@celilo/cli 0.11.0-alpha.0 → 0.12.0

package/src/cli/commands/registry-token.ts

@@ -0,0 +1,194 @@
+/**
+ * Registry publish-token management (append-safe)
+ *
+ * `celilo module secret set celilo-registry publish_tokens <v>` OVERWRITES the
+ * whole value. Because publish_tokens is a newline-separated list, that clobbers
+ * every other holder (external CI, scoped bootstrap tokens) whenever you rotate
+ * or add one token. These commands do a read-modify-write on the list instead.
+ *
+ * Runs on-mgr where the master key lives; never resurfaces the raw admin value
+ * to a laptop. Runtime-minted scoped tokens are handled elsewhere — this is the
+ * human-managed bootstrap/admin list only.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { getDb } from '../../db/client';
+import { modules, secrets } from '../../db/schema';
+import { decryptSecret, encryptSecret } from '../../secrets/encryption';
+import { getOrCreateMasterKey } from '../../secrets/master-key';
+import { getArg, validateRequiredArgs } from '../parser';
+import type { CommandResult } from '../types';
+
+const REGISTRY_MODULE_ID = 'celilo-registry';
+const PUBLISH_TOKENS_SECRET = 'publish_tokens';
+
+type CommandError = Extract<CommandResult, { success: false }>;
+
+/** Split a newline-separated token blob into trimmed, non-empty lines. */
+function parseTokens(raw: string | null): string[] {
+  if (!raw) return [];
+  return raw
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
+interface TokenStore {
+  masterKey: Buffer;
+  /** Existing secrets row id, or null if publish_tokens isn't set yet. */
+  rowId: number | null;
+  tokens: string[];
+}
+
+/**
+ * Read the current publish_tokens list (decrypted). Errors if celilo-registry
+ * isn't installed locally — these commands must run where the module lives.
+ */
+async function readTokenStore(): Promise<TokenStore | CommandError> {
+  const db = getDb();
+
+  const registryModule = db.select().from(modules).where(eq(modules.id, REGISTRY_MODULE_ID)).get();
+  if (!registryModule) {
+    return {
+      success: false,
+      error: `Module not found: ${REGISTRY_MODULE_ID}\n\nRun these commands on the host where celilo-registry is deployed (where the master key lives).`,
+    };
+  }
+
+  let masterKey: Buffer;
+  try {
+    masterKey = await getOrCreateMasterKey();
+  } catch (err) {
+    return { success: false, error: 'Failed to access master key', details: err };
+  }
+
+  const row = db
+    .select()
+    .from(secrets)
+    .where(and(eq(secrets.moduleId, REGISTRY_MODULE_ID), eq(secrets.name, PUBLISH_TOKENS_SECRET)))
+    .get();
+
+  const tokens = row
+    ? parseTokens(
+        decryptSecret(
+          { encryptedValue: row.encryptedValue, iv: row.iv, authTag: row.authTag },
+          masterKey,
+        ),
+      )
+    : [];
+
+  return { masterKey, rowId: row?.id ?? null, tokens };
+}
+
+function isError(v: TokenStore | CommandError): v is CommandError {
+  return 'success' in v && v.success === false;
+}
+
+/** Encrypt the list and upsert the publish_tokens row. */
+function writeTokens(store: TokenStore, tokens: string[]): void {
+  const db = getDb();
+  const encrypted = encryptSecret(tokens.join('\n'), store.masterKey);
+
+  if (store.rowId !== null) {
+    db.update(secrets)
+      .set({
+        encryptedValue: encrypted.encryptedValue,
+        iv: encrypted.iv,
+        authTag: encrypted.authTag,
+        updatedAt: new Date(),
+      })
+      .where(eq(secrets.id, store.rowId))
+      .run();
+    return;
+  }
+
+  db.insert(secrets)
+    .values({
+      moduleId: REGISTRY_MODULE_ID,
+      name: PUBLISH_TOKENS_SECRET,
+      encryptedValue: encrypted.encryptedValue,
+      iv: encrypted.iv,
+      authTag: encrypted.authTag,
+    })
+    .run();
+}
+
+/**
+ * Resolve the local admin/bootstrap publish token (ce-1ch) — the first
+ * bootstrap line with no package scope (a bare `<token>`), which the admin
+ * owner-management endpoints require. Runs on-mgr where publish_tokens lives.
+ * Returns the raw token or a CommandError describing what's missing.
+ */
+export async function resolveAdminToken(): Promise<string | CommandError> {
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+  // A scoped line is `<token> <package>`; the admin/bootstrap token is a bare
+  // single-field line. Pick the first one.
+  const admin = store.tokens.find((line) => line.split(/\s+/).length === 1);
+  if (!admin) {
+    return {
+      success: false,
+      error:
+        'No admin publish token found in publish_tokens.\n\nAdd one with: celilo registry token add <admin-token>',
+    };
+  }
+  return admin;
+}
+
+/**
+ * Handle `celilo registry token add <token>`.
+ * Appends a token to publish_tokens without clobbering existing holders.
+ * Idempotent — adding a token that's already present is a no-op.
+ */
+export async function handleRegistryTokenAdd(args: string[]): Promise<CommandResult> {
+  const err = validateRequiredArgs(args, 1);
+  if (err) {
+    return { success: false, error: `${err}\n\nUsage: celilo registry token add <token>` };
+  }
+  const token = getArg(args, 0)?.trim();
+  if (!token) {
+    return { success: false, error: 'Token value is required' };
+  }
+
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+
+  if (store.tokens.includes(token)) {
+    return { success: true, message: 'Token already present — no change' };
+  }
+
+  writeTokens(store, [...store.tokens, token]);
+  return {
+    success: true,
+    message: `Added publish token (${store.tokens.length + 1} total)`,
+  };
+}
+
+/**
+ * Handle `celilo registry token rm <token>`.
+ * Removes one token from publish_tokens, leaving the others intact.
+ */
+export async function handleRegistryTokenRm(args: string[]): Promise<CommandResult> {
+  const err = validateRequiredArgs(args, 1);
+  if (err) {
+    return { success: false, error: `${err}\n\nUsage: celilo registry token rm <token>` };
+  }
+  const token = getArg(args, 0)?.trim();
+  if (!token) {
+    return { success: false, error: 'Token value is required' };
+  }
+
+  const store = await readTokenStore();
+  if (isError(store)) return store;
+
+  if (!store.tokens.includes(token)) {
+    return { success: false, error: 'Token not found in publish_tokens' };
+  }
+
+  const remaining = store.tokens.filter((t) => t !== token);
+  writeTokens(store, remaining);
+  return {
+    success: true,
+    message: `Removed publish token (${remaining.length} remaining)`,
+  };
+}

package/src/cli/commands/restore.ts

@@ -12,7 +12,7 @@
  * Calls restoreFromArtifactFile, then runs Drizzle migrations on the
  * restored DB so a backup from an older celilo still opens cleanly.
  *
- * Phase 4 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md.
+ * Phase 4 of openspec/specs/management-server-backup/spec.md.
  */
 
 import { existsSync } from 'node:fs';

package/src/cli/commands/service-add-proxmox.ts

@@ -146,7 +146,7 @@ export async function handleServiceAddProxmox(
 
       // VM template for `requires.system.type: vm` modules.
       // Auto-detect existing templates on the node; offer to build if none found.
-      // See v2/PROXMOX_VM_TEMPLATE.md.
+      // See reference/PROXMOX_VM_TEMPLATE.md.
       let vmTemplate: string | undefined;
       const existingTemplates = await detectExistingVmTemplates(credentials, targetNode);
       if (existingTemplates.length > 0) {

package/src/cli/commands/subscribers-list.ts

@@ -1,7 +1,7 @@
 /**
  * `celilo subscribers list` — show registered build-bus subscribers.
  *
- * Reads the static-config subscriber list ([[v2/BUILD_BUS.md]] Phase
+ * Reads the static-config subscriber list ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase
  * 2-lite — registry-server switchboard is deferred). Doesn't print
  * the HMAC secret in cleartext — only a truncated hash so operators
  * can disambiguate subscribers without leaking credentials into

package/src/cli/commands/system-apply-config-equivalence.test.ts

@@ -1,5 +1,5 @@
 /**
- * End-to-end equivalence test for v2/MANAGEMENT_AS_NETAPP.md Phase 2.
+ * End-to-end equivalence test for openspec/specs/management-as-module/spec.md Phase 2.
  *
  * The spec calls for "celilo system apply-config" to write the same
  * systemConfig state that the legacy `celilo system init` produces,

package/src/cli/commands/system-apply-config.ts

@@ -1,7 +1,7 @@
 /**
  * `celilo system apply-config` — headless write to systemConfig.
  *
- * Phase 2 of v2/MANAGEMENT_AS_NETAPP.md: the celilo-mgmt module's
+ * Phase 2 of openspec/specs/management-as-module/spec.md: the celilo-mgmt module's
  * on_install hook needs a CLI surface it can shell out to that writes
  * the operator-chosen network/DNS/SSH config without the interactive
  * framing of `celilo system init`. This is that command.

package/src/cli/commands/system-init-deprecation.test.ts

@@ -1,5 +1,5 @@
 /**
- * Phase 5 of v2/MANAGEMENT_AS_NETAPP.md — confirm `celilo system init`
+ * Phase 5 of openspec/specs/management-as-module/spec.md — confirm `celilo system init`
  * surfaces a deprecation banner pointing at the new paths
  * (bootstrap.sh + `system apply-config`), and that
  * CELILO_SUPPRESS_DEPRECATION=1 silences it.

package/src/cli/commands/system-init.ts

@@ -45,7 +45,7 @@ export async function handleSystemInit(
   const cliOverrides = parseOverrides(args);
   const db = getDb();
 
-  // Phase 5 of v2/MANAGEMENT_AS_NETAPP.md — surface that this command
+  // Phase 5 of openspec/specs/management-as-module/spec.md — surface that this command
   // is on its way out so operators have time to migrate to the new
   // paths. Keeps working unchanged; the banner just points at the
   // replacements. CELILO_SUPPRESS_DEPRECATION=1 silences for callers
@@ -172,7 +172,7 @@ async function initInteractive(cliOverrides: Record<string, string> = {}): Promi
 
     // Network and DNS addressing are intentionally NOT prompted here.
     // Network topology is no longer owned by `system init`
-    // (v2/NETWORK_CONFIG_TO_FIREWALL.md): the `internal` zone and DNS are
+    // (openspec/specs/progressive-zone-disclosure/spec.md): the `internal` zone and DNS are
     // discovered when celilo-mgmt is deployed, and `dmz`/`app`/`secure`
     // come from a firewall module. The only thing left to capture
     // interactively is the SSH key celilo uses to reach managed machines.

package/src/cli/commands/token.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from 'bun:test';
+import { handleTokenList, handleTokenObtain, handleTokenRevoke } from './token';
+
+// These cover the argument-validation paths that short-circuit BEFORE the idp
+// capability is loaded — no DB or authentik needed. The idp-side behavior
+// (mint / list / revoke) is covered in modules/authentik/scripts/idp-functions.test.ts.
+
+describe('celilo token — argument validation', () => {
+  test('obtain requires a username', async () => {
+    const result = await handleTokenObtain([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Username required/);
+  });
+
+  test('list requires a username', async () => {
+    const result = await handleTokenList([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Username required/);
+  });
+
+  test('revoke requires an identifier', async () => {
+    const result = await handleTokenRevoke([], {});
+    expect(result.success).toBe(false);
+    if (!result.success) expect(result.error).toMatch(/Identifier required/);
+  });
+});

package/src/cli/commands/token.ts

@@ -0,0 +1,160 @@
+/**
+ * Contributor identity tokens (idp-issued, per-user)
+ *
+ * `celilo token obtain|list|revoke` mints, lists, and revokes per-user API
+ * tokens from the idp (authentik) so a module contributor authenticates
+ * publishes AS THEMSELVES — no admin/shared token ever reaches their machine
+ * (SECURE_MODULE_PUBLISH.md). The token consumed by `celilo author init`.
+ *
+ * Distinct from `celilo registry token add/rm`, which manages the raw
+ * bootstrap `publish_tokens` list — a different trust/storage model. Keep the
+ * two families separate.
+ *
+ * Runs on-mgr where the idp provider + bootstrap token live (same model as
+ * registry-token.ts). The token string is shown once at mint; the idp stores
+ * it hashed and celilo persists nothing.
+ */
+
+import type { IdpCapability } from '@celilo/capabilities';
+import { getDb } from '../../db/client';
+import { loadCapabilityFunctions } from '../../hooks/capability-loader';
+import { createCapturingLogger } from '../../hooks/logger';
+import { getArg, getFlag } from '../parser';
+import type { CommandError, CommandResult } from '../types';
+
+/** Default identifier for a contributor's publish token — stable per user so obtain is idempotent. */
+function defaultIdentifier(username: string): string {
+  return `celilo-publish-${username}`;
+}
+
+function isError(v: unknown): v is CommandError {
+  return typeof v === 'object' && v !== null && 'success' in v && v.success === false;
+}
+
+/**
+ * Load the idp capability. Runs where the idp provider (authentik) is
+ * deployed; errors clearly when it isn't. The capturing logger discards the
+ * capability's own progress markers so command output stays clean.
+ */
+async function loadIdp(): Promise<IdpCapability | CommandError> {
+  const db = getDb();
+  const { logger } = createCapturingLogger();
+  const caps = await loadCapabilityFunctions('celilo-token', db, logger);
+  const idp = caps.idp as IdpCapability | undefined;
+  if (!idp) {
+    return {
+      success: false,
+      error:
+        'No idp provider found. Run this on the host where the idp (authentik) is deployed (celilo-mgr).',
+    };
+  }
+  return idp;
+}
+
+/** Resolve the target username from `--user` (or first positional arg). */
+function resolveUser(args: string[], flags: Record<string, string | boolean>): string | undefined {
+  const flag = getFlag(flags, 'user').trim();
+  if (flag) return flag;
+  return getArg(args, 0)?.trim();
+}
+
+/**
+ * `celilo token obtain --user <username> [--identifier <id>] [--description <text>]`
+ * Mints (or returns the existing) per-user token. Idempotent on identifier.
+ */
+export async function handleTokenObtain(
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const username = resolveUser(args, flags);
+  if (!username) {
+    return {
+      success: false,
+      error:
+        'Username required\n\nUsage: celilo token obtain --user <username> [--identifier <id>]',
+    };
+  }
+  const identifier = getFlag(flags, 'identifier').trim() || defaultIdentifier(username);
+  const description = getFlag(flags, 'description').trim() || undefined;
+
+  const idp = await loadIdp();
+  if (isError(idp)) return idp;
+
+  const result = await idp.create_token({ username, identifier, description });
+  const verb = result.created ? 'Minted new' : 'Returned existing';
+
+  return {
+    success: true,
+    message: `${verb} per-user token for '${username}' (identifier: ${identifier})
+
+  ${result.token}
+
+Treat as a secret — store it now (CELILO_PUBLISH_TOKEN, or \`celilo author init --token …\`).
+celilo persists nothing; the idp stores it hashed.
+Revoke with: celilo token revoke ${identifier}`,
+  };
+}
+
+/**
+ * `celilo token list --user <username>`
+ * Lists the user's API tokens (metadata only — never the bearer string).
+ */
+export async function handleTokenList(
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const username = resolveUser(args, flags);
+  if (!username) {
+    return {
+      success: false,
+      error: 'Username required\n\nUsage: celilo token list --user <username>',
+    };
+  }
+
+  const idp = await loadIdp();
+  if (isError(idp)) return idp;
+
+  const tokens = await idp.list_tokens({ username });
+  if (tokens.length === 0) {
+    return { success: true, message: `No API tokens for '${username}'.` };
+  }
+
+  const lines = tokens.map((t) => {
+    const desc = t.description ? `  — ${t.description}` : '';
+    const exp = t.expiring && t.expires ? `  (expires ${t.expires})` : '';
+    return `  ${t.identifier}${desc}${exp}`;
+  });
+  return {
+    success: true,
+    message: `API tokens for '${username}':\n${lines.join('\n')}`,
+  };
+}
+
+/**
+ * `celilo token revoke <identifier>` (or `--identifier <id>`)
+ * Deletes a token at the idp; the next publish with it is denied.
+ */
+export async function handleTokenRevoke(
+  args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const identifier = getArg(args, 0)?.trim() || getFlag(flags, 'identifier').trim();
+  if (!identifier) {
+    return {
+      success: false,
+      error: 'Identifier required\n\nUsage: celilo token revoke <identifier>',
+    };
+  }
+
+  const idp = await loadIdp();
+  if (isError(idp)) return idp;
+
+  const { revoked } = await idp.revoke_token({ identifier });
+  if (!revoked) {
+    return { success: false, error: `No token with identifier '${identifier}' found.` };
+  }
+  return {
+    success: true,
+    message: `Revoked token '${identifier}'. The next publish using it will be denied.`,
+  };
+}

package/src/cli/completion.ts

@@ -46,12 +46,14 @@ export async function getCompletions(words: string[], current: number): Promise<
       'package',
       'proxmox',
       'publish',
+      'registry',
       'restore',
       'service',
       'status',
       'storage',
       'subscribers',
       'system',
+      'token',
       'version',
     ];
     return filterSuggestions(commands, args[0] || '');
@@ -70,6 +72,22 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(subcommands, args[1] || '');
   }
 
+  // Registry subcommands
+  if (command === 'registry' && currentIndex === 1) {
+    return filterSuggestions(['token', 'owner'], args[1] || '');
+  }
+  if (command === 'registry' && args[1] === 'token' && currentIndex === 2) {
+    return filterSuggestions(['add', 'rm'], args[2] || '');
+  }
+  if (command === 'registry' && args[1] === 'owner' && currentIndex === 2) {
+    return filterSuggestions(['list', 'show', 'set'], args[2] || '');
+  }
+
+  // Token subcommands (contributor identity tokens)
+  if (command === 'token' && currentIndex === 1) {
+    return filterSuggestions(['obtain', 'list', 'revoke'], args[1] || '');
+  }
+
   // Capability info - complete with capability names
   if (command === 'capability' && args[1] === 'info' && currentIndex === 2) {
     const db = getDb();
@@ -161,6 +179,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'run-hook',
       'secret',
       'status',
+      'where',
       'terraform-unlock',
       'types',
       'validate',