@attest-it/cli 0.5.0 → 0.6.1

package/dist/index.cjs

@@ -6,6 +6,7 @@ var path = require('path');
 var chromaterm = require('chromaterm');
 var prompts = require('@inquirer/prompts');
 var core = require('@attest-it/core');
+var tabtab2 = require('@pnpm/tabtab');
 var child_process = require('child_process');
 var os = require('os');
 var shellQuote = require('shell-quote');
@@ -15,7 +16,6 @@ var jsxRuntime = require('react/jsx-runtime');
 var promises = require('fs/promises');
 var ui = require('@inkjs/ui');
 var yaml = require('yaml');
-var tabtab = require('@pnpm/tabtab');
 var url = require('url');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -41,9 +41,9 @@ function _interopNamespace(e) {
 
 var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
 var path__namespace = /*#__PURE__*/_interopNamespace(path);
+var tabtab2__default = /*#__PURE__*/_interopDefault(tabtab2);
 var os__namespace = /*#__PURE__*/_interopNamespace(os);
 var React7__namespace = /*#__PURE__*/_interopNamespace(React7);
-var tabtab__default = /*#__PURE__*/_interopDefault(tabtab);
 
 // src/index.ts
 var globalOptions = {};
@@ -197,6 +197,87 @@ var ExitCode = {
   /** Missing required key file */
   MISSING_KEY: 5
 };
+var PROGRAM_NAME = "attest-it";
+var PROGRAM_ALIAS = "attest";
+function detectCurrentShell() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/bash") || shellPath.endsWith("/bash.exe")) {
+    return "bash";
+  }
+  if (shellPath.endsWith("/zsh") || shellPath.endsWith("/zsh.exe")) {
+    return "zsh";
+  }
+  if (shellPath.endsWith("/fish") || shellPath.endsWith("/fish.exe")) {
+    return "fish";
+  }
+  return null;
+}
+function getSourceCommand(shell) {
+  switch (shell) {
+    case "bash":
+      return "source ~/.bashrc";
+    case "zsh":
+      return "source ~/.zshrc";
+    case "fish":
+      return "source ~/.config/fish/config.fish";
+  }
+}
+async function offerCompletionInstall() {
+  try {
+    const prefs = await core.loadPreferences();
+    if (prefs.cliExperience?.declinedCompletionInstall) {
+      return false;
+    }
+    const shell = detectCurrentShell();
+    if (!shell) {
+      return false;
+    }
+    log("");
+    const shouldInstall = await prompts.confirm({
+      message: `Would you like to enable shell completions for ${shell}?`,
+      default: true
+    });
+    if (!shouldInstall) {
+      await core.savePreferences({
+        ...prefs,
+        cliExperience: {
+          ...prefs.cliExperience,
+          declinedCompletionInstall: true
+        }
+      });
+      log("");
+      info("No problem! If you change your mind, you can run:");
+      log("  attest-it completion install");
+      log("");
+      return false;
+    }
+    await tabtab2__default.default.install({
+      name: PROGRAM_NAME,
+      completer: PROGRAM_NAME,
+      shell
+    });
+    await tabtab2__default.default.install({
+      name: PROGRAM_ALIAS,
+      completer: PROGRAM_ALIAS,
+      shell
+    });
+    log("");
+    success(`Shell completions installed for ${shell}!`);
+    info(`Completions enabled for both "${PROGRAM_NAME}" and "${PROGRAM_ALIAS}" commands.`);
+    log("");
+    info("Restart your shell or run:");
+    log(`  ${getSourceCommand(shell)}`);
+    log("");
+    return true;
+  } catch (err) {
+    error(`Failed to install completions: ${err instanceof Error ? err.message : String(err)}`);
+    log("");
+    info("You can try again later with:");
+    log("  attest-it completion install");
+    log("");
+    return false;
+  }
+}
 
 // src/commands/init.ts
 var initCommand = new commander.Command("init").description("Initialize attest-it configuration").option("-p, --path <path>", "Config file path", ".attest-it/config.yaml").option("-f, --force", "Overwrite existing config").action(async (options) => {
@@ -260,6 +341,7 @@ async function runInit(options) {
     log(`  1. Edit ${options.path} to define your test suites`);
     log("  2. Run: attest-it keygen");
     log("  3. Run: attest-it status");
+    await offerCompletionInstall();
   } catch (err) {
     if (err instanceof Error) {
       error(err.message);
@@ -1550,6 +1632,15 @@ function createKeyProviderFromIdentity(identity) {
           field: privateKey.field
         }
       });
+    case "yubikey":
+      return core.KeyProviderRegistry.create({
+        type: "yubikey",
+        options: {
+          encryptedKeyPath: privateKey.encryptedKeyPath,
+          slot: privateKey.slot,
+          serial: privateKey.serial
+        }
+      });
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -1565,6 +1656,8 @@ function getKeyRefFromIdentity(identity) {
       return `${privateKey.service}:${privateKey.account}`;
     case "1password":
       return privateKey.item;
+    case "yubikey":
+      return privateKey.encryptedKeyPath;
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -1621,7 +1714,7 @@ function KeygenInteractive(props) {
     } else if (value === "1password") {
       setSelectedProvider("1password");
       if (accounts.length === 1 && accounts[0]) {
-        setSelectedAccount(accounts[0].email);
+        setSelectedAccount(accounts[0].user_uuid);
         setStep("select-vault");
       } else {
         setStep("select-account");
@@ -1668,8 +1761,12 @@ function KeygenInteractive(props) {
         if (!selectedVault || !itemName) {
           throw new Error("Vault and item name are required for 1Password");
         }
+        const vault = vaults.find((v) => v.id === selectedVault);
+        if (!vault) {
+          throw new Error("Selected vault not found");
+        }
         const providerOptions = {
-          vault: selectedVault,
+          vault: vault.name,
           itemName
         };
         if (selectedAccount !== void 0) {
@@ -1686,7 +1783,7 @@ function KeygenInteractive(props) {
           publicKeyPath: result.publicKeyPath,
           privateKeyRef: result.privateKeyRef,
           storageDescription: result.storageDescription,
-          vault: selectedVault,
+          vault: vault.name,
           itemName
         };
         if (selectedAccount !== void 0) {
@@ -1752,7 +1849,7 @@ function KeygenInteractive(props) {
   if (step === "select-account") {
     const options = accounts.map((account) => ({
       label: account.email,
-      value: account.email
+      value: account.user_uuid
     }));
     return /* @__PURE__ */ jsxRuntime.jsxs(ink.Box, { flexDirection: "column", children: [
       /* @__PURE__ */ jsxRuntime.jsx(ink.Text, { bold: true, children: "Select 1Password account:" }),
@@ -1769,7 +1866,7 @@ function KeygenInteractive(props) {
     }
     const options = vaults.map((vault) => ({
       label: vault.name,
-      value: vault.name
+      value: vault.id
     }));
     return /* @__PURE__ */ jsxRuntime.jsxs(ink.Box, { flexDirection: "column", children: [
       /* @__PURE__ */ jsxRuntime.jsx(ink.Text, { bold: true, children: "Select vault for private key storage:" }),
@@ -2408,6 +2505,15 @@ function createKeyProviderFromIdentity2(identity) {
           field: privateKey.field
         }
       });
+    case "yubikey":
+      return core.KeyProviderRegistry.create({
+        type: "yubikey",
+        options: {
+          encryptedKeyPath: privateKey.encryptedKeyPath,
+          slot: privateKey.slot,
+          serial: privateKey.serial
+        }
+      });
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -2423,6 +2529,8 @@ function getKeyRefFromIdentity2(identity) {
       return privateKey.service;
     case "1password":
       return privateKey.item;
+    case "yubikey":
+      return privateKey.encryptedKeyPath;
     default: {
       const _exhaustiveCheck = privateKey;
       throw new Error(`Unsupported private key type: ${String(_exhaustiveCheck)}`);
@@ -2462,6 +2570,9 @@ async function runList() {
         case "1password":
           keyType = "1password";
           break;
+        case "yubikey":
+          keyType = "yubikey";
+          break;
       }
       log(`${marker} ${theme3.blue(slug)}`);
       log(`  Name:       ${nameDisplay}`);
@@ -2551,6 +2662,8 @@ async function runCreate() {
     info("Checking available key storage providers...");
     const opAvailable = await core.OnePasswordKeyProvider.isInstalled();
     const keychainAvailable = core.MacOSKeychainKeyProvider.isAvailable();
+    const yubikeyInstalled = await core.YubiKeyProvider.isInstalled();
+    const yubikeyConnected = yubikeyInstalled ? await core.YubiKeyProvider.isConnected() : false;
     const configDir = core.getAttestItConfigDir();
     const storageChoices = [
       { name: `File system (${path.join(configDir, "keys")})`, value: "file" }
@@ -2561,6 +2674,10 @@ async function runCreate() {
     if (opAvailable) {
       storageChoices.push({ name: "1Password", value: "1password" });
     }
+    if (yubikeyInstalled) {
+      const yubikeyLabel = yubikeyConnected ? "YubiKey (encrypted with challenge-response)" : "YubiKey (not connected - insert YubiKey first)";
+      storageChoices.push({ name: yubikeyLabel, value: "yubikey" });
+    }
     const keyStorageType = await prompts.select({
       message: "Where should the private key be stored?",
       choices: storageChoices
@@ -2760,6 +2877,75 @@ async function runCreate() {
         keyStorageDescription = `1Password (${selectedVault}/${item})`;
         break;
       }
+      case "yubikey": {
+        if (!await core.YubiKeyProvider.isConnected()) {
+          error("No YubiKey detected. Please insert your YubiKey and try again.");
+          process.exit(ExitCode.CONFIG_ERROR);
+        }
+        const yubikeys = await core.YubiKeyProvider.listDevices();
+        if (yubikeys.length === 0) {
+          throw new Error("No YubiKeys detected. Please insert a YubiKey and try again.");
+        }
+        const formatYubiKeyChoice = (yk) => {
+          return `${theme3.blue.bold()(yk.type)} ${theme3.muted(`(Serial: ${yk.serial}, FW: ${yk.firmware})`)}`;
+        };
+        let selectedSerial;
+        if (yubikeys.length === 1 && yubikeys[0]) {
+          selectedSerial = yubikeys[0].serial;
+          info(`Using YubiKey: ${formatYubiKeyChoice(yubikeys[0])}`);
+        } else {
+          selectedSerial = await prompts.select({
+            message: "Select YubiKey:",
+            choices: yubikeys.map((yk) => ({
+              name: formatYubiKeyChoice(yk),
+              value: yk.serial
+            }))
+          });
+        }
+        const slot = 2;
+        const isChallengeResponseConfigured = await core.YubiKeyProvider.isChallengeResponseConfigured(
+          slot,
+          selectedSerial
+        );
+        if (!isChallengeResponseConfigured) {
+          log("");
+          error(`YubiKey slot ${String(slot)} is not configured for HMAC challenge-response.`);
+          log("");
+          log("To configure it, run:");
+          log(theme3.blue(`  ykman otp chalresp --generate ${String(slot)}`));
+          log("");
+          log("This will configure slot 2 with a randomly generated secret.");
+          log(theme3.muted("Note: Make sure to back up the secret if needed for recovery."));
+          process.exit(ExitCode.CONFIG_ERROR);
+        }
+        const encryptedKeyName = await prompts.input({
+          message: "Encrypted key file name:",
+          default: `${slug}.enc`,
+          validate: (value) => {
+            if (!value || value.trim().length === 0) {
+              return "File name cannot be empty";
+            }
+            return true;
+          }
+        });
+        const keysDir = path.join(core.getAttestItConfigDir(), "keys");
+        await promises.mkdir(keysDir, { recursive: true });
+        const encryptedKeyPath = path.join(keysDir, encryptedKeyName);
+        const result = await core.YubiKeyProvider.encryptPrivateKey({
+          privateKey: keyPair.privateKey,
+          encryptedKeyPath,
+          slot,
+          serial: selectedSerial
+        });
+        privateKeyRef = {
+          type: "yubikey",
+          encryptedKeyPath: result.encryptedKeyPath,
+          slot,
+          serial: selectedSerial
+        };
+        keyStorageDescription = result.storageDescription;
+        break;
+      }
       default:
         throw new Error(`Unknown key storage type: ${keyStorageType}`);
     }
@@ -2809,6 +2995,7 @@ async function runCreate() {
       log(`To use this identity, run: attest-it identity use ${slug}`);
       log("");
     }
+    await offerCompletionInstall();
   } catch (err) {
     if (err instanceof Error) {
       error(err.message);
@@ -3091,6 +3278,11 @@ function formatKeyLocation(privateKey) {
       }
       return `${theme3.blue.bold()("1Password")}: ${theme3.muted(parts.join("/"))}`;
     }
+    case "yubikey": {
+      const slotInfo = privateKey.slot ? ` (slot ${String(privateKey.slot)})` : "";
+      const serialInfo = privateKey.serial ? ` [${privateKey.serial}]` : "";
+      return `${theme3.blue.bold()("YubiKey")}${serialInfo}${slotInfo}: ${theme3.muted(privateKey.encryptedKeyPath)}`;
+    }
     default:
       return "Unknown storage";
   }
@@ -3764,11 +3956,16 @@ async function runRemove2(slug, options) {
 
 // src/commands/team/index.ts
 var teamCommand = new commander.Command("team").description("Manage team members and authorizations").addCommand(listCommand2).addCommand(addCommand).addCommand(editCommand2).addCommand(removeCommand2);
-var PROGRAM_NAME = "attest-it";
+var PROGRAM_NAME2 = "attest-it";
+var PROGRAM_ALIAS2 = "attest";
+var PROGRAM_NAMES = [PROGRAM_NAME2, PROGRAM_ALIAS2];
+function isSupportedShell(value) {
+  return value === "bash" || value === "zsh" || value === "fish";
+}
 async function getCompletions(env) {
   let shell;
   try {
-    const detectedShell = tabtab__default.default.getShellFromEnv(process.env);
+    const detectedShell = tabtab2__default.default.getShellFromEnv(process.env);
     shell = detectedShell === "pwsh" ? "bash" : detectedShell;
   } catch {
     shell = "bash";
@@ -3812,15 +4009,15 @@ async function getCompletions(env) {
   const lastWord = env.last;
   const prevWord = env.prev;
   if (prevWord === "--config" || prevWord === "-c") {
-    tabtab__default.default.logFiles();
+    tabtab2__default.default.logFiles();
     return;
   }
   if (lastWord.startsWith("-")) {
-    tabtab__default.default.log(globalOptions2, shell, console.log);
+    tabtab2__default.default.log(globalOptions2, shell, console.log);
     return;
   }
   const commandIndex = words.findIndex(
-    (w) => !w.startsWith("-") && w !== PROGRAM_NAME && w !== "npx"
+    (w) => !w.startsWith("-") && !PROGRAM_NAMES.includes(w) && w !== "npx"
   );
   const currentCommand = commandIndex >= 0 ? words[commandIndex] ?? null : null;
   if (currentCommand === "identity") {
@@ -3831,12 +4028,12 @@ async function getCompletions(env) {
     if (subcommand === "use" || subcommand === "remove") {
       const identities = await getIdentitySlugs();
       if (identities.length > 0) {
-        tabtab__default.default.log(identities, shell, console.log);
+        tabtab2__default.default.log(identities, shell, console.log);
         return;
       }
     }
     if (!subcommand || subcommandIndex < 0) {
-      tabtab__default.default.log(identitySubcommands, shell, console.log);
+      tabtab2__default.default.log(identitySubcommands, shell, console.log);
       return;
     }
   }
@@ -3846,7 +4043,7 @@ async function getCompletions(env) {
     );
     const subcommand = subcommandIndex >= 0 ? words[subcommandIndex] ?? null : null;
     if (!subcommand || subcommandIndex < 0) {
-      tabtab__default.default.log(teamSubcommands, shell, console.log);
+      tabtab2__default.default.log(teamSubcommands, shell, console.log);
       return;
     }
   }
@@ -3856,30 +4053,43 @@ async function getCompletions(env) {
     );
     const subcommand = subcommandIndex >= 0 ? words[subcommandIndex] ?? null : null;
     if (subcommand === "install") {
-      tabtab__default.default.log(["bash", "zsh", "fish"], shell, console.log);
+      tabtab2__default.default.log(["bash", "zsh", "fish"], shell, console.log);
       return;
     }
     if (!subcommand || subcommandIndex < 0) {
-      tabtab__default.default.log(completionSubcommands, shell, console.log);
+      tabtab2__default.default.log(completionSubcommands, shell, console.log);
       return;
     }
   }
   if (currentCommand === "status" || currentCommand === "verify" || currentCommand === "seal") {
     const gates = await getGateNames();
     if (gates.length > 0) {
-      tabtab__default.default.log(gates, shell, console.log);
+      tabtab2__default.default.log(gates, shell, console.log);
       return;
     }
   }
   if (currentCommand === "run") {
     const suites = await getSuiteNames();
     if (suites.length > 0) {
-      tabtab__default.default.log(suites, shell, console.log);
+      tabtab2__default.default.log(suites, shell, console.log);
       return;
     }
   }
-  if (!currentCommand) {
-    tabtab__default.default.log([...commands, ...globalOptions2], shell, console.log);
+  const knownCommands = [
+    "init",
+    "status",
+    "run",
+    "verify",
+    "seal",
+    "keygen",
+    "prune",
+    "identity",
+    "team",
+    "whoami",
+    "completion"
+  ];
+  if (!currentCommand || !knownCommands.includes(currentCommand)) {
+    tabtab2__default.default.log([...commands, ...globalOptions2], shell, console.log);
   }
 }
 async function getIdentitySlugs() {
@@ -3911,35 +4121,65 @@ async function getSuiteNames() {
   return [];
 }
 var completionCommand = new commander.Command("completion").description("Shell completion commands");
-completionCommand.command("install [shell]").description("Install shell completion (bash, zsh, or fish)").action(async (shellArg) => {
+function detectCurrentShell2() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/bash") || shellPath.endsWith("/bash.exe")) {
+    return "bash";
+  }
+  if (shellPath.endsWith("/zsh") || shellPath.endsWith("/zsh.exe")) {
+    return "zsh";
+  }
+  if (shellPath.endsWith("/fish") || shellPath.endsWith("/fish.exe")) {
+    return "fish";
+  }
+  return null;
+}
+function getSourceCommand2(shell) {
+  switch (shell) {
+    case "bash":
+      return "source ~/.bashrc";
+    case "zsh":
+      return "source ~/.zshrc";
+    case "fish":
+      return "source ~/.config/fish/config.fish";
+  }
+}
+completionCommand.command("install [shell]").description("Install shell completion (auto-detects shell, or specify bash/zsh/fish)").action(async (shellArg) => {
   try {
     let shell;
     if (shellArg !== void 0) {
-      if (tabtab__default.default.isShellSupported(shellArg)) {
-        shell = shellArg;
-      } else {
+      if (!isSupportedShell(shellArg)) {
         error(`Shell "${shellArg}" is not supported. Use bash, zsh, or fish.`);
         process.exit(ExitCode.CONFIG_ERROR);
       }
+      shell = shellArg;
+    } else {
+      const detected = detectCurrentShell2();
+      if (!detected) {
+        error(
+          "Could not detect your shell. Please specify: attest-it completion install <bash|zsh|fish>"
+        );
+        process.exit(ExitCode.CONFIG_ERROR);
+      }
+      shell = detected;
+      info(`Detected shell: ${shell}`);
     }
-    await tabtab__default.default.install({
-      name: PROGRAM_NAME,
-      completer: PROGRAM_NAME,
+    await tabtab2__default.default.install({
+      name: PROGRAM_NAME2,
+      completer: PROGRAM_NAME2,
+      shell
+    });
+    await tabtab2__default.default.install({
+      name: PROGRAM_ALIAS2,
+      completer: PROGRAM_ALIAS2,
       shell
     });
     log("");
-    success("Shell completion installed!");
+    success(`Shell completion installed for ${shell}!`);
+    info(`Completions enabled for both "${PROGRAM_NAME2}" and "${PROGRAM_ALIAS2}" commands.`);
     log("");
     info("Restart your shell or run:");
-    if (shell === "bash" || !shell) {
-      log("  source ~/.bashrc");
-    }
-    if (shell === "zsh" || !shell) {
-      log("  source ~/.zshrc");
-    }
-    if (shell === "fish" || !shell) {
-      log("  source ~/.config/fish/config.fish");
-    }
+    log(`  ${getSourceCommand2(shell)}`);
     log("");
   } catch (err) {
     error(`Failed to install completion: ${err instanceof Error ? err.message : String(err)}`);
@@ -3948,8 +4188,11 @@ completionCommand.command("install [shell]").description("Install shell completi
 });
 completionCommand.command("uninstall").description("Uninstall shell completion").action(async () => {
   try {
-    await tabtab__default.default.uninstall({
-      name: PROGRAM_NAME
+    await tabtab2__default.default.uninstall({
+      name: PROGRAM_NAME2
+    });
+    await tabtab2__default.default.uninstall({
+      name: PROGRAM_ALIAS2
     });
     log("");
     success("Shell completion uninstalled!");
@@ -3960,11 +4203,19 @@ completionCommand.command("uninstall").description("Uninstall shell completion")
   }
 });
 completionCommand.command("server", { hidden: true }).description("Completion server (internal)").action(async () => {
-  const env = tabtab__default.default.parseEnv(process.env);
+  const env = tabtab2__default.default.parseEnv(process.env);
   if (env.complete) {
     await getCompletions(env);
   }
 });
+function createCompletionServerCommand() {
+  return new commander.Command("completion-server").allowUnknownOption().allowExcessArguments(true).action(async () => {
+    const env = tabtab2__default.default.parseEnv(process.env);
+    if (env.complete) {
+      await getCompletions(env);
+    }
+  });
+}
 function hasVersion(data) {
   return typeof data === "object" && data !== null && "version" in data && // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
   typeof data.version === "string";
@@ -4009,6 +4260,7 @@ program.addCommand(identityCommand);
 program.addCommand(teamCommand);
 program.addCommand(whoamiCommand);
 program.addCommand(completionCommand);
+program.addCommand(createCompletionServerCommand(), { hidden: true });
 function processHomeDirOption() {
   const homeDirIndex = process.argv.indexOf("--home-dir");
   if (homeDirIndex !== -1 && homeDirIndex + 1 < process.argv.length) {
@@ -4025,7 +4277,10 @@ async function run() {
     console.log(getPackageVersion());
     process.exit(0);
   }
-  await initTheme();
+  const isCompletionServer = process.argv.includes("completion-server");
+  if (!isCompletionServer) {
+    await initTheme();
+  }
   program.parse();
   const options = program.opts();
   const outputOptions = {};