@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/state/__tests__/identities.test.ts

@@ -1,142 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import {
-  IDENTITY_STORE_VERSION,
-  IdentityStateError,
-  readIdentityStore,
-  updateIdentityStore,
-  type IdentityStore,
-} from '../identities'
-
-let directory: string
-let path: string
-
-const legacy = JSON.stringify(
-  {
-    default: 'manager',
-    identities: {
-      manager: {
-        subject: 'manager',
-        createdAt: '2024-01-01T00:00:00.000Z',
-        source: 'key',
-        mode: 'local',
-      },
-    },
-  },
-  null,
-  2,
-)
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'astrale-identity-state-'))
-  path = join(directory, 'identities.json')
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-describe('identity state', () => {
-  /** @evidence TEST-CLI-STATE-IDENTITY-READ-SAFE */
-  test('reads missing, legacy, and current state without writing', async () => {
-    const missing = await readIdentityStore({
-      path,
-      now: () => new Date('2025-01-01T00:00:00.000Z'),
-    })
-    expect(missing).toEqual({ default: '', identities: {} })
-    await expect(readFile(path, 'utf-8')).rejects.toThrow()
-
-    await writeFile(path, legacy)
-    expect((await readIdentityStore({ path })).default).toBe('manager')
-    expect(await readFile(path, 'utf-8')).toBe(legacy)
-    await expect(readFile(`${path}.v0.bak`, 'utf-8')).rejects.toThrow()
-
-    const current = `${JSON.stringify({ version: IDENTITY_STORE_VERSION, ...missing })}\n`
-    await writeFile(path, current)
-    expect((await readIdentityStore({ path })).identities).toEqual({})
-    expect(await readFile(path, 'utf-8')).toBe(current)
-  })
-
-  /** @evidence TEST-CLI-STATE-IDENTITY-FAILS-CLOSED */
-  test('rejects malformed and unsupported state without replacing it', async () => {
-    for (const raw of ['{', JSON.stringify({ version: 2, default: 'manager', identities: {} })]) {
-      await writeFile(path, raw)
-      const error = await readIdentityStore({ path }).catch((caught) => caught)
-      expect(error).toBeInstanceOf(IdentityStateError)
-      expect((error as IdentityStateError).code).toBe(
-        raw === '{' ? 'IDENTITY_STATE_INVALID' : 'IDENTITY_STATE_VERSION_UNSUPPORTED',
-      )
-      expect(await readFile(path, 'utf-8')).toBe(raw)
-    }
-  })
-
-  /** @evidence TEST-CLI-STATE-IDENTITY-MIGRATES */
-  test('backs up exact legacy bytes before the first V1 mutation', async () => {
-    await writeFile(path, legacy)
-
-    await updateIdentityStore(
-      (current) => ({ next: { ...current, default: 'alice' }, value: undefined }),
-      { path },
-    )
-
-    expect(await readFile(`${path}.v0.bak`, 'utf-8')).toBe(legacy)
-    expect((await stat(`${path}.v0.bak`)).mode & 0o777).toBe(0o600)
-    const written = JSON.parse(await readFile(path, 'utf-8')) as {
-      version: number
-      default: string
-    }
-    expect(written).toMatchObject({ version: 1, default: 'alice' })
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-  })
-
-  /** @evidence TEST-CLI-STATE-IDENTITY-CONCURRENT */
-  test('retains concurrent selection and registration from separate processes', async () => {
-    const alice = {
-      subject: 'alice',
-      createdAt: '2025-01-01T00:00:00.000Z',
-      source: 'key' as const,
-      mode: 'local' as const,
-    }
-    const bob = { ...alice, subject: 'bob' }
-    await writeFile(
-      path,
-      JSON.stringify({
-        version: IDENTITY_STORE_VERSION,
-        default: 'manager',
-        identities: {
-          manager: { ...alice, subject: 'manager' },
-          alice,
-          bob,
-        },
-      }),
-    )
-    const fixture = join(import.meta.dir, 'fixtures', 'identity-transition.ts')
-    const commands = [
-      ['default', 'alice'],
-      ...Array.from({ length: 8 }, (_, index) => ['registration', 'bob', `instance-${index}`]),
-    ]
-    const processes = commands.map((args) =>
-      Bun.spawn({
-        cmd: ['bun', fixture, ...args],
-        env: { ...process.env, ASTRALE_HOME: directory },
-        stdout: 'pipe',
-        stderr: 'pipe',
-      }),
-    )
-    const outcomes = await Promise.all(
-      processes.map(async (process) => ({
-        code: await process.exited,
-        stderr: await new Response(process.stderr).text(),
-      })),
-    )
-    expect(outcomes).toEqual(outcomes.map(() => ({ code: 0, stderr: '' })))
-
-    const store: IdentityStore = await readIdentityStore({ path })
-    expect(store.default).toBe('alice')
-    expect(Object.keys(store.identities.bob.registrations ?? {})).toHaveLength(8)
-    await expect(readFile(`${path}.lock`, 'utf-8')).rejects.toThrow()
-  })
-})

package/src/state/__tests__/paths.test.ts

@@ -1,28 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-import { join } from 'node:path'
-
-import { createPaths } from '../paths'
-
-describe('state paths', () => {
-  /** @evidence TEST-CLI-STATE-PATHS-CAPTURED */
-  test('captures explicit and environment coordinates once', () => {
-    const environment: Record<string, string | undefined> = {
-      ASTRALE_HOME: '/environment/home',
-      ASTRALE_KEYS_DIR: '/environment/keys',
-      ASTRALE_DATA_DIR: '/environment/data',
-    }
-    const explicit = createPaths('/explicit/home', environment)
-    const inherited = createPaths(undefined, environment)
-
-    environment.ASTRALE_HOME = '/changed/home'
-    environment.ASTRALE_KEYS_DIR = '/changed/keys'
-
-    expect(explicit.home).toBe('/explicit/home')
-    expect(explicit.keys).toBe('/environment/keys')
-    expect(explicit.config).toBe(join('/explicit/home', 'config.json'))
-    expect(explicit.sessionRoutes).toBe(join('/explicit/home', 'session', 'routes.json'))
-    expect(inherited.home).toBe('/environment/home')
-    expect(inherited.keys).toBe('/environment/keys')
-    expect(Object.isFrozen(explicit)).toBe(true)
-  })
-})

package/src/state/__tests__/session-routes.test.ts

@@ -1,138 +0,0 @@
-import type { SessionRouteArtifact } from '@astrale-os/sdk/client/session'
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { access, mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { FileSessionRouteStore } from '../session-routes'
-
-let directory: string
-let path: string
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'astrale-session-routes-'))
-  path = join(directory, 'private', 'routes.json')
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-describe('session route file store', () => {
-  test('round-trips the Kernel-owned artifact under owner-private filesystem modes', async () => {
-    const artifact: SessionRouteArtifact = { version: 1, entries: {} }
-    const store = new FileSessionRouteStore(path)
-
-    store.write(artifact)
-
-    expect(store.read()).toEqual(artifact)
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect((await stat(join(directory, 'private'))).mode & 0o777).toBe(0o700)
-    expect(await readFile(path, 'utf8')).toBe('{"version":1,"entries":{}}\n')
-
-    store.clear()
-    await expect(access(path)).rejects.toThrow()
-    expect(() => store.clear()).not.toThrow()
-  })
-
-  test('leaves malformed representation recovery to Kernel Client as a cold miss', async () => {
-    await mkdir(join(directory, 'private'))
-    await writeFile(path, '{invalid')
-    const fixture = join(import.meta.dir, 'fixtures', 'session-route-process.ts')
-
-    expect(await runFixture(fixture, path)).toEqual({
-      value: 'done',
-      sourceAttempts: 1,
-      destinationAttempts: 1,
-    })
-    expect(JSON.parse(await readFile(path, 'utf8'))).toMatchObject({ version: 1 })
-  })
-
-  test('reuses Kernel-admitted routing state in a separate operating-system process', async () => {
-    const routePath = join(directory, 'private', 'routes.json')
-    const fixture = join(import.meta.dir, 'fixtures', 'session-route-process.ts')
-
-    const first = await runFixture(fixture, routePath)
-    const second = await runFixture(fixture, routePath)
-
-    expect(first).toEqual({ value: 'done', sourceAttempts: 1, destinationAttempts: 1 })
-    expect(second).toEqual({ value: 'done', sourceAttempts: 0, destinationAttempts: 1 })
-  })
-
-  test('publishes only complete owner-private artifacts under concurrent process writers', async () => {
-    const routePath = join(directory, 'private', 'routes.json')
-    const fixture = join(import.meta.dir, 'fixtures', 'session-route-process.ts')
-
-    const results = await Promise.all(
-      Array.from({ length: 8 }, () => runFixture(fixture, routePath)),
-    )
-    expect(results).toHaveLength(8)
-    expect(results.every((result) => result.destinationAttempts === 1)).toBe(true)
-    expect(JSON.parse(await readFile(routePath, 'utf8'))).toMatchObject({ version: 1 })
-    expect((await stat(routePath)).mode & 0o777).toBe(0o600)
-    expect(await runFixture(fixture, routePath)).toEqual({
-      value: 'done',
-      sourceAttempts: 0,
-      destinationAttempts: 1,
-    })
-  })
-
-  test('auth logout clears every persisted bearer cache through the real CLI command', async () => {
-    const routePath = join(directory, 'session', 'routes.json')
-    const exchangePath = join(directory, 'exchange', 'credentials.json')
-    await mkdir(join(directory, 'session'), { recursive: true })
-    await mkdir(join(directory, 'exchange'), { recursive: true })
-    await writeFile(routePath, '{"version":1,"entries":{"confidential":{}}}\n')
-    await writeFile(
-      exchangePath,
-      '{"version":2,"entries":{"confidential":{"credential":"bearer"}}}\n',
-    )
-
-    const child = Bun.spawn(
-      [
-        process.execPath,
-        join(import.meta.dir, '../../..', 'bin', 'astrale.ts'),
-        'auth',
-        'logout',
-        '--all',
-        '--json',
-      ],
-      {
-        env: { ...process.env, ASTRALE_HOME: directory },
-        stdout: 'pipe',
-        stderr: 'pipe',
-      },
-    )
-    const [exitCode, stdout, stderr] = await Promise.all([
-      child.exited,
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-    ])
-
-    expect(exitCode, stderr).toBe(0)
-    expect(JSON.parse(stdout)).toEqual({ cleared: [] })
-    await expect(access(routePath)).rejects.toThrow()
-    expect(JSON.parse(await readFile(exchangePath, 'utf8'))).toEqual({ version: 2, entries: {} })
-  })
-})
-
-interface FixtureResult {
-  readonly value: string
-  readonly sourceAttempts: number
-  readonly destinationAttempts: number
-}
-
-async function runFixture(fixture: string, routePath: string): Promise<FixtureResult> {
-  const child = Bun.spawn([process.execPath, fixture, routePath], {
-    stdout: 'pipe',
-    stderr: 'pipe',
-  })
-  const [exitCode, stdout, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-  ])
-  expect(exitCode, stderr).toBe(0)
-  return JSON.parse(stdout) as FixtureResult
-}

package/src/state/exchange-credentials.ts

@@ -1,250 +0,0 @@
-import { credential, grant } from '@astrale-os/sdk/auth'
-import { chmod, mkdir, readFile } from 'node:fs/promises'
-import { dirname } from 'node:path'
-
-import { credentialLifetimeCovers } from '../lib/credential-lifetime'
-import { atomicWrite, withFileLock } from './files'
-import { EXCHANGE_CREDENTIALS_PATH } from './paths'
-
-const VERSION = 2
-const MINIMUM_REMAINING_SECONDS = 30
-
-export namespace exchange {
-  export interface Artifact {
-    readonly version: 2
-    readonly entries: Record<string, Entry>
-  }
-
-  export interface Key {
-    readonly kernelIssuer: string
-    readonly domainIssuer: string
-    readonly sourceIssuer: string
-    readonly sourceSubject: string
-  }
-
-  export interface Entry {
-    readonly credential: string
-    readonly expiresAt: number
-    readonly user: string
-    readonly sourceIssuer: string
-    readonly sourceSubject: string
-  }
-}
-
-export class ExchangeCredentialCache {
-  private readonly refreshing = new Map<string, Promise<string>>()
-
-  constructor(private readonly path = EXCHANGE_CREDENTIALS_PATH) {}
-
-  getOrRefresh(
-    key: exchange.Key,
-    minimumRemainingSeconds: number,
-    refresh: () => Promise<exchange.Entry>,
-    now = () => Math.floor(Date.now() / 1_000),
-  ): Promise<string> {
-    if (!Number.isSafeInteger(minimumRemainingSeconds) || minimumRemainingSeconds < 1) {
-      throw new TypeError('Exchange credential minimum lifetime must be a positive safe integer.')
-    }
-    const encoded = encodeKey(key)
-    const pendingKey = `${encoded}\0${minimumRemainingSeconds}`
-    const current = this.refreshing.get(pendingKey)
-    if (current !== undefined) return current
-    const pending = this.getOrRefreshOnce(
-      key,
-      encoded,
-      minimumRemainingSeconds,
-      refresh,
-      now,
-    ).finally(() => {
-      this.refreshing.delete(pendingKey)
-    })
-    this.refreshing.set(pendingKey, pending)
-    return pending
-  }
-
-  async deleteKernel(kernelIssuer: string): Promise<void> {
-    await this.transition((store) => {
-      for (const encoded of Object.keys(store.entries)) {
-        const key = decodeKey(encoded)
-        if (key === undefined || key.kernelIssuer === kernelIssuer) delete store.entries[encoded]
-      }
-    })
-  }
-
-  async clear(): Promise<void> {
-    await this.transition((store) => {
-      for (const encoded of Object.keys(store.entries)) delete store.entries[encoded]
-    })
-  }
-
-  private async getOrRefreshOnce(
-    key: exchange.Key,
-    encoded: string,
-    minimumRemainingSeconds: number,
-    refresh: () => Promise<exchange.Entry>,
-    now: () => number,
-  ): Promise<string> {
-    return withFileLock(`${this.path}.lock`, async () => {
-      await ensurePrivateDirectory(this.path)
-      const store = await readStore(this.path)
-      const changed = scrub(store, now())
-      const cached = store.entries[encoded]
-      if (cached !== undefined && validEntry(key, cached, now(), minimumRemainingSeconds)) {
-        if (changed) await writeStore(this.path, store)
-        return cached.credential
-      }
-
-      const next = await refresh()
-      if (!validEntry(key, next, now(), minimumRemainingSeconds)) {
-        throw new Error(
-          'Token exchange returned a credential inconsistent with its cache key or required lifetime.',
-        )
-      }
-      store.entries[encoded] = Object.freeze({ ...next })
-      await writeStore(this.path, store)
-      return next.credential
-    })
-  }
-
-  private async transition(change: (store: exchange.Artifact) => void): Promise<void> {
-    await withFileLock(`${this.path}.lock`, async () => {
-      await ensurePrivateDirectory(this.path)
-      const store = await readStore(this.path)
-      change(store)
-      await writeStore(this.path, store)
-    })
-  }
-}
-
-async function readStore(path: string): Promise<exchange.Artifact> {
-  try {
-    const input = JSON.parse(await readFile(path, 'utf8')) as unknown
-    if (input === null || typeof input !== 'object' || Array.isArray(input)) return emptyStore()
-    const value = input as Record<string, unknown>
-    if (
-      value.version !== VERSION ||
-      value.entries === null ||
-      typeof value.entries !== 'object' ||
-      Array.isArray(value.entries)
-    ) {
-      return emptyStore()
-    }
-    return { version: VERSION, entries: { ...(value.entries as Record<string, exchange.Entry>) } }
-  } catch {
-    return emptyStore()
-  }
-}
-
-function emptyStore(): exchange.Artifact {
-  return { version: VERSION, entries: {} }
-}
-
-async function writeStore(path: string, store: exchange.Artifact): Promise<void> {
-  await atomicWrite(path, `${JSON.stringify(store, null, 2)}\n`)
-  await chmod(path, 0o600)
-}
-
-async function ensurePrivateDirectory(path: string): Promise<void> {
-  const directory = dirname(path)
-  await mkdir(directory, { recursive: true, mode: 0o700 })
-  await chmod(directory, 0o700)
-}
-
-function validEntry(
-  key: exchange.Key,
-  entry: exchange.Entry,
-  now: number,
-  minimumRemaining = MINIMUM_REMAINING_SECONDS,
-): boolean {
-  if (
-    entry === null ||
-    typeof entry !== 'object' ||
-    Reflect.ownKeys(entry).length !== 5 ||
-    typeof entry.credential !== 'string' ||
-    entry.credential.length === 0 ||
-    !Number.isSafeInteger(entry.expiresAt) ||
-    entry.expiresAt - now < minimumRemaining ||
-    typeof entry.user !== 'string' ||
-    entry.user.length === 0 ||
-    entry.sourceIssuer !== key.sourceIssuer ||
-    entry.sourceSubject !== key.sourceSubject
-  ) {
-    return false
-  }
-  try {
-    const inspected = credential.inspect(entry.credential)
-    const carried = grant.acceptUnresolved(inspected.claims.grant).expr
-    if (
-      carried.kind !== 'identity' ||
-      !('credential' in carried) ||
-      typeof carried.credential !== 'string'
-    ) {
-      return false
-    }
-    const proof = credential.inspect(carried.credential)
-    const issued = proof.claims.delegation
-    if (
-      issued === null ||
-      typeof issued !== 'object' ||
-      Array.isArray(issued) ||
-      Reflect.ownKeys(issued).length !== 2 ||
-      !Object.hasOwn(issued, 'v') ||
-      !Object.hasOwn(issued, 'expr') ||
-      Reflect.get(issued, 'v') !== 1
-    ) {
-      return false
-    }
-    grant.accept({ expr: Reflect.get(issued, 'expr') })
-    return (
-      inspected.iss === key.domainIssuer &&
-      inspected.aud === key.kernelIssuer &&
-      inspected.claims.exp === entry.expiresAt &&
-      !Object.hasOwn(inspected.claims, 'delegation') &&
-      proof.iss === key.kernelIssuer &&
-      proof.sub === entry.user &&
-      proof.aud === key.kernelIssuer &&
-      typeof proof.claims.exp === 'number' &&
-      Number.isSafeInteger(proof.claims.exp) &&
-      credentialLifetimeCovers(proof.claims.exp, minimumRemaining, now)
-    )
-  } catch {
-    return false
-  }
-}
-
-function encodeKey(key: exchange.Key): string {
-  return JSON.stringify([key.kernelIssuer, key.domainIssuer, key.sourceIssuer, key.sourceSubject])
-}
-
-function decodeKey(input: string): exchange.Key | undefined {
-  try {
-    const value = JSON.parse(input) as unknown
-    if (
-      !Array.isArray(value) ||
-      value.length !== 4 ||
-      value.some((part) => typeof part !== 'string' || part.length === 0)
-    ) {
-      return undefined
-    }
-    return {
-      kernelIssuer: value[0]!,
-      domainIssuer: value[1]!,
-      sourceIssuer: value[2]!,
-      sourceSubject: value[3]!,
-    }
-  } catch {
-    return undefined
-  }
-}
-
-function scrub(store: Pick<exchange.Artifact, 'entries'>, now: number): boolean {
-  let changed = false
-  for (const [encoded, entry] of Object.entries(store.entries)) {
-    const key = decodeKey(encoded)
-    if (key === undefined || !validEntry(key, entry, now, 1)) {
-      delete store.entries[encoded]
-      changed = true
-    }
-  }
-  return changed
-}