@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/src/services/ai-context-signing-key-cache.js

@@ -0,0 +1,160 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiContextSigningKeyCache = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@nexusclaw/shared");
+const DEFAULT_CACHE_PATH = node_path_1.default.join(node_os_1.default.homedir(), '.nexusclaw', 'cache', 'ai-context-signing-keys.json');
+class AiContextSigningKeyCache {
+    constructor(cachePath = DEFAULT_CACHE_PATH) {
+        this.cachePath = cachePath;
+    }
+    resolveLocal(keyId, expectedIssuer, now = new Date()) {
+        const candidates = this.read().entries
+            .filter((entry) => expectedIssuer === undefined || entry.issuer === expectedIssuer)
+            .filter((entry) => this.hasUsableKey(entry.keySet, keyId, now));
+        if (candidates.length !== 1) {
+            throw new shared_1.AiContextSigningError('AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+        }
+        return candidates[0].keySet;
+    }
+    async resolveOnline(input) {
+        const now = input.now ?? new Date();
+        try {
+            return this.resolveLocal(input.keyId, input.expectedIssuer, now);
+        }
+        catch (error) {
+            if (!(error instanceof shared_1.AiContextSigningError) ||
+                error.code !== 'AI_CONTEXT_SIGNING_KEY_UNKNOWN') {
+                throw error;
+            }
+        }
+        const fetched = await input.fetchKeySet();
+        (0, shared_1.assertAiContextSigningKeySet)(fetched);
+        if (input.expectedIssuer !== undefined &&
+            fetched.issuer !== input.expectedIssuer) {
+            throw new shared_1.AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+        }
+        this.store(fetched, now);
+        if (!this.hasUsableKey(fetched, input.keyId, now)) {
+            throw new shared_1.AiContextSigningError('AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+        }
+        return fetched;
+    }
+    store(keySet, fetchedAt = new Date()) {
+        (0, shared_1.assertAiContextSigningKeySet)(keySet);
+        const fetchedAtMs = fetchedAt.getTime();
+        if (!Number.isFinite(fetchedAtMs)) {
+            throw new shared_1.AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+        }
+        const current = this.read();
+        const entries = current.entries
+            .filter((entry) => entry.issuer !== keySet.issuer)
+            .concat({
+            issuer: keySet.issuer,
+            fetchedAt: new Date(fetchedAtMs).toISOString(),
+            keySet,
+        })
+            .sort((a, b) => a.issuer.localeCompare(b.issuer));
+        this.write({
+            schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_CACHE_SCHEMA_VERSION,
+            entries,
+        });
+    }
+    hasUsableKey(keySet, keyId, now) {
+        try {
+            (0, shared_1.assertAiContextSigningKeySet)(keySet);
+        }
+        catch {
+            return false;
+        }
+        const nowMs = now.getTime();
+        if (!Number.isFinite(nowMs) ||
+            nowMs >= Date.parse(keySet.cacheUntil)) {
+            return false;
+        }
+        const key = keySet.keys.find((candidate) => candidate.keyId === keyId);
+        return Boolean(key &&
+            nowMs >= Date.parse(key.notBefore) &&
+            nowMs < Date.parse(key.notAfter));
+    }
+    read() {
+        if (!node_fs_1.default.existsSync(this.cachePath)) {
+            return {
+                schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_CACHE_SCHEMA_VERSION,
+                entries: [],
+            };
+        }
+        try {
+            const parsed = JSON.parse(node_fs_1.default.readFileSync(this.cachePath, 'utf8'));
+            if (!isRecord(parsed) ||
+                parsed.schemaVersion !== shared_1.AI_CONTEXT_SIGNING_KEY_CACHE_SCHEMA_VERSION ||
+                !Array.isArray(parsed.entries)) {
+                throw new Error('invalid cache');
+            }
+            const entries = [];
+            for (const entry of parsed.entries) {
+                if (!isRecord(entry) ||
+                    typeof entry.issuer !== 'string' ||
+                    typeof entry.fetchedAt !== 'string') {
+                    throw new Error('invalid cache entry');
+                }
+                const fetchedAt = Date.parse(entry.fetchedAt);
+                if (!Number.isFinite(fetchedAt) ||
+                    new Date(fetchedAt).toISOString() !== entry.fetchedAt) {
+                    throw new Error('invalid cache timestamp');
+                }
+                (0, shared_1.assertAiContextSigningKeySet)(entry.keySet);
+                if (entry.issuer !== entry.keySet.issuer) {
+                    throw new Error('cache issuer mismatch');
+                }
+                entries.push({
+                    issuer: entry.issuer,
+                    fetchedAt: entry.fetchedAt,
+                    keySet: entry.keySet,
+                });
+            }
+            return {
+                schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_CACHE_SCHEMA_VERSION,
+                entries,
+            };
+        }
+        catch {
+            return {
+                schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_CACHE_SCHEMA_VERSION,
+                entries: [],
+            };
+        }
+    }
+    write(value) {
+        const directory = node_path_1.default.dirname(this.cachePath);
+        node_fs_1.default.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        node_fs_1.default.chmodSync(directory, 0o700);
+        const tempPath = node_path_1.default.join(directory, `.${node_path_1.default.basename(this.cachePath)}.${process.pid}.${Date.now()}.tmp`);
+        try {
+            node_fs_1.default.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
+                encoding: 'utf8',
+                mode: 0o600,
+            });
+            node_fs_1.default.renameSync(tempPath, this.cachePath);
+            node_fs_1.default.chmodSync(this.cachePath, 0o600);
+        }
+        catch (error) {
+            try {
+                node_fs_1.default.unlinkSync(tempPath);
+            }
+            catch {
+            }
+            throw error;
+        }
+    }
+}
+exports.AiContextSigningKeyCache = AiContextSigningKeyCache;
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=ai-context-signing-key-cache.js.map

package/dist/nexus-cli/src/services/ai-context-signing-key-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-context-signing-key-cache.js","sourceRoot":"","sources":["../../../../src/services/ai-context-signing-key-cache.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAC7B,8CAK2B;AAoB3B,MAAM,kBAAkB,GAAG,mBAAI,CAAC,IAAI,CAClC,iBAAE,CAAC,OAAO,EAAE,EACZ,YAAY,EACZ,OAAO,EACP,8BAA8B,CAC/B,CAAC;AAMF,MAAa,wBAAwB;IACnC,YAA6B,YAAY,kBAAkB;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,YAAY,CACV,KAAa,EACb,cAAuB,EACvB,GAAG,GAAG,IAAI,IAAI,EAAE;QAEhB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO;aACnC,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,CAClE;aACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAmC;QAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,CAAC,CAAC,KAAK,YAAY,8BAAqB,CAAC;gBACzC,KAAK,CAAC,IAAI,KAAK,gCAAgC,EAC/C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAA,qCAA4B,EAAC,OAAO,CAAC,CAAC;QACtC,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,EACvC,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAgC,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE;QAC5D,IAAA,qCAA4B,EAAC,MAAM,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;aACjD,MAAM,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9C,MAAM;SACP,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC;YACT,aAAa,EAAE,oDAA2C;YAC1D,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,MAAgC,EAChC,KAAa,EACb,GAAS;QAET,IAAI,CAAC;YACH,IAAA,qCAA4B,EAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EACtC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACvE,OAAO,OAAO,CACZ,GAAG;YACD,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CACnC,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,aAAa,EAAE,oDAA2C;gBAC1D,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAC7B,CAAC;YACb,IACE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjB,MAAM,CAAC,aAAa,KAAK,oDAA2C;gBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,OAAO,GAA0B,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAChB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAChC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC9C,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,EACrD,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAA,qCAA4B,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC3C,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,oDAA2C;gBAC1D,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YAGP,OAAO;gBACL,aAAa,EAAE,oDAA2C;gBAC1D,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAA4B;QACxC,MAAM,SAAS,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,iBAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,iBAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CACxB,SAAS,EACT,IAAI,mBAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CACrE,CAAC;QACF,IAAI,CAAC;YACH,iBAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAChE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,iBAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,iBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,iBAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAnLD,4DAmLC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/nexus-cli/src/services/ai-context-signing-key-cache.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nexus-cli/src/services/ai-context-signing-key-cache.test.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_test_1 = __importDefault(require("node:test"));
+const shared_1 = require("@nexusclaw/shared");
+const ai_context_signing_key_cache_1 = require("./ai-context-signing-key-cache");
+const NOW = new Date('2026-07-17T00:00:00.000Z');
+const PUBLIC_X = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+function keySet(overrides = {}) {
+    return {
+        schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_SET_SCHEMA_VERSION,
+        issuer: 'https://issuer.example',
+        generatedAt: NOW.toISOString(),
+        cacheUntil: '2026-07-17T01:00:00.000Z',
+        keys: [
+            {
+                keyId: 'key-1',
+                alg: 'EdDSA',
+                publicKeyJwk: {
+                    kty: 'OKP',
+                    crv: 'Ed25519',
+                    x: PUBLIC_X,
+                },
+                notBefore: '2026-07-16T00:00:00.000Z',
+                notAfter: '2026-07-18T00:00:00.000Z',
+                status: 'active',
+            },
+        ],
+        ...overrides,
+    };
+}
+function fixture() {
+    const root = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-ai-context-key-cache-'));
+    return {
+        root,
+        cachePath: node_path_1.default.join(root, 'private', 'keys.json'),
+        cleanup: () => node_fs_1.default.rmSync(root, { recursive: true, force: true }),
+    };
+}
+(0, node_test_1.default)('AI context signing cache writes atomically as public-only mode 0600', () => {
+    const files = fixture();
+    try {
+        const cache = new ai_context_signing_key_cache_1.AiContextSigningKeyCache(files.cachePath);
+        cache.store(keySet(), NOW);
+        const raw = node_fs_1.default.readFileSync(files.cachePath, 'utf8');
+        strict_1.default.equal(JSON.parse(raw).entries[0].keySet.issuer, 'https://issuer.example');
+        strict_1.default.equal(raw.includes('accessToken'), false);
+        strict_1.default.equal(raw.includes('bearer'), false);
+        strict_1.default.equal(raw.includes('"d"'), false);
+        strict_1.default.equal(node_fs_1.default.statSync(files.cachePath).mode & 0o777, 0o600);
+        strict_1.default.equal(node_fs_1.default.statSync(node_path_1.default.dirname(files.cachePath)).mode & 0o777, 0o700);
+        strict_1.default.equal(cache.resolveLocal('key-1', 'https://issuer.example', NOW).issuer, 'https://issuer.example');
+    }
+    finally {
+        files.cleanup();
+    }
+});
+(0, node_test_1.default)('online resolution refreshes exactly once on miss/unknown key and then reuses cache', async () => {
+    const files = fixture();
+    try {
+        const cache = new ai_context_signing_key_cache_1.AiContextSigningKeyCache(files.cachePath);
+        let fetches = 0;
+        const fetchKeySet = async () => {
+            fetches += 1;
+            return keySet();
+        };
+        await cache.resolveOnline({
+            keyId: 'key-1',
+            expectedIssuer: 'https://issuer.example',
+            fetchKeySet,
+            now: NOW,
+        });
+        await cache.resolveOnline({
+            keyId: 'key-1',
+            expectedIssuer: 'https://issuer.example',
+            fetchKeySet,
+            now: NOW,
+        });
+        strict_1.default.equal(fetches, 1);
+        await strict_1.default.rejects(cache.resolveOnline({
+            keyId: 'missing',
+            expectedIssuer: 'https://issuer.example',
+            fetchKeySet,
+            now: NOW,
+        }), (error) => error instanceof shared_1.AiContextSigningError &&
+            error.code === 'AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+        strict_1.default.equal(fetches, 2);
+    }
+    finally {
+        files.cleanup();
+    }
+});
+(0, node_test_1.default)('local resolution performs no refresh and rejects expired/corrupt cache', () => {
+    const files = fixture();
+    try {
+        const cache = new ai_context_signing_key_cache_1.AiContextSigningKeyCache(files.cachePath);
+        cache.store(keySet(), NOW);
+        strict_1.default.throws(() => cache.resolveLocal('key-1', 'https://issuer.example', new Date('2026-07-17T01:00:00.000Z')), (error) => error instanceof shared_1.AiContextSigningError &&
+            error.code === 'AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+        node_fs_1.default.writeFileSync(files.cachePath, '{"schemaVersion":"tampered"}', 'utf8');
+        strict_1.default.throws(() => cache.resolveLocal('key-1', undefined, NOW), (error) => error instanceof shared_1.AiContextSigningError &&
+            error.code === 'AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+    }
+    finally {
+        files.cleanup();
+    }
+});
+//# sourceMappingURL=ai-context-signing-key-cache.test.js.map

package/dist/nexus-cli/src/services/ai-context-signing-key-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-context-signing-key-cache.test.js","sourceRoot":"","sources":["../../../../src/services/ai-context-signing-key-cache.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAC7B,0DAA6B;AAC7B,8CAI2B;AAC3B,iFAA0E;AAE1E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACjD,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAE/D,SAAS,MAAM,CACb,YAA+C,EAAE;IAEjD,OAAO;QACL,aAAa,EAAE,kDAAyC;QACxD,MAAM,EAAE,wBAAwB;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC9B,UAAU,EAAE,0BAA0B;QACtC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,OAAO;gBACZ,YAAY,EAAE;oBACZ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,QAAQ;iBACZ;gBACD,SAAS,EAAE,0BAA0B;gBACrC,QAAQ,EAAE,0BAA0B;gBACpC,MAAM,EAAE,QAAQ;aACjB;SACF;QACD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,iBAAE,CAAC,WAAW,CACzB,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CACtD,CAAC;IACF,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,uDAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,iBAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,gBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACjF,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5C,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACzC,gBAAM,CAAC,KAAK,CAAC,iBAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,gBAAM,CAAC,KAAK,CAAC,iBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7E,gBAAM,CAAC,KAAK,CACV,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC,MAAM,EACjE,wBAAwB,CACzB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,uDAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;YAC7B,OAAO,IAAI,CAAC,CAAC;YACb,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,KAAK,EAAE,OAAO;YACd,cAAc,EAAE,wBAAwB;YACxC,WAAW;YACX,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,KAAK,EAAE,OAAO;YACd,cAAc,EAAE,wBAAwB;YACxC,WAAW;YACX,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,gBAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAEzB,MAAM,gBAAM,CAAC,OAAO,CAClB,KAAK,CAAC,aAAa,CAAC;YAClB,KAAK,EAAE,SAAS;YAChB,cAAc,EAAE,wBAAwB;YACxC,WAAW;YACX,GAAG,EAAE,GAAG;SACT,CAAC,EACF,CAAC,KAAc,EAAE,EAAE,CACjB,KAAK,YAAY,8BAAqB;YACtC,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAClD,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,uDAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,gBAAM,CAAC,MAAM,CACX,GAAG,EAAE,CACH,KAAK,CAAC,YAAY,CAChB,OAAO,EACP,wBAAwB,EACxB,IAAI,IAAI,CAAC,0BAA0B,CAAC,CACrC,EACH,CAAC,KAAc,EAAE,EAAE,CACjB,KAAK,YAAY,8BAAqB;YACtC,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAClD,CAAC;QAEF,iBAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,8BAA8B,EAAE,MAAM,CAAC,CAAC;QAC1E,gBAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EACjD,CAAC,KAAc,EAAE,EAAE,CACjB,KAAK,YAAY,8BAAqB;YACtC,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}