@astrale-os/cli 1.0.0-beta.9 → 1.0.0-npm-deprecated.0

package/src/commands/identity/register.ts

@@ -1,196 +0,0 @@
-import type { IssuerId, JsonWebKey, ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { ClassKey as ClassKeyValue } from '@astrale-os/sdk/graph/class'
-import type { JWK } from 'jose'
-
-import { provision, jwk } from '@astrale-os/sdk/auth'
-import { LocalBinding } from '@astrale-os/sdk/graph'
-import { normalizeProperties } from '@astrale-os/sdk/graph/properties'
-import { MutationAST } from '@astrale-os/sdk/mutation'
-import { importJWK, SignJWT } from 'jose'
-import { readFile } from 'node:fs/promises'
-
-import type { KernelCommandOpts } from '../../connection'
-import type { IdentityRegistrationResult } from '../../identity/index'
-import type { CommandDefinition } from '../../program/index'
-
-import { registrationKeyForTarget, runKernelCommand } from '../../connection'
-import { classKey } from '../../graph'
-import { getIdentity, setRegistration, submitIdentityProvision } from '../../identity/index'
-import { fileExists, keypairPaths } from '../../keys/index'
-import { fatal, log } from '../../lib/log'
-import { output } from '../../lib/output'
-
-type RegisterOpts = KernelCommandOpts & {
-  class?: string
-  props?: string
-  via?: string
-}
-
-async function readJwk(path: string): Promise<JWK> {
-  return JSON.parse(await readFile(path, 'utf8')) as JWK
-}
-
-export default {
-  name: 'register',
-  description: 'Atomically provision a local key identity and its V2 graph Node',
-  afterHelpText: `
-Behavior:
-  Creates one Node through Mutation V3 and designates it as a self-proven
-  Identity in the same atomic Auth.provision request. --class is required;
-  --props must use fully-qualified Property keys owned by that Class.
-
-  By default the authenticated caller submits the request directly to Kernel
-  Auth.provision. Use --via for an application-owned identity Class: the CLI
-  sends the exact self-proven request through that Domain callable, then admits
-  its result and stores the same target-bound registration. The callable owns
-  authorization; the CLI never receives installed Domain authority.
-
-  Kernel V2 Nodes have opaque identity and no caller-assigned storage path, so
-  the historical --path option no longer exists. The CLI binds the key proof
-  to the exact provision fingerprint and target Kernel audience, then caches
-  the returned (issuer, subject) for subsequent calls.
-
-Example:
-  $ astrale identity register alice --class /:accounts.example:class.User \
-      --props '{"accounts.example:class.User.property.name":"Alice"}' -i staging
-  $ astrale identity register responder --class /:ops.example:class.Operator \
-      --via /:ops.example:function.provisionOperator -i staging
-`,
-  arguments: [{ name: 'name', description: 'Local identity name', required: true }],
-  options: [
-    {
-      flags: '--class <classPath>',
-      description: 'Exact Class of the identity-bearing Node (required)',
-    },
-    {
-      flags: '--props <json>',
-      description: 'Fully-qualified canonical properties for the new Node',
-    },
-    {
-      flags: '--via <callablePath>',
-      description: 'Submit the self-proven request through an authorizing Domain callable',
-    },
-  ],
-  action: async (name: string, opts: RegisterOpts) => {
-    try {
-      if (!opts.class) throw new TypeError('Missing required flag: --class <classPath>')
-      const identity = await getIdentity(name)
-      const { privatePath, publicPath } = keypairPaths(identity.subject)
-      if (!(await fileExists(privatePath)) || !(await fileExists(publicPath))) {
-        throw new Error(
-          `No keypair on disk for "${name}" (expected ${privatePath}). Recreate it with \`astrale identity create ${name}\`.`,
-        )
-      }
-
-      const privateKey = await readJwk(privatePath)
-      const publicKey = jwk.acceptPublic(await readJwk(publicPath))
-      const classPath = classKey(opts.class, '--class')
-      const properties = normalizeProperties(opts.props ? JSON.parse(opts.props) : {})
-
-      await runKernelCommand<IdentityRegistrationResult>({
-        opts,
-        label: `Register "${name}"`,
-        fn: async ({ auth, session, target }) => {
-          const registrationKey = registrationKeyForTarget(target)
-          const existing = identity.registrations?.[registrationKey]
-          if (existing) {
-            log.warn(`"${name}" is already registered on "${registrationKey}"`)
-            return existing
-          }
-
-          const prepared = await prepareIdentityProvision({
-            name,
-            classPath,
-            properties,
-            privateKey,
-            publicKey,
-            kernelIssuer: target.kernelIssuer,
-          })
-          const registered = await submitIdentityProvision({
-            request: prepared.request,
-            binding: prepared.binding,
-            ...(opts.via === undefined ? {} : { via: opts.via }),
-            direct: auth,
-            callable: session,
-          })
-          await setRegistration(name, registrationKey, {
-            iss: registered.iss,
-            sub: registered.sub,
-            registeredAt: new Date().toISOString(),
-          })
-          return registered
-        },
-        format: formatIdentityRegistration,
-      })
-    } catch (error) {
-      fatal(error, opts)
-    }
-  },
-} satisfies CommandDefinition
-
-/** Preserve one structured stdout value while retaining useful detail in the human view. */
-export function formatIdentityRegistration(
-  result: IdentityRegistrationResult,
-  format: KernelCommandOpts,
-  machine: boolean,
-): void {
-  output(result, format)
-  if (machine) return
-  log.dim(`  iss=${result.iss}`)
-  log.dim(`  sub=${result.sub}`)
-}
-
-/** Build and self-prove one exact canonical provision request for the target Kernel. */
-export async function prepareIdentityProvision(input: {
-  readonly name: string
-  readonly classPath: ClassKeyValue
-  readonly properties: ReturnType<typeof normalizeProperties>
-  readonly privateKey: JWK
-  readonly publicKey: JsonWebKey
-  readonly kernelIssuer: IssuerId
-}): Promise<{
-  readonly binding: ReturnType<typeof LocalBinding>
-  readonly request: ProvisionRequest
-}> {
-  const binding = LocalBinding('identity')
-  const mutation = MutationAST.build((builder) => {
-    builder.createNode({ as: binding, class: input.classPath, props: input.properties })
-    return undefined
-  })
-  const idempotencyKey = `identity-register:${input.name}`
-  const unsigned = provision.accept({
-    idempotencyKey,
-    mutation,
-    identities: {
-      [binding]: { credentials: { publicKey: input.publicKey, proof: 'pending-proof' } },
-    },
-  })
-  const fingerprint = await provision.fingerprint(unsigned)
-  const issuer = await provision.selfIssuer(input.kernelIssuer, input.publicKey)
-  const proof = await mintProvisionProof(input.privateKey, issuer, input.kernelIssuer, fingerprint)
-  return {
-    binding,
-    request: provision.accept({
-      idempotencyKey,
-      mutation,
-      identities: { [binding]: { credentials: { publicKey: input.publicKey, proof } } },
-    }),
-  }
-}
-
-async function mintProvisionProof(
-  privateKey: JWK,
-  issuer: string,
-  audience: string,
-  fingerprint: string,
-): Promise<string> {
-  const key = await importJWK(privateKey, 'ES256')
-  return new SignJWT({ provision: fingerprint })
-    .setProtectedHeader({ alg: 'ES256', ...(privateKey.kid ? { kid: privateKey.kid } : {}) })
-    .setIssuer(issuer)
-    .setSubject('self')
-    .setAudience(audience)
-    .setIssuedAt()
-    .setExpirationTime('5m')
-    .sign(key)
-}

package/src/commands/identity/sync.ts

@@ -1,38 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { getIdentity, setIdentityMode } from '../../identity/index'
-import { fatal, fatalNotImplemented, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'sync',
-  description: 'Migrate an identity local → remote (astrale cloud)',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [
-    {
-      flags: '--force',
-      description: 'Tag as remote in the local registry even without cloud login',
-    },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (name: string, opts: { force?: boolean } & RawOutputOpts) => {
-    try {
-      const identity = await getIdentity(name)
-      if (!opts.force) {
-        fatalNotImplemented(
-          'identity sync (remote)',
-          'Cloud adapter is stubbed in v1. Use --force to pre-tag the identity locally.',
-        )
-      }
-      await setIdentityMode(name, 'remote')
-      if (isMachine(opts)) {
-        output({ name, mode: 'remote', subject: identity.subject }, opts)
-        return
-      }
-      log.warn(`Tagged "${name}" as remote locally (cloud sync stubbed in v1)`)
-      log.dim(`  subject=${identity.subject}`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/unsync.ts

@@ -1,34 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { getIdentity, setIdentityMode } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-/** Metadata-only flip remote → local until cloud sync ships (§2.7). */
-export default {
-  name: 'unsync',
-  description: 'Migrate an identity remote → local',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: RawOutputOpts) => {
-    try {
-      const identity = await getIdentity(name)
-      if (identity.mode !== 'remote') {
-        if (isMachine(opts)) {
-          output({ name, mode: identity.mode ?? 'local', unchanged: true }, opts)
-          return
-        }
-        log.warn(`Identity "${name}" is already ${identity.mode ?? 'local'}`)
-        return
-      }
-      await setIdentityMode(name, 'local')
-      if (isMachine(opts)) {
-        output({ name, mode: 'local' }, opts)
-        return
-      }
-      log.success(`Identity "${name}" → local`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/use.ts

@@ -1,24 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { setDefault } from '../../identity/index'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-export default {
-  name: 'use',
-  description: 'Set the active CLI identity',
-  arguments: [{ name: 'name', description: 'Identity name', required: true }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: RawOutputOpts) => {
-    try {
-      await setDefault(name)
-      if (isMachine(opts)) {
-        output({ default: name }, opts)
-        return
-      }
-      log.success(`Active identity set to "${name}"`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/identity/whoami.ts

@@ -1,34 +0,0 @@
-import chalk from 'chalk'
-
-import type { CommandDefinition } from '../../program/index'
-
-import { getDefault } from '../../identity/index'
-import { fatal } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-type WhoamiResult = {
-  name: string
-  subject: string
-}
-
-export default {
-  name: 'whoami',
-  description: 'Show the current default identity',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: RawOutputOpts) => {
-    try {
-      const identity = await getDefault()
-      const result: WhoamiResult = {
-        name: identity.name,
-        subject: identity.subject,
-      }
-      if (isMachine(opts)) {
-        output(result, opts)
-        return
-      }
-      console.log(`${chalk.bold(result.name)} (subject: ${result.subject})`)
-    } catch (e) {
-      fatal(e, opts)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/idp/add.ts

@@ -1,150 +0,0 @@
-import { readFile } from 'node:fs/promises'
-
-import type { CommandDefinition } from '../../program/index'
-
-import {
-  fetchOidcMetadata,
-  fetchWorkosApplication,
-  OidcMetadataSchema,
-  type IdpClientConfig,
-  upsertIdpConfig,
-  workosAuthKitMetadata,
-} from '../../lib/idp'
-import { log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-import { validateName, validateUrl } from '../../lib/validation'
-
-type AddOpts = {
-  issuer?: string
-  metadata?: string
-  clientId?: string
-  clientSecretEnv?: string
-  redirectUri?: string
-  scope?: string
-  public?: boolean
-  workosApiKeyEnv?: string
-  workosApp?: string
-  workosAuthkit?: boolean
-  workosApiHostname?: string
-  raw?: boolean
-  json?: boolean
-}
-
-export default {
-  name: 'add',
-  description: 'Add or update an OpenID Connect identity provider',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [
-    { flags: '--issuer <url>', description: 'OIDC issuer URL' },
-    { flags: '--metadata <path>', description: 'Read discovery metadata from a local JSON file' },
-    { flags: '--client-id <id>', description: 'OAuth/OIDC client ID' },
-    { flags: '--client-secret-env <name>', description: 'Env var containing the client secret' },
-    { flags: '--redirect-uri <url>', description: 'Redirect URI for authorization-code login' },
-    { flags: '--scope <scope>', description: 'Default OAuth scope string' },
-    { flags: '--public', description: 'Mark the client as public/PKCE-capable' },
-    {
-      flags: '--workos-api-key-env <name>',
-      description: 'Env var containing the WorkOS API key',
-      default: 'WORKOS_API_KEY',
-    },
-    { flags: '--workos-app <id>', description: 'Fetch WorkOS Connect application metadata' },
-    {
-      flags: '--workos-authkit',
-      description: 'Configure WorkOS AuthKit CLI Auth using client_id only',
-    },
-    {
-      flags: '--workos-api-hostname <url>',
-      description: 'WorkOS API host for AuthKit CLI Auth',
-      default: 'https://api.workos.com',
-    },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  afterHelpText: `
-Examples:
-  $ astrale idp add workos --workos-authkit --client-id client_...
-  $ astrale idp add workos-connect --issuer https://example.authkit.app \\
-      --client-id client_... --scope "openid profile email offline_access"
-  $ astrale idp add workos-connect --issuer https://example.authkit.app \\
-      --workos-app app_... --workos-api-key-env WORKOS_API_KEY
-
-Security:
-  Client secrets and WorkOS API keys are never stored by the CLI. Store only
-  the env var name with --client-secret-env / --workos-api-key-env.
-`,
-  action: async (name: string, opts: AddOpts) => {
-    validateName(name, 'IdP')
-    if (!opts.issuer && !opts.metadata && !opts.workosAuthkit) {
-      throw new Error('Either --issuer, --metadata, or --workos-authkit is required')
-    }
-
-    let metadata = opts.workosAuthkit
-      ? workosAuthKitMetadata(opts.workosApiHostname, opts.clientId)
-      : opts.metadata
-        ? OidcMetadataSchema.parse(JSON.parse(await readFile(opts.metadata, 'utf-8')))
-        : await fetchOidcMetadata(opts.issuer!)
-
-    if (opts.issuer) {
-      validateUrl(opts.issuer)
-      if (normalizeIssuer(metadata.issuer) !== normalizeIssuer(opts.issuer)) {
-        throw new Error(
-          `OIDC issuer mismatch: metadata has ${metadata.issuer}, expected ${opts.issuer}`,
-        )
-      }
-    }
-
-    let client: IdpClientConfig = {
-      client_id: opts.clientId,
-      client_secret_env: opts.clientSecretEnv,
-      redirect_uris: opts.redirectUri ? [opts.redirectUri] : undefined,
-      scope: opts.scope,
-      public: opts.public,
-      token_response: opts.workosAuthkit ? 'workos-authkit' : undefined,
-      token_request_format: opts.workosAuthkit ? 'json' : undefined,
-    }
-
-    if (opts.workosApp) {
-      const app = await fetchWorkosApplication({
-        app: opts.workosApp,
-        apiKeyEnv: opts.workosApiKeyEnv ?? 'WORKOS_API_KEY',
-      })
-      client = {
-        ...client,
-        client_id: client.client_id ?? app.client_id,
-        redirect_uris:
-          client.redirect_uris ?? app.redirect_uris?.map((uri) => uri.uri).filter(isString),
-        scope: client.scope ?? app.scopes?.join(' '),
-        public: client.public ?? app.uses_pkce,
-        workos_application_id: app.id,
-        workos_application_type: app.application_type,
-      }
-    }
-
-    if (opts.workosAuthkit && client.client_id) {
-      metadata = workosAuthKitMetadata(opts.workosApiHostname, client.client_id)
-    }
-
-    const idp = await upsertIdpConfig({ name, metadata, client })
-    if (isMachine(opts)) {
-      output(redact(idp), opts)
-      return
-    }
-
-    log.success(`IdP "${name}" saved`)
-    log.dim(`  issuer: ${idp.metadata.issuer}`)
-    if (idp.client.client_id) log.dim(`  client_id: ${idp.client.client_id}`)
-    if (idp.client.client_secret_env)
-      log.dim(`  client_secret_env: ${idp.client.client_secret_env}`)
-  },
-} satisfies CommandDefinition
-
-function isString(value: unknown): value is string {
-  return typeof value === 'string'
-}
-
-function redact<T extends { client: IdpClientConfig }>(value: T): T {
-  return value
-}
-
-function normalizeIssuer(value: string): string {
-  return value.replace(/\/+$/, '')
-}

package/src/commands/idp/list.ts

@@ -1,57 +0,0 @@
-import chalk from 'chalk'
-
-import type { ListOpts, ListProjection } from '../../lib/output'
-import type { CommandDefinition } from '../../program/index'
-
-import { listIdpConfigs } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { isMachine, presentList, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-type IdpRow = {
-  name: string
-  issuer: string
-  clientId?: string
-  scope?: string
-  builtIn: boolean
-  updatedAt?: string
-}
-
-function projection(items: IdpRow[]): ListProjection {
-  return {
-    columns: [
-      { key: 'name', header: 'NAME', color: chalk.bold },
-      { key: 'type', header: 'TYPE', color: chalk.dim },
-      { key: 'issuer', header: 'ISSUER', color: chalk.dim },
-      { key: 'clientId', header: 'CLIENT_ID', color: chalk.dim },
-    ],
-    rows: items.map((i) => ({
-      name: i.name,
-      type: i.builtIn ? 'built-in' : 'custom',
-      issuer: i.issuer ?? '',
-      clientId: i.clientId ?? '',
-    })),
-    paths: items.map((i) => i.name),
-  }
-}
-
-export default {
-  name: 'list',
-  description: 'List configured identity providers',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: ListOpts) => {
-    const items: IdpRow[] = (await listIdpConfigs()).map((config) => ({
-      name: config.name,
-      issuer: config.entry.issuer,
-      clientId: config.client.client_id,
-      scope: config.client.scope,
-      builtIn: !!config.entry.builtIn,
-      updatedAt: config.entry.updatedAt,
-    }))
-
-    if (items.length === 0 && !isMachine(opts)) {
-      log.dim('  No IdPs. Run: astrale idp add <name> --issuer <url>')
-      return
-    }
-    presentList(items, opts, projection)
-  },
-} satisfies CommandDefinition

package/src/commands/idp/refresh.ts

@@ -1,38 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import {
-  fetchOidcMetadata,
-  readIdpConfigOrBuiltin,
-  upsertIdpConfig,
-  workosAuthKitMetadata,
-} from '../../lib/idp'
-import { log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'refresh',
-  description: 'Refresh discovery metadata for an identity provider',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (name: string, opts: { raw?: boolean; json?: boolean }) => {
-    const existing = await readIdpConfigOrBuiltin(name)
-    const metadata =
-      existing.client.token_response === 'workos-authkit'
-        ? workosAuthKitMetadata(existing.entry.issuer)
-        : await fetchOidcMetadata(existing.entry.issuer)
-    const idp = await upsertIdpConfig({
-      name,
-      metadata,
-      client: existing.client,
-      builtIn: existing.entry.builtIn,
-    })
-
-    if (isMachine(opts)) {
-      output(idp, opts)
-      return
-    }
-
-    log.success(`IdP "${name}" discovery metadata refreshed`)
-    log.dim(`  issuer: ${idp.metadata.issuer}`)
-  },
-} satisfies CommandDefinition

package/src/commands/idp/remove.ts

@@ -1,36 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdentities } from '../../identity/index'
-import { removeIdpConfig } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'remove',
-  aliases: ['rm'],
-  description: 'Remove an identity provider',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [
-    { flags: '--force', description: 'Remove even when IdP-backed identities exist' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (name: string, opts: { force?: boolean; raw?: boolean; json?: boolean }) => {
-    const store = await readIdentities()
-    const dependents = Object.entries(store.identities)
-      .filter(([, identity]) => identity.source === 'idp' && identity.idp === name)
-      .map(([identityName]) => identityName)
-
-    if (dependents.length > 0 && !opts.force) {
-      throw new Error(
-        `IdP "${name}" is used by identities: ${dependents.join(', ')}. Re-run with --force or delete those identities first.`,
-      )
-    }
-
-    await removeIdpConfig(name)
-    if (opts.raw || opts.json) {
-      output({ removed: name, dependentIdentities: dependents }, opts)
-      return
-    }
-    log.success(`IdP "${name}" removed`)
-  },
-} satisfies CommandDefinition

package/src/commands/idp/show.ts

@@ -1,29 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdpConfigOrBuiltin } from '../../lib/idp'
-import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-export default {
-  name: 'show',
-  description: 'Show an identity provider configuration',
-  arguments: [{ name: 'name', description: 'Local IdP registry name' }],
-  options: [
-    { flags: '--format <type>', description: 'Output format', choices: ['yaml', 'json'] },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (
-    name: string,
-    opts: { raw?: boolean; json?: boolean; format?: 'yaml' | 'json' },
-  ) => {
-    const idp = await readIdpConfigOrBuiltin(name)
-    output(
-      {
-        name: idp.name,
-        entry: idp.entry,
-        metadata: idp.metadata,
-        client: idp.client,
-      },
-      opts,
-    )
-  },
-} satisfies CommandDefinition