@astrale-os/cli 1.0.0-beta.9 → 1.0.0-npm-deprecated.0

package/src/identity/.history/ard/domain-mediated-registration.md

@@ -1,36 +0,0 @@
-# Domain-mediated Identity registration
-
-Status: resolved
-Impact: high
-Selection: explicit-authority-owner-callable
-
-## Context
-
-`identity register` prepares an atomic graph Node and self-proven Identity designation. Submitting
-that request directly to Kernel Auth is correct only when the authenticated caller already holds
-creation authority for the chosen Class. A child Kernel management principal does not thereby own
-an installed application Domain's `Operator` Class, and production correctly denied that attempted
-authority substitution.
-
-The CLI must still own local key proof and target-bound registration state. Manufacturing CLI state,
-handing application credentials to the operator, or weakening mutation authorization would cross
-the wrong boundary.
-
-## Decision
-
-Registration retains direct Auth submission as its default. `--via <callablePath>` selects a second,
-explicit submission boundary: after constructing the exact same Provision request and fingerprint-
-bound self proof, CLI invokes the named Domain callable through the normal Host route. That callable
-owns admission and may exercise its Domain authority to submit the request to Kernel Auth.
-
-CLI treats the callable response as untrusted. It admits the prepared binding's issuer, subject, and
-optional created Node ID, then stores only the target-keyed issuer and subject. It never accepts or
-persists application authority, and it never exposes the self proof in argv or output.
-
-## Consequences
-
-- Kernel mutation non-amplification remains unchanged.
-- A Domain that offers registration must declare and authorize a Provision-shaped callable.
-- The option is explicit because choosing the authority owner is security-significant.
-- Direct registration remains useful for Classes the selected caller genuinely owns.
-- A failed callable or malformed response leaves CLI registration state unchanged.

package/src/identity/.spec/api.d.ts

@@ -1,124 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { Call } from '@astrale-os/sdk/client'
-import type { LocalBinding } from '@astrale-os/sdk/graph'
-import type { JWK } from 'jose'
-
-import type {
-  Identity,
-  IdentityMode,
-  IdentityStore,
-  IdentityStoreOptions,
-  Registration,
-} from '../../state/.spec/api.js'
-
-export type { Identity, IdentityStore, Registration } from '../../state/.spec/api.js'
-
-/** Filesystem coordinates used only by explicit identity transfer operations. */
-export interface IdentityFileOptions {
-  readonly state?: IdentityStoreOptions
-  readonly keysDir?: string
-}
-
-/** Canonical V1 key-identity transfer envelope. */
-export interface IdentityExport {
-  readonly version: 1
-  readonly subject: string
-  readonly mode: IdentityMode
-  readonly kid?: string
-  readonly issuer?: string
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-}
-
-export interface IdentityImportOptions extends IdentityFileOptions {
-  readonly name?: string
-  readonly issuer?: string
-  readonly replace?: boolean
-}
-
-export interface IdentityRegistrationResult {
-  readonly iss: string
-  readonly sub: string
-  readonly nodeId?: string
-}
-
-export interface IdentityProvisionSubmission {
-  readonly request: ProvisionRequest
-  readonly binding: LocalBinding
-  readonly via?: string
-  readonly direct: {
-    provision(request: ProvisionRequest): Promise<unknown>
-  }
-  readonly callable: {
-    call(call: Call): Promise<unknown>
-  }
-}
-
-/** Submit one prepared request either directly or through its explicit Domain authority owner. */
-export function submitIdentityProvision(
-  input: IdentityProvisionSubmission,
-): Promise<IdentityRegistrationResult>
-
-/** Admit only the exact binding the CLI prepared; remote callables remain untrusted input. */
-export function acceptProvisionedIdentity(
-  value: unknown,
-  binding: LocalBinding,
-): IdentityRegistrationResult
-
-export function readIdentities(): Promise<IdentityStore>
-
-export function createIdentity(
-  name: string,
-  options?: {
-    readonly subject?: string
-    readonly mode?: IdentityMode
-    readonly issuer?: string
-    readonly kid?: string
-  },
-): Promise<Identity>
-
-export function deleteIdentity(name: string): Promise<void>
-export function setDefault(name: string): Promise<void>
-export function getDefault(): Promise<Identity & { readonly name: string }>
-export function getIdentity(name: string): Promise<Identity>
-
-export function upsertIdpIdentity(
-  name: string,
-  options: {
-    readonly subject: string
-    readonly idp: string
-    readonly issuer: string
-    readonly audience?: string
-    readonly claims?: Readonly<Record<string, unknown>>
-    readonly use?: boolean
-  },
-): Promise<Identity>
-
-export function setRegistration(
-  name: string,
-  instanceSlug: string,
-  registration: Registration,
-): Promise<void>
-
-export function setIdentityMode(name: string, mode: IdentityMode): Promise<void>
-
-/** Detect the retained compact-JWE representation without decoding it. */
-export function isEncryptedIdentityExport(raw: string): boolean
-
-/** Decode legacy plaintext, V1 plaintext, or compact-JWE content into one admitted V1 envelope. */
-export function decodeIdentityExport(raw: string, passphrase?: string): Promise<IdentityExport>
-
-/** Encode one admitted envelope as plaintext JSON or compact JWE. */
-export function encodeIdentityExport(envelope: IdentityExport, passphrase?: string): Promise<string>
-
-/** Read and prove one key-backed identity's transferable envelope. */
-export function exportIdentity(name: string, options?: IdentityFileOptions): Promise<IdentityExport>
-
-/** Import one admitted envelope after checking registry conflicts but before publishing registry state. */
-export function importIdentity(
-  envelope: IdentityExport,
-  options?: IdentityImportOptions,
-): Promise<Identity>
-
-/** Atomically publish one explicit private export file with mode 0600. */
-export function writeIdentityExport(path: string, content: string): Promise<void>

package/src/identity/.spec/architecture.md

@@ -1,33 +0,0 @@
-# CLI identity ownership
-
-Identity owns local identity selection and the coordination between the State registry, per-subject
-Keys, and IdP sessions. State owns durable registry decoding and locking; Keys owns JWK admission,
-pair proof, and private files. Commands own prompts and presentation, not persistence mechanics.
-
-Identity transfer accepts the retained unversioned plaintext envelope and the current V1 plaintext
-or compact-JWE representation. Admission completes before mutation. Import checks the registry under
-its file lock, persists the admitted keypair, and only then publishes the identity entry. Export
-proves the stored pair and atomically writes one mode-`0600` user-selected file.
-
-The canonical plaintext V1 structure is independently published as
-`https://schemas.astrale.ai/cli/identity-export/1`. A production Host may emit that envelope as its
-bootstrap root secret, but CLI Identity remains the format owner and cryptographically proves the
-pair on import. The governing bootstrap flow imports the root as `platform-root`, authenticates it
-directly to the `platform-manager` Kernel, and reaches a child only through a manager-minted
-child-audience Management carrier. The carrier's outer subject is not the child's effective
-principal; authenticated child `Identity.whoami` owns that projection.
-
-Identity registration always prepares one self-proven atomic Provision request. Direct registration
-submits it to Kernel Auth only when the selected caller already owns the target Class authority. An
-explicit `--via <callable>` instead sends those exact bytes through the Domain that owns an
-application Identity Class. The Domain callable owns admission and effect authority; CLI admits only
-the prepared binding from the response before persisting its target-bound `(issuer, subject)`.
-
-```mermaid
-flowchart LR
-  C[identity command] --> D[decode or encode transfer]
-  D --> I[Identity orchestration]
-  I --> S[State registry lock]
-  I --> K[Keys pair proof and files]
-  S --> F[identities.json]
-```

package/src/identity/.spec/capabilities/identity.ts

@@ -1,7 +0,0 @@
-import { defineCapability } from '@astrale-os/spec/authoring'
-
-export const CLI_IDENTITY = defineCapability({
-  id: 'CLI-IDENTITY',
-  statement:
-    'Preserves local identity selection, isolated key material, and explicit import/export journeys.',
-})

package/src/identity/.spec/flows/bootstrap-root.ts

@@ -1,79 +0,0 @@
-import type { IdentityExport } from '../api.js'
-
-interface Target {
-  readonly name: string
-  readonly url: string
-  readonly issuer: string
-}
-
-interface ReadyChild {
-  readonly target: Target
-  readonly operation: string
-  readonly instance: string
-}
-
-interface BootstrapAuthority {
-  /** Supported identity-import boundary; never a direct State or Keys write. */
-  importIdentity(input: {
-    readonly name: 'platform-root'
-    readonly envelope: IdentityExport
-  }): Promise<void>
-  bookmark(input: {
-    readonly target: Target
-    readonly defaultIdentity?: 'platform-root'
-  }): Promise<void>
-  /** Authenticated public Identity.whoami result on the selected target. */
-  whoami(input: {
-    readonly target: Target
-    readonly as?: 'platform-root'
-    readonly credential?: string
-  }): Promise<{ readonly id: string }>
-  /** Public manager createInstance call plus Operation and Instance status polling. */
-  callCreateChild(input: {
-    readonly manager: Target
-    readonly as: 'platform-root'
-    readonly operationId: string
-    readonly slug: string
-  }): Promise<ReadyChild>
-  /** Public Auth delegation invoked on the manager after authenticated whoami. */
-  delegateSelf(input: {
-    readonly manager: Target
-    readonly as: 'platform-root'
-    readonly principal: string
-    readonly audience: string
-  }): Promise<string>
-}
-
-/**
- * Bootstrap uses the imported root directly on the manager, then an unchanged
- * manager-to-child Management carrier whose effective child principal is
- * established only by the child's authenticated whoami result.
- */
-export async function bootstrapRootAndChild(
-  authority: BootstrapAuthority,
-  input: {
-    readonly envelope: IdentityExport
-    readonly manager: Target & { readonly name: 'platform-manager' }
-    readonly childSlug: string
-    readonly operationId: string
-  },
-): Promise<{ readonly managerId: string; readonly childId: string; readonly child: ReadyChild }> {
-  await authority.importIdentity({ name: 'platform-root', envelope: input.envelope })
-  await authority.bookmark({ target: input.manager, defaultIdentity: 'platform-root' })
-  const manager = await authority.whoami({ target: input.manager, as: 'platform-root' })
-  const child = await authority.callCreateChild({
-    manager: input.manager,
-    as: 'platform-root',
-    operationId: input.operationId,
-    slug: input.childSlug,
-  })
-  const credential = await authority.delegateSelf({
-    manager: input.manager,
-    as: 'platform-root',
-    principal: manager.id,
-    audience: child.target.issuer,
-  })
-  await authority.bookmark({ target: child.target })
-  const effectiveChild = await authority.whoami({ target: child.target, credential })
-  return { managerId: manager.id, childId: effectiveChild.id, child }
-}

package/src/identity/.spec/flows/domain-mediated-registration.ts

@@ -1,51 +0,0 @@
-import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth'
-import type { LocalBinding } from '@astrale-os/sdk/mutation'
-
-interface RegistrationAuthority {
-  prepareSelfProven(input: {
-    readonly identity: string
-    readonly classPath: string
-    readonly properties: Readonly<Record<string, unknown>>
-    readonly kernelIssuer: string
-  }): Promise<{ readonly binding: LocalBinding; readonly request: ProvisionRequest }>
-  call(input: {
-    readonly target: string
-    readonly request: ProvisionRequest
-  }): Promise<ProvisionResult>
-  persist(input: {
-    readonly identity: string
-    readonly targetKey: string
-    readonly issuer: string
-    readonly subject: string
-  }): Promise<void>
-}
-
-/** Application Identity Classes are provisioned only through their explicit authority owner. */
-export async function registerThroughDomain(
-  authority: RegistrationAuthority,
-  input: {
-    readonly identity: string
-    readonly classPath: string
-    readonly properties: Readonly<Record<string, unknown>>
-    readonly kernelIssuer: string
-    readonly targetKey: string
-    readonly callable: string
-  },
-): Promise<{ readonly issuer: string; readonly subject: string; readonly nodeId?: string }> {
-  const prepared = await authority.prepareSelfProven(input)
-  const result = await authority.call({ target: input.callable, request: prepared.request })
-  const identity = result.identities[prepared.binding]
-  if (identity === undefined) throw new Error('Provision result omitted the prepared binding.')
-  await authority.persist({
-    identity: input.identity,
-    targetKey: input.targetKey,
-    issuer: identity.issuer,
-    subject: identity.subject,
-  })
-  const nodeId = result.createdNodes[prepared.binding]
-  return {
-    issuer: identity.issuer,
-    subject: identity.subject,
-    ...(nodeId === undefined ? {} : { nodeId }),
-  }
-}

package/src/identity/.spec/flows/import.ts

@@ -1,29 +0,0 @@
-import type { Identity, IdentityExport, IdentityImportOptions, IdentityStore } from '../api.js'
-
-declare const withIdentityLock: <Value>(transition: () => Promise<Value>) => Promise<Value>
-declare const readLatest: () => Promise<IdentityStore>
-declare const checkImportConflict: (
-  store: IdentityStore,
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-) => string
-declare const persistAdmittedKeypair: (envelope: IdentityExport) => Promise<void>
-declare const publishIdentity: (
-  store: IdentityStore,
-  name: string,
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-) => Promise<Identity>
-
-/** Import performs all fallible admission before entering this ordered persistence flow. */
-export function importIdentity(
-  envelope: IdentityExport,
-  options: IdentityImportOptions,
-): Promise<Identity> {
-  return withIdentityLock(async () => {
-    const store = await readLatest()
-    const name = checkImportConflict(store, envelope, options)
-    await persistAdmittedKeypair(envelope)
-    return publishIdentity(store, name, envelope, options)
-  })
-}

package/src/identity/.spec/laws/identity.ts

@@ -1,56 +0,0 @@
-import { defineLaw } from '@astrale-os/spec/authoring'
-
-export const CLI_IDENTITY_REGISTRY_TRANSITIONS = defineLaw({
-  id: 'CLI-IDENTITY-REGISTRY-TRANSITIONS',
-  statement:
-    'Create, selection, registration, mode change, and non-default deletion preserve one locked registry and isolated subject keypair; deleting the selected identity is rejected unchanged.',
-  tests: [{ file: '__tests__/registry.test.ts', id: 'TEST-CLI-IDENTITY-REGISTRY-JOURNEY' }],
-})
-
-export const CLI_IDENTITY_TRANSFER_ADMITTED = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-ADMITTED',
-  statement:
-    'Malformed, unsupported-version, or cryptographically mismatched transfer content is rejected before either key files or registry state changes.',
-  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-REJECTS' }],
-})
-
-export const CLI_IDENTITY_TRANSFER_ROUNDTRIP = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-ROUNDTRIP',
-  statement:
-    'Legacy plaintext and V1 plaintext or compact-JWE content converge on one V1 envelope, and explicit exports are published atomically with mode 0600.',
-  tests: [
-    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-TRANSFER-ROUNDTRIP' },
-    { file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-EXPORT-PRIVATE' },
-  ],
-})
-
-export const CLI_IDENTITY_TRANSFER_SCHEMA = defineLaw({
-  id: 'CLI-IDENTITY-TRANSFER-SCHEMA',
-  statement:
-    'Plaintext IdentityExport V1 has one independently versioned portable JSON Schema; decoding additionally proves the JWK pair before any durable mutation.',
-  tests: [
-    {
-      file: '__tests__/transfer.test.ts',
-      id: 'TEST-CLI-IDENTITY-TRANSFER-SCHEMA',
-    },
-  ],
-})
-
-export const CLI_IDENTITY_IMPORT_ORDERED = defineLaw({
-  id: 'CLI-IDENTITY-IMPORT-ORDERED',
-  statement:
-    'Import checks name and identity-source conflicts under the registry lock before replacing keys, then publishes the registry only after the admitted pair is durable.',
-  tests: [{ file: '__tests__/transfer.test.ts', id: 'TEST-CLI-IDENTITY-IMPORT-ORDERED' }],
-})
-
-export const CLI_IDENTITY_REGISTRATION_AUTHORITY = defineLaw({
-  id: 'CLI-IDENTITY-REGISTRATION-AUTHORITY',
-  statement:
-    'Identity registration binds one self-proven Provision request to the selected Kernel; direct submission uses caller authority, while explicit Domain-mediated submission sends the same request to the named callable and persists only its admitted prepared binding.',
-  tests: [
-    {
-      file: '__tests__/registration.test.ts',
-      id: 'TEST-CLI-IDENTITY-REGISTER-DOMAIN-MEDIATED',
-    },
-  ],
-})

package/src/identity/.spec/layout.ts

@@ -1,13 +0,0 @@
-import { defineLayout } from '@astrale-os/spec/authoring'
-
-export default defineLayout({
-  entries: [
-    '__tests__/',
-    'index.ts',
-    'registration.ts',
-    'registry.ts',
-    'transfer.ts',
-    'tsconfig.json',
-  ],
-  exact: true,
-})

package/src/identity/.spec/schemas/identity-export-v1.schema.json

@@ -1,25 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.astrale.ai/cli/identity-export/1",
-  "title": "Astrale Identity Export V1",
-  "description": "Portable plaintext key-identity transfer envelope consumed by the Astrale CLI.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "subject", "privateJwk", "publicJwk"],
-  "properties": {
-    "version": { "const": 1 },
-    "subject": { "type": "string", "minLength": 1 },
-    "mode": { "enum": ["local", "remote"] },
-    "kid": { "type": "string", "minLength": 1 },
-    "issuer": { "type": "string", "format": "uri" },
-    "privateJwk": { "$ref": "#/$defs/jwk" },
-    "publicJwk": { "$ref": "#/$defs/jwk" }
-  },
-  "$defs": {
-    "jwk": {
-      "type": "object",
-      "minProperties": 1,
-      "additionalProperties": true
-    }
-  }
-}

package/src/identity/__tests__/fixtures/registry-journey.ts

@@ -1,53 +0,0 @@
-import { fileExists, keypairPaths } from '../../../keys/index'
-import { KEYS_DIR } from '../../../state/index'
-import {
-  createIdentity,
-  exportIdentity,
-  importIdentity,
-  deleteIdentity,
-  getDefault,
-  readIdentities,
-  setDefault,
-  setIdentityMode,
-  setRegistration,
-  upsertIdpIdentity,
-} from '../../index'
-
-await createIdentity('alice')
-await createIdentity('bob', { mode: 'remote' })
-await importIdentity(await exportIdentity('alice'), { name: 'alice-alias' })
-await setDefault('alice')
-await setIdentityMode('bob', 'local')
-await setRegistration('alice', 'production', {
-  iss: 'https://kernel.example',
-  sub: 'node-alice',
-  registeredAt: '2026-08-11T12:00:00.000Z',
-})
-
-let selectedDeletion = ''
-try {
-  await deleteIdentity('alice')
-} catch (error) {
-  selectedDeletion = error instanceof Error ? error.message : String(error)
-}
-await deleteIdentity('bob')
-await deleteIdentity('alice-alias')
-await upsertIdpIdentity('workos', {
-  subject: 'user_123',
-  idp: 'workos',
-  issuer: 'https://idp.example',
-  audience: 'https://kernel.example',
-  use: false,
-})
-
-const store = await readIdentities()
-const selected = await getDefault()
-console.log(
-  JSON.stringify({
-    store,
-    selected,
-    selectedDeletion,
-    aliceKey: await fileExists(keypairPaths('alice', KEYS_DIR).privatePath),
-    bobKey: await fileExists(keypairPaths('bob', KEYS_DIR).privatePath),
-  }),
-)

package/src/identity/__tests__/registration.test.ts

@@ -1,64 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-
-import { LocalBinding } from '@astrale-os/sdk/graph'
-import { expect, test } from 'bun:test'
-
-import { submitIdentityProvision } from '../registration'
-
-/** @evidence TEST-CLI-IDENTITY-REGISTER-DOMAIN-MEDIATED */
-test('submits the exact self-proven request through an explicit Domain callable', async () => {
-  const binding = LocalBinding('identity')
-  const request = {
-    idempotencyKey: 'identity-register:operator',
-    mutation: {
-      format: 'astrale.graph.mutation',
-      version: 'v2',
-      preconditions: [],
-      operations: [],
-    },
-    identities: {
-      identity: {
-        credentials: {
-          publicKey: { kty: 'EC', crv: 'P-256', x: 'x', y: 'y', alg: 'ES256' },
-          proof: 'self-proven-request.jwt.signature',
-        },
-      },
-    },
-  } as unknown as ProvisionRequest
-  const calls: unknown[] = []
-  let directCalls = 0
-  const result = await submitIdentityProvision({
-    binding,
-    request,
-    via: '/:ops.example:function.provisionOperator',
-    direct: {
-      async provision() {
-        directCalls += 1
-        throw new Error('direct provision must not run')
-      },
-    },
-    callable: {
-      async call(call) {
-        calls.push(call)
-        return {
-          createdNodes: { identity: 'operator-node' },
-          identities: {
-            identity: { issuer: 'https://identity.example', subject: 'operator-node' },
-          },
-        }
-      },
-    },
-  })
-
-  expect(directCalls).toBe(0)
-  expect(calls).toHaveLength(1)
-  expect(JSON.parse(JSON.stringify(calls[0]))).toEqual({
-    target: '/:ops.example:function.provisionOperator',
-    input: JSON.parse(JSON.stringify(request)),
-  })
-  expect(result).toEqual({
-    iss: 'https://identity.example',
-    sub: 'operator-node',
-    nodeId: 'operator-node',
-  })
-})

package/src/identity/__tests__/registry.test.ts

@@ -1,70 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-describe('identity registry journey', () => {
-  let root = ''
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'astrale-identity-registry-'))
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  /** @evidence TEST-CLI-IDENTITY-REGISTRY-JOURNEY */
-  test('runs create, selection, registration, mode, IdP, and deletion in a real process', async () => {
-    const child = Bun.spawn(
-      [process.execPath, join(import.meta.dir, 'fixtures', 'registry-journey.ts')],
-      {
-        env: { ...process.env, ASTRALE_HOME: root },
-        stdout: 'pipe',
-        stderr: 'pipe',
-      },
-    )
-    const [exitCode, stdout, stderr] = await Promise.all([
-      child.exited,
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-    ])
-    expect(exitCode, stderr).toBe(0)
-
-    const result = JSON.parse(stdout) as {
-      store: {
-        default: string
-        identities: Record<
-          string,
-          {
-            source?: string
-            mode?: string
-            registrations?: Record<string, { iss: string; sub: string; registeredAt: string }>
-          }
-        >
-      }
-      selected: { name: string; subject: string }
-      selectedDeletion: string
-      aliceKey: boolean
-      bobKey: boolean
-    }
-    expect(result.store.default).toBe('alice')
-    expect(Object.keys(result.store.identities).sort()).toEqual(['alice', 'workos'])
-    expect(result.store.identities.alice.registrations?.production).toEqual({
-      iss: 'https://kernel.example',
-      sub: 'node-alice',
-      registeredAt: '2026-08-11T12:00:00.000Z',
-    })
-    expect(result.store.identities.workos).toMatchObject({ source: 'idp', mode: 'remote' })
-    expect(result.selected).toMatchObject({ name: 'alice', subject: 'alice' })
-    expect(result.selectedDeletion).toContain('Cannot delete the default identity')
-    expect(result.aliceKey).toBe(true)
-    expect(result.bobKey).toBe(false)
-
-    const persisted = JSON.parse(await readFile(join(root, 'identities.json'), 'utf-8')) as {
-      version?: unknown
-    }
-    expect(persisted.version).toBe(1)
-    expect(stdout).not.toContain('"d":')
-  })
-})