@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/state/identities.ts

@@ -0,0 +1,236 @@
+import { readFile } from 'node:fs/promises'
+import { z } from 'zod'
+
+import type { FileLockOptions } from './files'
+
+import { atomicWrite, withFileLock } from './files'
+import { IDENTITIES_PATH } from './paths'
+
+export type IdentitySource = 'key' | 'idp'
+export type IdentityMode = 'local' | 'remote'
+
+export interface Registration {
+  readonly iss: string
+  readonly sub: string
+  readonly registeredAt: string
+}
+
+export interface Identity {
+  readonly subject: string
+  readonly createdAt: string
+  readonly source?: IdentitySource
+  readonly mode?: IdentityMode
+  readonly kid?: string
+  readonly idp?: string
+  readonly issuer?: string
+  readonly audience?: string
+  readonly claims?: Readonly<Record<string, unknown>>
+  readonly registrations?: Readonly<Record<string, Registration>>
+}
+
+export interface IdentityStore {
+  readonly default: string
+  readonly identities: Readonly<Record<string, Identity>>
+}
+
+export const IDENTITY_STORE_VERSION = 1 as const
+
+export type IdentityStateErrorCode =
+  | 'IDENTITY_STATE_INVALID'
+  | 'IDENTITY_STATE_VERSION_UNSUPPORTED'
+  | 'IDENTITY_STATE_UNREADABLE'
+  | 'IDENTITY_STATE_BACKUP_CONFLICT'
+
+export class IdentityStateError extends Error {
+  readonly code: IdentityStateErrorCode
+  readonly path: string
+
+  constructor(code: IdentityStateErrorCode, path: string, message: string, cause?: unknown) {
+    super(message, { cause })
+    this.name = 'IdentityStateError'
+    this.code = code
+    this.path = path
+  }
+}
+
+export interface IdentityStoreOptions {
+  readonly path?: string
+  readonly now?: () => Date
+  readonly lock?: FileLockOptions
+}
+
+export interface IdentityUpdate<Value> {
+  readonly next: IdentityStore
+  readonly value: Value
+}
+
+const RegistrationSchema: z.ZodType<Registration> = z
+  .object({
+    iss: z.string(),
+    sub: z.string(),
+    registeredAt: z.string(),
+  })
+  .strict()
+
+const IdentitySchema: z.ZodType<Identity> = z
+  .object({
+    subject: z.string(),
+    createdAt: z.string(),
+    source: z.enum(['key', 'idp']).optional(),
+    mode: z.enum(['local', 'remote']).optional(),
+    kid: z.string().optional(),
+    idp: z.string().optional(),
+    issuer: z.string().url().optional(),
+    audience: z.string().optional(),
+    claims: z.record(z.string(), z.unknown()).optional(),
+    registrations: z.record(z.string(), RegistrationSchema).optional(),
+  })
+  .strict()
+
+const IdentityStoreFields = {
+  default: z.string(),
+  identities: z.record(z.string(), IdentitySchema),
+}
+
+const IdentityStoreSchema: z.ZodType<IdentityStore> = z.object(IdentityStoreFields).strict()
+
+const IdentityFileV1Schema = z
+  .object({ version: z.literal(IDENTITY_STORE_VERSION), ...IdentityStoreFields })
+  .strict()
+
+interface DecodedIdentityStore {
+  readonly store: IdentityStore
+  readonly legacyBytes?: string
+}
+
+export async function readIdentityStore(
+  options: IdentityStoreOptions = {},
+): Promise<IdentityStore> {
+  return (await readDecoded(options)).store
+}
+
+export async function updateIdentityStore<Value>(
+  transition: (current: IdentityStore) => IdentityUpdate<Value> | Promise<IdentityUpdate<Value>>,
+  options: IdentityStoreOptions = {},
+): Promise<Value> {
+  const path = options.path ?? IDENTITIES_PATH
+  return withFileLock(
+    `${path}.lock`,
+    async () => {
+      const current = await readDecoded(options)
+      const update = await transition(current.store)
+      if (current.legacyBytes !== undefined) {
+        await preserveLegacyBackup(path, current.legacyBytes)
+      }
+      await atomicWrite(path, encodeV1(update.next))
+      return update.value
+    },
+    options.lock,
+  )
+}
+
+async function readDecoded(options: IdentityStoreOptions): Promise<DecodedIdentityStore> {
+  const path = options.path ?? IDENTITIES_PATH
+  let raw: string
+  try {
+    raw = await readFile(path, 'utf-8')
+  } catch (error) {
+    if ((error as { code?: string }).code === 'ENOENT') {
+      return { store: seed(options.now?.() ?? new Date()) }
+    }
+    throw new IdentityStateError(
+      'IDENTITY_STATE_UNREADABLE',
+      path,
+      `Could not read identity state at ${path}`,
+      error,
+    )
+  }
+
+  let input: unknown
+  try {
+    input = JSON.parse(raw)
+  } catch (error) {
+    throw invalidState(path, error)
+  }
+
+  if (hasVersion(input)) {
+    if (typeof input.version !== 'number' || !Number.isInteger(input.version)) {
+      throw invalidState(path)
+    }
+    if (input.version !== IDENTITY_STORE_VERSION) {
+      throw new IdentityStateError(
+        'IDENTITY_STATE_VERSION_UNSUPPORTED',
+        path,
+        `Identity state at ${path} uses unsupported version ${input.version}`,
+      )
+    }
+    try {
+      const { version: _, ...store } = IdentityFileV1Schema.parse(input)
+      return { store }
+    } catch (error) {
+      throw invalidState(path, error)
+    }
+  }
+
+  try {
+    return { store: IdentityStoreSchema.parse(input), legacyBytes: raw }
+  } catch (error) {
+    throw invalidState(path, error)
+  }
+}
+
+function hasVersion(input: unknown): input is { readonly version: unknown } {
+  return typeof input === 'object' && input !== null && Object.hasOwn(input, 'version')
+}
+
+function seed(now: Date): IdentityStore {
+  return {
+    default: 'manager',
+    identities: {
+      manager: {
+        subject: 'manager',
+        createdAt: now.toISOString(),
+        source: 'key',
+        mode: 'local',
+      },
+    },
+  }
+}
+
+function encodeV1(store: IdentityStore): string {
+  return `${JSON.stringify({ version: IDENTITY_STORE_VERSION, ...store }, null, 2)}\n`
+}
+
+async function preserveLegacyBackup(path: string, legacyBytes: string): Promise<void> {
+  const backupPath = `${path}.v0.bak`
+  try {
+    const existing = await readFile(backupPath, 'utf-8')
+    if (existing !== legacyBytes) {
+      throw new IdentityStateError(
+        'IDENTITY_STATE_BACKUP_CONFLICT',
+        backupPath,
+        `Legacy identity backup at ${backupPath} does not match the file being migrated`,
+      )
+    }
+  } catch (error) {
+    if (error instanceof IdentityStateError) throw error
+    if ((error as { code?: string }).code !== 'ENOENT') {
+      throw new IdentityStateError(
+        'IDENTITY_STATE_UNREADABLE',
+        backupPath,
+        `Could not read legacy identity backup at ${backupPath}`,
+        error,
+      )
+    }
+    await atomicWrite(backupPath, legacyBytes)
+  }
+}
+
+function invalidState(path: string, cause?: unknown): IdentityStateError {
+  return new IdentityStateError(
+    'IDENTITY_STATE_INVALID',
+    path,
+    `Identity state at ${path} is malformed`,
+    cause,
+  )
+}

package/src/state/index.ts

@@ -0,0 +1,29 @@
+export { atomicWrite, withFileLock } from './files'
+export type { FileLockOptions } from './files'
+export { ExchangeCredentialCache } from './exchange-credentials'
+export type { exchange } from './exchange-credentials'
+export { IDENTITY_STORE_VERSION, readIdentityStore, updateIdentityStore } from './identities'
+export type {
+  Identity,
+  IdentityMode,
+  IdentitySource,
+  IdentityStore,
+  IdentityStoreOptions,
+  IdentityUpdate,
+  Registration,
+} from './identities'
+export {
+  ASTRALE_HOME,
+  CONFIG_PATH,
+  DATA_DIR,
+  IDENTITIES_PATH,
+  IDPS_PATH,
+  IDP_SESSIONS_DIR,
+  EXCHANGE_CREDENTIALS_PATH,
+  INSTALL_PATH,
+  INSTANCES_PATH,
+  KEYS_DIR,
+  createPaths,
+  paths,
+} from './paths'
+export type { PathEnvironment, Paths } from './paths'

package/src/state/paths.ts

@@ -0,0 +1,61 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export interface PathEnvironment {
+  readonly ASTRALE_HOME?: string
+  readonly ASTRALE_KEYS_DIR?: string
+  readonly ASTRALE_DATA_DIR?: string
+}
+
+export interface Paths {
+  readonly home: string
+  readonly keys: string
+  readonly data: string
+  readonly config: string
+  readonly install: string
+  readonly identities: string
+  readonly instances: string
+  readonly idps: string
+  readonly idpSessionsDir: string
+  readonly exchangeCredentials: string
+  idpDir(name: string): string
+  idpSession(identityName: string): string
+}
+
+/** Resolve every CLI state path once from explicit input and the captured environment. */
+export function createPaths(home?: string, environment?: PathEnvironment): Paths {
+  const captured = environment ?? {
+    ASTRALE_HOME: process.env.ASTRALE_HOME,
+    ASTRALE_KEYS_DIR: process.env.ASTRALE_KEYS_DIR,
+    ASTRALE_DATA_DIR: process.env.ASTRALE_DATA_DIR,
+  }
+  const base = home ?? captured.ASTRALE_HOME ?? join(homedir(), '.astrale')
+  const idpsDir = join(base, 'idps')
+  const idpSessionsDir = join(base, 'idp-sessions')
+  return Object.freeze({
+    home: base,
+    keys: captured.ASTRALE_KEYS_DIR ?? join(base, 'keys'),
+    data: captured.ASTRALE_DATA_DIR ?? join(base, 'data'),
+    config: join(base, 'config.json'),
+    install: join(base, 'install.json'),
+    identities: join(base, 'identities.json'),
+    instances: join(base, 'instances.json'),
+    idps: join(idpsDir, 'index.json'),
+    idpSessionsDir,
+    exchangeCredentials: join(base, 'exchange', 'credentials.json'),
+    idpDir: (name: string) => join(idpsDir, name),
+    idpSession: (identityName: string) => join(idpSessionsDir, `${identityName}.json`),
+  })
+}
+
+export const paths: Paths = createPaths()
+export const ASTRALE_HOME = paths.home
+export const KEYS_DIR = paths.keys
+export const DATA_DIR = paths.data
+export const CONFIG_PATH = paths.config
+export const INSTALL_PATH = paths.install
+export const IDENTITIES_PATH = paths.identities
+export const INSTANCES_PATH = paths.instances
+export const IDPS_PATH = paths.idps
+export const IDP_SESSIONS_DIR = paths.idpSessionsDir
+export const EXCHANGE_CREDENTIALS_PATH = paths.exchangeCredentials

package/src/state/tsconfig.json

@@ -0,0 +1,6 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": { "types": ["@types/node"] },
+  "include": ["*.ts"],
+  "exclude": ["__tests__"]
+}

package/src/telemetry/__tests__/redact.test.ts

@@ -27,9 +27,9 @@ describe('redactArgv', () => {
   })
 
   test('leaves non-secret flags and their values intact', () => {
-    expect(redactArgv(['get', '--depth', '3', '--format=json'])).toEqual([
-      'get',
-      '--depth',
+    expect(redactArgv(['query', '--limit', '3', '--format=json'])).toEqual([
+      'query',
+      '--limit',
       '3',
       '--format=json',
     ])

package/src/telemetry/__tests__/trigger.test.ts

@@ -16,7 +16,7 @@ beforeAll(async () => {
   // leaves a telemetry-disabled config.json in the shared home) — own it here.
   delete process.env.ASTRALE_TELEMETRY
   delete process.env.ASTRALE_TELEMETRY_NO_TRIGGER
-  const { CONFIG_PATH } = await import('../../lib/paths')
+  const { CONFIG_PATH } = await import('../../state/index')
   rmSync(CONFIG_PATH, { force: true })
 })
 

package/src/telemetry/settings.ts

@@ -5,7 +5,7 @@
  */
 import { readFileSync } from 'node:fs'
 
-import { createPaths } from '../lib/env'
+import { createPaths } from '../state/index'
 
 const OFF_VALUES = new Set(['0', 'false', 'off'])
 

package/src/telemetry/store.ts

@@ -11,7 +11,7 @@ import { join } from 'node:path'
 
 import type { AnalyzedMarker, SessionMeta } from './types'
 
-import { createPaths } from '../lib/env'
+import { createPaths } from '../state/index'
 
 export const IDLE_WINDOW_MS = 30 * 60 * 1000
 

package/src/test-utils.ts

@@ -2,7 +2,7 @@ import { mkdtemp, mkdir } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { createPaths, type Paths } from './lib/env'
+import { createPaths, type Paths } from './state/index'
 
 export type TestEnv = {
   paths: Paths

package/studio/client/dist/assets/elk-api-D0cBetPW.js

@@ -0,0 +1 @@
+import{m as L}from"./index-Dspir4w7.js";function S(y,b){for(var u=0;u<b.length;u++){const a=b[u];if(typeof a!="string"&&!Array.isArray(a)){for(const i in a)if(i!=="default"&&!(i in y)){const n=Object.getOwnPropertyDescriptor(a,i);n&&Object.defineProperty(y,i,n.get?n:{enumerable:!0,get:()=>a[i]})}}}return Object.freeze(Object.defineProperty(y,Symbol.toStringTag,{value:"Module"}))}function w(y){throw new Error('Could not dynamically require "'+y+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}var O={exports:{}},j;function C(){return j||(j=1,(function(y,b){(function(u){y.exports=u()})(function(){return(function(){function u(a,i,n){function d(f,_){if(!i[f]){if(!a[f]){var h=typeof w=="function"&&w;if(!_&&h)return h(f,!0);if(g)return g(f,!0);var o=new Error("Cannot find module '"+f+"'");throw o.code="MODULE_NOT_FOUND",o}var e=i[f]={exports:{}};a[f][0].call(e.exports,function(r){var t=a[f][1][r];return d(t||r)},e,e.exports,u,a,i,n)}return i[f].exports}for(var g=typeof w=="function"&&w,m=0;m<n.length;m++)d(n[m]);return d}return u})()({1:[function(u,a,i){Object.defineProperty(i,"__esModule",{value:!0}),i.default=void 0;function n(o){"@babel/helpers - typeof";return n=typeof Symbol=="function"&&typeof Symbol.iterator=="symbol"?function(e){return typeof e}:function(e){return e&&typeof Symbol=="function"&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(o)}function d(o,e){if(!(o instanceof e))throw new TypeError("Cannot call a class as a function")}function g(o,e){for(var r=0;r<e.length;r++){var t=e[r];t.enumerable=t.enumerable||!1,t.configurable=!0,"value"in t&&(t.writable=!0),Object.defineProperty(o,f(t.key),t)}}function m(o,e,r){return e&&g(o.prototype,e),Object.defineProperty(o,"prototype",{writable:!1}),o}function f(o){var e=_(o,"string");return n(e)=="symbol"?e:e+""}function _(o,e){if(n(o)!="object"||!o)return o;var r=o[Symbol.toPrimitive];if(r!==void 0){var t=r.call(o,e);if(n(t)!="object")return t;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(o)}i.default=(function(){function o(){var e=this,r=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{},t=r.defaultLayoutOptions,s=t===void 0?{}:t,l=r.algorithms,v=l===void 0?["layered","stress","mrtree","radial","force","disco","sporeOverlap","sporeCompaction","rectpacking"]:l,c=r.workerFactory,p=r.workerUrl;if(d(this,o),this.defaultLayoutOptions=s,this.initialized=!1,typeof p>"u"&&typeof c>"u")throw new Error("Cannot construct an ELK without both 'workerUrl' and 'workerFactory'.");var k=c;typeof p<"u"&&typeof c>"u"&&(k=function(M){return new Worker(M)});var E=k(p);if(typeof E.postMessage!="function")throw new TypeError("Created worker does not provide the required 'postMessage' function.");this.worker=new h(E),this.worker.postMessage({cmd:"register",algorithms:v}).then(function(P){return e.initialized=!0}).catch(console.err)}return m(o,[{key:"layout",value:function(r){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},s=t.layoutOptions,l=s===void 0?this.defaultLayoutOptions:s,v=t.logging,c=v===void 0?!1:v,p=t.measureExecutionTime,k=p===void 0?!1:p;return r?this.worker.postMessage({cmd:"layout",graph:r,layoutOptions:l,options:{logging:c,measureExecutionTime:k}}):Promise.reject(new Error("Missing mandatory parameter 'graph'."))}},{key:"knownLayoutAlgorithms",value:function(){return this.worker.postMessage({cmd:"algorithms"})}},{key:"knownLayoutOptions",value:function(){return this.worker.postMessage({cmd:"options"})}},{key:"knownLayoutCategories",value:function(){return this.worker.postMessage({cmd:"categories"})}},{key:"terminateWorker",value:function(){this.worker&&this.worker.terminate()}}])})();var h=(function(){function o(e){var r=this;if(d(this,o),e===void 0)throw new Error("Missing mandatory parameter 'worker'.");this.resolvers={},this.worker=e,this.worker.onmessage=function(t){setTimeout(function(){r.receive(r,t)},0)}}return m(o,[{key:"postMessage",value:function(r){var t=this.id||0;this.id=t+1,r.id=t;var s=this;return new Promise(function(l,v){s.resolvers[t]=function(c,p){c?(s.convertGwtStyleError(c),v(c)):l(p)},s.worker.postMessage(r)})}},{key:"receive",value:function(r,t){var s=t.data,l=r.resolvers[s.id];l&&(delete r.resolvers[s.id],s.error?l(s.error):l(null,s.data))}},{key:"terminate",value:function(){this.worker&&this.worker.terminate()}},{key:"convertGwtStyleError",value:function(r){if(r){var t=r.__java$exception;t&&(t.cause&&t.cause.backingJsObject&&(r.cause=t.cause.backingJsObject,this.convertGwtStyleError(r.cause)),delete r.__java$exception)}}}])})()},{}],2:[function(u,a,i){var n=u("./elk-api.js").default;Object.defineProperty(a.exports,"__esModule",{value:!0}),a.exports=n,n.default=n},{"./elk-api.js":1}]},{},[2])(2)})})(O)),O.exports}var x=C();const A=L(x),q=S({__proto__:null,default:A},[x]);export{q as e};