@astrale-os/cli 0.8.0-alpha.0 → 0.8.1-alpha.2

package/src/lib/keys.ts

@@ -1,294 +0,0 @@
-import { generateKeyPair, exportJWK, importJWK, SignJWT, type JWK } from 'jose'
-import { randomUUID } from 'node:crypto'
-import { readFile, mkdir, access, unlink } from 'node:fs/promises'
-import { join } from 'node:path'
-
-import { IdentityKeyMissingError } from '../errors'
-import { inferAlg } from './domain-identity'
-import { atomicWrite } from './fs-atomic'
-import { log } from './log'
-import { KEYS_DIR } from './paths'
-
-const LEGACY_MANAGER_PRIVATE = 'manager.private.jwk'
-const LEGACY_MANAGER_PUBLIC = 'manager.public.jwk'
-
-// Default issuer/audience for the host-mode manager's own credential. The
-// manager kernel mounts at `/host` (the reserved host slug — SPEC §5.2).
-const DEFAULT_MANAGER_ISSUER = 'http://localhost:4400/host'
-
-type AuthOptions = {
-  issuer?: string
-  subject?: string
-  kid?: string
-}
-
-export type AuthBinding = {
-  credential: string
-  publicKey: { jwk: JWK }
-}
-
-export type KeypairPaths = {
-  privatePath: string
-  publicPath: string
-}
-
-/**
- * Per-identity keypair paths. `manager` stays on the legacy filenames so
- * existing installs keep working; other subjects use `<subject>.*.jwk`.
- */
-export function keypairPaths(subject: string, keysDir: string = KEYS_DIR): KeypairPaths {
-  if (subject === 'manager') {
-    return {
-      privatePath: join(keysDir, LEGACY_MANAGER_PRIVATE),
-      publicPath: join(keysDir, LEGACY_MANAGER_PUBLIC),
-    }
-  }
-  return {
-    privatePath: join(keysDir, `${subject}.private.jwk`),
-    publicPath: join(keysDir, `${subject}.public.jwk`),
-  }
-}
-
-export async function fileExists(path: string): Promise<boolean> {
-  try {
-    await access(path)
-    return true
-  } catch {
-    return false
-  }
-}
-
-/** List identity names that have a private key on disk. */
-export async function listIdentityKeys(keysDir: string = KEYS_DIR): Promise<string[]> {
-  try {
-    const { readdir } = await import('node:fs/promises')
-    const entries = await readdir(keysDir)
-    const names = new Set<string>()
-    for (const entry of entries) {
-      if (entry === LEGACY_MANAGER_PRIVATE) names.add('manager')
-      else if (entry.endsWith('.private.jwk')) names.add(entry.replace(/\.private\.jwk$/, ''))
-    }
-    return Array.from(names).sort()
-  } catch {
-    return []
-  }
-}
-
-/**
- * Generate a fresh Ed25519 keypair as plain JWKs (not persisted).
- *
- * Used by the domain scaffold to stamp worker key files with a real,
- * internally-consistent pair — defense against drift between `d` and `x`
- * (historical template copies had a mismatched `x`, making every scaffold
- * inherit a broken pair). Same crypto as ES256 elsewhere in the CLI but
- * EdDSA/Ed25519 matches the worker runtime convention.
- */
-export async function generateEd25519Jwk(
-  kid: string,
-): Promise<{ privateJwk: JWK; publicJwk: JWK }> {
-  const { publicKey, privateKey } = await generateKeyPair('EdDSA', {
-    crv: 'Ed25519',
-    extractable: true,
-  })
-  const privateJwk = await exportJWK(privateKey)
-  const publicJwk = await exportJWK(publicKey)
-  privateJwk.alg = 'EdDSA'
-  publicJwk.alg = 'EdDSA'
-  privateJwk.kid = kid
-  publicJwk.kid = kid
-  return { privateJwk, publicJwk }
-}
-
-/**
- * Generate a new keypair for `subject`, persist atomically with 0o600
- * perms, and return the JWKs + kid. Overwrites any existing keys.
- */
-export async function persistKeypair(
-  subject: string,
-  opts?: { keysDir?: string; kid?: string },
-): Promise<{ publicJwk: JWK; privateJwk: JWK; kid: string }> {
-  const keysDir = opts?.keysDir ?? KEYS_DIR
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-  await mkdir(keysDir, { recursive: true })
-
-  const { publicKey, privateKey } = await generateKeyPair('ES256', { extractable: true })
-  const publicJwk = await exportJWK(publicKey)
-  const privateJwk = await exportJWK(privateKey)
-  const kid = opts?.kid ?? `${subject}-key-${randomUUID().slice(0, 8)}`
-  publicJwk.kid = kid
-  privateJwk.kid = kid
-  publicJwk.alg = 'ES256'
-  privateJwk.alg = 'ES256'
-
-  await atomicWrite(privatePath, JSON.stringify(privateJwk, null, 2))
-  await atomicWrite(publicPath, JSON.stringify(publicJwk, null, 2))
-
-  return { publicJwk, privateJwk, kid }
-}
-
-/** Remove a subject's keypair files. Idempotent. */
-export async function removeKeypair(subject: string, keysDir: string = KEYS_DIR): Promise<void> {
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-  for (const p of [privatePath, publicPath]) {
-    try {
-      await unlink(p)
-    } catch {
-      /* ignore */
-    }
-  }
-}
-
-// Legacy signal: warn once per session when an unknown subject falls back
-// to the manager key.
-const warnedFallback = new Set<string>()
-
-async function loadSigningMaterial(
-  subject: string,
-  keysDir: string,
-): Promise<{ privateJwk: JWK; publicJwk: JWK; kid: string }> {
-  const { privatePath, publicPath } = keypairPaths(subject, keysDir)
-
-  if (await fileExists(privatePath)) {
-    const privateJwk = JSON.parse(await readFile(privatePath, 'utf-8')) as JWK
-    const publicJwk = JSON.parse(await readFile(publicPath, 'utf-8')) as JWK
-    return {
-      privateJwk,
-      publicJwk,
-      kid: (privateJwk.kid as string | undefined) ?? `${subject}-key`,
-    }
-  }
-
-  if (process.env.ASTRALE_STRICT_IDENTITIES === '1') {
-    throw new IdentityKeyMissingError(subject)
-  }
-
-  // Manager always uses its own file. Any other subject falls through
-  // to the manager key with a one-shot warning so the migration window
-  // stays visible without being noisy.
-  if (subject === 'manager') throw new IdentityKeyMissingError(subject)
-
-  const { privatePath: mgrPrivate, publicPath: mgrPublic } = keypairPaths('manager', keysDir)
-  if (!(await fileExists(mgrPrivate))) throw new IdentityKeyMissingError(subject)
-
-  if (!warnedFallback.has(subject)) {
-    log.warn(
-      `Legacy shared-key mode for "${subject}" — run \`astrale identity create ${subject}\` to generate a dedicated key.`,
-    )
-    warnedFallback.add(subject)
-  }
-  const privateJwk = JSON.parse(await readFile(mgrPrivate, 'utf-8')) as JWK
-  const publicJwk = JSON.parse(await readFile(mgrPublic, 'utf-8')) as JWK
-  return {
-    privateJwk,
-    publicJwk,
-    kid: (privateJwk.kid as string | undefined) ?? 'manager-key',
-  }
-}
-
-/**
- * Sign a self-identity credential (`grant: identity/self`) from a private
- * JWK. Shared by `persistAuth`, `loadAuth`, and `signAs` so the protected
- * header and claim set stay identical across all three; the only thing that
- * varies is how each caller obtains the key material and which
- * subject/audience it stamps.
- */
-async function signIdentityCredential(args: {
-  privateJwk: JWK
-  kid: string
-  issuer: string
-  subject: string
-  audience: string
-}): Promise<string> {
-  const alg = inferAlg(args.privateJwk as Record<string, unknown>)
-  const privateKey = await importJWK(args.privateJwk, alg)
-  return new SignJWT({ grant: { v: 1, expr: { kind: 'identity', self: true } } })
-    .setProtectedHeader({ alg, kid: args.kid })
-    .setIssuer(args.issuer)
-    .setSubject(args.subject)
-    .setAudience(args.audience)
-    .sign(privateKey)
-}
-
-/**
- * Generate a new keypair, persist to disk, and return a signed credential.
- * Wraps the manager init path — use `persistKeypair` for bare keypair generation.
- */
-export async function persistAuth(
-  keysDir: string = KEYS_DIR,
-  opts?: AuthOptions,
-): Promise<AuthBinding> {
-  const issuer = opts?.issuer ?? DEFAULT_MANAGER_ISSUER
-  const subject = opts?.subject ?? 'manager'
-  const kid = opts?.kid ?? `${subject}-key`
-
-  const { privateJwk, publicJwk } = await persistKeypair(subject, { keysDir, kid })
-  const credential = await signIdentityCredential({
-    privateJwk,
-    kid,
-    issuer,
-    subject,
-    audience: issuer,
-  })
-
-  return { credential, publicKey: { jwk: publicJwk } }
-}
-
-/**
- * Load existing keys from disk and sign a fresh credential.
- */
-export async function loadAuth(
-  keysDir: string = KEYS_DIR,
-  opts?: AuthOptions,
-): Promise<AuthBinding> {
-  const issuer = opts?.issuer ?? DEFAULT_MANAGER_ISSUER
-  const subject = opts?.subject ?? 'manager'
-
-  const { privateJwk, publicJwk, kid } = await loadSigningMaterial(subject, keysDir)
-  const credential = await signIdentityCredential({
-    privateJwk,
-    kid,
-    issuer,
-    subject,
-    audience: issuer,
-  })
-
-  return { credential, publicKey: { jwk: publicJwk } }
-}
-
-/**
- * Load existing keys if present, otherwise generate and persist new ones.
- */
-export async function resolveAuth(
-  keysDir: string = KEYS_DIR,
-  opts?: AuthOptions,
-): Promise<AuthBinding> {
-  const subject = opts?.subject ?? 'manager'
-  const { privatePath } = keypairPaths(subject, keysDir)
-  if (await fileExists(privatePath)) {
-    return loadAuth(keysDir, opts)
-  }
-  return persistAuth(keysDir, opts)
-}
-
-/**
- * Sign a JWT as a specific subject. Uses the subject's own keypair when
- * present; falls back to the manager key (with a one-shot warning) for
- * unknown subjects until `ASTRALE_STRICT_IDENTITIES=1` is set.
- */
-export async function signAs(
-  subject: string,
-  keysDir: string = KEYS_DIR,
-  opts?: { issuer?: string; audience?: string; subject?: string },
-): Promise<string> {
-  const issuer = opts?.issuer ?? DEFAULT_MANAGER_ISSUER
-  const audience = opts?.audience ?? issuer
-  const { privateJwk, kid } = await loadSigningMaterial(subject, keysDir)
-
-  return signIdentityCredential({
-    privateJwk,
-    kid,
-    issuer,
-    subject: opts?.subject ?? subject,
-    audience,
-  })
-}

package/src/lib/paths.ts

@@ -1,11 +0,0 @@
-import { paths } from './env'
-
-export const ASTRALE_HOME = paths.home
-export const KEYS_DIR = paths.keys
-export const DATA_DIR = paths.data
-export const CONFIG_PATH = paths.config
-export const INSTALL_PATH = paths.install
-export const IDENTITIES_PATH = paths.identities
-export const INSTANCES_PATH = paths.instances
-export const IDPS_PATH = paths.idps
-export const IDP_SESSIONS_DIR = paths.idpSessionsDir

package/src/program.ts

@@ -1,213 +0,0 @@
-import { Command, Option } from 'commander'
-
-import type { CommandDefinition } from './command'
-
-import pkg from '../package.json' with { type: 'json' }
-import { KERNEL_PASSTHROUGH_OPTIONS } from './kernel/options'
-import { RAW_OUTPUT_OPTIONS } from './lib/output'
-import { registerCommand, registerGroup } from './registry'
-
-/**
- * Build the fully-wired Commander program (every command + group registered)
- * WITHOUT parsing argv. `bin/astrale.ts` is a thin shim that calls this and
- * `.parse()`; tests import it to walk the command tree (the `--help` surface
- * is asserted to be the source of truth it claims to be — see
- * `commands/__tests__/help-contract.test.ts`).
- */
-export async function buildProgram(): Promise<Command> {
-  const program = new Command()
-
-  program
-    .name('astrale')
-    .description('Astrale CLI — connect to existing Astrale kernels')
-    // Single source of truth = package.json (bumped by release-please together
-    // with .release-please-manifest.json). Never hand-write a version literal.
-    .version(pkg.version)
-    .showSuggestionAfterError(true)
-    .addOption(new Option('--ci', 'Machine mode: no prompts, structured errors on stderr'))
-    .addOption(new Option('--no-prompt', 'Disable interactive prompts'))
-    .addOption(
-      new Option('--offline-ok', 'Tolerate offline state for commands that can operate locally'),
-    )
-    .addOption(
-      new Option('--log-level <level>', 'Log level').choices(['debug', 'info', 'warn', 'error']),
-    )
-    .addOption(new Option('--log-format <format>', 'Log output format').choices(['text', 'json']))
-    .action(async () => {
-      // Bare `astrale` in an interactive terminal with nothing connected yet →
-      // launch the guided setup. Otherwise (configured, piped, or CI) show help.
-      if (process.stdin.isTTY && process.stdout.isTTY) {
-        const { shouldAutostartSetup } = await import('./setup/engine')
-        if (await shouldAutostartSetup()) {
-          await (await import('./commands/setup')).default.action(undefined, {})
-          return
-        }
-      }
-      program.help()
-    })
-
-  // Options shared by every kernel-touching command (call / token / get / ls /
-  // describe / query + `domain install`). Merged onto the command's own
-  // options at the registration site so the list stays single-sourced — the
-  // command-definition files only carry their command-specific options.
-  const kernelOptions = [
-    {
-      flags: '--format <type>',
-      description: 'Output format (default: yaml in TTY, json when piped)',
-      choices: ['yaml', 'json'],
-    },
-    ...RAW_OUTPUT_OPTIONS,
-    ...KERNEL_PASSTHROUGH_OPTIONS,
-  ]
-
-  const withKernelOptions = (def: CommandDefinition): CommandDefinition => ({
-    ...def,
-    options: [...(def.options ?? []), ...kernelOptions],
-  })
-
-  // Verbatim alias of `identity whoami` — defer to the command-definition
-  // module so options stay in sync.
-  const whoamiMod = await import('./commands/identity/whoami')
-  registerCommand(program, {
-    name: 'whoami',
-    description: 'Show the current default identity (alias for identity whoami)',
-    options: whoamiMod.default.options,
-    action: whoamiMod.default.action,
-  })
-  registerCommand(program, (await import('./commands/setup')).default)
-  registerCommand(program, (await import('./commands/use')).default)
-  registerCommand(program, (await import('./commands/update')).default)
-
-  // ── Graph / kernel ─────────────────────────────────────────────
-  registerCommand(program, withKernelOptions((await import('./commands/call')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/token')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/get')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/mutate')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/ls')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/describe')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/query')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/logs')).default))
-  registerCommand(program, withKernelOptions((await import('./commands/view')).default))
-  registerCommand(program, (await import('./commands/status')).default)
-  registerCommand(program, (await import('./commands/browser')).default)
-  registerCommand(program, (await import('./commands/view-serve')).default)
-  registerCommand(program, (await import('./commands/studio')).default)
-
-  registerGroup(program, {
-    name: 'instance',
-    description: 'Manage admin-provisioned instances and local bookmarks',
-    commands: [
-      withKernelOptions((await import('./commands/instance/list')).default),
-      (await import('./commands/instance/bookmark')).default,
-      (await import('./commands/instance/forget')).default,
-      withKernelOptions((await import('./commands/instance/create')).default),
-      withKernelOptions((await import('./commands/instance/delete')).default),
-      withKernelOptions((await import('./commands/instance/status')).default),
-      (await import('./commands/instance/active')).default,
-      (await import('./commands/instance/use')).default,
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'domain',
-    description: 'List, publish, and install domains (admin catalog + per-instance install)',
-    commands: [
-      withKernelOptions((await import('./commands/domain/list')).default),
-      withKernelOptions((await import('./commands/domain/publish')).default),
-      withKernelOptions((await import('./commands/domain/install')).default),
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'admin',
-    description: 'Configure the admin kernel',
-    commands: [
-      (await import('./commands/admin/status')).default,
-      (await import('./commands/admin/use')).default,
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'identity',
-    description: 'Manage CLI identities & delegation keypairs',
-    commands: [
-      (await import('./commands/identity/create')).default,
-      (await import('./commands/identity/register')).default,
-      (await import('./commands/identity/list')).default,
-      (await import('./commands/identity/use')).default,
-      (await import('./commands/identity/whoami')).default,
-      (await import('./commands/identity/delete')).default,
-      (await import('./commands/identity/sync')).default,
-      (await import('./commands/identity/unsync')).default,
-      (await import('./commands/identity/export')).default,
-      (await import('./commands/identity/import')).default,
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'auth',
-    description: 'Authenticate with configured identity providers',
-    commands: [
-      (await import('./commands/auth/login')).default,
-      (await import('./commands/auth/token')).default,
-      (await import('./commands/auth/logout')).default,
-      (await import('./commands/auth/status')).default,
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'session',
-    description: 'Locally recorded work sessions: list and DX-analyze them',
-    commands: [
-      (await import('./commands/session/list')).default,
-      (await import('./commands/session/analyze')).default,
-    ],
-  })
-
-  registerGroup(program, {
-    name: 'idp',
-    description: 'Manage OpenID Connect identity providers',
-    commands: [
-      (await import('./commands/idp/add')).default,
-      (await import('./commands/idp/list')).default,
-      (await import('./commands/idp/show')).default,
-      (await import('./commands/idp/refresh')).default,
-      (await import('./commands/idp/remove')).default,
-    ],
-  })
-
-  program.addHelpText(
-    'after',
-    `
-Command groups:
-  Getting started  setup     (sign in, pick an instance, equip your workspace)
-  Kernel        ls, get, mutate, call, query, describe, token
-  Management    admin, instance, domain, identity, auth, idp, update
-  Agent         browser   (drive the GUI via agent-browser)
-  Studio        studio    (launch the local Domain Studio GUI for a workspace)
-
-Path syntax:
-  /domain                        Domain node
-  /domain/class.Name             Class node     (or /domain/interface.Name)
-  /domain/class.Name/method      Static method  — single slash
-                                 (interface-hosted static: /domain/interface.Name/method)
-  <nodePath>::method             Instance method dispatch — double colon ::
-  @nodeId                        Reference a node by its UID
-  @nodeId::method                Instance method on a node by UID
-
-Examples:
-  $ astrale ls /
-  $ astrale studio
-  $ astrale admin status
-  $ astrale update --check
-  $ astrale instance bookmark staging --url https://kernel.example.com
-  $ astrale instance create my-app
-  $ astrale instance status staging
-  $ astrale token --audience shell.astrale.ai --ttl 3600
-  $ astrale query / --depth 1
-  $ astrale query --cypher 'MATCH (n) RETURN n LIMIT 5'
-`,
-  )
-
-  return program
-}