@astrale-os/cli 1.0.0-beta.8 → 1.0.0-npm-deprecated.0

package/src/identity/__tests__/transfer.test.ts

@@ -1,198 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { access, mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { keypairPaths, persistKeypair, readKeypair } from '../../keys/index'
-import { readIdentityStore, updateIdentityStore } from '../../state/index'
-import {
-  decodeIdentityExport,
-  encodeIdentityExport,
-  exportIdentity,
-  importIdentity,
-  isEncryptedIdentityExport,
-  writeIdentityExport,
-  type IdentityExport,
-} from '../index'
-
-describe('identity transfer', () => {
-  let root = ''
-  let statePath = ''
-  let keysDir = ''
-  const now = () => new Date('2026-08-11T12:00:00.000Z')
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'astrale-identity-transfer-'))
-    statePath = join(root, 'identities.json')
-    keysDir = join(root, 'keys')
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  async function envelope(subject: string, suffix: string): Promise<IdentityExport> {
-    const pair = await persistKeypair(subject, {
-      keysDir: join(root, `source-${suffix}`),
-      kid: `${subject}-${suffix}`,
-    })
-    return decodeIdentityExport(
-      JSON.stringify({
-        version: 1,
-        subject,
-        mode: 'local',
-        kid: pair.kid,
-        issuer: 'https://identity.example',
-        privateJwk: pair.privateJwk,
-        publicJwk: pair.publicJwk,
-      }),
-    )
-  }
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-REJECTS */
-  test('rejects malformed, newer, and mismatched content before durable mutation', async () => {
-    await expect(decodeIdentityExport('{')).rejects.toThrow(/not valid JSON/)
-    await expect(
-      decodeIdentityExport(
-        JSON.stringify({
-          version: 2,
-          subject: 'alice',
-          mode: 'local',
-          privateJwk: {},
-          publicJwk: {},
-        }),
-      ),
-    ).rejects.toThrow(/invalid or unsupported shape/)
-
-    const alice = await envelope('alice', 'a')
-    const bob = await envelope('bob', 'b')
-    const forged = {
-      ...alice,
-      publicJwk: { ...bob.publicJwk, kid: alice.kid },
-    } as IdentityExport
-    const mismatch = await importIdentity(forged, {
-      state: { path: statePath, now },
-      keysDir,
-    }).catch((error) => error)
-    expect(mismatch).toBeInstanceOf(Error)
-    expect((mismatch as Error).message).toMatch(/do not form a valid matching pair/)
-    expect((mismatch as Error).message).not.toContain(String(alice.privateJwk.d))
-
-    await expect(access(statePath)).rejects.toThrow()
-    await expect(access(keypairPaths('alice', keysDir).privatePath)).rejects.toThrow()
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-ROUNDTRIP */
-  test('converges legacy, V1, and encrypted representations on one envelope', async () => {
-    const current = await envelope('alice', 'roundtrip')
-    const { version: _, ...legacy } = current
-    expect(await decodeIdentityExport(JSON.stringify(legacy))).toEqual(current)
-
-    const plaintext = await encodeIdentityExport(current)
-    expect(isEncryptedIdentityExport(plaintext)).toBe(false)
-    expect(await decodeIdentityExport(plaintext)).toEqual(current)
-
-    const encrypted = await encodeIdentityExport(current, 'correct-horse-battery')
-    expect(isEncryptedIdentityExport(encrypted)).toBe(true)
-    expect(await decodeIdentityExport(encrypted, 'correct-horse-battery')).toEqual(current)
-    await expect(decodeIdentityExport(encrypted, 'wrong')).rejects.toThrow(/Could not decrypt/)
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-TRANSFER-SCHEMA */
-  test('keeps the portable V1 JSON Schema aligned with the admitted identity envelope', async () => {
-    const schemaPath = fileURLToPath(
-      new URL('../.spec/schemas/identity-export-v1.schema.json', import.meta.url),
-    )
-    const schema = JSON.parse(await readFile(schemaPath, 'utf8')) as {
-      readonly $id: string
-      readonly additionalProperties: boolean
-      readonly required: readonly string[]
-      readonly properties: Readonly<Record<string, unknown>>
-    }
-    const identityEnvelope = await envelope('manager-principal', 'host-bootstrap')
-
-    expect(schema.$id).toBe('https://schemas.astrale.ai/cli/identity-export/1')
-    expect(schema.additionalProperties).toBe(false)
-    expect(schema.required).toEqual(['version', 'subject', 'privateJwk', 'publicJwk'])
-    expect(Object.keys(schema.properties).sort()).toEqual(
-      ['issuer', 'kid', 'mode', 'privateJwk', 'publicJwk', 'subject', 'version'].sort(),
-    )
-    await expect(decodeIdentityExport(JSON.stringify(identityEnvelope))).resolves.toEqual(
-      identityEnvelope,
-    )
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-IMPORT-ORDERED */
-  test('checks conflicts before key replacement and publishes registry after keys', async () => {
-    const first = await envelope('alice', 'first')
-    const imported = await importIdentity(first, {
-      name: 'operator',
-      state: { path: statePath, now },
-      keysDir,
-    })
-    expect(imported.subject).toBe('alice')
-    expect((await readKeypair('alice', keysDir)).kid).toBe(first.kid)
-    expect((await readIdentityStore({ path: statePath })).identities.operator).toEqual(imported)
-
-    const privatePath = keypairPaths('alice', keysDir).privatePath
-    const originalPrivate = await readFile(privatePath, 'utf-8')
-    const replacement = await envelope('alice', 'replacement')
-    await expect(
-      importIdentity(replacement, {
-        name: 'operator',
-        state: { path: statePath, now },
-        keysDir,
-      }),
-    ).rejects.toThrow('already exists')
-    expect(await readFile(privatePath, 'utf-8')).toBe(originalPrivate)
-
-    await updateIdentityStore(
-      (store) => ({
-        next: {
-          ...store,
-          identities: {
-            ...store.identities,
-            remote: {
-              subject: 'remote-user',
-              createdAt: now().toISOString(),
-              source: 'idp',
-              mode: 'remote',
-              idp: 'workos',
-              issuer: 'https://idp.example',
-            },
-          },
-        },
-        value: undefined,
-      }),
-      { path: statePath, now },
-    )
-    await expect(
-      importIdentity(await envelope('remote-user', 'remote'), {
-        name: 'remote',
-        replace: true,
-        state: { path: statePath, now },
-        keysDir,
-      }),
-    ).rejects.toThrow(/IdP-backed/)
-    await expect(access(keypairPaths('remote-user', keysDir).privatePath)).rejects.toThrow()
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-EXPORT-PRIVATE */
-  test('exports a proven pair through one atomic mode-0600 file', async () => {
-    await importIdentity(await envelope('alice', 'export'), {
-      state: { path: statePath, now },
-      keysDir,
-    })
-    const exported = await exportIdentity('alice', {
-      state: { path: statePath, now },
-      keysDir,
-    })
-    const path = join(root, 'alice.identity.json')
-    await writeIdentityExport(path, await encodeIdentityExport(exported))
-
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
-    expect(await decodeIdentityExport(await readFile(path, 'utf-8'))).toEqual(exported)
-    expect((await readdir(root)).some((entry) => entry.endsWith('.tmp'))).toBe(false)
-  })
-})

package/src/identity/index.ts

@@ -1,23 +0,0 @@
-export {
-  createIdentity,
-  deleteIdentity,
-  getDefault,
-  getIdentity,
-  readIdentities,
-  setDefault,
-  setIdentityMode,
-  setRegistration,
-  upsertIdpIdentity,
-} from './registry'
-export {
-  decodeIdentityExport,
-  encodeIdentityExport,
-  exportIdentity,
-  importIdentity,
-  isEncryptedIdentityExport,
-  writeIdentityExport,
-} from './transfer'
-export { acceptProvisionedIdentity, submitIdentityProvision } from './registration'
-export type { IdentityProvisionSubmission, IdentityRegistrationResult } from './registration'
-export type { Identity, IdentityStore, Registration } from './registry'
-export type { IdentityExport, IdentityFileOptions, IdentityImportOptions } from './transfer'

package/src/identity/registration.ts

@@ -1,72 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { Call } from '@astrale-os/sdk/client'
-import type { LocalBinding } from '@astrale-os/sdk/graph'
-
-import { issuer } from '@astrale-os/sdk/auth'
-import { call } from '@astrale-os/sdk/client'
-import { NodeId } from '@astrale-os/sdk/graph/node'
-import { Path } from '@astrale-os/sdk/graph/path'
-
-export interface IdentityRegistrationResult {
-  readonly iss: string
-  readonly sub: string
-  readonly nodeId?: string
-}
-
-export interface IdentityProvisionSubmission {
-  readonly request: ProvisionRequest
-  readonly binding: LocalBinding
-  readonly via?: string
-  readonly direct: {
-    provision(request: ProvisionRequest): Promise<unknown>
-  }
-  readonly callable: {
-    call(call: Call): Promise<unknown>
-  }
-}
-
-/** Submit one prepared request either directly or through its explicit Domain authority owner. */
-export async function submitIdentityProvision(
-  input: IdentityProvisionSubmission,
-): Promise<IdentityRegistrationResult> {
-  const result =
-    input.via === undefined
-      ? await input.direct.provision(input.request)
-      : await input.callable.call(
-          // Client admits the portable value before transport. ProvisionRequest is the
-          // stricter semantic type but does not declare the portable Object index signature.
-          call(Path.parse(input.via), input.request as unknown as Call['input']),
-        )
-  return acceptProvisionedIdentity(result, input.binding)
-}
-
-/** Admit only the exact binding the CLI prepared; remote callables remain untrusted input. */
-export function acceptProvisionedIdentity(
-  value: unknown,
-  binding: LocalBinding,
-): IdentityRegistrationResult {
-  const result = record(value, 'Provision result')
-  const identities = record(result.identities, 'Provision result identities')
-  const identity = record(identities[binding], 'Provision result identity binding')
-  const createdNodes = record(result.createdNodes, 'Provision result created Nodes')
-  const node = createdNodes[binding]
-  return Object.freeze({
-    iss: issuer.accept(text(identity.issuer, 'Provisioned Identity issuer')),
-    sub: text(identity.subject, 'Provisioned Identity subject'),
-    ...(node === undefined ? {} : { nodeId: NodeId(text(node, 'Provisioned Identity Node')) }),
-  })
-}
-
-function record(value: unknown, label: string): Record<string, unknown> {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-    throw new TypeError(`${label} must be an object.`)
-  }
-  return value as Record<string, unknown>
-}
-
-function text(value: unknown, label: string): string {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new TypeError(`${label} must be non-empty text.`)
-  }
-  return value
-}

package/src/identity/registry.ts

@@ -1,179 +0,0 @@
-import { AstraleError } from '../errors'
-import { persistKeypair, removeKeypair } from '../keys/index'
-import { deleteIdpSession } from '../lib/idp'
-import { validateName } from '../lib/validation'
-import {
-  readIdentityStore,
-  updateIdentityStore,
-  type Identity,
-  type IdentityMode,
-  type IdentityStore,
-  type Registration,
-  ExchangeCredentialCache,
-} from '../state/index'
-
-export type { Identity, IdentityStore, Registration } from '../state/index'
-
-export async function readIdentities(): Promise<IdentityStore> {
-  return readIdentityStore()
-}
-
-export async function createIdentity(
-  name: string,
-  options: {
-    readonly subject?: string
-    readonly mode?: IdentityMode
-    readonly issuer?: string
-    readonly kid?: string
-  } = {},
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  return updateIdentityStore(async (store) => {
-    if (store.identities[name]) throw new Error(`Identity "${name}" already exists`)
-
-    const subject = options.subject ?? name
-    const generated = await persistKeypair(subject, { kid: options.kid })
-    const identity: Identity = {
-      subject,
-      createdAt: new Date().toISOString(),
-      source: 'key',
-      mode: options.mode ?? 'local',
-      kid: generated.kid,
-      issuer: options.issuer,
-    }
-    const hasDefault = store.default !== '' && store.identities[store.default] !== undefined
-    return {
-      next: {
-        default: hasDefault ? store.default : name,
-        identities: { ...store.identities, [name]: identity },
-      },
-      value: identity,
-    }
-  })
-}
-
-export async function deleteIdentity(name: string): Promise<void> {
-  await updateIdentityStore(async (store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    if (store.default === name) {
-      throw new Error(
-        `Cannot delete the default identity "${name}". Switch default first with: astrale identity use <other>`,
-      )
-    }
-    if ((entry.source ?? 'key') === 'idp') await deleteIdpSession(name)
-    else if (!hasAnotherKeyIdentity(store, name, entry.subject)) await removeKeypair(entry.subject)
-
-    const { [name]: _, ...identities } = store.identities
-    return { next: { ...store, identities }, value: undefined }
-  })
-  await new ExchangeCredentialCache().clear()
-}
-
-function hasAnotherKeyIdentity(store: IdentityStore, name: string, subject: string): boolean {
-  return Object.entries(store.identities).some(
-    ([candidateName, candidate]) =>
-      candidateName !== name &&
-      (candidate.source ?? 'key') === 'key' &&
-      candidate.subject === subject,
-  )
-}
-
-export async function setDefault(name: string): Promise<void> {
-  await updateIdentityStore((store) => {
-    if (!store.identities[name]) throw new Error(`Identity "${name}" not found`)
-    return { next: { ...store, default: name }, value: undefined }
-  })
-}
-
-export async function getDefault(): Promise<Identity & { readonly name: string }> {
-  const store = await readIdentities()
-  if (store.default === '' || store.identities[store.default] === undefined) {
-    throw new AstraleError(
-      'NO_IDENTITY',
-      'No default identity.',
-      'Run: astrale identity create <name>',
-    )
-  }
-  const identity = store.identities[store.default]!
-  return { ...identity, name: store.default }
-}
-
-export async function getIdentity(name: string): Promise<Identity> {
-  const store = await readIdentities()
-  const identity = store.identities[name]
-  if (!identity) {
-    throw new Error(`Identity "${name}" not found. Run: astrale identity create ${name}`)
-  }
-  return identity
-}
-
-export async function upsertIdpIdentity(
-  name: string,
-  options: {
-    readonly subject: string
-    readonly idp: string
-    readonly issuer: string
-    readonly audience?: string
-    readonly claims?: Readonly<Record<string, unknown>>
-    readonly use?: boolean
-  },
-): Promise<Identity> {
-  validateName(name, 'Identity')
-  validateName(options.idp, 'IdP')
-  return updateIdentityStore((store) => {
-    const existing = store.identities[name]
-    if (existing && (existing.source ?? 'key') !== 'idp') {
-      throw new Error(`Identity "${name}" already exists and is key-backed`)
-    }
-    const identity: Identity = {
-      subject: options.subject,
-      createdAt: existing?.createdAt ?? new Date().toISOString(),
-      source: 'idp',
-      mode: 'remote',
-      idp: options.idp,
-      issuer: options.issuer,
-      audience: options.audience,
-      claims: options.claims,
-      registrations: existing?.registrations,
-    }
-    return {
-      next: {
-        default: options.use === false ? store.default : name,
-        identities: { ...store.identities, [name]: identity },
-      },
-      value: identity,
-    }
-  })
-}
-
-export async function setRegistration(
-  name: string,
-  instanceSlug: string,
-  registration: Registration,
-): Promise<void> {
-  await updateIdentityStore((store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    const identity: Identity = {
-      ...entry,
-      registrations: { ...entry.registrations, [instanceSlug]: registration },
-    }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: undefined,
-    }
-  })
-}
-
-export async function setIdentityMode(name: string, mode: IdentityMode): Promise<void> {
-  await updateIdentityStore((store) => {
-    const entry = store.identities[name]
-    if (!entry) throw new Error(`Identity "${name}" not found`)
-    const identity: Identity = { ...entry, mode }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: undefined,
-    }
-  })
-}

package/src/identity/transfer.ts

@@ -1,187 +0,0 @@
-import { compactDecrypt, CompactEncrypt, type JWK } from 'jose'
-import { z } from 'zod'
-
-import { AstraleError } from '../errors'
-import { acceptKeypair, importKeypair, readKeypair } from '../keys/index'
-import { validateName, validateUrl } from '../lib/validation'
-import {
-  atomicWrite,
-  readIdentityStore,
-  updateIdentityStore,
-  type Identity,
-  type IdentityMode,
-  type IdentityStoreOptions,
-} from '../state/index'
-
-const IDENTITY_EXPORT_VERSION = 1 as const
-const JwkSchema = z.record(z.string(), z.unknown())
-const IdentityExportFields = {
-  subject: z.string().min(1),
-  mode: z.enum(['local', 'remote']).optional(),
-  kid: z.string().min(1).optional(),
-  issuer: z.string().url().optional(),
-  privateJwk: JwkSchema,
-  publicJwk: JwkSchema,
-}
-const LegacyIdentityExportSchema = z.object(IdentityExportFields).strict()
-const IdentityExportV1Schema = z
-  .object({ version: z.literal(IDENTITY_EXPORT_VERSION), ...IdentityExportFields })
-  .strict()
-
-export interface IdentityFileOptions {
-  readonly state?: IdentityStoreOptions
-  readonly keysDir?: string
-}
-
-export interface IdentityExport {
-  readonly version: 1
-  readonly subject: string
-  readonly mode: IdentityMode
-  readonly kid?: string
-  readonly issuer?: string
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-}
-
-export interface IdentityImportOptions extends IdentityFileOptions {
-  readonly name?: string
-  readonly issuer?: string
-  readonly replace?: boolean
-}
-
-export function isEncryptedIdentityExport(raw: string): boolean {
-  const content = raw.trim()
-  return !content.startsWith('{') && content.split('.').length === 5
-}
-
-export async function decodeIdentityExport(
-  raw: string,
-  passphrase?: string,
-): Promise<IdentityExport> {
-  let json = raw
-  if (isEncryptedIdentityExport(raw)) {
-    if (passphrase === undefined) {
-      throw invalidExport('This encrypted identity export requires a passphrase.')
-    }
-    try {
-      const { plaintext } = await compactDecrypt(raw.trim(), new TextEncoder().encode(passphrase), {
-        keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
-        contentEncryptionAlgorithms: ['A256GCM'],
-      })
-      json = new TextDecoder().decode(plaintext)
-    } catch {
-      throw invalidExport('Could not decrypt the identity export.')
-    }
-  }
-
-  let input: unknown
-  try {
-    input = JSON.parse(json)
-  } catch {
-    throw invalidExport('The identity export is not valid JSON.')
-  }
-
-  let decoded: z.infer<typeof LegacyIdentityExportSchema>
-  try {
-    decoded = hasVersion(input)
-      ? IdentityExportV1Schema.parse(input)
-      : LegacyIdentityExportSchema.parse(input)
-  } catch {
-    throw invalidExport('The identity export has an invalid or unsupported shape.')
-  }
-
-  const pair = await acceptKeypair({
-    privateJwk: decoded.privateJwk,
-    publicJwk: decoded.publicJwk,
-  })
-  if (decoded.kid && pair.kid && decoded.kid !== pair.kid) {
-    throw invalidExport('The envelope key ID differs from its JWK key ID.')
-  }
-
-  return {
-    version: IDENTITY_EXPORT_VERSION,
-    subject: decoded.subject,
-    mode: decoded.mode ?? 'local',
-    kid: decoded.kid ?? pair.kid,
-    issuer: decoded.issuer,
-    privateJwk: pair.privateJwk,
-    publicJwk: pair.publicJwk,
-  }
-}
-
-export async function encodeIdentityExport(
-  envelope: IdentityExport,
-  passphrase?: string,
-): Promise<string> {
-  const plaintext = JSON.stringify(envelope, null, 2)
-  if (passphrase === undefined) return plaintext
-  return new CompactEncrypt(new TextEncoder().encode(plaintext))
-    .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A256GCM' })
-    .encrypt(new TextEncoder().encode(passphrase))
-}
-
-export async function exportIdentity(
-  name: string,
-  options: IdentityFileOptions = {},
-): Promise<IdentityExport> {
-  const store = await readIdentityStore(options.state)
-  const identity = store.identities[name]
-  if (!identity)
-    throw new Error(`Identity "${name}" not found. Run: astrale identity create ${name}`)
-  if ((identity.source ?? 'key') !== 'key') {
-    throw new Error(`Identity "${name}" is IdP-backed and has no transferable local keypair`)
-  }
-  const pair = await readKeypair(identity.subject, options.keysDir)
-  return {
-    version: IDENTITY_EXPORT_VERSION,
-    subject: identity.subject,
-    mode: identity.mode ?? 'local',
-    kid: identity.kid ?? pair.kid,
-    issuer: identity.issuer,
-    privateJwk: pair.privateJwk,
-    publicJwk: pair.publicJwk,
-  }
-}
-
-export async function importIdentity(
-  envelope: IdentityExport,
-  options: IdentityImportOptions = {},
-): Promise<Identity> {
-  const name = options.name ?? envelope.subject
-  validateName(name, 'Identity')
-  if (options.issuer !== undefined) validateUrl(options.issuer)
-
-  return updateIdentityStore(async (store) => {
-    const existing = store.identities[name]
-    if (existing && !options.replace) throw new Error(`Identity "${name}" already exists`)
-    if (existing && (existing.source ?? 'key') !== 'key') {
-      throw new Error(`Identity "${name}" already exists and is IdP-backed`)
-    }
-
-    const pair = await importKeypair(envelope.subject, envelope, options.keysDir)
-    const identity: Identity = {
-      subject: envelope.subject,
-      createdAt: existing?.createdAt ?? (options.state?.now?.() ?? new Date()).toISOString(),
-      source: 'key',
-      mode: envelope.mode,
-      kid: envelope.kid ?? pair.kid,
-      issuer: options.issuer ?? envelope.issuer,
-    }
-    return {
-      next: { ...store, identities: { ...store.identities, [name]: identity } },
-      value: identity,
-    }
-  }, options.state)
-}
-
-export async function writeIdentityExport(path: string, content: string): Promise<void> {
-  await atomicWrite(path, content)
-}
-
-function hasVersion(input: unknown): input is { readonly version: unknown } {
-  return typeof input === 'object' && input !== null && Object.hasOwn(input, 'version')
-}
-
-function invalidExport(message: string): AstraleError {
-  return new AstraleError('INVALID_IDENTITY_EXPORT', message)
-}

package/src/identity/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/index.ts

@@ -1 +0,0 @@
-export {}