@astrale-os/cli 1.0.0-beta.9 → 1.0.0-npm-deprecated.0

package/src/state/identities.ts

@@ -1,229 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import { z } from 'zod'
-
-import type { FileLockOptions } from './files'
-
-import { atomicWrite, withFileLock } from './files'
-import { IDENTITIES_PATH } from './paths'
-
-export type IdentitySource = 'key' | 'idp'
-export type IdentityMode = 'local' | 'remote'
-
-export interface Registration {
-  readonly iss: string
-  readonly sub: string
-  readonly registeredAt: string
-}
-
-export interface Identity {
-  readonly subject: string
-  readonly createdAt: string
-  readonly source?: IdentitySource
-  readonly mode?: IdentityMode
-  readonly kid?: string
-  readonly idp?: string
-  readonly issuer?: string
-  readonly audience?: string
-  readonly claims?: Readonly<Record<string, unknown>>
-  readonly registrations?: Readonly<Record<string, Registration>>
-}
-
-export interface IdentityStore {
-  readonly default: string
-  readonly identities: Readonly<Record<string, Identity>>
-}
-
-export const IDENTITY_STORE_VERSION = 1 as const
-
-export type IdentityStateErrorCode =
-  | 'IDENTITY_STATE_INVALID'
-  | 'IDENTITY_STATE_VERSION_UNSUPPORTED'
-  | 'IDENTITY_STATE_UNREADABLE'
-  | 'IDENTITY_STATE_BACKUP_CONFLICT'
-
-export class IdentityStateError extends Error {
-  readonly code: IdentityStateErrorCode
-  readonly path: string
-
-  constructor(code: IdentityStateErrorCode, path: string, message: string, cause?: unknown) {
-    super(message, { cause })
-    this.name = 'IdentityStateError'
-    this.code = code
-    this.path = path
-  }
-}
-
-export interface IdentityStoreOptions {
-  readonly path?: string
-  readonly now?: () => Date
-  readonly lock?: FileLockOptions
-}
-
-export interface IdentityUpdate<Value> {
-  readonly next: IdentityStore
-  readonly value: Value
-}
-
-const RegistrationSchema: z.ZodType<Registration> = z
-  .object({
-    iss: z.string(),
-    sub: z.string(),
-    registeredAt: z.string(),
-  })
-  .strict()
-
-const IdentitySchema: z.ZodType<Identity> = z
-  .object({
-    subject: z.string(),
-    createdAt: z.string(),
-    source: z.enum(['key', 'idp']).optional(),
-    mode: z.enum(['local', 'remote']).optional(),
-    kid: z.string().optional(),
-    idp: z.string().optional(),
-    issuer: z.string().url().optional(),
-    audience: z.string().optional(),
-    claims: z.record(z.string(), z.unknown()).optional(),
-    registrations: z.record(z.string(), RegistrationSchema).optional(),
-  })
-  .strict()
-
-const IdentityStoreFields = {
-  default: z.string(),
-  identities: z.record(z.string(), IdentitySchema),
-}
-
-const IdentityStoreSchema: z.ZodType<IdentityStore> = z.object(IdentityStoreFields).strict()
-
-const IdentityFileV1Schema = z
-  .object({ version: z.literal(IDENTITY_STORE_VERSION), ...IdentityStoreFields })
-  .strict()
-
-interface DecodedIdentityStore {
-  readonly store: IdentityStore
-  readonly legacyBytes?: string
-}
-
-export async function readIdentityStore(
-  options: IdentityStoreOptions = {},
-): Promise<IdentityStore> {
-  return (await readDecoded(options)).store
-}
-
-export async function updateIdentityStore<Value>(
-  transition: (current: IdentityStore) => IdentityUpdate<Value> | Promise<IdentityUpdate<Value>>,
-  options: IdentityStoreOptions = {},
-): Promise<Value> {
-  const path = options.path ?? IDENTITIES_PATH
-  return withFileLock(
-    `${path}.lock`,
-    async () => {
-      const current = await readDecoded(options)
-      const update = await transition(current.store)
-      if (current.legacyBytes !== undefined) {
-        await preserveLegacyBackup(path, current.legacyBytes)
-      }
-      await atomicWrite(path, encodeV1(update.next))
-      return update.value
-    },
-    options.lock,
-  )
-}
-
-async function readDecoded(options: IdentityStoreOptions): Promise<DecodedIdentityStore> {
-  const path = options.path ?? IDENTITIES_PATH
-  let raw: string
-  try {
-    raw = await readFile(path, 'utf-8')
-  } catch (error) {
-    if ((error as { code?: string }).code === 'ENOENT') {
-      return { store: seed(options.now?.() ?? new Date()) }
-    }
-    throw new IdentityStateError(
-      'IDENTITY_STATE_UNREADABLE',
-      path,
-      `Could not read identity state at ${path}`,
-      error,
-    )
-  }
-
-  let input: unknown
-  try {
-    input = JSON.parse(raw)
-  } catch (error) {
-    throw invalidState(path, error)
-  }
-
-  if (hasVersion(input)) {
-    if (typeof input.version !== 'number' || !Number.isInteger(input.version)) {
-      throw invalidState(path)
-    }
-    if (input.version !== IDENTITY_STORE_VERSION) {
-      throw new IdentityStateError(
-        'IDENTITY_STATE_VERSION_UNSUPPORTED',
-        path,
-        `Identity state at ${path} uses unsupported version ${input.version}`,
-      )
-    }
-    try {
-      const { version: _, ...store } = IdentityFileV1Schema.parse(input)
-      return { store }
-    } catch (error) {
-      throw invalidState(path, error)
-    }
-  }
-
-  try {
-    return { store: IdentityStoreSchema.parse(input), legacyBytes: raw }
-  } catch (error) {
-    throw invalidState(path, error)
-  }
-}
-
-function hasVersion(input: unknown): input is { readonly version: unknown } {
-  return typeof input === 'object' && input !== null && Object.hasOwn(input, 'version')
-}
-
-function seed(_now: Date): IdentityStore {
-  return {
-    default: '',
-    identities: {},
-  }
-}
-
-function encodeV1(store: IdentityStore): string {
-  return `${JSON.stringify({ version: IDENTITY_STORE_VERSION, ...store }, null, 2)}\n`
-}
-
-async function preserveLegacyBackup(path: string, legacyBytes: string): Promise<void> {
-  const backupPath = `${path}.v0.bak`
-  try {
-    const existing = await readFile(backupPath, 'utf-8')
-    if (existing !== legacyBytes) {
-      throw new IdentityStateError(
-        'IDENTITY_STATE_BACKUP_CONFLICT',
-        backupPath,
-        `Legacy identity backup at ${backupPath} does not match the file being migrated`,
-      )
-    }
-  } catch (error) {
-    if (error instanceof IdentityStateError) throw error
-    if ((error as { code?: string }).code !== 'ENOENT') {
-      throw new IdentityStateError(
-        'IDENTITY_STATE_UNREADABLE',
-        backupPath,
-        `Could not read legacy identity backup at ${backupPath}`,
-        error,
-      )
-    }
-    await atomicWrite(backupPath, legacyBytes)
-  }
-}
-
-function invalidState(path: string, cause?: unknown): IdentityStateError {
-  return new IdentityStateError(
-    'IDENTITY_STATE_INVALID',
-    path,
-    `Identity state at ${path} is malformed`,
-    cause,
-  )
-}

package/src/state/index.ts

@@ -1,29 +0,0 @@
-export { atomicWrite, withFileLock } from './files'
-export type { FileLockOptions } from './files'
-export { ExchangeCredentialCache } from './exchange-credentials'
-export type { exchange } from './exchange-credentials'
-export { IDENTITY_STORE_VERSION, readIdentityStore, updateIdentityStore } from './identities'
-export type {
-  Identity,
-  IdentityMode,
-  IdentitySource,
-  IdentityStore,
-  IdentityStoreOptions,
-  IdentityUpdate,
-  Registration,
-} from './identities'
-export {
-  ASTRALE_HOME,
-  CONFIG_PATH,
-  DATA_DIR,
-  IDENTITIES_PATH,
-  IDPS_PATH,
-  IDP_SESSIONS_DIR,
-  EXCHANGE_CREDENTIALS_PATH,
-  INSTALL_PATH,
-  INSTANCES_PATH,
-  KEYS_DIR,
-  createPaths,
-  paths,
-} from './paths'
-export type { PathEnvironment, Paths } from './paths'

package/src/state/paths.ts

@@ -1,61 +0,0 @@
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-export interface PathEnvironment {
-  readonly ASTRALE_HOME?: string
-  readonly ASTRALE_KEYS_DIR?: string
-  readonly ASTRALE_DATA_DIR?: string
-}
-
-export interface Paths {
-  readonly home: string
-  readonly keys: string
-  readonly data: string
-  readonly config: string
-  readonly install: string
-  readonly identities: string
-  readonly instances: string
-  readonly idps: string
-  readonly idpSessionsDir: string
-  readonly exchangeCredentials: string
-  idpDir(name: string): string
-  idpSession(identityName: string): string
-}
-
-/** Resolve every CLI state path once from explicit input and the captured environment. */
-export function createPaths(home?: string, environment?: PathEnvironment): Paths {
-  const captured = environment ?? {
-    ASTRALE_HOME: process.env.ASTRALE_HOME,
-    ASTRALE_KEYS_DIR: process.env.ASTRALE_KEYS_DIR,
-    ASTRALE_DATA_DIR: process.env.ASTRALE_DATA_DIR,
-  }
-  const base = home ?? captured.ASTRALE_HOME ?? join(homedir(), '.astrale')
-  const idpsDir = join(base, 'idps')
-  const idpSessionsDir = join(base, 'idp-sessions')
-  return Object.freeze({
-    home: base,
-    keys: captured.ASTRALE_KEYS_DIR ?? join(base, 'keys'),
-    data: captured.ASTRALE_DATA_DIR ?? join(base, 'data'),
-    config: join(base, 'config.json'),
-    install: join(base, 'install.json'),
-    identities: join(base, 'identities.json'),
-    instances: join(base, 'instances.json'),
-    idps: join(idpsDir, 'index.json'),
-    idpSessionsDir,
-    exchangeCredentials: join(base, 'exchange', 'credentials.json'),
-    idpDir: (name: string) => join(idpsDir, name),
-    idpSession: (identityName: string) => join(idpSessionsDir, `${identityName}.json`),
-  })
-}
-
-export const paths: Paths = createPaths()
-export const ASTRALE_HOME = paths.home
-export const KEYS_DIR = paths.keys
-export const DATA_DIR = paths.data
-export const CONFIG_PATH = paths.config
-export const INSTALL_PATH = paths.install
-export const IDENTITIES_PATH = paths.identities
-export const INSTANCES_PATH = paths.instances
-export const IDPS_PATH = paths.idps
-export const IDP_SESSIONS_DIR = paths.idpSessionsDir
-export const EXCHANGE_CREDENTIALS_PATH = paths.exchangeCredentials

package/src/state/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/telemetry/__tests__/gate.test.ts

@@ -1,63 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import type { TelemetryEvent } from '../types'
-
-import { commandHead, extractSignals, hasSignals } from '../gate'
-
-function ev(argv: string[], exitCode: number, errorName?: string): TelemetryEvent {
-  return {
-    v: 1,
-    ts: '2026-07-10T10:00:00.000Z',
-    argv,
-    exitCode,
-    durationMs: 10,
-    errorName,
-    cwd: '/w',
-    root: '/w',
-    surface: 'cli',
-  }
-}
-
-describe('commandHead', () => {
-  test('keeps up to two leading command tokens, stops at flags/values', () => {
-    expect(commandHead(['get', '/path', '-i', 'x'])).toBe('get /path')
-    expect(commandHead(['domain', 'install', './foo'])).toBe('domain install')
-    expect(commandHead(['status'])).toBe('status')
-    expect(commandHead(['--help'])).toBe('(bare)')
-    expect(commandHead(['call', 'k=v'])).toBe('call')
-  })
-})
-
-describe('extractSignals / hasSignals', () => {
-  test('failures grouped by command with error names', () => {
-    const s = extractSignals([
-      ev(['domain', 'install'], 1, 'AUTH_ERROR'),
-      ev(['domain', 'install'], 1, 'AUTH_ERROR'),
-      ev(['status'], 0),
-    ])
-    expect(s.failures).toEqual([
-      { command: 'domain install', count: 2, errorNames: ['AUTH_ERROR'] },
-    ])
-    expect(s.retries).toEqual([])
-    expect(hasSignals(s)).toBe(true)
-  })
-
-  test('3+ runs of one command is a retry smell even when green', () => {
-    const s = extractSignals([ev(['get', '/a'], 0), ev(['get', '/a'], 0), ev(['get', '/a'], 0)])
-    expect(s.retries).toEqual([{ command: 'get /a', count: 3 }])
-    expect(hasSignals(s)).toBe(true)
-  })
-
-  test('quiet session has no signals until a transcript is attached', () => {
-    const s = extractSignals([ev(['status'], 0), ev(['query', '/'], 0)])
-    expect(hasSignals(s)).toBe(false)
-    s.harnessSessions = [
-      {
-        harness: 'claude-code',
-        transcriptPath: '/t.jsonl',
-        sizeBytes: 1,
-      },
-    ]
-    expect(hasSignals(s)).toBe(true)
-  })
-})

package/src/telemetry/__tests__/recorder.test.ts

@@ -1,110 +0,0 @@
-import { afterEach, beforeAll, beforeEach, describe, expect, test } from 'bun:test'
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import type { Finalizer } from '../recorder'
-import type { SessionInfo } from '../store'
-import type { TelemetryEvent } from '../types'
-
-// ASTRALE_HOME must be set before the store/paths singleton is first imported.
-process.env.ASTRALE_HOME = mkdtempSync(join(tmpdir(), 'astrale-tele-recorder-'))
-
-let beginInvocation: (argv: string[]) => Finalizer
-let eventsPath: (id: string) => string
-let listSessions: () => SessionInfo[]
-let sessionsRoot: () => string
-let configPath: string
-
-const SESSION = 'rec-test'
-
-let work: string
-let cwd0: string
-
-beforeAll(async () => {
-  const recorder = await import('../recorder')
-  const store = await import('../store')
-  beginInvocation = recorder.beginInvocation
-  eventsPath = store.eventsPath
-  listSessions = store.listSessions
-  sessionsRoot = store.sessionsRoot
-  configPath = join(process.env.ASTRALE_HOME!, 'config.json')
-})
-
-beforeEach(() => {
-  // Destructive cleanup must be provably confined to this file's mkdtemp home.
-  if (!sessionsRoot().startsWith(tmpdir())) throw new Error('refusing to clean a non-tmp home')
-  rmSync(sessionsRoot(), { recursive: true, force: true })
-  rmSync(configPath, { force: true })
-  delete process.env.ASTRALE_TELEMETRY
-  process.env.ASTRALE_SESSION = SESSION
-  work = mkdtempSync(join(tmpdir(), 'astrale-tele-recwork-'))
-  cwd0 = process.cwd()
-  process.chdir(work)
-})
-
-afterEach(() => {
-  process.chdir(cwd0)
-  rmSync(work, { recursive: true, force: true })
-})
-
-function readEvents(id: string): TelemetryEvent[] {
-  return readFileSync(eventsPath(id), 'utf-8')
-    .split('\n')
-    .filter(Boolean)
-    .map((l) => JSON.parse(l) as TelemetryEvent)
-}
-
-describe('beginInvocation', () => {
-  test('appends one valid, parseable event with redacted argv', () => {
-    const cwd = process.cwd()
-    const finalize = beginInvocation(['node', 'astrale', 'get', '--token', 'abc', 'x'])
-    finalize(0)
-
-    const events = readEvents(SESSION)
-    expect(events).toHaveLength(1)
-    const [e] = events
-    expect(e.v).toBe(1)
-    expect(e.surface).toBe('cli')
-    expect(e.exitCode).toBe(0)
-    expect(e.argv).toEqual(['get', '--token', '<redacted>', 'x'])
-    expect(e.cwd).toBe(cwd)
-    expect(e.root).toBe(cwd)
-    expect(typeof e.ts).toBe('string')
-    expect(typeof e.durationMs).toBe('number')
-    expect('errorName' in e).toBe(false)
-  })
-
-  test('records exitCode and errorName on failure', () => {
-    beginInvocation(['node', 'astrale', 'call', 'foo'])(1, 'AuthError')
-    const [e] = readEvents(SESSION)
-    expect(e.exitCode).toBe(1)
-    expect(e.errorName).toBe('AuthError')
-  })
-
-  test('appends a second line on a second invocation', () => {
-    beginInvocation(['node', 'astrale', 'query'])(0)
-    beginInvocation(['node', 'astrale', 'whoami'])(0)
-    expect(readEvents(SESSION)).toHaveLength(2)
-  })
-
-  test('writes nothing for help/version-only invocations', () => {
-    beginInvocation(['node', 'astrale', '--help'])(0)
-    beginInvocation(['node', 'astrale', '--version'])(0)
-    beginInvocation(['node', 'astrale'])(0)
-    expect(listSessions()).toHaveLength(0)
-  })
-
-  test('writes nothing when disabled via ASTRALE_TELEMETRY', () => {
-    process.env.ASTRALE_TELEMETRY = '0'
-    beginInvocation(['node', 'astrale', 'get', 'x'])(0)
-    expect(listSessions()).toHaveLength(0)
-    expect(existsSync(eventsPath(SESSION))).toBe(false)
-  })
-
-  test('writes nothing when disabled via config telemetry.enabled=false', () => {
-    writeFileSync(configPath, JSON.stringify({ telemetry: { enabled: false } }))
-    beginInvocation(['node', 'astrale', 'get', 'x'])(0)
-    expect(listSessions()).toHaveLength(0)
-  })
-})

package/src/telemetry/__tests__/redact.test.ts

@@ -1,79 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { redactArgv } from '../redact'
-
-describe('redactArgv', () => {
-  test('redacts the value following a secret flag', () => {
-    expect(redactArgv(['--token', 'abc123', '--json'])).toEqual(['--token', '<redacted>', '--json'])
-  })
-
-  test('matches secret substrings in flag names, case-insensitively', () => {
-    expect(redactArgv(['--api-Token', 's', '--Bearer', 'b', '--jwk', 'k'])).toEqual([
-      '--api-Token',
-      '<redacted>',
-      '--Bearer',
-      '<redacted>',
-      '--jwk',
-      '<redacted>',
-    ])
-  })
-
-  test('redacts the value part of inline k=v secret args', () => {
-    expect(redactArgv(['--secret=hunter2', 'password=p', '--verbose'])).toEqual([
-      '--secret=<redacted>',
-      'password=<redacted>',
-      '--verbose',
-    ])
-  })
-
-  test('leaves non-secret flags and their values intact', () => {
-    expect(redactArgv(['query', '--limit', '3', '--format=json'])).toEqual([
-      'query',
-      '--limit',
-      '3',
-      '--format=json',
-    ])
-  })
-
-  test('truncates any arg longer than 200 chars to 200 + ellipsis', () => {
-    const long = 'x'.repeat(300)
-    const [only] = redactArgv([long])
-    expect(only).toBe('x'.repeat(200) + '…')
-    expect([...only].length).toBe(201)
-  })
-
-  test('a secret value is redacted before length matters', () => {
-    expect(redactArgv(['--password', 'y'.repeat(500)])).toEqual(['--password', '<redacted>'])
-  })
-
-  test('caps the array at 40 items with a …+N marker', () => {
-    const args = Array.from({ length: 45 }, (_, i) => `a${i}`)
-    const out = redactArgv(args)
-    expect(out.length).toBe(41)
-    expect(out.slice(0, 40)).toEqual(args.slice(0, 40))
-    expect(out[40]).toBe('…+5')
-  })
-
-  test('does not cap at exactly 40 items', () => {
-    const args = Array.from({ length: 40 }, (_, i) => `a${i}`)
-    expect(redactArgv(args)).toEqual(args)
-  })
-
-  test('a trailing secret flag with no value does not throw', () => {
-    expect(redactArgv(['call', '--token'])).toEqual(['call', '--token'])
-  })
-})
-
-describe('secret-shaped values', () => {
-  test('positional JWT is redacted wherever it appears', () => {
-    const jwt =
-      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U'
-    expect(redactArgv(['call', '/x::y', jwt])).toEqual(['call', '/x::y', '<redacted>'])
-    expect(redactArgv(['call', `body=Bearer ${jwt}`])[1]).toBe('body=Bearer <redacted>')
-  })
-  test('sk- style api key is redacted, plain paths are not', () => {
-    expect(redactArgv(['x', 'sk-abcdefghijklmnop1234'])).toEqual(['x', '<redacted>'])
-    const p = '/Users/someone/Documents/astrale/workspace/cli/src/telemetry/adapters/index.ts'
-    expect(redactArgv([p])).toEqual([p])
-  })
-})