@aria-cli/tools 1.0.0

package/tests/network-runtime/protocol-schemas.contract.test.ts

@@ -0,0 +1,512 @@
+import { describe, expect, it } from "vitest";
+import * as runtimeContracts from "../../src/index.js";
+import {
+  NETWORK_RUNTIME_PROTOCOL_VERSION,
+  DeliveryAckSchema,
+  MutationEnvelopeSchema,
+  PairProposalSchema,
+  PrincipalFingerprintSchema,
+  TransportInviteTokenSchema,
+  RuntimeIngressEnvelopeSchema,
+  RuntimeNodeAdvertisementSchema,
+  RuntimeRegisterRequestSchema,
+  SignedContinuityBindSchema,
+  TlsCaFingerprintSchema,
+  assertSupportedNetworkRuntimeProtocolVersion,
+} from "../../src/index.js";
+import { AcceptInviteRequestSchema } from "../../src/network-runtime/pair-route-contract.js";
+
+const nodeAPrincipalFingerprint = PrincipalFingerprintSchema.parse("a".repeat(64));
+const nodeBPrincipalFingerprint = PrincipalFingerprintSchema.parse("b".repeat(64));
+const pinnedTlsCaFingerprint = TlsCaFingerprintSchema.parse("c".repeat(64));
+
+describe("network runtime protocol schemas", () => {
+  it("exports canonical shared schemas plus a fail-closed version gate", () => {
+    expect(
+      assertSupportedNetworkRuntimeProtocolVersion(NETWORK_RUNTIME_PROTOCOL_VERSION, "join"),
+    ).toBe(NETWORK_RUNTIME_PROTOCOL_VERSION);
+    expect(() => assertSupportedNetworkRuntimeProtocolVersion(0, "join")).toThrow(
+      /Unsupported join protocol version 0/i,
+    );
+    expect(() => assertSupportedNetworkRuntimeProtocolVersion(2, "join")).toThrow(/Supported: 1/i);
+  });
+
+  it("parses canonical runtime protocol shapes and rejects ambiguous legacy fields", () => {
+    const joinRequestSchema = (
+      runtimeContracts as { JoinRequestSchema?: { parse: Function; safeParse: Function } }
+    ).JoinRequestSchema;
+    expect(joinRequestSchema).toBeDefined();
+
+    const deliveryAck = DeliveryAckSchema.parse({
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      messageId: "msg-1",
+      senderNodeId: "node-a",
+      recipientNodeId: "node-b",
+      storedAt: 123,
+    });
+
+    expect(
+      DeliveryAckSchema.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        messageId: "msg-legacy",
+        senderNodeId: "node-a",
+        recipientName: "runtime-b",
+        storedAt: 123,
+      }).success,
+    ).toBe(false);
+
+    expect(
+      RuntimeIngressEnvelopeSchema.parse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        deliveryAck,
+      }),
+    ).toEqual({
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      deliveryAck,
+    });
+
+    expect(
+      RuntimeNodeAdvertisementSchema.parse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        publicationRevision: 7,
+        nodeId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        signingPublicKey: "signing-a",
+        transportPublicKey: "transport-a",
+        transportEndpoint: {
+          host: "127.0.0.1",
+          port: 51820,
+        },
+        controlEndpoint: {
+          host: "127.0.0.1",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: nodeAPrincipalFingerprint,
+          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        },
+      }),
+    ).toMatchObject({
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      publicationRevision: 7,
+      nodeId: "node-a",
+      principalFingerprint: nodeAPrincipalFingerprint,
+      signingPublicKey: "signing-a",
+      transportPublicKey: "transport-a",
+    });
+    expect(
+      RuntimeNodeAdvertisementSchema.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        publicationRevision: 7,
+        nodeId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        transportPublicKey: "transport-a",
+        controlEndpoint: {
+          host: "127.0.0.1",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: nodeAPrincipalFingerprint,
+          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        },
+      }).success,
+    ).toBe(false);
+
+    const transportInvite = TransportInviteTokenSchema.parse({
+      nodeId: "node-a",
+      audienceNodeId: "node-b",
+      publicKey: "transport-a",
+      host: "127.0.0.1",
+      port: 51820,
+      controlEndpoint: {
+        host: "127.0.0.1",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: nodeAPrincipalFingerprint,
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      },
+      psk: "psk-a",
+      displayNameSnapshot: "Alpha",
+      signingPublicKey: "principal-a",
+      createdAt: 123,
+      expiresAt: 456,
+      tokenNonce: "nonce-a",
+    });
+
+    expect(transportInvite).toMatchObject({
+      nodeId: "node-a",
+      audienceNodeId: "node-b",
+      publicKey: "transport-a",
+    });
+    expect(
+      TransportInviteTokenSchema.safeParse({
+        nodeId: "node-a",
+        peerId: "node-a",
+        publicKey: "transport-a",
+        host: "127.0.0.1",
+        port: 51820,
+        psk: "psk-a",
+        displayNameSnapshot: "Alpha",
+        createdAt: 123,
+        expiresAt: 456,
+        tokenNonce: "nonce-a",
+      }).success,
+    ).toBe(false);
+
+    const joinRequest = joinRequestSchema!.parse({
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      nodeId: "node-a",
+      principalFingerprint: nodeAPrincipalFingerprint,
+      peerPublicKey: "transport-a",
+      signingPublicKey: "principal-a",
+      transportEndpoint: {
+        host: "127.0.0.1",
+        port: 51820,
+      },
+      controlEndpoint: {
+        host: "127.0.0.1",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: nodeAPrincipalFingerprint,
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      },
+      displayNameSnapshot: "Alpha",
+      inviteTokenNonce: "nonce-a",
+    });
+
+    expect(
+      RuntimeIngressEnvelopeSchema.parse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        joinRequest,
+      }),
+    ).toEqual({
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      joinRequest,
+    });
+
+    expect(
+      joinRequestSchema!.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        nodeId: "node-a",
+        peerPublicKey: "transport-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        signingPublicKey: "principal-a",
+        transportEndpoint: {
+          host: "127.0.0.1",
+          port: 51820,
+        },
+        displayNameSnapshot: "Alpha",
+        inviteTokenNonce: "nonce-a",
+      }).success,
+    ).toBe(true);
+
+    expect(
+      joinRequestSchema!.safeParse({
+        protocolVersion: 2,
+        nodeId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        peerPublicKey: "transport-a",
+        signingPublicKey: "principal-a",
+        transportEndpoint: {
+          host: "127.0.0.1",
+          port: 51820,
+        },
+        displayNameSnapshot: "Alpha",
+        inviteTokenNonce: "nonce-a",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      joinRequestSchema!.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        peerId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        peerPublicKey: "transport-a",
+        signingPublicKey: "principal-a",
+        transportEndpoint: {
+          host: "127.0.0.1",
+          port: 51820,
+        },
+        displayNameSnapshot: "Alpha",
+        inviteTokenNonce: "nonce-a",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      joinRequestSchema!.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        nodeId: "node-a",
+        peerPublicKey: "transport-a",
+        signingPublicKey: "principal-a",
+        transportEndpoint: {
+          host: "127.0.0.1",
+          port: 51820,
+        },
+        displayNameSnapshot: "Alpha",
+        inviteTokenNonce: "nonce-a",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      TransportInviteTokenSchema.safeParse({
+        nodeId: "node-a",
+        publicKey: "transport-a",
+        host: "127.0.0.1",
+        port: 51820,
+        psk: "psk-a",
+        displayNameSnapshot: "Alpha",
+        createdAt: 1,
+        expiresAt: 2,
+        tokenNonce: "nonce-a",
+      }).success,
+    ).toBe(true);
+    expect(
+      TransportInviteTokenSchema.safeParse({
+        nodeId: "node-a",
+        peerId: "node-a",
+        publicKey: "transport-a",
+        host: "127.0.0.1",
+        port: 51820,
+        psk: "psk-a",
+        displayNameSnapshot: "Alpha",
+        createdAt: 1,
+        expiresAt: 2,
+        tokenNonce: "nonce-a",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      RuntimeRegisterRequestSchema.parse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        nodeId: "node-a",
+        transportPublicKey: "transport-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        endpointRevision: 4,
+        controlEndpoint: {
+          host: "127.0.0.1",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: nodeAPrincipalFingerprint,
+          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        },
+      }),
+    ).toMatchObject({
+      nodeId: "node-a",
+      endpointRevision: 4,
+    });
+    expect(
+      RuntimeRegisterRequestSchema.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        peerId: "node-a",
+        transportPublicKey: "transport-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        endpointRevision: 4,
+      }).success,
+    ).toBe(false);
+
+    expect(
+      PairProposalSchema.parse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        nodeId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        transportPublicKey: "transport-a",
+        presharedKey: "psk-a",
+        controlEndpoint: {
+          host: "127.0.0.1",
+          port: 58291,
+          tlsCaFingerprint: pinnedTlsCaFingerprint,
+          tlsServerIdentity: nodeAPrincipalFingerprint,
+          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        },
+      }),
+    ).toMatchObject({
+      nodeId: "node-a",
+    });
+
+    expect(
+      PairProposalSchema.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        nodeId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        transportPublicKey: "transport-a",
+        presharedKey: "psk-a",
+        ["message" + "Port"]: 58291,
+      }).success,
+    ).toBe(false);
+    expect(
+      PairProposalSchema.safeParse({
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        peerId: "node-a",
+        principalFingerprint: nodeAPrincipalFingerprint,
+        transportPublicKey: "transport-a",
+        presharedKey: "psk-a",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      SignedContinuityBindSchema.parse({
+        statement: {
+          nodeId: "node-a",
+          previousPrincipalFingerprint: nodeAPrincipalFingerprint,
+          newPrincipalFingerprint: nodeBPrincipalFingerprint,
+          newTransportPublicKey: "transport-b",
+          bindingGeneration: 3,
+          revocationGeneration: 1,
+          createdAt: "2026-03-11T00:00:00Z",
+        },
+        delegationSignature: "sig-a",
+        acceptanceSignature: "sig-b",
+        previousPublicKey: "old-public-key",
+        newPublicKey: "new-public-key",
+      }),
+    ).toMatchObject({
+      statement: {
+        nodeId: "node-a",
+        bindingGeneration: 3,
+      },
+    });
+    expect(
+      SignedContinuityBindSchema.safeParse({
+        statement: {
+          peerId: "node-a",
+          previousPrincipalFingerprint: nodeAPrincipalFingerprint,
+          newPrincipalFingerprint: nodeBPrincipalFingerprint,
+          newTransportPublicKey: "transport-b",
+          bindingGeneration: 3,
+          revocationGeneration: 1,
+          createdAt: "2026-03-11T00:00:00Z",
+        },
+        delegationSignature: "sig-a",
+        acceptanceSignature: "sig-b",
+        previousPublicKey: "old-public-key",
+        newPublicKey: "new-public-key",
+      }).success,
+    ).toBe(false);
+
+    expect(
+      MutationEnvelopeSchema.parse({
+        version: NETWORK_RUNTIME_PROTOCOL_VERSION,
+        id: "env-1",
+        operation: "network.register",
+        principal: {
+          nodeId: "node-a",
+          principalFingerprint: nodeAPrincipalFingerprint,
+          transportPublicKey: "transport-a",
+          bindingGeneration: 1,
+          displayNameSnapshot: "Alpha",
+        },
+        target: {
+          nodeId: "node-b",
+          principalFingerprint: nodeBPrincipalFingerprint,
+          transportPublicKey: "transport-b",
+          bindingGeneration: 2,
+          displayNameSnapshot: "Bravo",
+        },
+        namespace: "mesh",
+        policyEpoch: 1,
+        nonce: "node-a#1",
+        timestamp: 123,
+        ttl: 1000,
+        contextHash: "ctx",
+        payload: { ok: true },
+        signature: "sig",
+      }),
+    ).toMatchObject({
+      version: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      operation: "network.register",
+    });
+  });
+
+  it("preserves signed transport invite PEM payloads verbatim", () => {
+    const caCert = "-----BEGIN CERTIFICATE-----\nalpha-bootstrap-ca\n-----END CERTIFICATE-----\n";
+
+    const parsed = TransportInviteTokenSchema.parse({
+      nodeId: "node-a",
+      audienceNodeId: "node-b",
+      publicKey: "leader-public-key",
+      host: "127.0.0.1",
+      port: 51820,
+      controlEndpoint: {
+        host: "127.0.0.1",
+        port: 58291,
+        tlsCaFingerprint: pinnedTlsCaFingerprint,
+        tlsServerIdentity: nodeAPrincipalFingerprint,
+        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+      },
+      psk: "preshared-key",
+      displayNameSnapshot: "Alpha",
+      signingPublicKey: "signing-public-key",
+      caCert,
+      createdAt: 123,
+      expiresAt: 456,
+      tokenNonce: "nonce-a",
+      coordinationUrl: "https://coordination.example.test",
+    });
+
+    expect(parsed.caCert).toBe(caCert);
+    expect("peerId" in parsed).toBe(false);
+  });
+
+  it("hard-cuts accept-invite continuity to dual-signed binds instead of operatorApproved proofChain proposals", () => {
+    const transportEndpoint = {
+      host: "127.0.0.1",
+      port: 51820,
+    };
+    const controlEndpoint = {
+      host: "127.0.0.1",
+      port: 58291,
+      tlsCaFingerprint: pinnedTlsCaFingerprint,
+      tlsServerIdentity: nodeAPrincipalFingerprint,
+      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+    };
+
+    expect(
+      AcceptInviteRequestSchema.safeParse({
+        inviteToken: "invite-token",
+        nodeId: "node-a",
+        transportEndpoint,
+        controlEndpoint,
+        continuity: {
+          statement: {
+            nodeId: "node-a",
+            previousPrincipalFingerprint: nodeAPrincipalFingerprint,
+            newPrincipalFingerprint: nodeBPrincipalFingerprint,
+            newTransportPublicKey: "transport-b",
+            bindingGeneration: 3,
+            revocationGeneration: 1,
+            createdAt: "2026-03-11T00:00:00Z",
+          },
+          delegationSignature: "sig:delegation-base64",
+          acceptanceSignature: "sig:acceptance-base64",
+          previousPublicKey: "ed25519:old-public-key",
+          newPublicKey: "ed25519:new-public-key",
+        },
+      }).success,
+    ).toBe(true);
+
+    expect(
+      AcceptInviteRequestSchema.safeParse({
+        inviteToken: "invite-token",
+        nodeId: "node-a",
+        transportEndpoint,
+        controlEndpoint,
+        continuity: {
+          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
+          nodeId: "node-a",
+          newPrincipalFingerprint: nodeBPrincipalFingerprint,
+          newTransportPublicKey: "transport-b",
+          bindingGeneration: 3,
+          revocationGeneration: 1,
+          operatorApproved: true,
+          proofChain: [
+            {
+              kind: "continuity_bind",
+              principalFingerprint: nodeAPrincipalFingerprint,
+              transportPublicKey: "transport-a",
+              signedAt: 123,
+              signature: "sig-a",
+            },
+          ],
+        },
+      }).success,
+    ).toBe(false);
+  });
+});

package/tests/network-runtime/relay-pending-nodeid.contract.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import {
+  RelayPendingRequestSchema,
+  RelayPendingResponseSchema,
+} from "../../src/network-runtime/pair-route-contract.js";
+
+describe("relay-pending nodeId contract", () => {
+  it("uses nodeId as the only remote actor identity in relayed pair requests", () => {
+    const request = RelayPendingRequestSchema.parse({
+      id: "relay-req-1",
+      nodeId: "node-initiator",
+      displayNameSnapshot: "Initiator",
+      principalFingerprint: "c".repeat(64),
+      signingPublicKey: "c2lnbmluZy1wdWJrZXk=",
+      port: 58291,
+      ingressHost: "198.51.100.44",
+      responderControlHostHint: "198.51.100.45",
+      ephemeralPublicKey: "ZWZlbWVyYWwtcHVibGljLWtleQ==",
+      ephemeralKeySignature: "ZWZlbWVyYWwtc2ln",
+      caCert: "-----BEGIN CERTIFICATE-----\nPAIR-RELAY\n-----END CERTIFICATE-----\n",
+      expiresAt: Date.now() + 60_000,
+    });
+
+    expect(request.nodeId).toBe("node-initiator");
+    expect(() =>
+      RelayPendingRequestSchema.parse({
+        ...request,
+        peerId: "peer-legacy",
+      }),
+    ).toThrow();
+  });
+
+  it("uses the canonical response envelope for relay-pending payloads", () => {
+    const response = RelayPendingResponseSchema.parse({
+      requests: [
+        {
+          id: "relay-req-1",
+          nodeId: "node-initiator",
+          displayNameSnapshot: "Initiator",
+          principalFingerprint: "c".repeat(64),
+          signingPublicKey: "c2lnbmluZy1wdWJrZXk=",
+          port: 58291,
+          ingressHost: "198.51.100.44",
+          expiresAt: Date.now() + 60_000,
+        },
+      ],
+    });
+
+    expect(response.requests).toHaveLength(1);
+    expect(response.requests[0]?.nodeId).toBe("node-initiator");
+    expect(() =>
+      RelayPendingResponseSchema.parse({
+        requests: [
+          {
+            ...response.requests[0],
+            peerId: "peer-legacy",
+          },
+        ],
+      }),
+    ).toThrow();
+  });
+});