@dcl/sdk-commands 7.31.1-40606969412.commit-24c05c3 → 7.31.1-41472004640.commit-3147448

package/dist/commands/scene-insights/inputs.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOG_LEVELS = void 0;
+exports.normalizeWorldName = normalizeWorldName;
+exports.normalizeParcel = normalizeParcel;
+exports.buildSceneTarget = buildSceneTarget;
+exports.parseTime = parseTime;
+exports.parseDuration = parseDuration;
+exports.parseTarget = parseTarget;
+exports.parseLevel = parseLevel;
+exports.parseInteger = parseInteger;
+exports.normalizeMetricName = normalizeMetricName;
+const error_1 = require("../../logic/error");
+exports.LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
+/** The service refuses ranges longer than its 7-day retention. */
+const MAX_RANGE_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Room for the time between computing `from` here and the service resolving its own "now": a
+ * duration of exactly 7 days would otherwise always arrive a few milliseconds over the limit.
+ */
+const RANGE_SLACK_MS = 60 * 1000;
+const DURATION_UNITS_MS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000
+};
+/** setTimeout fires at once past 2^31-1 ms (about 24.8 days). */
+const MAX_DURATION_DAYS = 24;
+/** The hosts a session is meant for; the signature doesn't cover the host, so anywhere else could replay it. */
+const TRUSTED_TARGET_DOMAINS = ['decentraland.org', 'decentraland.zone'];
+/**
+ * Normalizes a World name the way creators type it: `foo`, `foo.dcl.eth` or any other ENS name
+ * (`foo.eth`). Names without an `.eth` suffix are DCL names.
+ */
+function normalizeWorldName(raw) {
+    const name = raw.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9.-]*$/.test(name)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid --world "${raw}"`);
+    }
+    return name.endsWith('.eth') ? name : `${name}.dcl.eth`;
+}
+/** Normalizes `x,y` parcel coordinates (spaces and leading zeros removed). */
+function normalizeParcel(raw) {
+    const match = raw.trim().match(/^(-?\d+)\s*,\s*(-?\d+)$/);
+    if (!match) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid --position "${raw}"; expected "x,y" with integer coordinates`);
+    }
+    return `${parseInt(match[1], 10)},${parseInt(match[2], 10)}`;
+}
+/**
+ * Builds the scene target. A World is addressed by name (`sceneId`), plus the parcel of one of its
+ * scenes when it has several; a Genesis City scene by any of its parcels.
+ */
+function buildSceneTarget(world, parcel) {
+    if (world) {
+        return {
+            label: parcel ? `${world} ${parcel}` : world,
+            metadata: JSON.stringify({ sceneId: world, realmName: world, ...(parcel && { parcel }) }),
+            world,
+            parcel
+        };
+    }
+    if (!parcel) {
+        throw new error_1.CliError('SCENE_INSIGHTS_MISSING_SCENE', 'Provide --world (with an optional --position) for a World, or --position for a Genesis City scene');
+    }
+    return {
+        label: `Genesis City ${parcel}`,
+        metadata: JSON.stringify({ parcel, realmName: 'main' }),
+        parcel
+    };
+}
+/**
+ * Parses a `--from`/`--to` value into the ISO-8601 form the service expects. Accepts `now`, a
+ * duration back from now (`30s`, `15m`, `2h`, `7d`), epoch milliseconds (13 digits) or ISO-8601
+ * with an explicit offset (`2026-10-01T12:00:00Z`, `2026-10-01T09:00:00-03:00`). A duration of 7
+ * days or more means the whole retention window, ending a minute short of it.
+ */
+function parseTime(raw, flag, now = Date.now()) {
+    const value = raw.trim();
+    if (value === 'now') {
+        return new Date(now).toISOString();
+    }
+    const duration = value.match(/^(\d+)([smhd])$/);
+    if (duration) {
+        const ms = parseInt(duration[1], 10) * DURATION_UNITS_MS[duration[2]];
+        return new Date(now - Math.min(ms, MAX_RANGE_MS - RANGE_SLACK_MS)).toISOString();
+    }
+    if (/^\d{13}$/.test(value)) {
+        return new Date(parseInt(value, 10)).toISOString();
+    }
+    const hasOffset = /(Z|[+-]\d{2}:?\d{2})$/i.test(value);
+    const parsed = Date.parse(value);
+    if (!hasOffset || Number.isNaN(parsed)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid ${flag} "${raw}"; use a duration back from now (15m, 2h, 7d), epoch milliseconds or ISO-8601 with an offset (2026-10-01T12:00:00Z)`);
+    }
+    return new Date(parsed).toISOString();
+}
+/** Parses a duration (`30s`, `5m`, `2h`, `1d`, up to 24 days) into milliseconds. */
+function parseDuration(raw, flag) {
+    const duration = raw.trim().match(/^(\d+)([smhd])$/);
+    const ms = duration ? parseInt(duration[1], 10) * DURATION_UNITS_MS[duration[2]] : 0;
+    if (!(ms > 0)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid ${flag} "${raw}"; use a duration such as 30s, 5m or 2h`);
+    }
+    if (ms > MAX_DURATION_DAYS * DURATION_UNITS_MS.d) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `${flag} must be at most ${MAX_DURATION_DAYS}d`);
+    }
+    return ms;
+}
+/**
+ * Validates a `--target` URL. Without `trustAny`, only https Decentraland hosts are accepted: the
+ * signed headers don't name the host, so another server receiving them could replay them.
+ */
+function parseTarget(raw, trustAny) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        url = undefined;
+    }
+    if (!url || !['http:', 'https:'].includes(url.protocol) || url.search || url.hash || url.username || url.password) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid --target "${raw}"; expected an http(s) URL`);
+    }
+    const hostname = url.hostname;
+    const trusted = url.protocol === 'https:' &&
+        TRUSTED_TARGET_DOMAINS.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
+    if (!trusted && !trustAny) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `--target "${raw}" is not an https host under ${TRUSTED_TARGET_DOMAINS.join(' or ')}. It would receive signed ` +
+            'headers it could replay against the real service; pass --trust-target to send them anyway');
+    }
+    return raw;
+}
+/** Validates a `--level` value. */
+function parseLevel(raw) {
+    const level = raw.trim().toLowerCase();
+    if (!exports.LOG_LEVELS.includes(level)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid --level "${raw}"; use ${exports.LOG_LEVELS.join(', ')}`);
+    }
+    return level;
+}
+/** Validates an integer flag inside [min, max]. */
+function parseInteger(value, flag, min, max) {
+    if (!Number.isInteger(value) || value < min || value > max) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `${flag} must be an integer between ${min} and ${max}`);
+    }
+    return value;
+}
+/** The metric names the insights service serves: `dcl.scene.<group>.<field>`. */
+const METRIC_NAME_PATTERN = /^dcl\.scene\.[a-z0-9_]+\.[a-z0-9_]+$/;
+/**
+ * Expands a metric name, so `cpu.run_ms` can be typed for `dcl.scene.cpu.run_ms`.
+ *
+ * @throws {CliError} SCENE_INSIGHTS_INVALID_ARGUMENT when the result is not `dcl.scene.<group>.<field>`
+ */
+function normalizeMetricName(raw) {
+    const trimmed = raw.trim();
+    const name = trimmed.startsWith('dcl.scene.') ? trimmed : `dcl.scene.${trimmed}`;
+    // checked here because the name becomes a path segment: `..` or `/` would change the path
+    if (!METRIC_NAME_PATTERN.test(name)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_ARGUMENT', `Invalid metric "${raw}": expected <group>.<field> (lowercase letters, digits and _), e.g. cpu.run_ms`);
+    }
+    return name;
+}
+//# sourceMappingURL=inputs.js.map

package/dist/commands/scene-insights/inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputs.js","sourceRoot":"","sources":["../../../src/commands/scene-insights/inputs.ts"],"names":[],"mappings":";;;AAyCA,gDAMC;AAGD,0CASC;AAMD,4CAoBC;AAQD,8BAyBC;AAGD,sCAaC;AAMD,kCAsBC;AAGD,gCAMC;AAGD,oCAKC;AAUD,kDAWC;AAxMD,6CAA4C;AAc/B,QAAA,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAA;AAGrE,kEAAkE;AAClE,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5C;;;GAGG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhC,MAAM,iBAAiB,GAA2B;IAChD,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAA;AACD,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAE5B,gHAAgH;AAChH,MAAM,sBAAsB,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;AAExE;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACrC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,gBAAQ,CAAC,iCAAiC,EAAE,oBAAoB,GAAG,GAAG,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAA;AACzD,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAQ,CAChB,iCAAiC,EACjC,uBAAuB,GAAG,4CAA4C,CACvE,CAAA;IACH,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAyB,EAAE,MAA0B;IACpF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK;YAC5C,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzF,KAAK;YACL,MAAM;SACP,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAQ,CAChB,8BAA8B,EAC9B,mGAAmG,CACpG,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,gBAAgB,MAAM,EAAE;QAC/B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACvD,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC3E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACxB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACrE,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAQ,CAChB,iCAAiC,EACjC,WAAW,IAAI,KAAK,GAAG,qHAAqH,CAC7I,CAAA;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;AACvC,CAAC;AAED,oFAAoF;AACpF,SAAgB,aAAa,CAAC,GAAW,EAAE,IAAY;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpD,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpF,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,gBAAQ,CAChB,iCAAiC,EACjC,WAAW,IAAI,KAAK,GAAG,yCAAyC,CACjE,CAAA;IACH,CAAC;IACD,IAAI,EAAE,GAAG,iBAAiB,GAAG,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,gBAAQ,CAAC,iCAAiC,EAAE,GAAG,IAAI,oBAAoB,iBAAiB,GAAG,CAAC,CAAA;IACxG,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,GAAW,EAAE,QAAiB;IACxD,IAAI,GAAoB,CAAA;IACxB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClH,MAAM,IAAI,gBAAQ,CAAC,iCAAiC,EAAE,qBAAqB,GAAG,4BAA4B,CAAC,CAAA;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC7B,MAAM,OAAO,GACX,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAA;IACjG,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,gBAAQ,CAChB,iCAAiC,EACjC,aAAa,GAAG,gCAAgC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B;YAC7G,2FAA2F,CAC9F,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,mCAAmC;AACnC,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,CAAE,kBAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,gBAAQ,CAAC,iCAAiC,EAAE,oBAAoB,GAAG,UAAU,kBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,OAAO,KAAiB,CAAA;AAC1B,CAAC;AAED,mDAAmD;AACnD,SAAgB,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW,EAAE,GAAW;IAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC3D,MAAM,IAAI,gBAAQ,CAAC,iCAAiC,EAAE,GAAG,IAAI,+BAA+B,GAAG,QAAQ,GAAG,EAAE,CAAC,CAAA;IAC/G,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,sCAAsC,CAAA;AAElE;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,CAAA;IAChF,0FAA0F;IAC1F,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gBAAQ,CAChB,iCAAiC,EACjC,mBAAmB,GAAG,gFAAgF,CACvG,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/commands/scene-insights/session-store.d.ts

@@ -0,0 +1,42 @@
+import { AuthChain, AuthIdentity } from '@dcl/crypto';
+import { CliComponents } from '../../components';
+import { InsightsSession } from './session';
+/** Environment variable naming the folder whose .dcl/ holds the session, e.g. a sandbox an agent can read. */
+export declare const SESSION_DIR_ENV = "DCL_SCENE_INSIGHTS_SESSION_DIR";
+/**
+ * What is saved after a browser signature: the ephemeral key the wallet delegated to, and the
+ * delegation. Until it expires it signs requests as the wallet, so it is written readable only by
+ * the user and removed by `scene-insights logout`.
+ */
+export interface SavedSession {
+    version: 1;
+    address: string;
+    expiration: string;
+    ephemeralIdentity: AuthIdentity['ephemeralIdentity'];
+    authChain: AuthChain;
+}
+export declare function getSessionFilePath(base?: string): string;
+/**
+ * Reads the saved session. Returns undefined when there is none, it is malformed, it expires within
+ * a minute, or its delegation does not verify (tampered, or not a delegation to its key).
+ */
+export declare function loadSession(components: Pick<CliComponents, 'fs'>, file: string, now?: number): Promise<{
+    session: InsightsSession;
+    saved: SavedSession;
+} | undefined>;
+/**
+ * Refuses a session file git already tracks, e.g. a .dcl folder committed before it ignored
+ * itself: its .gitignore doesn't stop a tracked file being committed again.
+ *
+ * @throws CliError `SCENE_INSIGHTS_UNSAFE_SESSION_FILE` when git tracks it.
+ */
+export declare function assertSessionFileIsNotTracked(file: string): Promise<void>;
+/**
+ * Saves the session readable only by the user (0600, in a 0700 directory), replacing any other.
+ * Its folder's .gitignore ignores everything in it, so git never commits it.
+ *
+ * @throws CliError `SCENE_INSIGHTS_UNSAFE_SESSION_FILE` when git tracks the file.
+ */
+export declare function saveSession(components: Pick<CliComponents, 'fs'>, file: string, ephemeralIdentity: AuthIdentity['ephemeralIdentity'], expiration: Date, authChain: AuthChain): Promise<void>;
+/** Removes the saved session. Returns whether there was one. */
+export declare function deleteSession(components: Pick<CliComponents, 'fs'>, file: string): Promise<boolean>;

package/dist/commands/scene-insights/session-store.js

@@ -0,0 +1,131 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_DIR_ENV = void 0;
+exports.getSessionFilePath = getSessionFilePath;
+exports.loadSession = loadSession;
+exports.assertSessionFileIsNotTracked = assertSessionFileIsNotTracked;
+exports.saveSession = saveSession;
+exports.deleteSession = deleteSession;
+const os_1 = require("os");
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const crypto_2 = require("@dcl/crypto");
+const error_1 = require("../../logic/error");
+const session_1 = require("./session");
+/** Environment variable naming the folder whose .dcl/ holds the session, e.g. a sandbox an agent can read. */
+exports.SESSION_DIR_ENV = 'DCL_SCENE_INSIGHTS_SESSION_DIR';
+/**
+ * Sessions are only saved in a .dcl folder: a dot folder is never deployed (whatever .dclignore
+ * says), and its own `*` .gitignore keeps git from adding anything in it.
+ */
+const SESSION_FOLDER = '.dcl';
+/** A saved session is not used in its last minute, so a request never races its expiry. */
+const EXPIRY_MARGIN_MS = 60 * 1000;
+function getSessionFilePath(base = process.env[exports.SESSION_DIR_ENV] || (0, os_1.homedir)()) {
+    return path_1.default.resolve(base, SESSION_FOLDER, 'scene-insights-session.json');
+}
+/**
+ * Reads the saved session. Returns undefined when there is none, it is malformed, it expires within
+ * a minute, or its delegation does not verify (tampered, or not a delegation to its key).
+ */
+async function loadSession(components, file, now = Date.now()) {
+    const { fs } = components;
+    if (!(await fs.fileExists(file)))
+        return undefined;
+    let saved;
+    try {
+        saved = JSON.parse(await fs.readFile(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (saved?.version !== 1 ||
+        typeof saved.expiration !== 'string' ||
+        typeof saved.ephemeralIdentity?.privateKey !== 'string' ||
+        typeof saved.ephemeralIdentity?.address !== 'string' ||
+        !Array.isArray(saved.authChain)) {
+        return undefined;
+    }
+    const expiration = new Date(saved.expiration);
+    if (!(expiration.getTime() - EXPIRY_MARGIN_MS > now))
+        return undefined;
+    const check = await crypto_2.Authenticator.validateSignature(saved.ephemeralIdentity.address.toLowerCase(), saved.authChain, null, now, { service: session_1.INSIGHTS_SERVICE });
+    if (!check.ok ||
+        !check.scope ||
+        !session_1.INSIGHTS_OPERATIONS.every((operation) => (0, crypto_2.isOperationGranted)(check.scope, operation)))
+        return undefined;
+    expiration.setTime(Math.min(expiration.getTime(), check.scope.expiration));
+    if (!(expiration.getTime() - EXPIRY_MARGIN_MS > now))
+        return undefined;
+    return { session: (0, session_1.createSessionFromChain)(saved.ephemeralIdentity, expiration, saved.authChain), saved };
+}
+/** Whether git tracks the file, so a .gitignore no longer keeps it out of commits. */
+function isTrackedByGit(file) {
+    // exits 0 only for a tracked file; untracked, outside a repository or without git, it fails
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('git', ['ls-files', '--error-unmatch', '--', path_1.default.basename(file)], { cwd: path_1.default.dirname(file) }, (error) => resolve(!error));
+    });
+}
+/**
+ * Refuses a session file git already tracks, e.g. a .dcl folder committed before it ignored
+ * itself: its .gitignore doesn't stop a tracked file being committed again.
+ *
+ * @throws CliError `SCENE_INSIGHTS_UNSAFE_SESSION_FILE` when git tracks it.
+ */
+async function assertSessionFileIsNotTracked(file) {
+    const resolved = path_1.default.resolve(file);
+    if (await isTrackedByGit(resolved)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_UNSAFE_SESSION_FILE', `The session file ${resolved} is tracked by git, so it would be committed. Remove it from the repository ` +
+            `(git rm --cached) or set ${exports.SESSION_DIR_ENV} to a folder outside it`);
+    }
+}
+/** Makes the session's folder ignore everything in it, so git never adds the session or its temporary copies. */
+async function ignoreFolderInGit(components, folder) {
+    const { fs } = components;
+    const gitignore = path_1.default.join(folder, '.gitignore');
+    const existing = (await fs.fileExists(gitignore)) ? await fs.readFile(gitignore, 'utf8') : '';
+    if (existing.split(/\r?\n/).includes('*'))
+        return;
+    const separator = existing && !existing.endsWith('\n') ? '\n' : '';
+    await fs.appendFile(gitignore, separator + '*\n');
+}
+/**
+ * Saves the session readable only by the user (0600, in a 0700 directory), replacing any other.
+ * Its folder's .gitignore ignores everything in it, so git never commits it.
+ *
+ * @throws CliError `SCENE_INSIGHTS_UNSAFE_SESSION_FILE` when git tracks the file.
+ */
+async function saveSession(components, file, ephemeralIdentity, expiration, authChain) {
+    const { fs } = components;
+    const saved = {
+        version: 1,
+        address: crypto_2.Authenticator.ownerAddress(authChain),
+        expiration: expiration.toISOString(),
+        ephemeralIdentity: {
+            address: ephemeralIdentity.address,
+            publicKey: '0x',
+            privateKey: ephemeralIdentity.privateKey
+        },
+        authChain
+    };
+    await assertSessionFileIsNotTracked(file);
+    await fs.mkdir(path_1.default.dirname(file), { recursive: true, mode: 0o700 });
+    await ignoreFolderInGit(components, path_1.default.dirname(file));
+    // a fresh file always gets the mode, unlike rewriting an existing one; rename makes it atomic
+    const temporary = `${file}.${(0, crypto_1.randomBytes)(6).toString('hex')}.tmp`;
+    await fs.writeFile(temporary, JSON.stringify(saved, null, 2), { mode: 0o600 });
+    await fs.rename(temporary, file);
+}
+/** Removes the saved session. Returns whether there was one. */
+async function deleteSession(components, file) {
+    const { fs } = components;
+    if (!(await fs.fileExists(file)))
+        return false;
+    await fs.unlink(file);
+    return true;
+}
+//# sourceMappingURL=session-store.js.map

package/dist/commands/scene-insights/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../../src/commands/scene-insights/session-store.ts"],"names":[],"mappings":";;;;;;AAmCA,gDAEC;AAMD,kCA4CC;AAkBD,sEASC;AAkBD,kCA0BC;AAGD,sCAKC;AAtKD,2BAA4B;AAC5B,gDAAuB;AACvB,mCAAoC;AACpC,iDAAwC;AACxC,wCAAwF;AAGxF,6CAA4C;AAC5C,uCAA0G;AAE1G,8GAA8G;AACjG,QAAA,eAAe,GAAG,gCAAgC,CAAA;AAE/D;;;GAGG;AACH,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAelC,SAAgB,kBAAkB,CAAC,OAAe,OAAO,CAAC,GAAG,CAAC,uBAAe,CAAC,IAAI,IAAA,YAAO,GAAE;IACzF,OAAO,cAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,6BAA6B,CAAC,CAAA;AAC1E,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,UAAqC,EACrC,IAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAElD,IAAI,KAAmB,CAAA;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,KAAK,EAAE,OAAO,KAAK,CAAC;QACpB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,iBAAiB,EAAE,UAAU,KAAK,QAAQ;QACvD,OAAO,KAAK,CAAC,iBAAiB,EAAE,OAAO,KAAK,QAAQ;QACpD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAC/B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEtE,MAAM,KAAK,GAAG,MAAM,sBAAa,CAAC,iBAAiB,CACjD,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,EAC7C,KAAK,CAAC,SAAS,EACf,IAAI,EACJ,GAAG,EACH,EAAE,OAAO,EAAE,0BAAgB,EAAE,CAC9B,CAAA;IACD,IACE,CAAC,KAAK,CAAC,EAAE;QACT,CAAC,KAAK,CAAC,KAAK;QACZ,CAAC,6BAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,2BAAkB,EAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAErF,OAAO,SAAS,CAAA;IAClB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1E,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEtE,OAAO,EAAE,OAAO,EAAE,IAAA,gCAAsB,EAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAA;AACzG,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,IAAY;IAClC,4FAA4F;IAC5F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CACjH,OAAO,CAAC,CAAC,KAAK,CAAC,CAChB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,6BAA6B,CAAC,IAAY;IAC9D,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,gBAAQ,CAChB,oCAAoC,EACpC,oBAAoB,QAAQ,8EAA8E;YACxG,4BAA4B,uBAAe,yBAAyB,CACvE,CAAA;IACH,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,iBAAiB,CAAC,UAAqC,EAAE,MAAc;IACpF,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAA;IACzB,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7F,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAM;IACjD,MAAM,SAAS,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,GAAG,KAAK,CAAC,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,UAAqC,EACrC,IAAY,EACZ,iBAAoD,EACpD,UAAgB,EAChB,SAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAA;IACzB,MAAM,KAAK,GAAiB;QAC1B,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,sBAAa,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB,CAAC,OAAO;YAClC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,iBAAiB,CAAC,UAAU;SACzC;QACD,SAAS;KACV,CAAA;IACD,MAAM,6BAA6B,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,iBAAiB,CAAC,UAAU,EAAE,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACvD,8FAA8F;IAC9F,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAA;IACjE,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,gEAAgE;AACzD,KAAK,UAAU,aAAa,CAAC,UAAqC,EAAE,IAAY;IACrF,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/commands/scene-insights/session.d.ts

@@ -0,0 +1,42 @@
+import { AuthChain, AuthIdentity } from '@dcl/crypto';
+/** How long one signature lasts; after that, `scene-insights login` signs a new session. */
+export declare const SESSION_MINUTES: number;
+export declare const INSIGHTS_SERVICE = "insights";
+export declare const INSIGHTS_OPERATIONS: readonly ["logs-read", "metrics-read", "executions-read"];
+export declare function getInsightsSessionMessage(address: string, expiration: Date): string;
+/**
+ * Signs any number of requests after a single wallet signature.
+ *
+ * Every insights request is a signed fetch over `method:path:timestamp:metadata`, so paging, tail
+ * reconnects and repeated commands need many signatures. Instead of asking the wallet for each one,
+ * the wallet signs once to delegate to an ephemeral key held by the CLI, and that key signs each
+ * request (session-store.ts keeps it between commands).
+ */
+export interface InsightsSession {
+    /** The wallet address the requests are made as */
+    address: string;
+    /** When the delegation stops being accepted */
+    expiration: Date;
+    /** Signed-fetch headers for one request */
+    sign(method: string, pathname: string, metadata: string): Record<string, string>;
+}
+/** The payload a signed fetch signs (crypto-middleware 6): method, path and timestamp lowercased, metadata verbatim. */
+export declare function buildSignedFetchPayload(method: string, pathname: string, timestamp: string, metadata: string): string;
+/** A fresh ephemeral key from a secure random source. */
+export declare function createEphemeralIdentity(): AuthIdentity['ephemeralIdentity'];
+/** Builds a session from a delegation chain whose final authority is the ephemeral key. */
+export declare function createSessionFromChain(ephemeralIdentity: AuthIdentity['ephemeralIdentity'], expiration: Date, authChain: AuthChain): InsightsSession;
+/** A delegation signed directly with a private key (`DCL_PRIVATE_KEY`). */
+export declare function createSessionFromPrivateKey(privateKey: string, now?: number): InsightsSession;
+/**
+ * Turns what the linker dApp returns into a delegation to our ephemeral key.
+ *
+ * The dApp signs whatever it is given with its own browser-side ephemeral key, closing the chain
+ * with an `ECDSA_SIGNED_ENTITY` link. Handing it our ephemeral key's login message makes that last
+ * link a signature of the message by the dApp's key, which is exactly a scoped delegation, so
+ * it is relabeled as one: wallet → dApp key → our key.
+ *
+ * @throws CliError when the chain does not sign the message, or comes from a contract wallet
+ *   (scoped contract-wallet chains require a provider rather than Catalyst validation).
+ */
+export declare function delegationFromLinkerChain(authChain: AuthChain, ephemeralAddress: string, message: string, now?: number): Promise<AuthChain>;

package/dist/commands/scene-insights/session.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSIGHTS_OPERATIONS = exports.INSIGHTS_SERVICE = exports.SESSION_MINUTES = void 0;
+exports.getInsightsSessionMessage = getInsightsSessionMessage;
+exports.buildSignedFetchPayload = buildSignedFetchPayload;
+exports.createEphemeralIdentity = createEphemeralIdentity;
+exports.createSessionFromChain = createSessionFromChain;
+exports.createSessionFromPrivateKey = createSessionFromPrivateKey;
+exports.delegationFromLinkerChain = delegationFromLinkerChain;
+const crypto_1 = require("crypto");
+const crypto_2 = require("@dcl/crypto");
+const crypto_3 = require("@dcl/crypto/dist/crypto");
+const eth_connect_1 = require("eth-connect");
+const error_1 = require("../../logic/error");
+const account_1 = require("../../logic/account");
+const auth_chain_headers_1 = require("../../logic/auth-chain-headers");
+/** How long one signature lasts; after that, `scene-insights login` signs a new session. */
+exports.SESSION_MINUTES = 12 * 60;
+exports.INSIGHTS_SERVICE = 'insights';
+exports.INSIGHTS_OPERATIONS = ['logs-read', 'metrics-read', 'executions-read'];
+function getInsightsSessionMessage(address, expiration) {
+    return (0, crypto_2.getScopedEphemeralMessage)(address, expiration, exports.INSIGHTS_OPERATIONS.map((operation) => ({ service: exports.INSIGHTS_SERVICE, operation })));
+}
+/** The payload a signed fetch signs (crypto-middleware 6): method, path and timestamp lowercased, metadata verbatim. */
+function buildSignedFetchPayload(method, pathname, timestamp, metadata) {
+    return [method.toLowerCase(), pathname.toLowerCase(), timestamp, metadata].join(':');
+}
+/** A fresh ephemeral key from a secure random source. */
+function createEphemeralIdentity() {
+    const privateKey = `0x${(0, crypto_1.randomBytes)(32).toString('hex')}`;
+    const { address } = (0, account_1.createWallet)(privateKey);
+    return { privateKey, publicKey: '0x', address };
+}
+/** Builds a session from a delegation chain whose final authority is the ephemeral key. */
+function createSessionFromChain(ephemeralIdentity, expiration, authChain) {
+    const identity = { ephemeralIdentity, expiration, authChain };
+    return {
+        address: crypto_2.Authenticator.ownerAddress(authChain),
+        expiration,
+        sign(method, pathname, metadata) {
+            const timestamp = String(Date.now());
+            const requestChain = crypto_2.Authenticator.signPayload(identity, buildSignedFetchPayload(method, pathname, timestamp, metadata));
+            return (0, auth_chain_headers_1.createAuthChainHeaders)(requestChain, timestamp, metadata);
+        }
+    };
+}
+/** A delegation signed directly with a private key (`DCL_PRIVATE_KEY`). */
+function createSessionFromPrivateKey(privateKey, now = Date.now()) {
+    const wallet = (0, account_1.createWallet)(privateKey);
+    const ephemeralIdentity = createEphemeralIdentity();
+    const expiration = new Date(now + exports.SESSION_MINUTES * 60 * 1000);
+    const message = getInsightsSessionMessage(ephemeralIdentity.address, expiration);
+    const authChain = [
+        { type: crypto_2.AuthLinkType.SIGNER, payload: wallet.address, signature: '' },
+        {
+            type: crypto_2.ScopedAuthLinkType.ECDSA_PERSONAL_SCOPED_EPHEMERAL,
+            payload: message,
+            signature: (0, crypto_3.ethSign)((0, eth_connect_1.hexToBytes)(wallet.privateKey), message)
+        }
+    ];
+    return createSessionFromChain(ephemeralIdentity, expiration, authChain);
+}
+/**
+ * Turns what the linker dApp returns into a delegation to our ephemeral key.
+ *
+ * The dApp signs whatever it is given with its own browser-side ephemeral key, closing the chain
+ * with an `ECDSA_SIGNED_ENTITY` link. Handing it our ephemeral key's login message makes that last
+ * link a signature of the message by the dApp's key, which is exactly a scoped delegation, so
+ * it is relabeled as one: wallet → dApp key → our key.
+ *
+ * @throws CliError when the chain does not sign the message, or comes from a contract wallet
+ *   (scoped contract-wallet chains require a provider rather than Catalyst validation).
+ */
+async function delegationFromLinkerChain(authChain, ephemeralAddress, message, now = Date.now()) {
+    if (authChain.some((link) => link.type === crypto_2.AuthLinkType.ECDSA_EIP_1654_EPHEMERAL)) {
+        throw new error_1.CliError('SCENE_INSIGHTS_UNSUPPORTED_WALLET', 'Smart contract wallets cannot sign insights sessions in the browser; set DCL_PRIVATE_KEY to an address with access instead');
+    }
+    const last = authChain[authChain.length - 1];
+    if (authChain.length < 2 ||
+        !last ||
+        last.type !== crypto_2.AuthLinkType.ECDSA_PERSONAL_SIGNED_ENTITY ||
+        last.payload !== message) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_SIGNATURE', 'The wallet did not sign the insights session');
+    }
+    const delegation = [
+        ...authChain.slice(0, -1),
+        { ...last, type: crypto_2.ScopedAuthLinkType.ECDSA_PERSONAL_SCOPED_EPHEMERAL }
+    ];
+    const result = await crypto_2.Authenticator.validateSignature(ephemeralAddress.toLowerCase(), delegation, null, now, {
+        service: exports.INSIGHTS_SERVICE
+    });
+    if (!result.ok) {
+        throw new error_1.CliError('SCENE_INSIGHTS_INVALID_SIGNATURE', `The insights session signature is invalid: ${result.message}`);
+    }
+    return delegation;
+}
+//# sourceMappingURL=session.js.map

package/dist/commands/scene-insights/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/commands/scene-insights/session.ts"],"names":[],"mappings":";;;AAqBA,8DAMC;AAoBD,0DAEC;AAGD,0DAIC;AAGD,wDAkBC;AAGD,kEAcC;AAaD,8DAqCC;AAhJD,mCAAoC;AACpC,wCAOoB;AACpB,oDAAiD;AACjD,6CAAwC;AAExC,6CAA4C;AAC5C,iDAAkD;AAClD,uEAAuE;AAEvE,4FAA4F;AAC/E,QAAA,eAAe,GAAG,EAAE,GAAG,EAAE,CAAA;AACzB,QAAA,gBAAgB,GAAG,UAAU,CAAA;AAC7B,QAAA,mBAAmB,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,iBAAiB,CAAU,CAAA;AAE5F,SAAgB,yBAAyB,CAAC,OAAe,EAAE,UAAgB;IACzE,OAAO,IAAA,kCAAyB,EAC9B,OAAO,EACP,UAAU,EACV,2BAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CACnF,CAAA;AACH,CAAC;AAmBD,wHAAwH;AACxH,SAAgB,uBAAuB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB,EAAE,QAAgB;IAC3G,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACtF,CAAC;AAED,yDAAyD;AACzD,SAAgB,uBAAuB;IACrC,MAAM,UAAU,GAAG,KAAK,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACzD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,sBAAY,EAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AACjD,CAAC;AAED,2FAA2F;AAC3F,SAAgB,sBAAsB,CACpC,iBAAoD,EACpD,UAAgB,EAChB,SAAoB;IAEpB,MAAM,QAAQ,GAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;IAC3E,OAAO;QACL,OAAO,EAAE,sBAAa,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,UAAU;QACV,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;YACpC,MAAM,YAAY,GAAG,sBAAa,CAAC,WAAW,CAC5C,QAAQ,EACR,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAC/D,CAAA;YACD,OAAO,IAAA,2CAAsB,EAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAgB,2BAA2B,CAAC,UAAkB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACtF,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,CAAC,CAAA;IACvC,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAA;IACnD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,uBAAe,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChF,MAAM,SAAS,GAAc;QAC3B,EAAE,IAAI,EAAE,qBAAY,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACrE;YACE,IAAI,EAAE,2BAAkB,CAAC,+BAA+C;YACxE,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAA,gBAAO,EAAC,IAAA,wBAAU,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;SAC3D;KACF,CAAA;IACD,OAAO,sBAAsB,CAAC,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,yBAAyB,CAC7C,SAAoB,EACpB,gBAAwB,EACxB,OAAe,EACf,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAY,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,gBAAQ,CAChB,mCAAmC,EACnC,4HAA4H,CAC7H,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,IACE,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,IAAI;QACL,IAAI,CAAC,IAAI,KAAK,qBAAY,CAAC,4BAA4B;QACvD,IAAI,CAAC,OAAO,KAAK,OAAO,EACxB,CAAC;QACD,MAAM,IAAI,gBAAQ,CAAC,kCAAkC,EAAE,8CAA8C,CAAC,CAAA;IACxG,CAAC;IAED,MAAM,UAAU,GAAc;QAC5B,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,2BAAkB,CAAC,+BAA+C,EAAE;KACtF,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,sBAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE;QAC1G,OAAO,EAAE,wBAAgB;KAC1B,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,gBAAQ,CAChB,kCAAkC,EAClC,8CAA8C,MAAM,CAAC,OAAO,EAAE,CAC/D,CAAA;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/commands/scene-insights/sign-in.d.ts

@@ -0,0 +1,48 @@
+import { AuthChain } from '@dcl/crypto';
+import { Router } from '@well-known-components/http-server';
+import { CliComponents } from '../../components';
+import { dAppOptions } from '../../run-dapp';
+import { InsightsSession } from './session';
+/** What the linker dApp shows while signing. */
+export interface SignInLabel {
+    label: string;
+    world?: string;
+    parcel?: string;
+}
+export interface SessionOptions {
+    /** Where the session is saved */
+    file: string;
+    /** The service URL, shown in the linker dApp */
+    targetUrl: string;
+    linkOptions: Omit<dAppOptions, 'uri'>;
+    /** Whether a person can answer the browser prompt; without one, a missing session is an error */
+    interactive: boolean;
+    /** Sign a new session even when a saved one is still valid (`login`) */
+    forceNew?: boolean;
+}
+export type SessionSource = 'private-key' | 'saved' | 'signed';
+/**
+ * Gets a session to sign requests with, in order:
+ * 1. `DCL_PRIVATE_KEY`, signed locally and never saved;
+ * 2. the saved session, while it is valid (unless `forceNew`);
+ * 3. a new browser signature through the linker dApp, which is then saved.
+ *
+ * @throws CliError `SCENE_INSIGHTS_SESSION_REQUIRED` when it would have to open the browser but
+ *   nobody is there to sign (an agent or script): `scene-insights login` has to be run first.
+ * @throws CliError `SCENE_INSIGHTS_UNSAFE_SESSION_FILE` when git tracks the session file, before
+ *   asking for a signature.
+ */
+export declare function getSession(components: Pick<CliComponents, 'fs' | 'logger' | 'fetch' | 'config'>, label: SignInLabel, options: SessionOptions): Promise<{
+    session: InsightsSession;
+    source: SessionSource;
+}>;
+/**
+ * Whether a request comes from the linker dApp's own page. The browser sets Origin and Host, so
+ * another page open in it (or a rebinding domain) can't pass for the dApp.
+ */
+export declare function isLinkerOrigin(origin: string | null, host: string | null): boolean;
+/**
+ * The linker dApp posts `view-logs` signatures to `/api/logs`. Only its own page is accepted: any
+ * other page could sign the message with its own wallet and sign the CLI in as that address.
+ */
+export declare function setSignInRoutes(router: Router<object>, ephemeralAddress: string, message: string, onSigned: (delegation: AuthChain) => void): Router<object>;