@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/identity/registration.ts

@@ -1,72 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { Call } from '@astrale-os/sdk/client'
-import type { LocalBinding } from '@astrale-os/sdk/graph'
-
-import { issuer } from '@astrale-os/sdk/auth'
-import { call } from '@astrale-os/sdk/client'
-import { NodeId } from '@astrale-os/sdk/graph/node'
-import { Path } from '@astrale-os/sdk/graph/path'
-
-export interface IdentityRegistrationResult {
-  readonly iss: string
-  readonly sub: string
-  readonly nodeId?: string
-}
-
-export interface IdentityProvisionSubmission {
-  readonly request: ProvisionRequest
-  readonly binding: LocalBinding
-  readonly via?: string
-  readonly direct: {
-    provision(request: ProvisionRequest): Promise<unknown>
-  }
-  readonly callable: {
-    call(call: Call): Promise<unknown>
-  }
-}
-
-/** Submit one prepared request either directly or through its explicit Domain authority owner. */
-export async function submitIdentityProvision(
-  input: IdentityProvisionSubmission,
-): Promise<IdentityRegistrationResult> {
-  const result =
-    input.via === undefined
-      ? await input.direct.provision(input.request)
-      : await input.callable.call(
-          // Client admits the portable value before transport. ProvisionRequest is the
-          // stricter semantic type but does not declare the portable Object index signature.
-          call(Path.parse(input.via), input.request as unknown as Call['input']),
-        )
-  return acceptProvisionedIdentity(result, input.binding)
-}
-
-/** Admit only the exact binding the CLI prepared; remote callables remain untrusted input. */
-export function acceptProvisionedIdentity(
-  value: unknown,
-  binding: LocalBinding,
-): IdentityRegistrationResult {
-  const result = record(value, 'Provision result')
-  const identities = record(result.identities, 'Provision result identities')
-  const identity = record(identities[binding], 'Provision result identity binding')
-  const createdNodes = record(result.createdNodes, 'Provision result created Nodes')
-  const node = createdNodes[binding]
-  return Object.freeze({
-    iss: issuer.accept(text(identity.issuer, 'Provisioned Identity issuer')),
-    sub: text(identity.subject, 'Provisioned Identity subject'),
-    ...(node === undefined ? {} : { nodeId: NodeId(text(node, 'Provisioned Identity Node')) }),
-  })
-}
-
-function record(value: unknown, label: string): Record<string, unknown> {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-    throw new TypeError(`${label} must be an object.`)
-  }
-  return value as Record<string, unknown>
-}
-
-function text(value: unknown, label: string): string {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new TypeError(`${label} must be non-empty text.`)
-  }
-  return value
-}

package/src/identity/registry.ts

@@ -1,181 +0,0 @@
-import { AstraleError } from '../errors'
-import { persistKeypair, removeKeypair } from '../keys/index'
-import { deleteIdpSession } from '../lib/idp'
-import { validateName } from '../lib/validation'
-import {
-  readIdentityStore,
-  updateIdentityStore,
-  type Identity,
-  type IdentityMode,
-  type IdentityStore,
-  type Registration,
-  ExchangeCredentialCache,
-  SESSION_ROUTE_STORE,
-} from '../state/index'
-
-export type { Identity, IdentityStore, Registration } from '../state/index'
-
-export async function readIdentities(): Promise<IdentityStore> {
-  return readIdentityStore()
-}
-
-export async function createIdentity(
-  name: string,
-  options: {
-    readonly subject?: string
-    readonly mode?: IdentityMode
-    readonly issuer?: string
-    readonly kid?: string
-  } = {},
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  return updateIdentityStore(async (store) => {
-    if (store.identities[name]) throw new Error(`Identity "${name}" already exists`)
-
-    const subject = options.subject ?? name
-    const generated = await persistKeypair(subject, { kid: options.kid })
-    const identity: Identity = {
-      subject,
-      createdAt: new Date().toISOString(),
-      source: 'key',
-      mode: options.mode ?? 'local',
-      kid: generated.kid,
-      issuer: options.issuer,
-    }
-    const hasDefault = store.default !== '' && store.identities[store.default] !== undefined
-    return {
-      next: {
-        default: hasDefault ? store.default : name,
-        identities: { ...store.identities, [name]: identity },
-      },
-      value: identity,
-    }
-  })
-}
-
-export async function deleteIdentity(name: string): Promise<void> {
-  await updateIdentityStore(async (store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    if (store.default === name) {
-      throw new Error(
-        `Cannot delete the default identity "${name}". Switch default first with: astrale identity use <other>`,
-      )
-    }
-    if ((entry.source ?? 'key') === 'idp') await deleteIdpSession(name)
-    else if (!hasAnotherKeyIdentity(store, name, entry.subject)) await removeKeypair(entry.subject)
-
-    const { [name]: _, ...identities } = store.identities
-    return { next: { ...store, identities }, value: undefined }
-  })
-  await new ExchangeCredentialCache().clear()
-  SESSION_ROUTE_STORE.clear()
-}
-
-function hasAnotherKeyIdentity(store: IdentityStore, name: string, subject: string): boolean {
-  return Object.entries(store.identities).some(
-    ([candidateName, candidate]) =>
-      candidateName !== name &&
-      (candidate.source ?? 'key') === 'key' &&
-      candidate.subject === subject,
-  )
-}
-
-export async function setDefault(name: string): Promise<void> {
-  await updateIdentityStore((store) => {
-    if (!store.identities[name]) throw new Error(`Identity "${name}" not found`)
-    return { next: { ...store, default: name }, value: undefined }
-  })
-}
-
-export async function getDefault(): Promise<Identity & { readonly name: string }> {
-  const store = await readIdentities()
-  if (store.default === '' || store.identities[store.default] === undefined) {
-    throw new AstraleError(
-      'NO_IDENTITY',
-      'No default identity.',
-      'Run: astrale identity create <name>',
-    )
-  }
-  const identity = store.identities[store.default]!
-  return { ...identity, name: store.default }
-}
-
-export async function getIdentity(name: string): Promise<Identity> {
-  const store = await readIdentities()
-  const identity = store.identities[name]
-  if (!identity) {
-    throw new Error(`Identity "${name}" not found. Run: astrale identity create ${name}`)
-  }
-  return identity
-}
-
-export async function upsertIdpIdentity(
-  name: string,
-  options: {
-    readonly subject: string
-    readonly idp: string
-    readonly issuer: string
-    readonly audience?: string
-    readonly claims?: Readonly<Record<string, unknown>>
-    readonly use?: boolean
-  },
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  validateName(options.idp, 'IdP')
-  return updateIdentityStore((store) => {
-    const existing = store.identities[name]
-    if (existing && (existing.source ?? 'key') !== 'idp') {
-      throw new Error(`Identity "${name}" already exists and is key-backed`)
-    }
-    const identity: Identity = {
-      subject: options.subject,
-      createdAt: existing?.createdAt ?? new Date().toISOString(),
-      source: 'idp',
-      mode: 'remote',
-      idp: options.idp,
-      issuer: options.issuer,
-      audience: options.audience,
-      claims: options.claims,
-      registrations: existing?.registrations,
-    }
-    return {
-      next: {
-        default: options.use === false ? store.default : name,
-        identities: { ...store.identities, [name]: identity },
-      },
-      value: identity,
-    }
-  })
-}
-
-export async function setRegistration(
-  name: string,
-  instanceSlug: string,
-  registration: Registration,
-): Promise<void> {
-  await updateIdentityStore((store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    const identity: Identity = {
-      ...entry,
-      registrations: { ...entry.registrations, [instanceSlug]: registration },
-    }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: undefined,
-    }
-  })
-}
-
-export async function setIdentityMode(name: string, mode: IdentityMode): Promise<void> {
-  await updateIdentityStore((store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    const identity: Identity = { ...entry, mode }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: undefined,
-    }
-  })
-}

package/src/identity/transfer.ts

@@ -1,187 +0,0 @@
-import { compactDecrypt, CompactEncrypt, type JWK } from 'jose'
-import { z } from 'zod'
-
-import { AstraleError } from '../errors'
-import { acceptKeypair, importKeypair, readKeypair } from '../keys/index'
-import { validateName, validateUrl } from '../lib/validation'
-import {
-  atomicWrite,
-  readIdentityStore,
-  updateIdentityStore,
-  type Identity,
-  type IdentityMode,
-  type IdentityStoreOptions,
-} from '../state/index'
-
-const IDENTITY_EXPORT_VERSION = 1 as const
-const JwkSchema = z.record(z.string(), z.unknown())
-const IdentityExportFields = {
-  subject: z.string().min(1),
-  mode: z.enum(['local', 'remote']).optional(),
-  kid: z.string().min(1).optional(),
-  issuer: z.string().url().optional(),
-  privateJwk: JwkSchema,
-  publicJwk: JwkSchema,
-}
-const LegacyIdentityExportSchema = z.object(IdentityExportFields).strict()
-const IdentityExportV1Schema = z
-  .object({ version: z.literal(IDENTITY_EXPORT_VERSION), ...IdentityExportFields })
-  .strict()
-
-export interface IdentityFileOptions {
-  readonly state?: IdentityStoreOptions
-  readonly keysDir?: string
-}
-
-export interface IdentityExport {
-  readonly version: 1
-  readonly subject: string
-  readonly mode: IdentityMode
-  readonly kid?: string
-  readonly issuer?: string
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-}
-
-export interface IdentityImportOptions extends IdentityFileOptions {
-  readonly name?: string
-  readonly issuer?: string
-  readonly replace?: boolean
-}
-
-export function isEncryptedIdentityExport(raw: string): boolean {
-  const content = raw.trim()
-  return !content.startsWith('{') && content.split('.').length === 5
-}
-
-export async function decodeIdentityExport(
-  raw: string,
-  passphrase?: string,
-): Promise<IdentityExport> {
-  let json = raw
-  if (isEncryptedIdentityExport(raw)) {
-    if (passphrase === undefined) {
-      throw invalidExport('This encrypted identity export requires a passphrase.')
-    }
-    try {
-      const { plaintext } = await compactDecrypt(raw.trim(), new TextEncoder().encode(passphrase), {
-        keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
-        contentEncryptionAlgorithms: ['A256GCM'],
-      })
-      json = new TextDecoder().decode(plaintext)
-    } catch {
-      throw invalidExport('Could not decrypt the identity export.')
-    }
-  }
-
-  let input: unknown
-  try {
-    input = JSON.parse(json)
-  } catch {
-    throw invalidExport('The identity export is not valid JSON.')
-  }
-
-  let decoded: z.infer<typeof LegacyIdentityExportSchema>
-  try {
-    decoded = hasVersion(input)
-      ? IdentityExportV1Schema.parse(input)
-      : LegacyIdentityExportSchema.parse(input)
-  } catch {
-    throw invalidExport('The identity export has an invalid or unsupported shape.')
-  }
-
-  const pair = await acceptKeypair({
-    privateJwk: decoded.privateJwk,
-    publicJwk: decoded.publicJwk,
-  })
-  if (decoded.kid && pair.kid && decoded.kid !== pair.kid) {
-    throw invalidExport('The envelope key ID differs from its JWK key ID.')
-  }
-
-  return {
-    version: IDENTITY_EXPORT_VERSION,
-    subject: decoded.subject,
-    mode: decoded.mode ?? 'local',
-    kid: decoded.kid ?? pair.kid,
-    issuer: decoded.issuer,
-    privateJwk: pair.privateJwk,
-    publicJwk: pair.publicJwk,
-  }
-}
-
-export async function encodeIdentityExport(
-  envelope: IdentityExport,
-  passphrase?: string,
-): Promise<string> {
-  const plaintext = JSON.stringify(envelope, null, 2)
-  if (passphrase === undefined) return plaintext
-  return new CompactEncrypt(new TextEncoder().encode(plaintext))
-    .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
-    .encrypt(new TextEncoder().encode(passphrase))
-}
-
-export async function exportIdentity(
-  name: string,
-  options: IdentityFileOptions = {},
-): Promise<IdentityExport> {
-  const store = await readIdentityStore(options.state)
-  const identity = store.identities[name]
-  if (!identity)
-    throw new Error(`Identity "${name}" not found. Run: astrale identity create ${name}`)
-  if ((identity.source ?? 'key') !== 'key') {
-    throw new Error(`Identity "${name}" is IdP-backed and has no transferable local keypair`)
-  }
-  const pair = await readKeypair(identity.subject, options.keysDir)
-  return {
-    version: IDENTITY_EXPORT_VERSION,
-    subject: identity.subject,
-    mode: identity.mode ?? 'local',
-    kid: identity.kid ?? pair.kid,
-    issuer: identity.issuer,
-    privateJwk: pair.privateJwk,
-    publicJwk: pair.publicJwk,
-  }
-}
-
-export async function importIdentity(
-  envelope: IdentityExport,
-  options: IdentityImportOptions = {},
-): Promise<Identity> {
-  const name = options.name ?? envelope.subject
-  validateName(name, 'Identity')
-  if (options.issuer !== undefined) validateUrl(options.issuer)
-
-  return updateIdentityStore(async (store) => {
-    const existing = store.identities[name]
-    if (existing && !options.replace) throw new Error(`Identity "${name}" already exists`)
-    if (existing && (existing.source ?? 'key') !== 'key') {
-      throw new Error(`Identity "${name}" already exists and is IdP-backed`)
-    }
-
-    const pair = await importKeypair(envelope.subject, envelope, options.keysDir)
-    const identity: Identity = {
-      subject: envelope.subject,
-      createdAt: existing?.createdAt ?? (options.state?.now?.() ?? new Date()).toISOString(),
-      source: 'key',
-      mode: envelope.mode,
-      kid: envelope.kid ?? pair.kid,
-      issuer: options.issuer ?? envelope.issuer,
-    }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: identity,
-    }
-  }, options.state)
-}
-
-export async function writeIdentityExport(path: string, content: string): Promise<void> {
-  await atomicWrite(path, content)
-}
-
-function hasVersion(input: unknown): input is { readonly version: unknown } {
-  return typeof input === 'object' && input !== null && Object.hasOwn(input, 'version')
-}
-
-function invalidExport(message: string): AstraleError {
-  return new AstraleError('INVALID_IDENTITY_EXPORT', message)
-}

package/src/identity/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/index.ts

@@ -1 +0,0 @@
-export {}

package/src/keys/.spec/api.d.ts

@@ -1,74 +0,0 @@
-import type { JWK } from 'jose'
-
-type AuthOptions = {
-  readonly issuer?: string
-  readonly subject?: string
-  readonly kid?: string
-}
-
-export type AuthBinding = {
-  readonly credential: string
-  readonly publicKey: { readonly jwk: JWK }
-}
-
-export type KeypairPaths = {
-  readonly privatePath: string
-  readonly publicPath: string
-}
-
-export interface Keypair {
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-  readonly kid?: string
-}
-
-export interface KeypairInput {
-  readonly privateJwk: unknown
-  readonly publicJwk: unknown
-}
-
-export function keypairPaths(subject: string, keysDir?: string): KeypairPaths
-
-export function fileExists(path: string): Promise<boolean>
-
-export function listIdentityKeys(keysDir?: string): Promise<string[]>
-
-export function generateEd25519Jwk(
-  kid: string,
-): Promise<{ readonly privateJwk: JWK; readonly publicJwk: JWK }>
-
-export function persistKeypair(
-  subject: string,
-  opts?: { readonly keysDir?: string; readonly kid?: string },
-): Promise<{ readonly publicJwk: JWK; readonly privateJwk: JWK; readonly kid: string }>
-
-/** Admit supported private/public JWKs and prove that they form one pair. */
-export function acceptKeypair(input: KeypairInput): Promise<Keypair>
-
-/** Decode and cryptographically prove a persisted subject keypair. */
-export function readKeypair(subject: string, keysDir?: string): Promise<Keypair>
-
-/** Admit and atomically persist one externally supplied subject keypair. */
-export function importKeypair(
-  subject: string,
-  input: KeypairInput,
-  keysDir?: string,
-): Promise<Keypair>
-
-export function removeKeypair(subject: string, keysDir?: string): Promise<void>
-
-export function persistAuth(keysDir?: string, opts?: AuthOptions): Promise<AuthBinding>
-
-export function loadAuth(keysDir?: string, opts?: AuthOptions): Promise<AuthBinding>
-
-export function resolveAuth(keysDir?: string, opts?: AuthOptions): Promise<AuthBinding>
-
-export function signAs(
-  subject: string,
-  keysDir?: string,
-  opts?: {
-    readonly issuer?: string
-    readonly audience?: string
-    readonly subject?: string
-  },
-): Promise<string>

package/src/keys/.spec/architecture.md

@@ -1,13 +0,0 @@
-# CLI key material
-
-This Node-only module owns the retained `@astrale-os/cli/keys` subpath. Manager keys remain on their
-legacy filenames; every other identity uses its own subject-named pair. Writes are private and
-atomic through State. Signing admits the selected private JWK algorithm and never substitutes
-manager material for a missing identity key.
-
-Externally supplied or persisted pairs cross a proof-loss boundary here. Keys accepts only supported
-algorithms, keeps paths inside the selected key directory, rejects private material in the public
-file, and proves private/public correspondence before returning or replacing files.
-
-The retained Node-only subpath contains the explicit raw-key operations required by import/export
-and scaffold consumers. Ordinary connection code receives signed credentials or public material.

package/src/keys/.spec/laws/keys.ts

@@ -1,43 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_KEYS_IDENTITY_ISOLATED = defineLaw({
-  id: 'CLI-KEYS-IDENTITY-ISOLATED',
-  statement:
-    'Each subject signs only with its own mode-0600 keypair; missing subject material fails even when manager keys exist.',
-  tests: [
-    { file: '__tests__/keys.test.ts', id: 'TEST-CLI-KEYS-PRIVATE-MODE' },
-    { file: '__tests__/keys.test.ts', id: 'TEST-CLI-KEYS-NO-MANAGER-FALLBACK' },
-  ],
-})
-
-export const CLI_KEYS_LEGACY_READABLE = defineLaw({
-  id: 'CLI-KEYS-LEGACY-READABLE',
-  statement:
-    'Manager filenames and unstamped supported legacy algorithms remain readable without changing another identity key coordinate.',
-  tests: [
-    { file: '__tests__/keys.test.ts', id: 'TEST-CLI-KEYS-LEGACY-FILENAMES' },
-    { file: '__tests__/algorithm.test.ts', id: 'TEST-CLI-KEYS-INFERS-LEGACY-ALGORITHM' },
-  ],
-})
-
-export const CLI_KEYS_PAIR_ADMITTED = defineLaw({
-  id: 'CLI-KEYS-PAIR-ADMITTED',
-  statement:
-    'A subject path remains inside the selected key directory, and imported or persisted material is returned only after supported-algorithm and private/public correspondence proof.',
-  tests: [
-    { file: '__tests__/keys.test.ts', id: 'TEST-CLI-KEYS-PAIR-ADMISSION' },
-    { file: '__tests__/keys.test.ts', id: 'TEST-CLI-KEYS-PATH-CONFINED' },
-  ],
-})
-
-export const CLI_KEYS_CREDENTIAL_GRANT_PROFILE = defineLaw({
-  id: 'CLI-KEYS-CREDENTIAL-GRANT-PROFILE',
-  statement:
-    'A self-issued Kernel credential carries the effective subject as an already-resolved identity Grant, while an externally issued primary credential carries an identity-self Grant for Runtime resolution.',
-  tests: [
-    {
-      file: '__tests__/keys.test.ts',
-      id: 'TEST-CLI-KEYS-DISTINGUISHES-KERNEL-ROOT-GRANT',
-    },
-  ],
-})

package/src/keys/.spec/layout.ts

@@ -1,6 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: ['__tests__/', 'algorithm.ts', 'credential.ts', 'index.ts', 'pair.ts', 'tsconfig.json'],
-  exact: true,
-})

package/src/keys/__tests__/algorithm.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { AstraleError } from '../../errors'
-import { inferAlg } from '../algorithm'
-
-describe('inferAlg', () => {
-  test('returns explicit alg when present', () => {
-    expect(inferAlg({ alg: 'ES256' })).toBe('ES256')
-    expect(inferAlg({ alg: 'EdDSA' })).toBe('EdDSA')
-  })
-
-  /** @evidence TEST-CLI-KEYS-INFERS-LEGACY-ALGORITHM */
-  test('infers supported algorithms for legacy unstamped key files', () => {
-    expect(inferAlg({ kty: 'EC', crv: 'P-256' })).toBe('ES256')
-    expect(inferAlg({ kty: 'OKP', crv: 'Ed25519' })).toBe('EdDSA')
-  })
-
-  test('explicit alg wins over inferable shape (no second-guessing)', () => {
-    expect(inferAlg({ alg: 'ES256', kty: 'OKP', crv: 'Ed25519' })).toBe('ES256')
-  })
-
-  test('throws AstraleError with hint when no alg/crv/kty resolves', () => {
-    expect(() => inferAlg({})).toThrow(AstraleError)
-    expect(() => inferAlg({ kty: 'EC' })).toThrow(AstraleError)
-    expect(() => inferAlg({ kty: 'EC', crv: 'P-384' })).toThrow(AstraleError)
-  })
-
-  test('error message includes keyPath when provided', () => {
-    expect(() => inferAlg({}, '/path/to/broken.jwk')).toThrow(/\/path\/to\/broken\.jwk/)
-  })
-
-  test('treats empty-string alg as missing', () => {
-    expect(inferAlg({ alg: '', kty: 'EC', crv: 'P-256' })).toBe('ES256')
-  })
-
-  test('rejects unsupported explicit algorithms', () => {
-    expect(() => inferAlg({ alg: 'HS256', kty: 'oct' })).toThrow(/unsupported signing algorithm/)
-  })
-})