@athsra/cli 1.1.4 → 1.1.6

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@athsra/cli",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "athsra CLI — E2EE secret manager on Cloudflare edge. Doppler-style dev UX + zero-knowledge encryption + soft-delete + version history. MIT.",
   "type": "module",
   "main": "./src/index.ts",
   "bin": {
-    "athsra": "./src/index.ts"
+    "athsra": "src/index.ts"
   },
   "license": "MIT",
   "repository": {

package/src/commands/doctor.ts

@@ -5,6 +5,7 @@ import { configFile, loadConfig, sessionFile } from '../lib/config.ts';
 import { partitionEnv } from '../lib/env-format.ts';
 import { readPlain } from '../lib/envelope.ts';
 import { getMasterPw, getToken, probeKeyring } from '../lib/keyring.ts';
+import { summarizeMemberCoverage } from './recipients.ts';
 
 export async function doctorCmd(args: string[]): Promise<number> {
   const audit = args.includes('--audit');
@@ -68,13 +69,28 @@ export async function doctorCmd(args: string[]): Promise<number> {
     console.log(`  info: error — ${(err as Error).message}`);
   }
 
+  let selfUserId: number | undefined;
   if (token) {
     try {
       const me = await client.whoami();
+      selfUserId = me.userId;
       console.log(`  whoami:           machineId=${me.machineId} lastSeenAt=${me.lastSeenAt}`);
     } catch (err) {
       console.log(`  whoami:           ✗ ${(err as Error).message}`);
     }
+    // identity key (server) — 다른 머신·위치의 브라우저 device-login 이 sealed key 를 받는 전제.
+    try {
+      const hasIdentityKey = (await client.getKeys()) !== null;
+      console.log(
+        `  identity key (server): ${
+          hasIdentityKey
+            ? '✓ provisioned (어디서든 device-login 가능)'
+            : '✗ missing — 다른 머신 device-login 불가. `athsra login` 재실행으로 생성.'
+        }`,
+      );
+    } catch (err) {
+      console.log(`  identity key (server): ? ${(err as Error).message}`);
+    }
     try {
       const projects = await client.listProjects();
       const head = projects.slice(0, 5).join(', ');
@@ -82,6 +98,21 @@ export async function doctorCmd(args: string[]): Promise<number> {
       console.log(
         `  projects:         ${projects.length}${projects.length ? ` (${head}${more})` : ''}`,
       );
+      // recipient 커버리지 — 브라우저 로그인(identity) 머신이 master pw 없이 복호 가능한 프로젝트 수.
+      if (selfUserId !== undefined && projects.length > 0) {
+        const uid = selfUserId;
+        const envs = await Promise.all(
+          projects.map((p) => client.getEnvelope(p).catch(() => null)),
+        );
+        const cov = summarizeMemberCoverage(projects, envs, uid);
+        console.log(
+          `  recipient coverage: ${cov.covered}/${cov.total} member-accessible (브라우저 로그인으로 복호)`,
+        );
+        if (cov.gaps.length > 0) {
+          console.log(`    ⚠ master-only (브라우저 로그인 복호 불가): ${cov.gaps.join(', ')}`);
+          console.log('      → 소유자가 `athsra migrate-envelopes --self --apply` 로 보강.');
+        }
+      }
     } catch (err) {
       console.log(`  projects:         fetch error — ${(err as Error).message}`);
     }

package/src/commands/login.ts

@@ -30,13 +30,25 @@ import { promptConfirm, promptPassword, promptText } from '../lib/prompt.ts';
  * 실제 공유는 Slice 6. master pw 로 wrap 된 privkey 만 server 보관(평문 미노출).
  */
 async function provisionIdentityKey(client: AthsraClient, masterPw: string): Promise<void> {
-  try {
-    const created = await ensureKeypair(client, masterPw);
-    console.log(created ? '  identity key: provisioned ✓' : '  identity key: present ✓');
-  } catch (err) {
-    console.warn(
-      `  identity key: provisioning deferred (${err instanceof Error ? err.message : String(err)})`,
-    );
+  // identity key = "어디서든 브라우저 device-login" 의 substrate (다른 머신이 sealed key 를 받는 전제).
+  // transient 실패에 1회 재시도, 영구 실패면 silent 가 아니라 결과(다른 머신 device-login 불가)를
+  // 명시 + 멱등 복구 경로 안내. master-pw 사용 자체는 정상이므로 login 을 hard-fail 하진 않는다.
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    try {
+      const created = await ensureKeypair(client, masterPw);
+      console.log(created ? '  identity key: provisioned ✓' : '  identity key: present ✓');
+      return;
+    } catch (err) {
+      if (attempt < 2) continue;
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`  ⚠ identity key 미provisioning (${msg})`);
+      console.warn(
+        '     → 다른 머신·위치에서 브라우저 device-login 이 불가합니다 (이 머신의 master-pw 접근은 정상).',
+      );
+      console.warn(
+        '     → 복구: 네트워크 확인 후 `athsra login` 재실행(멱등). 상태는 `athsra doctor` 로 확인.',
+      );
+    }
   }
 }
 

package/src/commands/org.ts

@@ -22,7 +22,7 @@ const USAGE = [
   '  athsra org create <name>                   — company org 생성 (owner)',
   '  athsra org ls                              — 내가 멤버인 org 목록 (* = 현재)',
   '  athsra org members                         — 현재 org 멤버',
-  '  athsra org invite <identifier> [--role=member|admin]  — 멤버 초대 (JIT pending)',
+  '  athsra org invite <identifier> [--role=member|admin] [--grant]  — 멤버 초대 (--grant: 공유 즉시 re-wrap)',
   '  athsra org remove <user_id>                — 멤버 제거 (owner 면 DEK 자동 회전)',
   '  athsra org rotate-after-removal <user_id>  — 제거 후 DEK 회전 재개 (부분 실패 복구, owner)',
   '  athsra org grant-access <identifier|id> [--replace]  — 멤버에게 공유 시크릿 re-wrap (--replace=key reset 복구)',
@@ -130,7 +130,7 @@ async function membersCmd(): Promise<number> {
 async function inviteCmd(args: string[]): Promise<number> {
   const identifier = args.filter((a) => !a.startsWith('-'))[0];
   if (!identifier) {
-    console.error('usage: athsra org invite <identifier> [--role=member|admin]');
+    console.error('usage: athsra org invite <identifier> [--role=member|admin] [--grant]');
     return 2;
   }
   let role: 'member' | 'admin' = 'member';
@@ -153,6 +153,28 @@ async function inviteCmd(args: string[]): Promise<number> {
     console.log(
       '  초대받은 사람: athsra login → `athsra org ls` 에 pending 표시 → `athsra org use` 로 수락',
     );
+    // --grant: 초대와 동시에 공유 시크릿 re-wrap(member recipient 추가) — 멤버가 이미 identity 키를
+    // provisioning(로그인)했다면 1-command 으로 접근 부여. 키 부재면 명시 안내(로그인 후 grant-access).
+    if (args.includes('--grant')) {
+      try {
+        const g = await grantOrgAccess(ctx.client, ctx.masterPw, res.user_id, {});
+        if (g.granted.length > 0) {
+          console.log(`✓ 공유 re-wrap — granted ${g.granted.length}: ${g.granted.join(', ')}`);
+        } else {
+          console.log(
+            '  (re-wrap 대상 없음 — 멤버 identity 키 미provisioning 또는 v2 envelope 없음. 멤버 `athsra login` 후 `athsra org grant-access` 재시도)',
+          );
+        }
+        if (g.legacyV1.length > 0) {
+          console.log(`  v1 envelope(먼저 \`athsra migrate-envelopes\`): ${g.legacyV1.join(', ')}`);
+        }
+        for (const f of g.failed) console.error(`  ✗ ${f.project}: ${f.error}`);
+      } catch (err) {
+        console.warn(
+          `  ⚠ 자동 공유 실패 (${(err as Error).message}) — 멤버 \`athsra login\` 후 \`athsra org grant-access ${identifier}\`.`,
+        );
+      }
+    }
     return 0;
   } catch (err) {
     const msg = (err as Error).message;

package/src/commands/recipients.ts

@@ -38,6 +38,29 @@ export async function recipientsCmd(args: string[]): Promise<number> {
   return listRecipientsCmd(args);
 }
 
+/**
+ * member-recipient 커버리지 요약 — browser-login(identity) 머신이 복호 가능한 프로젝트 수.
+ * envelope 에 `member:<userId>` 가 있어야 master pw 없이 복호된다 (`athsra doctor` 가 사용).
+ * 순수 함수 (네트워크 X) — fetch 한 envelope 배열을 받아 집계만 한다.
+ */
+export function summarizeMemberCoverage(
+  projects: string[],
+  envelopes: ({ version: number; recipients?: { id: string }[] } | null)[],
+  userId: number,
+): { covered: number; total: number; gaps: string[] } {
+  const gaps: string[] = [];
+  let covered = 0;
+  projects.forEach((project, i) => {
+    const env = envelopes[i];
+    if (env && env.version === 2 && env.recipients?.some((r) => r.id === `member:${userId}`)) {
+      covered++;
+    } else {
+      gaps.push(project);
+    }
+  });
+  return { covered, total: projects.length, gaps };
+}
+
 async function listRecipientsCmd(args: string[]): Promise<number> {
   if (args.includes('--help') || args.includes('-h')) {
     console.log(USAGE);

package/src/commands/rotate-master.ts

@@ -88,15 +88,33 @@ export async function rotateMasterCmd(_args: string[]): Promise<number> {
     }
   }
 
-  // 1. 모든 projects decrypt (옛 master pw, v1+v2 dispatcher)
+  // 1. 모든 project × 모든 활성 config decrypt (옛 master pw, v1+v2 dispatcher). 비-default 환경
+  //    (dev/staging/prod)까지 포함해야 한다 — 누락하면 회전 후 옛 pw 소실로 그 환경 시크릿이 영구
+  //    복호 불가(데이터 손실). dashboard lib/rotate-master 와 동일 정합.
   const projects = await client.listProjects();
-  console.log(`\n• Decrypting ${projects.length} projects with old master pw...`);
-  const plaintexts: Record<string, Record<string, string>> = {};
+  const targets: { project: string; config: string }[] = [];
   for (const p of projects) {
-    const plain = await readPlain(ctx, p);
+    try {
+      const res = await client.listConfigs(p);
+      const active = res.configs.filter((c) => c.active && !c.deleted).map((c) => c.config);
+      if (active.length === 0) targets.push({ project: p, config: 'default' });
+      else for (const config of active) targets.push({ project: p, config });
+    } catch {
+      // listConfigs 실패 — 최소 default 는 시도(누락보다 안전).
+      targets.push({ project: p, config: 'default' });
+    }
+  }
+  const cfgLabel = (t: { project: string; config: string }) =>
+    t.config === 'default' ? t.project : `${t.project}:${t.config}`;
+  console.log(
+    `\n• Decrypting ${targets.length} envelope(s) across ${projects.length} project(s) with old master pw...`,
+  );
+  const decrypted: { project: string; config: string; plain: Record<string, string> }[] = [];
+  for (const t of targets) {
+    const plain = await readPlain(ctx, t.project, t.config);
     if (!plain) continue;
-    plaintexts[p] = plain;
-    console.log(`  ✓ ${p} (${Object.keys(plain).length} keys)`);
+    decrypted.push({ project: t.project, config: t.config, plain });
+    console.log(`  ✓ ${cfgLabel(t)} (${Object.keys(plain).length} keys)`);
   }
 
   // 2. identity 키쌍 재포장 재료 계산 (있으면) — old pw 로 unwrap → new pw 로 wrap. proof 회전
@@ -135,18 +153,18 @@ export async function rotateMasterCmd(_args: string[]): Promise<number> {
 
   // 4. re-encrypt + PUT (v2 envelope, 자동 마이그레이션)
   console.log(
-    `\n• Re-encrypting ${Object.keys(plaintexts).length} projects with new master pw ` +
+    `\n• Re-encrypting ${decrypted.length} envelope(s) with new master pw ` +
       '(v2, Argon2id m=256MB enterprise)...',
   );
-  for (const [p, plain] of Object.entries(plaintexts)) {
+  for (const { project, config, plain } of decrypted) {
     // rotate-master = enterprise KDF 마이그레이션 지점 (m=256MB). 이후 routine set 은
-    // writePlain 의 보존 로직으로 256MB 유지 (silent downgrade 없음).
-    await writePlain(newCtx, p, plain, { kdfParams: ENTERPRISE_KDF });
-    console.log(`  ✓ ${p}`);
+    // writePlain 의 보존 로직으로 256MB 유지 (silent downgrade 없음). config 전파 필수.
+    await writePlain(newCtx, project, plain, { kdfParams: ENTERPRISE_KDF, config });
+    console.log(`  ✓ ${cfgLabel({ project, config })}`);
   }
 
   console.log(
-    `\n✓ master password rotated. ${Object.keys(plaintexts).length} projects re-encrypted ` +
+    `\n✓ master password rotated. ${decrypted.length} envelope(s) re-encrypted ` +
       'as v2 (Argon2id m=256MB).',
   );
   console.log(