@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/identity/.spec/flows/bootstrap-root.ts

@@ -1,79 +0,0 @@
-import type { IdentityExport } from '../api.js'
-
-interface Target {
-  readonly name: string
-  readonly url: string
-  readonly issuer: string
-}
-
-interface ReadyChild {
-  readonly target: Target
-  readonly operation: string
-  readonly instance: string
-}
-
-interface BootstrapAuthority {
-  /** Supported identity-import boundary; never a direct State or Keys write. */
-  importIdentity(input: {
-    readonly name: 'platform-root'
-    readonly envelope: IdentityExport
-  }): Promise<void>
-  bookmark(input: {
-    readonly target: Target
-    readonly defaultIdentity?: 'platform-root'
-  }): Promise<void>
-  /** Authenticated public Identity.whoami result on the selected target. */
-  whoami(input: {
-    readonly target: Target
-    readonly as?: 'platform-root'
-    readonly credential?: string
-  }): Promise<{ readonly id: string }>
-  /** Public manager createInstance call plus Operation and Instance status polling. */
-  callCreateChild(input: {
-    readonly manager: Target
-    readonly as: 'platform-root'
-    readonly operationId: string
-    readonly slug: string
-  }): Promise<ReadyChild>
-  /** Public Auth delegation invoked on the manager after authenticated whoami. */
-  delegateSelf(input: {
-    readonly manager: Target
-    readonly as: 'platform-root'
-    readonly principal: string
-    readonly audience: string
-  }): Promise<string>
-}
-
-/**
- * Bootstrap uses the imported root directly on the manager, then an unchanged
- * manager-to-child Management carrier whose effective child principal is
- * established only by the child's authenticated whoami result.
- */
-export async function bootstrapRootAndChild(
-  authority: BootstrapAuthority,
-  input: {
-    readonly envelope: IdentityExport
-    readonly manager: Target & { readonly name: 'platform-manager' }
-    readonly childSlug: string
-    readonly operationId: string
-  },
-): Promise<{ readonly managerId: string; readonly childId: string; readonly child: ReadyChild }> {
-  await authority.importIdentity({ name: 'platform-root', envelope: input.envelope })
-  await authority.bookmark({ target: input.manager, defaultIdentity: 'platform-root' })
-  const manager = await authority.whoami({ target: input.manager, as: 'platform-root' })
-  const child = await authority.callCreateChild({
-    manager: input.manager,
-    as: 'platform-root',
-    operationId: input.operationId,
-    slug: input.childSlug,
-  })
-  const credential = await authority.delegateSelf({
-    manager: input.manager,
-    as: 'platform-root',
-    principal: manager.id,
-    audience: child.target.issuer,
-  })
-  await authority.bookmark({ target: child.target })
-  const effectiveChild = await authority.whoami({ target: child.target, credential })
-  return { managerId: manager.id, childId: effectiveChild.id, child }
-}

package/src/identity/.spec/flows/domain-mediated-registration.ts

@@ -1,51 +0,0 @@
-import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth'
-import type { LocalBinding } from '@astrale-os/sdk/mutation'
-
-interface RegistrationAuthority {
-  prepareSelfProven(input: {
-    readonly identity: string
-    readonly classPath: string
-    readonly properties: Readonly<Record<string, unknown>>
-    readonly kernelIssuer: string
-  }): Promise<{ readonly binding: LocalBinding; readonly request: ProvisionRequest }>
-  call(input: {
-    readonly target: string
-    readonly request: ProvisionRequest
-  }): Promise<ProvisionResult>
-  persist(input: {
-    readonly identity: string
-    readonly targetKey: string
-    readonly issuer: string
-    readonly subject: string
-  }): Promise<void>
-}
-
-/** Application Identity Classes are provisioned only through their explicit authority owner. */
-export async function registerThroughDomain(
-  authority: RegistrationAuthority,
-  input: {
-    readonly identity: string
-    readonly classPath: string
-    readonly properties: Readonly<Record<string, unknown>>
-    readonly kernelIssuer: string
-    readonly targetKey: string
-    readonly callable: string
-  },
-): Promise<{ readonly issuer: string; readonly subject: string; readonly nodeId?: string }> {
-  const prepared = await authority.prepareSelfProven(input)
-  const result = await authority.call({ target: input.callable, request: prepared.request })
-  const identity = result.identities[prepared.binding]
-  if (identity === undefined) throw new Error('Provision result omitted the prepared binding.')
-  await authority.persist({
-    identity: input.identity,
-    targetKey: input.targetKey,
-    issuer: identity.issuer,
-    subject: identity.subject,
-  })
-  const nodeId = result.createdNodes[prepared.binding]
-  return {
-    issuer: identity.issuer,
-    subject: identity.subject,
-    ...(nodeId === undefined ? {} : { nodeId }),
-  }
-}

package/src/identity/.spec/flows/import.ts

@@ -1,29 +0,0 @@
-import type { Identity, IdentityExport, IdentityImportOptions, IdentityStore } from '../api.js'
-
-declare const withIdentityLock: <Value>(transition: () => Promise<Value>) => Promise<Value>
-declare const readLatest: () => Promise<IdentityStore>
-declare const checkImportConflict: (
-  store: IdentityStore,
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-) => string
-declare const persistAdmittedKeypair: (envelope: IdentityExport) => Promise<void>
-declare const publishIdentity: (
-  store: IdentityStore,
-  name: string,
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-) => Promise<Identity>
-
-/** Import performs all fallible admission before entering this ordered persistence flow. */
-export function importIdentity(
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-): Promise<Identity> {
-  return withIdentityLock(async () => {
-    const store = await readLatest()
-    const name = checkImportConflict(store, envelope, options)
-    await persistAdmittedKeypair(envelope)
-    return publishIdentity(store, name, envelope, options)
-  })
-}

package/src/identity/.spec/laws/identity.ts

@@ -1,56 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_IDENTITY_REGISTRY_TRANSITIONS = defineLaw({
-  id: 'CLI-IDENTITY-REGISTRY-TRANSITIONS',
-  statement:
-    'Create, selection, registration, mode change, and non-default deletion preserve one locked registry and isolated subject keypair; deleting the selected identity is rejected unchanged.',
-  tests: [{ file: '__tests__/registry.test.ts', id: 'TEST-CLI-IDENTITY-REGISTRY-JOURNEY' }],
-})
-
-export const CLI_IDENTITY_TRANSFER_ADMITTED = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-ADMITTED',
-  statement:
-    'Malformed, unsupported-version, or cryptographically mismatched transfer content is rejected before either key files or registry state changes.',
-  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-REJECTS' }],
-})
-
-export const CLI_IDENTITY_TRANSFER_ROUNDTRIP = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-ROUNDTRIP',
-  statement:
-    'Legacy plaintext and V1 plaintext or compact-JWE content converge on one V1 envelope, and explicit exports are published atomically with mode 0600.',
-  tests: [
-    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-ROUNDTRIP' },
-    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-EXPORT-PRIVATE' },
-  ],
-})
-
-export const CLI_IDENTITY_TRANSFER_SCHEMA = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-SCHEMA',
-  statement:
-    'Plaintext IdentityExport V1 has one independently versioned portable JSON Schema; decoding additionally proves the JWK pair before any durable mutation.',
-  tests: [
-    {
-      file: '__tests__/transfer.test.ts',
-      id: 'TEST-CLI-IDENTITY-TRANSFER-SCHEMA',
-    },
-  ],
-})
-
-export const CLI_IDENTITY_IMPORT_ORDERED = defineLaw({
-  id: 'CLI-IDENTITY-IMPORT-ORDERED',
-  statement:
-    'Import checks name and identity-source conflicts under the registry lock before replacing keys, then publishes the registry only after the admitted pair is durable.',
-  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-IMPORT-ORDERED' }],
-})
-
-export const CLI_IDENTITY_REGISTRATION_AUTHORITY = defineLaw({
-  id: 'CLI-IDENTITY-REGISTRATION-AUTHORITY',
-  statement:
-    'Identity registration binds one self-proven Provision request to the selected Kernel; direct submission uses caller authority, while explicit Domain-mediated submission sends the same request to the named callable and persists only its admitted prepared binding.',
-  tests: [
-    {
-      file: '__tests__/registration.test.ts',
-      id: 'TEST-CLI-IDENTITY-REGISTER-DOMAIN-MEDIATED',
-    },
-  ],
-})

package/src/identity/.spec/layout.ts

@@ -1,13 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: [
-    '__tests__/',
-    'index.ts',
-    'registration.ts',
-    'registry.ts',
-    'transfer.ts',
-    'tsconfig.json',
-  ],
-  exact: true,
-})

package/src/identity/__tests__/fixtures/registry-journey.ts

@@ -1,65 +0,0 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises'
-import { dirname } from 'node:path'
-
-import { fileExists, keypairPaths } from '../../../keys/index'
-import { EXCHANGE_CREDENTIALS_PATH, KEYS_DIR, SESSION_ROUTES_PATH } from '../../../state/index'
-import {
-  createIdentity,
-  exportIdentity,
-  importIdentity,
-  deleteIdentity,
-  getDefault,
-  readIdentities,
-  setDefault,
-  setIdentityMode,
-  setRegistration,
-  upsertIdpIdentity,
-} from '../../index'
-
-await createIdentity('alice')
-await createIdentity('bob', { mode: 'remote' })
-await importIdentity(await exportIdentity('alice'), { name: 'alice-alias' })
-await setDefault('alice')
-await setIdentityMode('bob', 'local')
-await setRegistration('alice', 'production', {
-  iss: 'https://kernel.example',
-  sub: 'node-alice',
-  registeredAt: '2026-08-11T12:00:00.000Z',
-})
-
-let selectedDeletion = ''
-try {
-  await deleteIdentity('alice')
-} catch (error) {
-  selectedDeletion = error instanceof Error ? error.message : String(error)
-}
-await mkdir(dirname(SESSION_ROUTES_PATH), { recursive: true })
-await mkdir(dirname(EXCHANGE_CREDENTIALS_PATH), { recursive: true })
-await writeFile(SESSION_ROUTES_PATH, '{"version":1,"entries":{"confidential":{}}}\n')
-await writeFile(
-  EXCHANGE_CREDENTIALS_PATH,
-  '{"version":2,"entries":{"confidential":{"credential":"bearer"}}}\n',
-)
-await deleteIdentity('bob')
-await deleteIdentity('alice-alias')
-await upsertIdpIdentity('workos', {
-  subject: 'user_123',
-  idp: 'workos',
-  issuer: 'https://idp.example',
-  audience: 'https://kernel.example',
-  use: false,
-})
-
-const store = await readIdentities()
-const selected = await getDefault()
-console.log(
-  JSON.stringify({
-    store,
-    selected,
-    selectedDeletion,
-    aliceKey: await fileExists(keypairPaths('alice', KEYS_DIR).privatePath),
-    bobKey: await fileExists(keypairPaths('bob', KEYS_DIR).privatePath),
-    routeCache: await fileExists(SESSION_ROUTES_PATH),
-    exchangeCache: JSON.parse(await readFile(EXCHANGE_CREDENTIALS_PATH, 'utf8')),
-  }),
-)

package/src/identity/__tests__/registration.test.ts

@@ -1,64 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-
-import { LocalBinding } from '@astrale-os/sdk/graph'
-import { expect, test } from 'bun:test'
-
-import { submitIdentityProvision } from '../registration'
-
-/** @evidence TEST-CLI-IDENTITY-REGISTER-DOMAIN-MEDIATED */
-test('submits the exact self-proven request through an explicit Domain callable', async () => {
-  const binding = LocalBinding('identity')
-  const request = {
-    idempotencyKey: 'identity-register:operator',
-    mutation: {
-      format: 'astrale.graph.mutation',
-      version: 'v2',
-      preconditions: [],
-      operations: [],
-    },
-    identities: {
-      identity: {
-        credentials: {
-          publicKey: { kty: 'EC', crv: 'P-256', x: 'x', y: 'y', alg: 'ES256' },
-          proof: 'self-proven-request.jwt.signature',
-        },
-      },
-    },
-  } as unknown as ProvisionRequest
-  const calls: unknown[] = []
-  let directCalls = 0
-  const result = await submitIdentityProvision({
-    binding,
-    request,
-    via: '/:ops.example:function.provisionOperator',
-    direct: {
-      async provision() {
-        directCalls += 1
-        throw new Error('direct provision must not run')
-      },
-    },
-    callable: {
-      async call(call) {
-        calls.push(call)
-        return {
-          createdNodes: { identity: 'operator-node' },
-          identities: {
-            identity: { issuer: 'https://identity.example', subject: 'operator-node' },
-          },
-        }
-      },
-    },
-  })
-
-  expect(directCalls).toBe(0)
-  expect(calls).toHaveLength(1)
-  expect(JSON.parse(JSON.stringify(calls[0]))).toEqual({
-    target: '/:ops.example:function.provisionOperator',
-    input: JSON.parse(JSON.stringify(request)),
-  })
-  expect(result).toEqual({
-    iss: 'https://identity.example',
-    sub: 'operator-node',
-    nodeId: 'operator-node',
-  })
-})

package/src/identity/__tests__/registry.test.ts

@@ -1,74 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-describe('identity registry journey', () => {
-  let root = ''
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'astrale-identity-registry-'))
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-REGISTRY-JOURNEY */
-  test('runs create, selection, registration, mode, IdP, and deletion in a real process', async () => {
-    const child = Bun.spawn(
-      [process.execPath, join(import.meta.dir, 'fixtures', 'registry-journey.ts')],
-      {
-        env: { ...process.env, ASTRALE_HOME: root },
-        stdout: 'pipe',
-        stderr: 'pipe',
-      },
-    )
-    const [exitCode, stdout, stderr] = await Promise.all([
-      child.exited,
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-    ])
-    expect(exitCode, stderr).toBe(0)
-
-    const result = JSON.parse(stdout) as {
-      store: {
-        default: string
-        identities: Record<
-          string,
-          {
-            source?: string
-            mode?: string
-            registrations?: Record<string, { iss: string; sub: string; registeredAt: string }>
-          }
-        >
-      }
-      selected: { name: string; subject: string }
-      selectedDeletion: string
-      aliceKey: boolean
-      bobKey: boolean
-      routeCache: boolean
-      exchangeCache: unknown
-    }
-    expect(result.store.default).toBe('alice')
-    expect(Object.keys(result.store.identities).sort()).toEqual(['alice', 'workos'])
-    expect(result.store.identities.alice.registrations?.production).toEqual({
-      iss: 'https://kernel.example',
-      sub: 'node-alice',
-      registeredAt: '2026-08-11T12:00:00.000Z',
-    })
-    expect(result.store.identities.workos).toMatchObject({ source: 'idp', mode: 'remote' })
-    expect(result.selected).toMatchObject({ name: 'alice', subject: 'alice' })
-    expect(result.selectedDeletion).toContain('Cannot delete the default identity')
-    expect(result.aliceKey).toBe(true)
-    expect(result.bobKey).toBe(false)
-    expect(result.routeCache).toBe(false)
-    expect(result.exchangeCache).toEqual({ version: 2, entries: {} })
-
-    const persisted = JSON.parse(await readFile(join(root, 'identities.json'), 'utf-8')) as {
-      version?: unknown
-    }
-    expect(persisted.version).toBe(1)
-    expect(stdout).not.toContain('"d":')
-  })
-})

package/src/identity/__tests__/transfer.test.ts

@@ -1,198 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { access, mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { keypairPaths, persistKeypair, readKeypair } from '../../keys/index'
-import { readIdentityStore, updateIdentityStore } from '../../state/index'
-import {
-  decodeIdentityExport,
-  encodeIdentityExport,
-  exportIdentity,
-  importIdentity,
-  isEncryptedIdentityExport,
-  writeIdentityExport,
-  type IdentityExport,
-} from '../index'
-
-describe('identity transfer', () => {
-  let root = ''
-  let statePath = ''
-  let keysDir = ''
-  const now = () => new Date('2026-08-11T12:00:00.000Z')
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'astrale-identity-transfer-'))
-    statePath = join(root, 'identities.json')
-    keysDir = join(root, 'keys')
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  async function envelope(subject: string, suffix: string): Promise<IdentityExport> {
-    const pair = await persistKeypair(subject, {
-      keysDir: join(root, `source-${suffix}`),
-      kid: `${subject}-${suffix}`,
-    })
-    return decodeIdentityExport(
-      JSON.stringify({
-        version: 1,
-        subject,
-        mode: 'local',
-        kid: pair.kid,
-        issuer: 'https://identity.example',
-        privateJwk: pair.privateJwk,
-        publicJwk: pair.publicJwk,
-      }),
-    )
-  }
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-REJECTS */
-  test('rejects malformed, newer, and mismatched content before durable mutation', async () => {
-    await expect(decodeIdentityExport('{')).rejects.toThrow(/not valid JSON/)
-    await expect(
-      decodeIdentityExport(
-        JSON.stringify({
-          version: 2,
-          subject: 'alice',
-          mode: 'local',
-          privateJwk: {},
-          publicJwk: {},
-        }),
-      ),
-    ).rejects.toThrow(/invalid or unsupported shape/)
-
-    const alice = await envelope('alice', 'a')
-    const bob = await envelope('bob', 'b')
-    const forged = {
-      ...alice,
-      publicJwk: { ...bob.publicJwk, kid: alice.kid },
-    } as IdentityExport
-    const mismatch = await importIdentity(forged, {
-      state: { path: statePath, now },
-      keysDir,
-    }).catch((error) => error)
-    expect(mismatch).toBeInstanceOf(Error)
-    expect((mismatch as Error).message).toMatch(/do not form a valid matching pair/)
-    expect((mismatch as Error).message).not.toContain(String(alice.privateJwk.d))
-
-    await expect(access(statePath)).rejects.toThrow()
-    await expect(access(keypairPaths('alice', keysDir).privatePath)).rejects.toThrow()
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-ROUNDTRIP */
-  test('converges legacy, V1, and encrypted representations on one envelope', async () => {
-    const current = await envelope('alice', 'roundtrip')
-    const { version: _, ...legacy } = current
-    expect(await decodeIdentityExport(JSON.stringify(legacy))).toEqual(current)
-
-    const plaintext = await encodeIdentityExport(current)
-    expect(isEncryptedIdentityExport(plaintext)).toBe(false)
-    expect(await decodeIdentityExport(plaintext)).toEqual(current)
-
-    const encrypted = await encodeIdentityExport(current, 'correct-horse-battery')
-    expect(isEncryptedIdentityExport(encrypted)).toBe(true)
-    expect(await decodeIdentityExport(encrypted, 'correct-horse-battery')).toEqual(current)
-    await expect(decodeIdentityExport(encrypted, 'wrong')).rejects.toThrow(/Could not decrypt/)
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-SCHEMA */
-  test('keeps the portable V1 JSON Schema aligned with the admitted identity envelope', async () => {
-    const schemaPath = fileURLToPath(
-      new URL('../.spec/schemas/identity-export-v1.schema.json', import.meta.url),
-    )
-    const schema = JSON.parse(await readFile(schemaPath, 'utf8')) as {
-      readonly $id: string
-      readonly additionalProperties: boolean
-      readonly required: readonly string[]
-      readonly properties: Readonly<Record<string, unknown>>
-    }
-    const identityEnvelope = await envelope('manager-principal', 'host-bootstrap')
-
-    expect(schema.$id).toBe('https://schemas.astrale.ai/cli/identity-export/1')
-    expect(schema.additionalProperties).toBe(false)
-    expect(schema.required).toEqual(['version', 'subject', 'privateJwk', 'publicJwk'])
-    expect(Object.keys(schema.properties).sort()).toEqual(
-      ['issuer', 'kid', 'mode', 'privateJwk', 'publicJwk', 'subject', 'version'].sort(),
-    )
-    await expect(decodeIdentityExport(JSON.stringify(identityEnvelope))).resolves.toEqual(
-      identityEnvelope,
-    )
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-IMPORT-ORDERED */
-  test('checks conflicts before key replacement and publishes registry after keys', async () => {
-    const first = await envelope('alice', 'first')
-    const imported = await importIdentity(first, {
-      name: 'operator',
-      state: { path: statePath, now },
-      keysDir,
-    })
-    expect(imported.subject).toBe('alice')
-    expect((await readKeypair('alice', keysDir)).kid).toBe(first.kid)
-    expect((await readIdentityStore({ path: statePath })).identities.operator).toEqual(imported)
-
-    const privatePath = keypairPaths('alice', keysDir).privatePath
-    const originalPrivate = await readFile(privatePath, 'utf-8')
-    const replacement = await envelope('alice', 'replacement')
-    await expect(
-      importIdentity(replacement, {
-        name: 'operator',
-        state: { path: statePath, now },
-        keysDir,
-      }),
-    ).rejects.toThrow('already exists')
-    expect(await readFile(privatePath, 'utf-8')).toBe(originalPrivate)
-
-    await updateIdentityStore(
-      (store) => ({
-        next: {
-          ...store,
-          identities: {
-            ...store.identities,
-            remote: {
-              subject: 'remote-user',
-              createdAt: now().toISOString(),
-              source: 'idp',
-              mode: 'remote',
-              idp: 'workos',
-              issuer: 'https://idp.example',
-            },
-          },
-        },
-        value: undefined,
-      }),
-      { path: statePath, now },
-    )
-    await expect(
-      importIdentity(await envelope('remote-user', 'remote'), {
-        name: 'remote',
-        replace: true,
-        state: { path: statePath, now },
-        keysDir,
-      }),
-    ).rejects.toThrow(/IdP-backed/)
-    await expect(access(keypairPaths('remote-user', keysDir).privatePath)).rejects.toThrow()
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-EXPORT-PRIVATE */
-  test('exports a proven pair through one atomic mode-0600 file', async () => {
-    await importIdentity(await envelope('alice', 'export'), {
-      state: { path: statePath, now },
-      keysDir,
-    })
-    const exported = await exportIdentity('alice', {
-      state: { path: statePath, now },
-      keysDir,
-    })
-    const path = join(root, 'alice.identity.json')
-    await writeIdentityExport(path, await encodeIdentityExport(exported))
-
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect(await decodeIdentityExport(await readFile(path, 'utf-8'))).toEqual(exported)
-    expect((await readdir(root)).some((entry) => entry.endsWith('.tmp'))).toBe(false)
-  })
-})

package/src/identity/index.ts

@@ -1,23 +0,0 @@
-export {
-  createIdentity,
-  deleteIdentity,
-  getDefault,
-  getIdentity,
-  readIdentities,
-  setDefault,
-  setIdentityMode,
-  setRegistration,
-  upsertIdpIdentity,
-} from './registry'
-export {
-  decodeIdentityExport,
-  encodeIdentityExport,
-  exportIdentity,
-  importIdentity,
-  isEncryptedIdentityExport,
-  writeIdentityExport,
-} from './transfer'
-export { acceptProvisionedIdentity, submitIdentityProvision } from './registration'
-export type { IdentityProvisionSubmission, IdentityRegistrationResult } from './registration'
-export type { Identity, IdentityStore, Registration } from './registry'
-export type { IdentityExport, IdentityFileOptions, IdentityImportOptions } from './transfer'