@aria-cli/tools 1.0.9 → 1.0.11

package/tests/network-runtime/protocol-schemas.contract.test.ts

@@ -1,512 +0,0 @@
-import { describe, expect, it } from "vitest";
-import * as runtimeContracts from "../../src/index.js";
-import {
-  NETWORK_RUNTIME_PROTOCOL_VERSION,
-  DeliveryAckSchema,
-  MutationEnvelopeSchema,
-  PairProposalSchema,
-  PrincipalFingerprintSchema,
-  TransportInviteTokenSchema,
-  RuntimeIngressEnvelopeSchema,
-  RuntimeNodeAdvertisementSchema,
-  RuntimeRegisterRequestSchema,
-  SignedContinuityBindSchema,
-  TlsCaFingerprintSchema,
-  assertSupportedNetworkRuntimeProtocolVersion,
-} from "../../src/index.js";
-import { AcceptInviteRequestSchema } from "../../src/network-runtime/pair-route-contract.js";
-
-const nodeAPrincipalFingerprint = PrincipalFingerprintSchema.parse("a".repeat(64));
-const nodeBPrincipalFingerprint = PrincipalFingerprintSchema.parse("b".repeat(64));
-const pinnedTlsCaFingerprint = TlsCaFingerprintSchema.parse("c".repeat(64));
-
-describe("network runtime protocol schemas", () => {
-  it("exports canonical shared schemas plus a fail-closed version gate", () => {
-    expect(
-      assertSupportedNetworkRuntimeProtocolVersion(NETWORK_RUNTIME_PROTOCOL_VERSION, "join"),
-    ).toBe(NETWORK_RUNTIME_PROTOCOL_VERSION);
-    expect(() => assertSupportedNetworkRuntimeProtocolVersion(0, "join")).toThrow(
-      /Unsupported join protocol version 0/i,
-    );
-    expect(() => assertSupportedNetworkRuntimeProtocolVersion(2, "join")).toThrow(/Supported: 1/i);
-  });
-
-  it("parses canonical runtime protocol shapes and rejects ambiguous legacy fields", () => {
-    const joinRequestSchema = (
-      runtimeContracts as { JoinRequestSchema?: { parse: Function; safeParse: Function } }
-    ).JoinRequestSchema;
-    expect(joinRequestSchema).toBeDefined();
-
-    const deliveryAck = DeliveryAckSchema.parse({
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      messageId: "msg-1",
-      senderNodeId: "node-a",
-      recipientNodeId: "node-b",
-      storedAt: 123,
-    });
-
-    expect(
-      DeliveryAckSchema.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        messageId: "msg-legacy",
-        senderNodeId: "node-a",
-        recipientName: "runtime-b",
-        storedAt: 123,
-      }).success,
-    ).toBe(false);
-
-    expect(
-      RuntimeIngressEnvelopeSchema.parse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        deliveryAck,
-      }),
-    ).toEqual({
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      deliveryAck,
-    });
-
-    expect(
-      RuntimeNodeAdvertisementSchema.parse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        publicationRevision: 7,
-        nodeId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        signingPublicKey: "signing-a",
-        transportPublicKey: "transport-a",
-        transportEndpoint: {
-          host: "127.0.0.1",
-          port: 51820,
-        },
-        controlEndpoint: {
-          host: "127.0.0.1",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: nodeAPrincipalFingerprint,
-          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        },
-      }),
-    ).toMatchObject({
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      publicationRevision: 7,
-      nodeId: "node-a",
-      principalFingerprint: nodeAPrincipalFingerprint,
-      signingPublicKey: "signing-a",
-      transportPublicKey: "transport-a",
-    });
-    expect(
-      RuntimeNodeAdvertisementSchema.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        publicationRevision: 7,
-        nodeId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        transportPublicKey: "transport-a",
-        controlEndpoint: {
-          host: "127.0.0.1",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: nodeAPrincipalFingerprint,
-          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        },
-      }).success,
-    ).toBe(false);
-
-    const transportInvite = TransportInviteTokenSchema.parse({
-      nodeId: "node-a",
-      audienceNodeId: "node-b",
-      publicKey: "transport-a",
-      host: "127.0.0.1",
-      port: 51820,
-      controlEndpoint: {
-        host: "127.0.0.1",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: nodeAPrincipalFingerprint,
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      },
-      psk: "psk-a",
-      displayNameSnapshot: "Alpha",
-      signingPublicKey: "principal-a",
-      createdAt: 123,
-      expiresAt: 456,
-      tokenNonce: "nonce-a",
-    });
-
-    expect(transportInvite).toMatchObject({
-      nodeId: "node-a",
-      audienceNodeId: "node-b",
-      publicKey: "transport-a",
-    });
-    expect(
-      TransportInviteTokenSchema.safeParse({
-        nodeId: "node-a",
-        peerId: "node-a",
-        publicKey: "transport-a",
-        host: "127.0.0.1",
-        port: 51820,
-        psk: "psk-a",
-        displayNameSnapshot: "Alpha",
-        createdAt: 123,
-        expiresAt: 456,
-        tokenNonce: "nonce-a",
-      }).success,
-    ).toBe(false);
-
-    const joinRequest = joinRequestSchema!.parse({
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      nodeId: "node-a",
-      principalFingerprint: nodeAPrincipalFingerprint,
-      peerPublicKey: "transport-a",
-      signingPublicKey: "principal-a",
-      transportEndpoint: {
-        host: "127.0.0.1",
-        port: 51820,
-      },
-      controlEndpoint: {
-        host: "127.0.0.1",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: nodeAPrincipalFingerprint,
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      },
-      displayNameSnapshot: "Alpha",
-      inviteTokenNonce: "nonce-a",
-    });
-
-    expect(
-      RuntimeIngressEnvelopeSchema.parse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        joinRequest,
-      }),
-    ).toEqual({
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      joinRequest,
-    });
-
-    expect(
-      joinRequestSchema!.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        nodeId: "node-a",
-        peerPublicKey: "transport-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        signingPublicKey: "principal-a",
-        transportEndpoint: {
-          host: "127.0.0.1",
-          port: 51820,
-        },
-        displayNameSnapshot: "Alpha",
-        inviteTokenNonce: "nonce-a",
-      }).success,
-    ).toBe(true);
-
-    expect(
-      joinRequestSchema!.safeParse({
-        protocolVersion: 2,
-        nodeId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        peerPublicKey: "transport-a",
-        signingPublicKey: "principal-a",
-        transportEndpoint: {
-          host: "127.0.0.1",
-          port: 51820,
-        },
-        displayNameSnapshot: "Alpha",
-        inviteTokenNonce: "nonce-a",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      joinRequestSchema!.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        peerId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        peerPublicKey: "transport-a",
-        signingPublicKey: "principal-a",
-        transportEndpoint: {
-          host: "127.0.0.1",
-          port: 51820,
-        },
-        displayNameSnapshot: "Alpha",
-        inviteTokenNonce: "nonce-a",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      joinRequestSchema!.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        nodeId: "node-a",
-        peerPublicKey: "transport-a",
-        signingPublicKey: "principal-a",
-        transportEndpoint: {
-          host: "127.0.0.1",
-          port: 51820,
-        },
-        displayNameSnapshot: "Alpha",
-        inviteTokenNonce: "nonce-a",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      TransportInviteTokenSchema.safeParse({
-        nodeId: "node-a",
-        publicKey: "transport-a",
-        host: "127.0.0.1",
-        port: 51820,
-        psk: "psk-a",
-        displayNameSnapshot: "Alpha",
-        createdAt: 1,
-        expiresAt: 2,
-        tokenNonce: "nonce-a",
-      }).success,
-    ).toBe(true);
-    expect(
-      TransportInviteTokenSchema.safeParse({
-        nodeId: "node-a",
-        peerId: "node-a",
-        publicKey: "transport-a",
-        host: "127.0.0.1",
-        port: 51820,
-        psk: "psk-a",
-        displayNameSnapshot: "Alpha",
-        createdAt: 1,
-        expiresAt: 2,
-        tokenNonce: "nonce-a",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      RuntimeRegisterRequestSchema.parse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        nodeId: "node-a",
-        transportPublicKey: "transport-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        endpointRevision: 4,
-        controlEndpoint: {
-          host: "127.0.0.1",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: nodeAPrincipalFingerprint,
-          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        },
-      }),
-    ).toMatchObject({
-      nodeId: "node-a",
-      endpointRevision: 4,
-    });
-    expect(
-      RuntimeRegisterRequestSchema.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        peerId: "node-a",
-        transportPublicKey: "transport-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        endpointRevision: 4,
-      }).success,
-    ).toBe(false);
-
-    expect(
-      PairProposalSchema.parse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        nodeId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        transportPublicKey: "transport-a",
-        presharedKey: "psk-a",
-        controlEndpoint: {
-          host: "127.0.0.1",
-          port: 58291,
-          tlsCaFingerprint: pinnedTlsCaFingerprint,
-          tlsServerIdentity: nodeAPrincipalFingerprint,
-          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        },
-      }),
-    ).toMatchObject({
-      nodeId: "node-a",
-    });
-
-    expect(
-      PairProposalSchema.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        nodeId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        transportPublicKey: "transport-a",
-        presharedKey: "psk-a",
-        ["message" + "Port"]: 58291,
-      }).success,
-    ).toBe(false);
-    expect(
-      PairProposalSchema.safeParse({
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        peerId: "node-a",
-        principalFingerprint: nodeAPrincipalFingerprint,
-        transportPublicKey: "transport-a",
-        presharedKey: "psk-a",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      SignedContinuityBindSchema.parse({
-        statement: {
-          nodeId: "node-a",
-          previousPrincipalFingerprint: nodeAPrincipalFingerprint,
-          newPrincipalFingerprint: nodeBPrincipalFingerprint,
-          newTransportPublicKey: "transport-b",
-          bindingGeneration: 3,
-          revocationGeneration: 1,
-          createdAt: "2026-03-11T00:00:00Z",
-        },
-        delegationSignature: "sig-a",
-        acceptanceSignature: "sig-b",
-        previousPublicKey: "old-public-key",
-        newPublicKey: "new-public-key",
-      }),
-    ).toMatchObject({
-      statement: {
-        nodeId: "node-a",
-        bindingGeneration: 3,
-      },
-    });
-    expect(
-      SignedContinuityBindSchema.safeParse({
-        statement: {
-          peerId: "node-a",
-          previousPrincipalFingerprint: nodeAPrincipalFingerprint,
-          newPrincipalFingerprint: nodeBPrincipalFingerprint,
-          newTransportPublicKey: "transport-b",
-          bindingGeneration: 3,
-          revocationGeneration: 1,
-          createdAt: "2026-03-11T00:00:00Z",
-        },
-        delegationSignature: "sig-a",
-        acceptanceSignature: "sig-b",
-        previousPublicKey: "old-public-key",
-        newPublicKey: "new-public-key",
-      }).success,
-    ).toBe(false);
-
-    expect(
-      MutationEnvelopeSchema.parse({
-        version: NETWORK_RUNTIME_PROTOCOL_VERSION,
-        id: "env-1",
-        operation: "network.register",
-        principal: {
-          nodeId: "node-a",
-          principalFingerprint: nodeAPrincipalFingerprint,
-          transportPublicKey: "transport-a",
-          bindingGeneration: 1,
-          displayNameSnapshot: "Alpha",
-        },
-        target: {
-          nodeId: "node-b",
-          principalFingerprint: nodeBPrincipalFingerprint,
-          transportPublicKey: "transport-b",
-          bindingGeneration: 2,
-          displayNameSnapshot: "Bravo",
-        },
-        namespace: "mesh",
-        policyEpoch: 1,
-        nonce: "node-a#1",
-        timestamp: 123,
-        ttl: 1000,
-        contextHash: "ctx",
-        payload: { ok: true },
-        signature: "sig",
-      }),
-    ).toMatchObject({
-      version: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      operation: "network.register",
-    });
-  });
-
-  it("preserves signed transport invite PEM payloads verbatim", () => {
-    const caCert = "-----BEGIN CERTIFICATE-----\nalpha-bootstrap-ca\n-----END CERTIFICATE-----\n";
-
-    const parsed = TransportInviteTokenSchema.parse({
-      nodeId: "node-a",
-      audienceNodeId: "node-b",
-      publicKey: "leader-public-key",
-      host: "127.0.0.1",
-      port: 51820,
-      controlEndpoint: {
-        host: "127.0.0.1",
-        port: 58291,
-        tlsCaFingerprint: pinnedTlsCaFingerprint,
-        tlsServerIdentity: nodeAPrincipalFingerprint,
-        protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-      },
-      psk: "preshared-key",
-      displayNameSnapshot: "Alpha",
-      signingPublicKey: "signing-public-key",
-      caCert,
-      createdAt: 123,
-      expiresAt: 456,
-      tokenNonce: "nonce-a",
-      coordinationUrl: "https://coordination.example.test",
-    });
-
-    expect(parsed.caCert).toBe(caCert);
-    expect("peerId" in parsed).toBe(false);
-  });
-
-  it("hard-cuts accept-invite continuity to dual-signed binds instead of operatorApproved proofChain proposals", () => {
-    const transportEndpoint = {
-      host: "127.0.0.1",
-      port: 51820,
-    };
-    const controlEndpoint = {
-      host: "127.0.0.1",
-      port: 58291,
-      tlsCaFingerprint: pinnedTlsCaFingerprint,
-      tlsServerIdentity: nodeAPrincipalFingerprint,
-      protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-    };
-
-    expect(
-      AcceptInviteRequestSchema.safeParse({
-        inviteToken: "invite-token",
-        nodeId: "node-a",
-        transportEndpoint,
-        controlEndpoint,
-        continuity: {
-          statement: {
-            nodeId: "node-a",
-            previousPrincipalFingerprint: nodeAPrincipalFingerprint,
-            newPrincipalFingerprint: nodeBPrincipalFingerprint,
-            newTransportPublicKey: "transport-b",
-            bindingGeneration: 3,
-            revocationGeneration: 1,
-            createdAt: "2026-03-11T00:00:00Z",
-          },
-          delegationSignature: "sig:delegation-base64",
-          acceptanceSignature: "sig:acceptance-base64",
-          previousPublicKey: "ed25519:old-public-key",
-          newPublicKey: "ed25519:new-public-key",
-        },
-      }).success,
-    ).toBe(true);
-
-    expect(
-      AcceptInviteRequestSchema.safeParse({
-        inviteToken: "invite-token",
-        nodeId: "node-a",
-        transportEndpoint,
-        controlEndpoint,
-        continuity: {
-          protocolVersion: NETWORK_RUNTIME_PROTOCOL_VERSION,
-          nodeId: "node-a",
-          newPrincipalFingerprint: nodeBPrincipalFingerprint,
-          newTransportPublicKey: "transport-b",
-          bindingGeneration: 3,
-          revocationGeneration: 1,
-          operatorApproved: true,
-          proofChain: [
-            {
-              kind: "continuity_bind",
-              principalFingerprint: nodeAPrincipalFingerprint,
-              transportPublicKey: "transport-a",
-              signedAt: 123,
-              signature: "sig-a",
-            },
-          ],
-        },
-      }).success,
-    ).toBe(false);
-  });
-});

package/tests/network-runtime/relay-pending-nodeid.contract.test.ts

@@ -1,62 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  RelayPendingRequestSchema,
-  RelayPendingResponseSchema,
-} from "../../src/network-runtime/pair-route-contract.js";
-
-describe("relay-pending nodeId contract", () => {
-  it("uses nodeId as the only remote actor identity in relayed pair requests", () => {
-    const request = RelayPendingRequestSchema.parse({
-      id: "relay-req-1",
-      nodeId: "node-initiator",
-      displayNameSnapshot: "Initiator",
-      principalFingerprint: "c".repeat(64),
-      signingPublicKey: "c2lnbmluZy1wdWJrZXk=",
-      port: 58291,
-      ingressHost: "198.51.100.44",
-      responderControlHostHint: "198.51.100.45",
-      ephemeralPublicKey: "ZWZlbWVyYWwtcHVibGljLWtleQ==",
-      ephemeralKeySignature: "ZWZlbWVyYWwtc2ln",
-      caCert: "-----BEGIN CERTIFICATE-----\nPAIR-RELAY\n-----END CERTIFICATE-----\n",
-      expiresAt: Date.now() + 60_000,
-    });
-
-    expect(request.nodeId).toBe("node-initiator");
-    expect(() =>
-      RelayPendingRequestSchema.parse({
-        ...request,
-        peerId: "peer-legacy",
-      }),
-    ).toThrow();
-  });
-
-  it("uses the canonical response envelope for relay-pending payloads", () => {
-    const response = RelayPendingResponseSchema.parse({
-      requests: [
-        {
-          id: "relay-req-1",
-          nodeId: "node-initiator",
-          displayNameSnapshot: "Initiator",
-          principalFingerprint: "c".repeat(64),
-          signingPublicKey: "c2lnbmluZy1wdWJrZXk=",
-          port: 58291,
-          ingressHost: "198.51.100.44",
-          expiresAt: Date.now() + 60_000,
-        },
-      ],
-    });
-
-    expect(response.requests).toHaveLength(1);
-    expect(response.requests[0]?.nodeId).toBe("node-initiator");
-    expect(() =>
-      RelayPendingResponseSchema.parse({
-        requests: [
-          {
-            ...response.requests[0],
-            peerId: "peer-legacy",
-          },
-        ],
-      }),
-    ).toThrow();
-  });
-});