@attest-it/cli 0.5.0 → 0.6.1

package/dist/bin/attest-it.js

@@ -6,7 +6,8 @@ import * as path from 'path';
 import { join, dirname } from 'path';
 import { detectTheme } from 'chromaterm';
 import { input, select, confirm, checkbox } from '@inquirer/prompts';
-import { loadConfig, toAttestItConfig, readSealsSync, computeFingerprintSync, verifyGateSeal, verifyAllSeals, computeFingerprint, createAttestation, readAttestations, upsertAttestation, KeyProviderRegistry, getDefaultPrivateKeyPath, FilesystemKeyProvider, writeSignedAttestations, loadLocalConfigSync, getActiveIdentity, isAuthorizedSigner, createSeal, writeSealsSync, checkOpenSSL, getDefaultPublicKeyPath, OnePasswordKeyProvider, MacOSKeychainKeyProvider, generateKeyPair, setKeyPermissions, getGate, loadLocalConfig, getAttestItConfigDir, generateEd25519KeyPair, saveLocalConfig, findConfigPath, findAttestation, setAttestItHomeDir } from '@attest-it/core';
+import { loadConfig, toAttestItConfig, readSealsSync, computeFingerprintSync, verifyGateSeal, verifyAllSeals, computeFingerprint, createAttestation, readAttestations, upsertAttestation, KeyProviderRegistry, getDefaultPrivateKeyPath, FilesystemKeyProvider, writeSignedAttestations, loadLocalConfigSync, getActiveIdentity, isAuthorizedSigner, createSeal, writeSealsSync, checkOpenSSL, getDefaultPublicKeyPath, OnePasswordKeyProvider, MacOSKeychainKeyProvider, generateKeyPair, setKeyPermissions, getGate, loadLocalConfig, YubiKeyProvider, getAttestItConfigDir, generateEd25519KeyPair, saveLocalConfig, findConfigPath, loadPreferences, savePreferences, findAttestation, setAttestItHomeDir } from '@attest-it/core';
+import tabtab2 from '@pnpm/tabtab';
 import { spawn } from 'child_process';
 import * as os from 'os';
 import { parse } from 'shell-quote';
@@ -17,7 +18,6 @@ import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { mkdir, writeFile, unlink, readFile } from 'fs/promises';
 import { Spinner, Select, TextInput } from '@inkjs/ui';
 import { stringify } from 'yaml';
-import tabtab from '@pnpm/tabtab';
 import { fileURLToPath } from 'url';
 
 var globalOptions = {};
@@ -171,6 +171,87 @@ var ExitCode = {
   /** Missing required key file */
   MISSING_KEY: 5
 };
+var PROGRAM_NAME = "attest-it";
+var PROGRAM_ALIAS = "attest";
+function detectCurrentShell() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/bash") || shellPath.endsWith("/bash.exe")) {
+    return "bash";
+  }
+  if (shellPath.endsWith("/zsh") || shellPath.endsWith("/zsh.exe")) {
+    return "zsh";
+  }
+  if (shellPath.endsWith("/fish") || shellPath.endsWith("/fish.exe")) {
+    return "fish";
+  }
+  return null;
+}
+function getSourceCommand(shell) {
+  switch (shell) {
+    case "bash":
+      return "source ~/.bashrc";
+    case "zsh":
+      return "source ~/.zshrc";
+    case "fish":
+      return "source ~/.config/fish/config.fish";
+  }
+}
+async function offerCompletionInstall() {
+  try {
+    const prefs = await loadPreferences();
+    if (prefs.cliExperience?.declinedCompletionInstall) {
+      return false;
+    }
+    const shell = detectCurrentShell();
+    if (!shell) {
+      return false;
+    }
+    log("");
+    const shouldInstall = await confirm({
+      message: `Would you like to enable shell completions for ${shell}?`,
+      default: true
+    });
+    if (!shouldInstall) {
+      await savePreferences({
+        ...prefs,
+        cliExperience: {
+          ...prefs.cliExperience,
+          declinedCompletionInstall: true
+        }
+      });
+      log("");
+      info("No problem! If you change your mind, you can run:");
+      log("  attest-it completion install");
+      log("");
+      return false;
+    }
+    await tabtab2.install({
+      name: PROGRAM_NAME,
+      completer: PROGRAM_NAME,
+      shell
+    });
+    await tabtab2.install({
+      name: PROGRAM_ALIAS,
+      completer: PROGRAM_ALIAS,
+      shell
+    });
+    log("");
+    success(`Shell completions installed for ${shell}!`);
+    info(`Completions enabled for both "${PROGRAM_NAME}" and "${PROGRAM_ALIAS}" commands.`);
+    log("");
+    info("Restart your shell or run:");
+    log(`  ${getSourceCommand(shell)}`);
+    log("");
+    return true;
+  } catch (err) {
+    error(`Failed to install completions: ${err instanceof Error ? err.message : String(err)}`);
+    log("");
+    info("You can try again later with:");
+    log("  attest-it completion install");
+    log("");
+    return false;
+  }
+}
 
 // src/commands/init.ts
 var initCommand = new Command("init").description("Initialize attest-it configuration").option("-p, --path <path>", "Config file path", ".attest-it/config.yaml").option("-f, --force", "Overwrite existing config").action(async (options) => {
@@ -234,6 +315,7 @@ async function runInit(options) {
     log(`  1. Edit ${options.path} to define your test suites`);
     log("  2. Run: attest-it keygen");
     log("  3. Run: attest-it status");
+    await offerCompletionInstall();
   } catch (err) {
     if (err instanceof Error) {
       error(err.message);
@@ -1524,6 +1606,15 @@ function createKeyProviderFromIdentity(identity) {
           field: privateKey.field
         }
       });
+    case "yubikey":
+      return KeyProviderRegistry.create({
+        type: "yubikey",
+        options: {
+          encryptedKeyPath: privateKey.encryptedKeyPath,
+          slot: privateKey.slot,
+          serial: privateKey.serial
+        }
+      });
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -1539,6 +1630,8 @@ function getKeyRefFromIdentity(identity) {
       return `${privateKey.service}:${privateKey.account}`;
     case "1password":
       return privateKey.item;
+    case "yubikey":
+      return privateKey.encryptedKeyPath;
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -1595,7 +1688,7 @@ function KeygenInteractive(props) {
     } else if (value === "1password") {
       setSelectedProvider("1password");
       if (accounts.length === 1 && accounts[0]) {
-        setSelectedAccount(accounts[0].email);
+        setSelectedAccount(accounts[0].user_uuid);
         setStep("select-vault");
       } else {
         setStep("select-account");
@@ -1642,8 +1735,12 @@ function KeygenInteractive(props) {
         if (!selectedVault || !itemName) {
           throw new Error("Vault and item name are required for 1Password");
         }
+        const vault = vaults.find((v) => v.id === selectedVault);
+        if (!vault) {
+          throw new Error("Selected vault not found");
+        }
         const providerOptions = {
-          vault: selectedVault,
+          vault: vault.name,
           itemName
         };
         if (selectedAccount !== void 0) {
@@ -1660,7 +1757,7 @@ function KeygenInteractive(props) {
           publicKeyPath: result.publicKeyPath,
           privateKeyRef: result.privateKeyRef,
           storageDescription: result.storageDescription,
-          vault: selectedVault,
+          vault: vault.name,
           itemName
         };
         if (selectedAccount !== void 0) {
@@ -1726,7 +1823,7 @@ function KeygenInteractive(props) {
   if (step === "select-account") {
     const options = accounts.map((account) => ({
       label: account.email,
-      value: account.email
+      value: account.user_uuid
     }));
     return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx(Text, { bold: true, children: "Select 1Password account:" }),
@@ -1743,7 +1840,7 @@ function KeygenInteractive(props) {
     }
     const options = vaults.map((vault) => ({
       label: vault.name,
-      value: vault.name
+      value: vault.id
     }));
     return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx(Text, { bold: true, children: "Select vault for private key storage:" }),
@@ -2382,6 +2479,15 @@ function createKeyProviderFromIdentity2(identity) {
           field: privateKey.field
         }
       });
+    case "yubikey":
+      return KeyProviderRegistry.create({
+        type: "yubikey",
+        options: {
+          encryptedKeyPath: privateKey.encryptedKeyPath,
+          slot: privateKey.slot,
+          serial: privateKey.serial
+        }
+      });
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -2397,6 +2503,8 @@ function getKeyRefFromIdentity2(identity) {
       return privateKey.service;
     case "1password":
       return privateKey.item;
+    case "yubikey":
+      return privateKey.encryptedKeyPath;
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -2436,6 +2544,9 @@ async function runList() {
         case "1password":
           keyType = "1password";
           break;
+        case "yubikey":
+          keyType = "yubikey";
+          break;
       }
       log(`${marker} ${theme3.blue(slug)}`);
       log(`  Name:       ${nameDisplay}`);
@@ -2525,6 +2636,8 @@ async function runCreate() {
     info("Checking available key storage providers...");
     const opAvailable = await OnePasswordKeyProvider.isInstalled();
     const keychainAvailable = MacOSKeychainKeyProvider.isAvailable();
+    const yubikeyInstalled = await YubiKeyProvider.isInstalled();
+    const yubikeyConnected = yubikeyInstalled ? await YubiKeyProvider.isConnected() : false;
     const configDir = getAttestItConfigDir();
     const storageChoices = [
       { name: `File system (${join(configDir, "keys")})`, value: "file" }
@@ -2535,6 +2648,10 @@ async function runCreate() {
     if (opAvailable) {
       storageChoices.push({ name: "1Password", value: "1password" });
     }
+    if (yubikeyInstalled) {
+      const yubikeyLabel = yubikeyConnected ? "YubiKey (encrypted with challenge-response)" : "YubiKey (not connected - insert YubiKey first)";
+      storageChoices.push({ name: yubikeyLabel, value: "yubikey" });
+    }
     const keyStorageType = await select({
       message: "Where should the private key be stored?",
       choices: storageChoices
@@ -2734,6 +2851,75 @@ async function runCreate() {
         keyStorageDescription = `1Password (${selectedVault}/${item})`;
         break;
       }
+      case "yubikey": {
+        if (!await YubiKeyProvider.isConnected()) {
+          error("No YubiKey detected. Please insert your YubiKey and try again.");
+          process.exit(ExitCode.CONFIG_ERROR);
+        }
+        const yubikeys = await YubiKeyProvider.listDevices();
+        if (yubikeys.length === 0) {
+          throw new Error("No YubiKeys detected. Please insert a YubiKey and try again.");
+        }
+        const formatYubiKeyChoice = (yk) => {
+          return `${theme3.blue.bold()(yk.type)} ${theme3.muted(`(Serial: ${yk.serial}, FW: ${yk.firmware})`)}`;
+        };
+        let selectedSerial;
+        if (yubikeys.length === 1 && yubikeys[0]) {
+          selectedSerial = yubikeys[0].serial;
+          info(`Using YubiKey: ${formatYubiKeyChoice(yubikeys[0])}`);
+        } else {
+          selectedSerial = await select({
+            message: "Select YubiKey:",
+            choices: yubikeys.map((yk) => ({
+              name: formatYubiKeyChoice(yk),
+              value: yk.serial
+            }))
+          });
+        }
+        const slot = 2;
+        const isChallengeResponseConfigured = await YubiKeyProvider.isChallengeResponseConfigured(
+          slot,
+          selectedSerial
+        );
+        if (!isChallengeResponseConfigured) {
+          log("");
+          error(`YubiKey slot ${String(slot)} is not configured for HMAC challenge-response.`);
+          log("");
+          log("To configure it, run:");
+          log(theme3.blue(`  ykman otp chalresp --generate ${String(slot)}`));
+          log("");
+          log("This will configure slot 2 with a randomly generated secret.");
+          log(theme3.muted("Note: Make sure to back up the secret if needed for recovery."));
+          process.exit(ExitCode.CONFIG_ERROR);
+        }
+        const encryptedKeyName = await input({
+          message: "Encrypted key file name:",
+          default: `${slug}.enc`,
+          validate: (value) => {
+            if (!value || value.trim().length === 0) {
+              return "File name cannot be empty";
+            }
+            return true;
+          }
+        });
+        const keysDir = join(getAttestItConfigDir(), "keys");
+        await mkdir(keysDir, { recursive: true });
+        const encryptedKeyPath = join(keysDir, encryptedKeyName);
+        const result = await YubiKeyProvider.encryptPrivateKey({
+          privateKey: keyPair.privateKey,
+          encryptedKeyPath,
+          slot,
+          serial: selectedSerial
+        });
+        privateKeyRef = {
+          type: "yubikey",
+          encryptedKeyPath: result.encryptedKeyPath,
+          slot,
+          serial: selectedSerial
+        };
+        keyStorageDescription = result.storageDescription;
+        break;
+      }
       default:
         throw new Error(`Unknown key storage type: ${keyStorageType}`);
     }
@@ -2783,6 +2969,7 @@ async function runCreate() {
       log(`To use this identity, run: attest-it identity use ${slug}`);
       log("");
     }
+    await offerCompletionInstall();
   } catch (err) {
     if (err instanceof Error) {
       error(err.message);
@@ -3065,6 +3252,11 @@ function formatKeyLocation(privateKey) {
       }
       return `${theme3.blue.bold()("1Password")}: ${theme3.muted(parts.join("/"))}`;
     }
+    case "yubikey": {
+      const slotInfo = privateKey.slot ? ` (slot ${String(privateKey.slot)})` : "";
+      const serialInfo = privateKey.serial ? ` [${privateKey.serial}]` : "";
+      return `${theme3.blue.bold()("YubiKey")}${serialInfo}${slotInfo}: ${theme3.muted(privateKey.encryptedKeyPath)}`;
+    }
     default:
       return "Unknown storage";
   }
@@ -3738,11 +3930,16 @@ async function runRemove2(slug, options) {
 
 // src/commands/team/index.ts
 var teamCommand = new Command("team").description("Manage team members and authorizations").addCommand(listCommand2).addCommand(addCommand).addCommand(editCommand2).addCommand(removeCommand2);
-var PROGRAM_NAME = "attest-it";
+var PROGRAM_NAME2 = "attest-it";
+var PROGRAM_ALIAS2 = "attest";
+var PROGRAM_NAMES = [PROGRAM_NAME2, PROGRAM_ALIAS2];
+function isSupportedShell(value) {
+  return value === "bash" || value === "zsh" || value === "fish";
+}
 async function getCompletions(env) {
   let shell;
   try {
-    const detectedShell = tabtab.getShellFromEnv(process.env);
+    const detectedShell = tabtab2.getShellFromEnv(process.env);
     shell = detectedShell === "pwsh" ? "bash" : detectedShell;
   } catch {
     shell = "bash";
@@ -3786,15 +3983,15 @@ async function getCompletions(env) {
   const lastWord = env.last;
   const prevWord = env.prev;
   if (prevWord === "--config" || prevWord === "-c") {
-    tabtab.logFiles();
+    tabtab2.logFiles();
     return;
   }
   if (lastWord.startsWith("-")) {
-    tabtab.log(globalOptions2, shell, console.log);
+    tabtab2.log(globalOptions2, shell, console.log);
     return;
   }
   const commandIndex = words.findIndex(
-    (w) => !w.startsWith("-") && w !== PROGRAM_NAME && w !== "npx"
+    (w) => !w.startsWith("-") && !PROGRAM_NAMES.includes(w) && w !== "npx"
   );
   const currentCommand = commandIndex >= 0 ? words[commandIndex] ?? null : null;
   if (currentCommand === "identity") {
@@ -3805,12 +4002,12 @@ async function getCompletions(env) {
     if (subcommand === "use" || subcommand === "remove") {
       const identities = await getIdentitySlugs();
       if (identities.length > 0) {
-        tabtab.log(identities, shell, console.log);
+        tabtab2.log(identities, shell, console.log);
         return;
       }
     }
     if (!subcommand || subcommandIndex < 0) {
-      tabtab.log(identitySubcommands, shell, console.log);
+      tabtab2.log(identitySubcommands, shell, console.log);
       return;
     }
   }
@@ -3820,7 +4017,7 @@ async function getCompletions(env) {
     );
     const subcommand = subcommandIndex >= 0 ? words[subcommandIndex] ?? null : null;
     if (!subcommand || subcommandIndex < 0) {
-      tabtab.log(teamSubcommands, shell, console.log);
+      tabtab2.log(teamSubcommands, shell, console.log);
       return;
     }
   }
@@ -3830,30 +4027,43 @@ async function getCompletions(env) {
     );
     const subcommand = subcommandIndex >= 0 ? words[subcommandIndex] ?? null : null;
     if (subcommand === "install") {
-      tabtab.log(["bash", "zsh", "fish"], shell, console.log);
+      tabtab2.log(["bash", "zsh", "fish"], shell, console.log);
       return;
     }
     if (!subcommand || subcommandIndex < 0) {
-      tabtab.log(completionSubcommands, shell, console.log);
+      tabtab2.log(completionSubcommands, shell, console.log);
       return;
     }
   }
   if (currentCommand === "status" || currentCommand === "verify" || currentCommand === "seal") {
     const gates = await getGateNames();
     if (gates.length > 0) {
-      tabtab.log(gates, shell, console.log);
+      tabtab2.log(gates, shell, console.log);
       return;
     }
   }
   if (currentCommand === "run") {
     const suites = await getSuiteNames();
     if (suites.length > 0) {
-      tabtab.log(suites, shell, console.log);
+      tabtab2.log(suites, shell, console.log);
       return;
     }
   }
-  if (!currentCommand) {
-    tabtab.log([...commands, ...globalOptions2], shell, console.log);
+  const knownCommands = [
+    "init",
+    "status",
+    "run",
+    "verify",
+    "seal",
+    "keygen",
+    "prune",
+    "identity",
+    "team",
+    "whoami",
+    "completion"
+  ];
+  if (!currentCommand || !knownCommands.includes(currentCommand)) {
+    tabtab2.log([...commands, ...globalOptions2], shell, console.log);
   }
 }
 async function getIdentitySlugs() {
@@ -3885,35 +4095,65 @@ async function getSuiteNames() {
   return [];
 }
 var completionCommand = new Command("completion").description("Shell completion commands");
-completionCommand.command("install [shell]").description("Install shell completion (bash, zsh, or fish)").action(async (shellArg) => {
+function detectCurrentShell2() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/bash") || shellPath.endsWith("/bash.exe")) {
+    return "bash";
+  }
+  if (shellPath.endsWith("/zsh") || shellPath.endsWith("/zsh.exe")) {
+    return "zsh";
+  }
+  if (shellPath.endsWith("/fish") || shellPath.endsWith("/fish.exe")) {
+    return "fish";
+  }
+  return null;
+}
+function getSourceCommand2(shell) {
+  switch (shell) {
+    case "bash":
+      return "source ~/.bashrc";
+    case "zsh":
+      return "source ~/.zshrc";
+    case "fish":
+      return "source ~/.config/fish/config.fish";
+  }
+}
+completionCommand.command("install [shell]").description("Install shell completion (auto-detects shell, or specify bash/zsh/fish)").action(async (shellArg) => {
   try {
     let shell;
     if (shellArg !== void 0) {
-      if (tabtab.isShellSupported(shellArg)) {
-        shell = shellArg;
-      } else {
+      if (!isSupportedShell(shellArg)) {
         error(`Shell "${shellArg}" is not supported. Use bash, zsh, or fish.`);
         process.exit(ExitCode.CONFIG_ERROR);
       }
+      shell = shellArg;
+    } else {
+      const detected = detectCurrentShell2();
+      if (!detected) {
+        error(
+          "Could not detect your shell. Please specify: attest-it completion install <bash|zsh|fish>"
+        );
+        process.exit(ExitCode.CONFIG_ERROR);
+      }
+      shell = detected;
+      info(`Detected shell: ${shell}`);
     }
-    await tabtab.install({
-      name: PROGRAM_NAME,
-      completer: PROGRAM_NAME,
+    await tabtab2.install({
+      name: PROGRAM_NAME2,
+      completer: PROGRAM_NAME2,
+      shell
+    });
+    await tabtab2.install({
+      name: PROGRAM_ALIAS2,
+      completer: PROGRAM_ALIAS2,
       shell
     });
     log("");
-    success("Shell completion installed!");
+    success(`Shell completion installed for ${shell}!`);
+    info(`Completions enabled for both "${PROGRAM_NAME2}" and "${PROGRAM_ALIAS2}" commands.`);
     log("");
     info("Restart your shell or run:");
-    if (shell === "bash" || !shell) {
-      log("  source ~/.bashrc");
-    }
-    if (shell === "zsh" || !shell) {
-      log("  source ~/.zshrc");
-    }
-    if (shell === "fish" || !shell) {
-      log("  source ~/.config/fish/config.fish");
-    }
+    log(`  ${getSourceCommand2(shell)}`);
     log("");
   } catch (err) {
     error(`Failed to install completion: ${err instanceof Error ? err.message : String(err)}`);
@@ -3922,8 +4162,11 @@ completionCommand.command("install [shell]").description("Install shell completi
 });
 completionCommand.command("uninstall").description("Uninstall shell completion").action(async () => {
   try {
-    await tabtab.uninstall({
-      name: PROGRAM_NAME
+    await tabtab2.uninstall({
+      name: PROGRAM_NAME2
+    });
+    await tabtab2.uninstall({
+      name: PROGRAM_ALIAS2
     });
     log("");
     success("Shell completion uninstalled!");
@@ -3934,11 +4177,19 @@ completionCommand.command("uninstall").description("Uninstall shell completion")
   }
 });
 completionCommand.command("server", { hidden: true }).description("Completion server (internal)").action(async () => {
-  const env = tabtab.parseEnv(process.env);
+  const env = tabtab2.parseEnv(process.env);
   if (env.complete) {
     await getCompletions(env);
   }
 });
+function createCompletionServerCommand() {
+  return new Command("completion-server").allowUnknownOption().allowExcessArguments(true).action(async () => {
+    const env = tabtab2.parseEnv(process.env);
+    if (env.complete) {
+      await getCompletions(env);
+    }
+  });
+}
 function hasVersion(data) {
   return typeof data === "object" && data !== null && "version" in data && // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
   typeof data.version === "string";
@@ -3983,6 +4234,7 @@ program.addCommand(identityCommand);
 program.addCommand(teamCommand);
 program.addCommand(whoamiCommand);
 program.addCommand(completionCommand);
+program.addCommand(createCompletionServerCommand(), { hidden: true });
 function processHomeDirOption() {
   const homeDirIndex = process.argv.indexOf("--home-dir");
   if (homeDirIndex !== -1 && homeDirIndex + 1 < process.argv.length) {
@@ -3999,7 +4251,10 @@ async function run() {
     console.log(getPackageVersion());
     process.exit(0);
   }
-  await initTheme();
+  const isCompletionServer = process.argv.includes("completion-server");
+  if (!isCompletionServer) {
+    await initTheme();
+  }
   program.parse();
   const options = program.opts();
   const outputOptions = {};