@attest-it/cli 0.9.0 → 0.9.1

package/dist/index.cjs

@@ -2300,10 +2300,19 @@ async function runCreate() {
       default: ""
     });
     info("Checking available key storage providers...");
+    info(
+      "You may see authentication prompts from 1Password, macOS Keychain, or other security tools."
+    );
     const opAvailable = await core.OnePasswordKeyProvider.isInstalled();
+    verbose(`  1Password CLI (op): ${opAvailable ? "found" : "not found"}`);
     const keychainAvailable = core.MacOSKeychainKeyProvider.isAvailable();
+    verbose(`  macOS Keychain: ${keychainAvailable ? "available" : "not available (not macOS)"}`);
     const yubikeyInstalled = await core.YubiKeyProvider.isInstalled();
+    verbose(`  YubiKey CLI (ykman): ${yubikeyInstalled ? "found" : "not found"}`);
     const yubikeyConnected = yubikeyInstalled ? await core.YubiKeyProvider.isConnected() : false;
+    if (yubikeyInstalled) {
+      verbose(`  YubiKey device: ${yubikeyConnected ? "connected" : "not connected"}`);
+    }
     const configDir = core.getAttestItConfigDir();
     const storageChoices = [
       { name: `File system (${path.join(configDir, "keys")})`, value: "file" }
@@ -2317,24 +2326,24 @@ async function runCreate() {
     if (yubikeyInstalled) {
       const yubikeyLabel = yubikeyConnected ? "YubiKey (encrypted with challenge-response)" : "YubiKey (not connected - insert YubiKey first)";
       storageChoices.push({ name: yubikeyLabel, value: "yubikey" });
+    } else {
+      storageChoices.push({
+        name: theme3.muted("YubiKey (install ykman CLI to enable)"),
+        value: "yubikey-disabled",
+        // @ts-expect-error -- @inquirer/prompts supports disabled property but types may not reflect it
+        disabled: true
+      });
     }
     const keyStorageType = await prompts.select({
       message: "Where should the private key be stored?",
       choices: storageChoices
     });
-    log("");
-    log("Generating Ed25519 keypair...");
-    const keyPair = core.generateEd25519KeyPair();
-    let privateKeyRef;
-    let keyStorageDescription;
+    let storageConfig;
     switch (keyStorageType) {
       case "file": {
         const keysDir = path.join(core.getAttestItConfigDir(), "keys");
-        await promises.mkdir(keysDir, { recursive: true });
         const keyPath = path.join(keysDir, `${slug}.pem`);
-        await promises.writeFile(keyPath, keyPair.privateKey, { mode: 384 });
-        privateKeyRef = { type: "file", path: keyPath };
-        keyStorageDescription = keyPath;
+        storageConfig = { type: "file", keyPath };
         break;
       }
       case "keychain": {
@@ -2342,6 +2351,9 @@ async function runCreate() {
           error("macOS Keychain is not available on this system");
           process.exit(ExitCode.CONFIG_ERROR);
         }
+        log("");
+        info("Accessing macOS Keychain to list available keychains...");
+        info("You may be prompted to allow access or enter your password.");
         const keychains = await core.MacOSKeychainKeyProvider.listKeychains();
         if (keychains.length === 0) {
           throw new Error("No keychains found on this system");
@@ -2377,38 +2389,15 @@ async function runCreate() {
             return true;
           }
         });
-        const { execFile } = await import('child_process');
-        const { promisify } = await import('util');
-        const execFileAsync = promisify(execFile);
-        const encodedKey = Buffer.from(keyPair.privateKey).toString("base64");
-        try {
-          const addArgs = [
-            "add-generic-password",
-            "-a",
-            "attest-it",
-            "-s",
-            keychainItemName,
-            "-w",
-            encodedKey,
-            "-U",
-            selectedKeychain.path
-          ];
-          await execFileAsync("security", addArgs);
-        } catch (err) {
-          throw new Error(
-            `Failed to store key in macOS Keychain: ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-        privateKeyRef = {
-          type: "keychain",
-          service: keychainItemName,
-          account: "attest-it",
-          keychain: selectedKeychain.path
-        };
-        keyStorageDescription = `macOS Keychain: ${selectedKeychain.name}/${keychainItemName}`;
+        storageConfig = { type: "keychain", selectedKeychain, keychainItemName };
         break;
       }
       case "1password": {
+        log("");
+        info("Accessing 1Password to list your accounts and vaults...");
+        info(
+          "You may see biometric prompts or be asked to unlock 1Password for each configured account."
+        );
         const accounts = await core.OnePasswordKeyProvider.listAccounts();
         if (accounts.length === 0) {
           throw new Error(
@@ -2429,7 +2418,7 @@ async function runCreate() {
                 "--format=json"
               ]);
               const details = JSON.parse(stdout);
-              const name2 = details !== null && typeof details === "object" && "name" in details && typeof details.name === "string" ? details.name : acc.url;
+              const name2 = details !== null && typeof details === "object" && "name" in details && typeof details.name === "string" ? details.name : "[Could not read account name]";
               return {
                 url: acc.url,
                 email: acc.email,
@@ -2439,7 +2428,7 @@ async function runCreate() {
               return {
                 url: acc.url,
                 email: acc.email,
-                name: acc.url
+                name: "[Could not read account name]"
               };
             }
           })
@@ -2481,43 +2470,21 @@ async function runCreate() {
             return true;
           }
         });
-        const { tmpdir } = await import('os');
-        const tempDir = path.join(tmpdir(), `attest-it-${String(Date.now())}`);
-        await promises.mkdir(tempDir, { recursive: true });
-        const tempPrivatePath = path.join(tempDir, "private.pem");
-        try {
-          await promises.writeFile(tempPrivatePath, keyPair.privateKey, { mode: 384 });
-          const { execFile: execFile2 } = await import('child_process');
-          const { promisify: promisify2 } = await import('util');
-          const execFileAsync2 = promisify2(execFile2);
-          const opArgs = [
-            "document",
-            "create",
-            tempPrivatePath,
-            "--title",
-            item,
-            "--vault",
-            selectedVault
-          ];
-          if (selectedAccount) {
-            opArgs.push("--account", selectedAccount);
-          }
-          await execFileAsync2("op", opArgs);
-        } finally {
-          const { rm } = await import('fs/promises');
-          await rm(tempDir, { recursive: true, force: true }).catch(() => {
-          });
-        }
-        privateKeyRef = {
+        const selectedAccountDetails = accountDetails.find((acc) => acc.url === selectedAccount);
+        const accountDisplayName = selectedAccountDetails?.name ?? selectedAccount;
+        storageConfig = {
           type: "1password",
-          vault: selectedVault,
-          item,
-          ...selectedAccount && { account: selectedAccount }
+          selectedAccount,
+          accountDisplayName,
+          selectedVault,
+          item
         };
-        keyStorageDescription = `1Password (${selectedVault}/${item})`;
         break;
       }
       case "yubikey": {
+        log("");
+        info("Accessing YubiKey to detect connected devices...");
+        info("Your private key will be encrypted using HMAC challenge-response from the YubiKey.");
         if (!await core.YubiKeyProvider.isConnected()) {
           error("No YubiKey detected. Please insert your YubiKey and try again.");
           process.exit(ExitCode.CONFIG_ERROR);
@@ -2569,25 +2536,115 @@ async function runCreate() {
           }
         });
         const keysDir = path.join(core.getAttestItConfigDir(), "keys");
-        await promises.mkdir(keysDir, { recursive: true });
         const encryptedKeyPath = path.join(keysDir, encryptedKeyName);
+        storageConfig = { type: "yubikey", selectedSerial, slot, encryptedKeyPath };
+        break;
+      }
+      default:
+        throw new Error(`Unknown key storage type: ${keyStorageType}`);
+    }
+    log("");
+    log("Generating Ed25519 keypair...");
+    const keyPair = core.generateEd25519KeyPair();
+    let privateKeyRef;
+    let keyStorageDescription;
+    switch (storageConfig.type) {
+      case "file": {
+        log("");
+        info("Creating private key file on disk...");
+        const keysDir = path.join(core.getAttestItConfigDir(), "keys");
+        await promises.mkdir(keysDir, { recursive: true });
+        await promises.writeFile(storageConfig.keyPath, keyPair.privateKey, { mode: 384 });
+        privateKeyRef = { type: "file", path: storageConfig.keyPath };
+        keyStorageDescription = storageConfig.keyPath;
+        break;
+      }
+      case "keychain": {
+        const { execFile } = await import('child_process');
+        const { promisify } = await import('util');
+        const execFileAsync = promisify(execFile);
+        const encodedKey = Buffer.from(keyPair.privateKey).toString("base64");
+        try {
+          const addArgs = [
+            "add-generic-password",
+            "-a",
+            "attest-it",
+            "-s",
+            storageConfig.keychainItemName,
+            "-w",
+            encodedKey,
+            "-U",
+            storageConfig.selectedKeychain.path
+          ];
+          await execFileAsync("security", addArgs);
+        } catch (err) {
+          throw new Error(
+            `Failed to store key in macOS Keychain: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+        privateKeyRef = {
+          type: "keychain",
+          service: storageConfig.keychainItemName,
+          account: "attest-it",
+          keychain: storageConfig.selectedKeychain.path
+        };
+        keyStorageDescription = `macOS Keychain: ${storageConfig.selectedKeychain.name}/${storageConfig.keychainItemName}`;
+        break;
+      }
+      case "1password": {
+        const { tmpdir } = await import('os');
+        const tempDir = path.join(tmpdir(), `attest-it-${String(Date.now())}`);
+        await promises.mkdir(tempDir, { recursive: true });
+        const tempPrivatePath = path.join(tempDir, "private.pem");
+        try {
+          await promises.writeFile(tempPrivatePath, keyPair.privateKey, { mode: 384 });
+          const { execFile } = await import('child_process');
+          const { promisify } = await import('util');
+          const execFileAsync = promisify(execFile);
+          const opArgs = [
+            "document",
+            "create",
+            tempPrivatePath,
+            "--title",
+            storageConfig.item,
+            "--vault",
+            storageConfig.selectedVault,
+            "--account",
+            storageConfig.selectedAccount
+          ];
+          await execFileAsync("op", opArgs);
+        } finally {
+          const { rm } = await import('fs/promises');
+          await rm(tempDir, { recursive: true, force: true }).catch(() => {
+          });
+        }
+        privateKeyRef = {
+          type: "1password",
+          vault: storageConfig.selectedVault,
+          item: storageConfig.item,
+          account: storageConfig.selectedAccount
+        };
+        keyStorageDescription = `1Password (${storageConfig.accountDisplayName}/${storageConfig.selectedVault}/${storageConfig.item})`;
+        break;
+      }
+      case "yubikey": {
+        const keysDir = path.join(core.getAttestItConfigDir(), "keys");
+        await promises.mkdir(keysDir, { recursive: true });
         const result = await core.YubiKeyProvider.encryptPrivateKey({
           privateKey: keyPair.privateKey,
-          encryptedKeyPath,
-          slot,
-          serial: selectedSerial
+          encryptedKeyPath: storageConfig.encryptedKeyPath,
+          slot: storageConfig.slot,
+          serial: storageConfig.selectedSerial
         });
         privateKeyRef = {
           type: "yubikey",
           encryptedKeyPath: result.encryptedKeyPath,
-          slot,
-          serial: selectedSerial
+          slot: storageConfig.slot,
+          serial: storageConfig.selectedSerial
         };
         keyStorageDescription = result.storageDescription;
         break;
       }
-      default:
-        throw new Error(`Unknown key storage type: ${keyStorageType}`);
     }
     const identity = {
       name,