@sigma-auth/cli 0.0.1 → 0.0.3

package/README.md

@@ -33,7 +33,24 @@ bunx @sigma-auth/cli identity create \
 | `sigma backup push` | POST ciphertext only |
 | `sigma oauth register` | Session `/api/oauth-clients` or RFC 7591 DCR |
 | `sigma doctor` | Env, files, RFC 8414, session |
+| `sigma diagnose bap` | Public BAP profile; optional `--pubkey` registered-list check |
+| `sigma diagnose identities` | `GET /api/user/bap-ids` (`--pubkey` or session cookie) |
+| `sigma diagnose last-oauth` | Last selected BAP for `--pubkey` `--client-id` |
+| `sigma diagnose client` | Public OAuth client metadata |
 
 Password sources (exactly one): `--password-file`, `--password-stdin`, or `SIGMA_BACKUP_PASSWORD`. `--password` on argv is rejected.
 
+## Diagnose (no private keys)
+
+Public HTTP lookups against `https://auth.sigmaidentity.com`. Use these when a Sigma login shows the wrong faucet, a profile 404s, or last-selected identity looks stuck.
+
+```bash
+bunx @sigma-auth/cli diagnose bap --bap-id 3QpdyNb9HScYmWEyfqtRQbKzwyf --json
+bunx @sigma-auth/cli diagnose bap --bap-id 33mGVYzkGE9XMbu346XkUaMHyzwV --pubkey 03a42932… --json
+bunx @sigma-auth/cli diagnose identities --pubkey 03a42932… --json
+bunx @sigma-auth/cli diagnose last-oauth --pubkey 03a42932… --client-id droplit --json
+```
+
+`diagnose bap` treats a profile 404 as a successful diagnosis (`found: false`), not a command failure.
+
 Contract: `docs/specs/sigma-cli-v1.md` in [sigma-auth](https://github.com/b-open-io/sigma-auth).

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@sigma-auth/cli",
-	"version": "0.0.1",
-	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, push encrypted backups, register OAuth clients",
+	"version": "0.0.3",
+	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, diagnose public identities, push encrypted backups, register OAuth clients",
 	"type": "module",
 	"bin": {
 		"sigma": "./src/index.ts"

package/src/commands.ts

@@ -5,11 +5,12 @@ import { isLegacyBackup, isType42Backup } from "bitcoin-backup";
 import type { ParsedArgs } from "./args.ts";
 import { boolFlag, flag, flagList } from "./args.ts";
 import { backupPath, type RuntimeConfig } from "./config.ts";
-import { loadJar, sessionCookieNames } from "./cookies.ts";
-import { CliError, cryptoFail, usage } from "./error.ts";
+import { deleteJar, loadJar, sessionCookieNames } from "./cookies.ts";
+import { cryptoFail, usage } from "./error.ts";
 import { ensureDir, pathExists, readText, writeSecretFile } from "./fsutil.ts";
 import { createHttp, requestJson, throwHttp } from "./http.ts";
 import {
+	assertBitcoinBackupCiphertext,
 	bapFromBackup,
 	createMasterBackup,
 	decryptMaster,
@@ -76,7 +77,7 @@ export async function identityCreate(
 			positional: args.positional,
 			flags: { ...args.flags, backup: [out] },
 		};
-		const code = await authSignIn(signinArgs, cfg, false);
+		const code = await authSignIn(signinArgs, cfg, false, password);
 		if (code !== 0) {
 			return code;
 		}
@@ -157,9 +158,10 @@ export async function backupEncrypt(
 export async function authSignIn(
 	args: ParsedArgs,
 	cfg: RuntimeConfig,
-	emit = true
+	emit = true,
+	resolvedPassword?: string
 ): Promise<number> {
-	const password = await resolvePassword(args, true);
+	const password = resolvedPassword ?? (await resolvePassword(args, true));
 	if (!password) {
 		usage("password required");
 	}
@@ -183,7 +185,13 @@ export async function authSignIn(
 		saveCookies: true,
 	});
 	if (signed.status >= 400) {
-		throwHttp("/api/auth/sign-in/sigma", signed.status, signed.json, signed.text);
+		throwHttp(
+			"/api/auth/sign-in/sigma",
+			signed.status,
+			signed.json,
+			signed.text,
+			signed.headers
+		);
 	}
 	const payload = signed.json as {
 		user?: { id?: string; pubkey?: string };
@@ -204,7 +212,14 @@ export async function authSignIn(
 		await requestJson(client, "POST", "/api/auth/sign-out", {
 			withCookies: true,
 		});
-		throwHttp("/api/user/bap-ids", registered.status, registered.json, registered.text);
+		deleteJar(client.cookieJar);
+		throwHttp(
+			"/api/user/bap-ids",
+			registered.status,
+			registered.json,
+			registered.text,
+			registered.headers
+		);
 	}
 	if (!emit) {
 		return 0;
@@ -228,20 +243,14 @@ export async function backupPush(
 ): Promise<number> {
 	const path = backupPath(args, cfg.home);
 	const ciphertext = readText(path).replace(/\n+$/, "");
-	if (looksLikePlaintextBackup(ciphertext)) {
-		throw new CliError(
-			7,
-			"crypto",
-			"refusing to upload plaintext backup (rootPk/xprv/wif/mnemonic present)"
-		);
-	}
+	assertBitcoinBackupCiphertext(ciphertext);
 	const client = createHttp(cfg);
 	const result = await requestJson(client, "POST", "/api/backup", {
 		body: { encryptedBackup: ciphertext },
 		withCookies: true,
 	});
 	if (result.status >= 400) {
-		throwHttp("/api/backup", result.status, result.json, result.text);
+		throwHttp("/api/backup", result.status, result.json, result.text, result.headers);
 	}
 	const payload = result.json as { bapId?: string; message?: string };
 	if (!emit) {
@@ -285,7 +294,13 @@ export async function oauthRegister(
 			withCookies: true,
 		});
 		if (result.status >= 400) {
-			throwHttp("/api/oauth-clients", result.status, result.json, result.text);
+			throwHttp(
+				"/api/oauth-clients",
+				result.status,
+				result.json,
+				result.text,
+				result.headers
+			);
 		}
 		const payload = result.json as {
 			client?: { clientId?: string; accountPubkey?: string; ownerBapId?: string };
@@ -327,7 +342,8 @@ export async function oauthRegister(
 			"/api/auth/oauth2/register",
 			result.status,
 			result.json,
-			result.text
+			result.text,
+			result.headers
 		);
 	}
 	const payload = result.json as {
@@ -577,6 +593,10 @@ Commands:
   backup push        POST ciphertext with session; never decrypt
   oauth register     Register an OAuth client (session path or DCR)
   doctor             Non-interactive health check
+  diagnose bap       Public BAP profile (+ --pubkey registered-list check)
+  diagnose identities  GET /api/user/bap-ids [--pubkey]
+  diagnose last-oauth  Last selected BAP for --pubkey --client-id
+  diagnose client    Public OAuth client metadata --client-id
 
 Global flags:
   --base-url <url>   SIGMA_AUTH_URL (default https://auth.sigmaidentity.com)

package/src/cookies.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { ensureDir } from "./fsutil.ts";
 
@@ -83,6 +83,12 @@ export function loadJar(path: string): Cookie[] {
 	return cookies;
 }
 
+export function deleteJar(path: string): void {
+	if (existsSync(path)) {
+		unlinkSync(path);
+	}
+}
+
 export function saveJar(path: string, cookies: Cookie[]): void {
 	ensureDir(dirname(path));
 	const lines = [

package/src/diagnose.ts

@@ -0,0 +1,191 @@
+import type { ParsedArgs } from "./args.ts";
+import { flag } from "./args.ts";
+import type { RuntimeConfig } from "./config.ts";
+import { usage } from "./error.ts";
+import { createHttp, requestJson, throwHttp } from "./http.ts";
+import { printHuman, printJson, type OutputMode } from "./output.ts";
+
+function mode(cfg: RuntimeConfig): OutputMode {
+	return { json: cfg.json, quiet: cfg.quiet };
+}
+
+function succeed(cfg: RuntimeConfig, data: Record<string, unknown>, human: string): number {
+	if (cfg.json) {
+		printJson(true, data);
+	} else {
+		printHuman(mode(cfg), human);
+	}
+	return 0;
+}
+
+function record(json: unknown): Record<string, unknown> {
+	return json && typeof json === "object" ? (json as Record<string, unknown>) : {};
+}
+
+export async function diagnoseBap(args: ParsedArgs, cfg: RuntimeConfig): Promise<number> {
+	const bapId = flag(args, "bap-id");
+	if (!bapId) {
+		usage("--bap-id is required");
+	}
+	const pubkey = flag(args, "pubkey");
+	const client = createHttp(cfg);
+	const profileRes = await requestJson(
+		client,
+		"GET",
+		`/api/bap/profile?bapId=${encodeURIComponent(bapId)}`
+	);
+	if (profileRes.status >= 500) {
+		throwHttp(
+			"/api/bap/profile",
+			profileRes.status,
+			profileRes.json,
+			profileRes.text,
+			profileRes.headers
+		);
+	}
+	const found = profileRes.status === 200 && record(profileRes.json).status === "OK";
+	const profile = found ? record(profileRes.json).result ?? record(profileRes.json) : null;
+
+	let registeredToPubkey: boolean | null = null;
+	let identities: unknown[] | undefined;
+	if (pubkey) {
+		const listRes = await requestJson(
+			client,
+			"GET",
+			`/api/user/bap-ids?pubkey=${encodeURIComponent(pubkey)}`
+		);
+		if (listRes.status >= 400) {
+			throwHttp(
+				"/api/user/bap-ids",
+				listRes.status,
+				listRes.json,
+				listRes.text,
+				listRes.headers
+			);
+		}
+		const bapIds = record(listRes.json).bapIds;
+		identities = Array.isArray(bapIds) ? bapIds : [];
+		registeredToPubkey = identities.some((row) => {
+			const item = record(row);
+			return item.identity_key === bapId || item.id === bapId || item.bapId === bapId;
+		});
+	}
+
+	let hint: string;
+	if (registeredToPubkey === true && found) {
+		hint = "registered to this pubkey and has a published profile";
+	} else if (registeredToPubkey === true && !found) {
+		hint = "registered to this pubkey but no published BAP profile";
+	} else if (registeredToPubkey === false && found) {
+		hint = "published profile exists but this BAP is not in this pubkey's registered list";
+	} else if (registeredToPubkey === false && !found) {
+		hint = "not in this pubkey's registered list and no published BAP profile (typical leftover HD identity)";
+	} else if (found) {
+		hint = "published BAP profile found";
+	} else {
+		hint = "no published BAP profile (404). Pass --pubkey to also check GET /api/user/bap-ids";
+	}
+
+	const data: Record<string, unknown> = {
+		bapId,
+		found,
+		profile,
+		hint,
+	};
+	if (pubkey) {
+		data.pubkey = pubkey;
+		data.registeredToPubkey = registeredToPubkey;
+		data.registeredCount = identities?.length ?? 0;
+	}
+
+	const lines = [
+		`bapId  ${bapId}`,
+		`found  ${found}`,
+		pubkey ? `registeredToPubkey  ${registeredToPubkey}` : null,
+		hint,
+	].filter((line): line is string => line !== null);
+	return succeed(cfg, data, lines.join("\n"));
+}
+
+export async function diagnoseIdentities(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const pubkey = flag(args, "pubkey");
+	const client = createHttp(cfg);
+	const path = pubkey
+		? `/api/user/bap-ids?pubkey=${encodeURIComponent(pubkey)}`
+		: "/api/user/bap-ids";
+	const result = await requestJson(client, "GET", path, {
+		withCookies: !pubkey,
+	});
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const bapIds = record(result.json).bapIds;
+	const list = Array.isArray(bapIds) ? bapIds : [];
+	const names = list
+		.map((row) => {
+			const item = record(row);
+			const id = String(item.identity_key ?? item.id ?? "");
+			const name = typeof item.name === "string" ? item.name : "";
+			const primary = item.is_primary === true ? " (primary)" : "";
+			return `${id}${name ? `  ${name}` : ""}${primary}`;
+		})
+		.join("\n");
+	return succeed(
+		cfg,
+		{ pubkey: pubkey ?? null, count: list.length, bapIds: list },
+		names || "(none)"
+	);
+}
+
+export async function diagnoseLastOauth(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const pubkey = flag(args, "pubkey");
+	const clientId = flag(args, "client-id");
+	if (!pubkey || !clientId) {
+		usage("--pubkey and --client-id are required");
+	}
+	const client = createHttp(cfg);
+	const path = `/api/user/last-oauth-identity?pubkey=${encodeURIComponent(pubkey)}&clientId=${encodeURIComponent(clientId)}`;
+	const result = await requestJson(client, "GET", path);
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const lastSelectedBapId = record(result.json).lastSelectedBapId ?? null;
+	return succeed(
+		cfg,
+		{ pubkey, clientId, lastSelectedBapId },
+		typeof lastSelectedBapId === "string" ? lastSelectedBapId : "(none)"
+	);
+}
+
+export async function diagnoseClient(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const clientId = flag(args, "client-id");
+	if (!clientId) {
+		usage("--client-id is required");
+	}
+	const client = createHttp(cfg);
+	const path = `/api/oauth-clients?clientId=${encodeURIComponent(clientId)}`;
+	const result = await requestJson(client, "GET", path);
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const payload = record(result.json);
+	const clients = Array.isArray(payload.clients) ? payload.clients : [];
+	const first = clients[0] ? record(clients[0]) : payload;
+	if (!first.clientId && !first.name) {
+		return succeed(cfg, { clientId, client: null }, "(not found)");
+	}
+	return succeed(
+		cfg,
+		{ clientId, client: first },
+		`${String(first.clientId ?? clientId)}  ${String(first.name ?? "")}`
+	);
+}

package/src/http.ts

@@ -78,13 +78,23 @@ export async function requestJson(
 	return { status: response.status, headers: response.headers, json, text };
 }
 
-export function throwHttp(path: string, status: number, json: unknown, text: string): never {
+export function throwHttp(
+	path: string,
+	status: number,
+	json: unknown,
+	text: string,
+	headers?: Headers
+): never {
 	const record = json && typeof json === "object" ? (json as Record<string, unknown>) : {};
-	const message =
+	let message =
 		(typeof record.error_description === "string" && record.error_description) ||
 		(typeof record.message === "string" && record.message) ||
 		(typeof record.error === "string" && record.error) ||
 		text ||
 		`${path} failed with ${status}`;
+	const retryAfter = headers?.get("retry-after");
+	if (retryAfter) {
+		message = `${message} (Retry-After: ${retryAfter})`;
+	}
 	throw new CliError(exitForHttp(status), codeForHttp(status), message, status);
 }

package/src/identity.ts

@@ -1,4 +1,4 @@
-import { HD, Mnemonic, PrivateKey } from "@bsv/sdk";
+import { HD, Mnemonic, PrivateKey, Utils } from "@bsv/sdk";
 import {
 	type BapMasterBackup,
 	decryptBackup,
@@ -9,6 +9,12 @@ import {
 import { BAP } from "bsv-bap";
 import { cryptoFail } from "./error.ts";
 
+/** bitcoin-backup encryptData: salt(16) || iv(12) || AES-GCM ciphertext (16-byte tag). */
+const SALT_LENGTH_BYTES = 16;
+const IV_LENGTH_BYTES = 12;
+const AES_GCM_TAG_BYTES = 16;
+const MIN_ENVELOPE_BYTES = SALT_LENGTH_BYTES + IV_LENGTH_BYTES + AES_GCM_TAG_BYTES;
+
 export type PublicIdentity = {
 	bapId: string;
 	pubkey: string;
@@ -153,3 +159,89 @@ export function looksLikePlaintextBackup(text: string): boolean {
 		return false;
 	}
 }
+
+function looksLikeWif(text: string): boolean {
+	return /^[5KL][1-9A-HJ-NP-Za-km-z]{50,51}$/.test(text);
+}
+
+function looksLikeExtendedKey(text: string): boolean {
+	return /^(xprv|tprv|yprv|zprv|Yprv|Zprv)/.test(text);
+}
+
+function looksLikeMnemonic(text: string): boolean {
+	const words: string[] = [];
+	let current = "";
+	for (const ch of text) {
+		if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
+			if (current.length > 0) {
+				words.push(current);
+				current = "";
+			}
+		} else {
+			current += ch;
+		}
+	}
+	if (current.length > 0) {
+		words.push(current);
+	}
+	const wordCount = words.length;
+	if (
+		wordCount !== 12 &&
+		wordCount !== 15 &&
+		wordCount !== 18 &&
+		wordCount !== 21 &&
+		wordCount !== 24
+	) {
+		return false;
+	}
+	return words.every((word) => /^[a-z]+$/i.test(word));
+}
+
+function looksLikeJsonObject(text: string): boolean {
+	try {
+		const parsed = JSON.parse(text) as unknown;
+		return parsed !== null && typeof parsed === "object";
+	} catch {
+		return false;
+	}
+}
+
+export function isBitcoinBackupCiphertext(text: string): boolean {
+	if (text.length === 0) {
+		return false;
+	}
+	if (
+		looksLikePlaintextBackup(text) ||
+		looksLikeJsonObject(text) ||
+		looksLikeWif(text) ||
+		looksLikeExtendedKey(text) ||
+		looksLikeMnemonic(text)
+	) {
+		return false;
+	}
+	try {
+		const bytes = Utils.toArray(text, "base64");
+		if (bytes.length < MIN_ENVELOPE_BYTES) {
+			return false;
+		}
+		return Utils.toBase64(bytes) === text;
+	} catch {
+		return false;
+	}
+}
+
+export function assertBitcoinBackupCiphertext(text: string): void {
+	if (
+		looksLikePlaintextBackup(text) ||
+		looksLikeWif(text) ||
+		looksLikeExtendedKey(text) ||
+		looksLikeMnemonic(text)
+	) {
+		cryptoFail(
+			"refusing to upload plaintext backup (rootPk/xprv/wif/mnemonic present)"
+		);
+	}
+	if (!isBitcoinBackupCiphertext(text)) {
+		cryptoFail("refusing to upload: not opaque bitcoin-backup ciphertext");
+	}
+}

package/src/index.ts

@@ -11,6 +11,12 @@ import {
 	identityInfo,
 	oauthRegister,
 } from "./commands.ts";
+import {
+	diagnoseBap,
+	diagnoseClient,
+	diagnoseIdentities,
+	diagnoseLastOauth,
+} from "./diagnose.ts";
 import { loadConfig } from "./config.ts";
 import { usage } from "./error.ts";
 import { reportError } from "./output.ts";
@@ -47,6 +53,18 @@ export async function run(argv: string[]): Promise<number> {
 		if (group === "doctor") {
 			return await doctor(args, cfg);
 		}
+		if (group === "diagnose" && command === "bap") {
+			return await diagnoseBap(args, cfg);
+		}
+		if (group === "diagnose" && command === "identities") {
+			return await diagnoseIdentities(args, cfg);
+		}
+		if (group === "diagnose" && command === "last-oauth") {
+			return await diagnoseLastOauth(args, cfg);
+		}
+		if (group === "diagnose" && command === "client") {
+			return await diagnoseClient(args, cfg);
+		}
 		if (!group) {
 			process.stdout.write(HELP);
 			return 0;

package/src/output.ts

@@ -10,7 +10,14 @@ export function printJson(ok: boolean, data: unknown, error?: unknown): void {
 		process.stdout.write(`${JSON.stringify({ ok: true, data })}\n`);
 		return;
 	}
-	process.stdout.write(`${JSON.stringify({ ok: false, error })}\n`);
+	const body: Record<string, unknown> = { ok: false };
+	if (error !== undefined) {
+		body.error = error;
+	}
+	if (data !== undefined) {
+		body.data = data;
+	}
+	process.stdout.write(`${JSON.stringify(body)}\n`);
 }
 
 export function printHuman(mode: OutputMode, text: string): void {

package/src/password.ts

@@ -4,6 +4,15 @@ import { boolFlag, flag } from "./args.ts";
 import { MIN_PASSWORD_LENGTH } from "./config.ts";
 import { cryptoFail, usage } from "./error.ts";
 
+function isAllWhitespace(value: string): boolean {
+	for (const ch of value) {
+		if (!/\s/.test(ch)) {
+			return false;
+		}
+	}
+	return true;
+}
+
 function envPassword(): string | undefined {
 	if (!("SIGMA_BACKUP_PASSWORD" in process.env)) {
 		return undefined;
@@ -12,6 +21,9 @@ function envPassword(): string | undefined {
 	if (value === undefined || value === "") {
 		usage("SIGMA_BACKUP_PASSWORD is set but empty");
 	}
+	if (isAllWhitespace(value)) {
+		usage("SIGMA_BACKUP_PASSWORD is whitespace-only");
+	}
 	return value;
 }