@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/lib/__tests__/keys.test.ts

@@ -1,129 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { CompactEncrypt, compactDecrypt, decodeProtectedHeader } from 'jose'
-import { access, mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { IdentityKeyMissingError } from '../../errors'
-import {
-  generateEd25519Jwk,
-  keypairPaths,
-  listIdentityKeys,
-  persistKeypair,
-  removeKeypair,
-  signAs,
-} from '../keys'
-
-describe('DESIGN — per-identity keys', () => {
-  let tmp = ''
-  const savedStrict = process.env.ASTRALE_STRICT_IDENTITIES
-
-  beforeEach(async () => {
-    tmp = await mkdtemp(join(tmpdir(), 'astrale-keys-test-'))
-    delete process.env.ASTRALE_STRICT_IDENTITIES
-  })
-
-  afterEach(async () => {
-    if (savedStrict) process.env.ASTRALE_STRICT_IDENTITIES = savedStrict
-    else delete process.env.ASTRALE_STRICT_IDENTITIES
-    await rm(tmp, { recursive: true, force: true })
-  })
-
-  test('keypairPaths routes manager to legacy filenames', () => {
-    const p = keypairPaths('manager', tmp)
-    expect(p.privatePath.endsWith('manager.private.jwk')).toBe(true)
-    expect(p.publicPath.endsWith('manager.public.jwk')).toBe(true)
-  })
-
-  test('keypairPaths routes others to <name>.*.jwk', () => {
-    const p = keypairPaths('alice', tmp)
-    expect(p.privatePath.endsWith('alice.private.jwk')).toBe(true)
-    expect(p.publicPath.endsWith('alice.public.jwk')).toBe(true)
-  })
-
-  test('persistKeypair writes both files with kid', async () => {
-    const result = await persistKeypair('alice', { keysDir: tmp })
-    expect(result.kid).toMatch(/^alice-key-/)
-    const { privatePath, publicPath } = keypairPaths('alice', tmp)
-    await access(privatePath)
-    await access(publicPath)
-  })
-
-  test('signAs(alice) works when alice has her own key', async () => {
-    await persistKeypair('alice', { keysDir: tmp })
-    const jwt = await signAs('alice', tmp)
-    expect(jwt.split('.').length).toBe(3)
-  })
-
-  test('signAs(alice) uses the key file algorithm for EdDSA identities', async () => {
-    const { privateJwk, publicJwk } = await generateEd25519Jwk('alice-ed25519')
-    const { privatePath, publicPath } = keypairPaths('alice', tmp)
-    await writeFile(privatePath, JSON.stringify(privateJwk, null, 2))
-    await writeFile(publicPath, JSON.stringify(publicJwk, null, 2))
-
-    const jwt = await signAs('alice', tmp)
-
-    expect(decodeProtectedHeader(jwt).alg).toBe('EdDSA')
-  })
-
-  test('signAs(alice) falls back to manager key with warning', async () => {
-    await persistKeypair('manager', { keysDir: tmp })
-    const jwt = await signAs('alice', tmp)
-    expect(jwt.split('.').length).toBe(3)
-  })
-
-  test('signAs(alice) errors when strict mode and no alice key', async () => {
-    await persistKeypair('manager', { keysDir: tmp })
-    process.env.ASTRALE_STRICT_IDENTITIES = '1'
-    await expect(signAs('alice', tmp)).rejects.toThrow(IdentityKeyMissingError)
-  })
-
-  test('signAs errors when no keys at all', async () => {
-    await expect(signAs('manager', tmp)).rejects.toThrow(IdentityKeyMissingError)
-  })
-
-  test('removeKeypair is idempotent', async () => {
-    await persistKeypair('alice', { keysDir: tmp })
-    await removeKeypair('alice', tmp)
-    await removeKeypair('alice', tmp)
-    const { privatePath } = keypairPaths('alice', tmp)
-    await expect(access(privatePath)).rejects.toThrow()
-  })
-
-  test('listIdentityKeys returns names with private keys', async () => {
-    await persistKeypair('manager', { keysDir: tmp })
-    await persistKeypair('alice', { keysDir: tmp })
-    await persistKeypair('bob', { keysDir: tmp })
-    const names = await listIdentityKeys(tmp)
-    expect(names.sort()).toEqual(['alice', 'bob', 'manager'])
-  })
-
-  test('encrypted export envelope round-trip (JWE PBES2)', async () => {
-    await persistKeypair('alice', { keysDir: tmp })
-    const plain = JSON.stringify({ subject: 'alice', secret: 'x' })
-    const passphrase = 'correct-horse-battery'
-    const enc = await new CompactEncrypt(new TextEncoder().encode(plain))
-      .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
-      .encrypt(new TextEncoder().encode(passphrase))
-
-    expect(enc.split('.').length).toBe(5)
-
-    const { plaintext } = await compactDecrypt(enc, new TextEncoder().encode(passphrase), {
-      keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
-    })
-    expect(new TextDecoder().decode(plaintext)).toBe(plain)
-  })
-
-  test('encrypted export fails with wrong passphrase', async () => {
-    const plain = JSON.stringify({ subject: 'alice' })
-    const enc = await new CompactEncrypt(new TextEncoder().encode(plain))
-      .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
-      .encrypt(new TextEncoder().encode('correct'))
-
-    await expect(
-      compactDecrypt(enc, new TextEncoder().encode('wrong'), {
-        keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
-      }),
-    ).rejects.toThrow()
-  })
-})

package/src/lib/domain-identity.ts

@@ -1,49 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import { resolve } from 'node:path'
-
-import { AstraleError } from '../errors'
-
-export async function loadPrivateJwk(keyPath: string): Promise<Record<string, unknown>> {
-  const filePath = resolve(keyPath)
-  const raw = await readFile(filePath, 'utf-8')
-  return JSON.parse(raw) as Record<string, unknown>
-}
-
-/**
- * True when the kernel rejected a `Domain.install` call because the
- * identity binding's signature failed to verify — i.e. the private/public
- * JWK halves don't match. Callers re-throw with a regenerate-the-keypair
- * hint instead of leaking the raw `AuthenticationError`.
- */
-export function isSignatureVerificationError(e: unknown): boolean {
-  if (!e || typeof e !== 'object') return false
-  const name = (e as { name?: unknown }).name
-  const msg = (e as { message?: unknown }).message
-  return (
-    name === 'AuthenticationError' &&
-    typeof msg === 'string' &&
-    /signature verification failed/i.test(msg)
-  )
-}
-
-/**
- * Resolve the JOSE algorithm to use with this key. Prefers `privateJwk.alg`
- * when present, falls back to inferring from `crv`/`kty` so keys generated
- * by older CLIs (which didn't stamp `alg`) keep working without manual
- * editing — see META_TRACE #34. Throws a clean error if neither path
- * resolves an algorithm.
- */
-export function inferAlg(privateJwk: Record<string, unknown>, keyPath?: string): string {
-  const explicit = privateJwk.alg
-  if (typeof explicit === 'string' && explicit.length > 0) return explicit
-  const crv = privateJwk.crv
-  const kty = privateJwk.kty
-  if (kty === 'EC' && crv === 'P-256') return 'ES256'
-  if (kty === 'OKP' && crv === 'Ed25519') return 'EdDSA'
-  const where = keyPath ? ` at ${keyPath}` : ''
-  throw new AstraleError(
-    'INVALID_KEY_FILE',
-    `JWK${where} is missing both \`alg\` and a recognizable \`(kty, crv)\` pair — cannot pick a signing algorithm.`,
-    'Re-stamp the file with `"alg": "ES256"` (P-256 EC keys) or `"alg": "EdDSA"` (Ed25519 OKP keys), or regenerate via `astrale domain init` / `astrale identity create`.',
-  )
-}

package/src/lib/env.ts

@@ -1,49 +0,0 @@
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-export type Paths = {
-  home: string
-  keys: string
-  data: string
-  config: string
-  install: string
-  identities: string
-  instances: string
-  idps: string
-  idpSessionsDir: string
-  /** Per-IdP config dir: `~/.astrale/idps/<name>/`. */
-  idpDir: (name: string) => string
-  /** Per-identity IdP session cache: `~/.astrale/idp-sessions/<name>.json`. */
-  idpSession: (identityName: string) => string
-}
-
-/**
- * Resolve the Astrale home dir.
- *
- * Priority: explicit arg → `ASTRALE_HOME` env var → `$HOME/.astrale`.
- */
-function resolveHome(home?: string): string {
-  return home ?? process.env.ASTRALE_HOME ?? join(homedir(), '.astrale')
-}
-
-export function createPaths(home?: string): Paths {
-  const base = resolveHome(home)
-  const idpsDir = join(base, 'idps')
-  const idpSessionsDir = join(base, 'idp-sessions')
-  return {
-    home: base,
-    keys: process.env.ASTRALE_KEYS_DIR ?? join(base, 'keys'),
-    data: process.env.ASTRALE_DATA_DIR ?? join(base, 'data'),
-    config: join(base, 'config.json'),
-    install: join(base, 'install.json'),
-    identities: join(base, 'identities.json'),
-    instances: join(base, 'instances.json'),
-    idps: join(idpsDir, 'index.json'),
-    idpSessionsDir,
-    idpDir: (name: string) => join(idpsDir, name),
-    idpSession: (identityName: string) => join(idpSessionsDir, `${identityName}.json`),
-  }
-}
-
-/** Default singleton used by all lib modules. */
-export const paths: Paths = createPaths()

package/src/lib/fs-atomic.ts

@@ -1,126 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import { mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
-import { dirname } from 'node:path'
-
-/** Write-tmp-then-rename so readers never observe a partial file. Mode 0600. */
-export async function atomicWrite(path: string, data: string): Promise<void> {
-  const tmp = `${path}.${randomUUID()}.tmp`
-  await writeFile(tmp, data, { mode: 0o600 })
-  await rename(tmp, path)
-}
-
-export type FileLockOptions = {
-  /** Delay between acquisition attempts while another process holds the lock. */
-  pollIntervalMs?: number
-  /** A lock file whose mtime is older than this is considered abandoned. */
-  staleAfterMs?: number
-  /** Give up acquiring after this long. */
-  timeoutMs?: number
-}
-
-/**
- * Run `fn` under a cross-process mutex backed by a create-exclusive lock file.
- *
- * Contenders poll until the holder releases (unlinks) the lock. Abandoned
- * locks are taken over when the holder pid is dead or the file's mtime
- * exceeds `staleAfterMs` — a crash mid-section can therefore delay other
- * processes by up to `staleAfterMs`, never deadlock them.
- */
-export async function withFileLock<T>(
-  lockPath: string,
-  fn: () => Promise<T>,
-  opts: FileLockOptions = {},
-): Promise<T> {
-  const pollIntervalMs = opts.pollIntervalMs ?? 100
-  const staleAfterMs = opts.staleAfterMs ?? 30_000
-  const timeoutMs = opts.timeoutMs ?? 60_000
-  const deadline = Date.now() + timeoutMs
-
-  for (;;) {
-    const acquired = await tryAcquire(lockPath)
-    if (acquired) {
-      try {
-        return await fn()
-      } finally {
-        await unlink(lockPath).catch(() => undefined)
-      }
-    }
-    if (await takeoverIfAbandoned(lockPath, staleAfterMs)) continue
-    if (Date.now() >= deadline) {
-      throw new Error(`Timed out after ${timeoutMs}ms waiting for lock ${lockPath}`)
-    }
-    await sleep(pollIntervalMs)
-  }
-}
-
-async function tryAcquire(lockPath: string): Promise<boolean> {
-  try {
-    const handle = await open(lockPath, 'wx', 0o600)
-    try {
-      await handle.writeFile(
-        JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }),
-      )
-    } finally {
-      await handle.close()
-    }
-    return true
-  } catch (e) {
-    const code = (e as { code?: string }).code
-    if (code === 'EEXIST') return false
-    if (code === 'ENOENT') {
-      await mkdir(dirname(lockPath), { recursive: true })
-      return tryAcquire(lockPath)
-    }
-    throw e
-  }
-}
-
-/**
- * Remove the lock if its holder is gone (dead pid, fast) or it outlived
- * `staleAfterMs` (mtime, covers unreadable pids and cross-container holders).
- * Returns true when the caller should immediately retry acquisition —
- * `open('wx')` re-arbitrates between concurrent takeover candidates.
- */
-async function takeoverIfAbandoned(lockPath: string, staleAfterMs: number): Promise<boolean> {
-  try {
-    const info = await stat(lockPath)
-    if (Date.now() - info.mtimeMs > staleAfterMs) {
-      await unlink(lockPath).catch(() => undefined)
-      return true
-    }
-  } catch (e) {
-    // Lock vanished between attempts: holder released — retry right away.
-    if ((e as { code?: string }).code === 'ENOENT') return true
-    throw e
-  }
-  const pid = await readLockPid(lockPath)
-  if (pid !== undefined && pid !== process.pid && !isPidAlive(pid)) {
-    await unlink(lockPath).catch(() => undefined)
-    return true
-  }
-  return false
-}
-
-async function readLockPid(lockPath: string): Promise<number | undefined> {
-  try {
-    const raw = await readFile(lockPath, 'utf-8')
-    const pid = (JSON.parse(raw) as { pid?: unknown }).pid
-    return typeof pid === 'number' ? pid : undefined
-  } catch {
-    return undefined
-  }
-}
-
-function isPidAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0)
-    return true
-  } catch (e) {
-    // EPERM means the pid exists but belongs to another user — still alive.
-    return (e as { code?: string }).code === 'EPERM'
-  }
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}

package/src/lib/identity.ts

@@ -1,256 +0,0 @@
-import { readFile, writeFile, mkdir } from 'node:fs/promises'
-import { dirname } from 'node:path'
-import { z } from 'zod'
-
-import { deleteIdpSession } from './idp'
-import { persistKeypair, removeKeypair } from './keys'
-import { log } from './log'
-import { IDENTITIES_PATH } from './paths'
-import { RegistryModeSchema, validateName, type RegistryMode } from './validation'
-
-export const RegistrationSchema = z.object({
-  iss: z.string(),
-  sub: z.string(),
-  registeredAt: z.string(),
-})
-
-export const IdentitySchema = z.object({
-  subject: z.string(),
-  createdAt: z.string(),
-  /** `key` identities sign local JWTs; `idp` identities reuse OAuth/OIDC access tokens. */
-  source: z.enum(['key', 'idp']).optional(),
-  // `local` = machine-only, `remote` = mirrored via astrale cloud (§2.7).
-  mode: RegistryModeSchema.optional(),
-  /** JWK thumbprint of the identity keypair. Optional for legacy entries. */
-  kid: z.string().optional(),
-  /** IdP registry name for source=idp identities. */
-  idp: z.string().optional(),
-  /** OIDC issuer for source=idp identities. */
-  issuer: z.string().url().optional(),
-  /** Optional preferred audience used during IdP login/refresh flows. */
-  audience: z.string().optional(),
-  /** Non-secret claims snapshot from the last successful IdP login. */
-  claims: z.record(z.string(), z.unknown()).optional(),
-  /**
-   * Cache of `(iss, sub)` pairs returned by `Identity::registerIdentity`,
-   * keyed by instance slug. Populated by `astrale identity register`; consulted
-   * by `resolveCredential` so `--as <name> -i <instance>` signs JWTs the kernel
-   * accepts.
-   */
-  registrations: z.record(z.string(), RegistrationSchema).optional(),
-})
-
-export type Registration = z.infer<typeof RegistrationSchema>
-
-export const IdentityStoreSchema = z.object({
-  default: z.string(),
-  identities: z.record(z.string(), IdentitySchema),
-})
-
-export type Identity = z.infer<typeof IdentitySchema>
-export type IdentityStore = z.infer<typeof IdentityStoreSchema>
-
-function seed(): IdentityStore {
-  return {
-    default: 'manager',
-    identities: {
-      manager: {
-        subject: 'manager',
-        createdAt: new Date().toISOString(),
-        source: 'key',
-        mode: 'local',
-      },
-    },
-  }
-}
-
-export async function readIdentities(): Promise<IdentityStore> {
-  try {
-    const raw = await readFile(IDENTITIES_PATH, 'utf-8')
-    return IdentityStoreSchema.parse(JSON.parse(raw))
-  } catch (e) {
-    if (e instanceof z.ZodError) {
-      log.warn(`Invalid identities at ${IDENTITIES_PATH} — using defaults`)
-    } else if ((e as { code?: string }).code !== 'ENOENT') {
-      // Present-but-unreadable file (malformed JSON → SyntaxError, or a
-      // non-missing-file read error). ENOENT is the legitimate first-run
-      // case and stays silent; anything else would otherwise be discarded
-      // and could be overwritten by a later writeIdentities.
-      log.warn(`Could not read identities at ${IDENTITIES_PATH} — using defaults`)
-    }
-    return seed()
-  }
-}
-
-export async function writeIdentities(store: IdentityStore): Promise<void> {
-  await mkdir(dirname(IDENTITIES_PATH), { recursive: true })
-  await writeFile(IDENTITIES_PATH, JSON.stringify(store, null, 2) + '\n')
-}
-
-export async function createIdentity(
-  name: string,
-  opts: {
-    subject?: string
-    mode?: RegistryMode
-    issuer?: string
-    kid?: string
-    skipKeygen?: boolean
-  } = {},
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  const store = await readIdentities()
-  if (store.identities[name]) {
-    throw new Error(`Identity "${name}" already exists`)
-  }
-  const subject = opts.subject ?? name
-  let kid: string | undefined
-  if (!opts.skipKeygen) {
-    const result = await persistKeypair(subject)
-    kid = result.kid
-  }
-  const identity: Identity = {
-    subject,
-    createdAt: new Date().toISOString(),
-    source: 'key',
-    mode: opts.mode ?? 'local',
-    kid: opts.kid ?? kid,
-    issuer: opts.issuer,
-  }
-  store.identities[name] = identity
-  await writeIdentities(store)
-  return identity
-}
-
-export async function upsertKeyIdentity(
-  name: string,
-  opts: {
-    subject: string
-    mode?: RegistryMode
-    issuer?: string
-    kid?: string
-  },
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  const store = await readIdentities()
-  const existing = store.identities[name]
-  if (existing && (existing.source ?? 'key') !== 'key') {
-    throw new Error(`Identity "${name}" already exists and is IdP-backed`)
-  }
-  const identity: Identity = {
-    subject: opts.subject,
-    createdAt: existing?.createdAt ?? new Date().toISOString(),
-    source: 'key',
-    mode: opts.mode ?? existing?.mode ?? 'local',
-    kid: opts.kid,
-    issuer: opts.issuer,
-  }
-  store.identities[name] = identity
-  await writeIdentities(store)
-  return identity
-}
-
-export async function deleteIdentity(name: string): Promise<void> {
-  const store = await readIdentities()
-  const entry = store.identities[name]
-  if (!entry) {
-    throw new Error(`Identity "${name}" not found`)
-  }
-  if (store.default === name) {
-    throw new Error(
-      `Cannot delete the default identity "${name}". Switch default first with: astrale identity use <other>`,
-    )
-  }
-  if ((entry.source ?? 'key') === 'idp') {
-    await deleteIdpSession(name)
-  } else {
-    await removeKeypair(entry.subject)
-  }
-  delete store.identities[name]
-  await writeIdentities(store)
-}
-
-export async function setDefault(name: string): Promise<void> {
-  const store = await readIdentities()
-  if (!store.identities[name]) {
-    throw new Error(`Identity "${name}" not found`)
-  }
-  store.default = name
-  await writeIdentities(store)
-}
-
-export async function getDefault(): Promise<Identity & { name: string }> {
-  const store = await readIdentities()
-  const identity = store.identities[store.default]
-  if (!identity) {
-    throw new Error(
-      `Default identity "${store.default}" not found. Run: astrale identity create ${store.default}`,
-    )
-  }
-  return { ...identity, name: store.default }
-}
-
-export async function getIdentity(name: string): Promise<Identity> {
-  const store = await readIdentities()
-  const identity = store.identities[name]
-  if (!identity) {
-    throw new Error(`Identity "${name}" not found. Run: astrale identity create ${name}`)
-  }
-  return identity
-}
-
-export async function upsertIdpIdentity(
-  name: string,
-  opts: {
-    subject: string
-    idp: string
-    issuer: string
-    audience?: string
-    claims?: Record<string, unknown>
-    use?: boolean
-  },
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  validateName(opts.idp, 'IdP')
-  const store = await readIdentities()
-  const existing = store.identities[name]
-  if (existing && (existing.source ?? 'key') !== 'idp') {
-    throw new Error(`Identity "${name}" already exists and is key-backed`)
-  }
-  const identity: Identity = {
-    subject: opts.subject,
-    createdAt: existing?.createdAt ?? new Date().toISOString(),
-    source: 'idp',
-    mode: 'remote',
-    idp: opts.idp,
-    issuer: opts.issuer,
-    audience: opts.audience,
-    claims: opts.claims,
-    registrations: existing?.registrations,
-  }
-  store.identities[name] = identity
-  if (opts.use !== false) store.default = name
-  await writeIdentities(store)
-  return identity
-}
-
-/** Record (or replace) the kernel-derived (iss, sub) pair for an identity on a target instance. */
-export async function setRegistration(
-  name: string,
-  instanceSlug: string,
-  registration: Registration,
-): Promise<void> {
-  const store = await readIdentities()
-  const entry = store.identities[name]
-  if (!entry) throw new Error(`Identity "${name}" not found`)
-  entry.registrations = { ...entry.registrations, [instanceSlug]: registration }
-  await writeIdentities(store)
-}
-
-/** Migrate an identity to a new registry mode (local ↔ remote, §2.7). */
-export async function setIdentityMode(name: string, mode: RegistryMode): Promise<void> {
-  const store = await readIdentities()
-  const entry = store.identities[name]
-  if (!entry) throw new Error(`Identity "${name}" not found`)
-  entry.mode = mode
-  await writeIdentities(store)
-}