointPort: 51820,
+        lastHandshake: Date.now(),
+      }),
+    ).toEqual({
+      identityState: "verified",
+      transportState: "connected",
+    });
+  });
+
+  it("rejects invalid peer identity and transport combinations centrally", () => {
+    expect(() =>
+      PeerStateSnapshotSchema.parse({
+        identityState: "invited",
+        transportState: "connected",
+      }),
+    ).toThrow(/invalid peer state combination/i);
+
+    expect(() =>
+      PeerStateSnapshotSchema.parse({
+        identityState: "revoked",
+        transportState: "degraded",
+      }),
+    ).toThrow(/invalid peer state combination/i);
+
+    expect(
+      PeerStateSnapshotSchema.parse({
+        identityState: "verified",
+        transportState: "degraded",
+      }),
+    ).toEqual({
+      identityState: "verified",
+      transportState: "degraded",
+    });
+  });
+
+  it("encodes identity transition rules instead of ad hoc status promotion", () => {
+    expect(isValidPeerIdentityTransition("invited", "joining")).toBe(true);
+    expect(isValidPeerIdentityTransition("joining", "paired_unverified")).toBe(true);
+    expect(isValidPeerIdentityTransition("paired_unverified", "verified")).toBe(true);
+    expect(isValidPeerIdentityTransition("verified", "paired_unverified")).toBe(false);
+    expect(
+      isValidPeerIdentityTransition("verified", "paired_unverified", {
+        viaContinuity: true,
+      }),
+    ).toBe(true);
+    expect(isValidPeerIdentityTransition("revoked", "verified")).toBe(false);
+  });
+
+  it("centralizes capability rules", () => {
+    expect(canRecordPendingPair("invited")).toBe(true);
+    expect(canRecordPendingPair("joining")).toBe(true);
+    expect(canRecordPendingPair("verified")).toBe(false);
+
+    expect(canCommitVerifiedPair("paired_unverified", { proofValid: true })).toBe(true);
+    expect(canCommitVerifiedPair("paired_unverified", { proofValid: false })).toBe(false);
+    expect(canCommitVerifiedPair("verified", { proofValid: true })).toBe(false);
+
+    expect(canRefreshEndpoint("joining")).toBe(true);
+    expect(canRefreshEndpoint("paired_unverified")).toBe(true);
+    expect(canRefreshEndpoint("verified")).toBe(true);
+    expect(canRefreshEndpoint("invited")).toBe(false);
+    expect(canRefreshEndpoint("revoked")).toBe(false);
+
+    expect(canHeartbeat("paired_unverified")).toBe(true);
+    expect(canHeartbeat("verified")).toBe(true);
+    expect(canHeartbeat("invited")).toBe(false);
+
+    expect(canAttemptBestEffortTransport("paired_unverified", "endpoint_known")).toBe(true);
+    expect(canAttemptBestEffortTransport("verified", "degraded")).toBe(true);
+    expect(canAttemptBestEffortTransport("revoked", "connected")).toBe(false);
+
+    expect(canAttemptDurableDelivery("verified", "connected")).toBe(true);
+    expect(canAttemptDurableDelivery("verified", "degraded")).toBe(false);
+    expect(canAttemptDurableDelivery("paired_unverified", "connected")).toBe(false);
+  });
+
+  it("encodes precedence for repair, revocation, and continuity", () => {
+    expect(PeerMutationKindSchema.options).toEqual(["repair", "continuity", "revocation"]);
+    expect(comparePeerMutationPrecedence("revocation", "repair")).toBeGreaterThan(0);
+    expect(comparePeerMutationPrecedence("continuity", "repair")).toBeGreaterThan(0);
+    expect(comparePeerMutationPrecedence("repair", "revocation")).toBeLessThan(0);
+  });
+});