@sigma-auth/cli 0.0.2 → 0.0.3

package/README.md

@@ -33,7 +33,24 @@ bunx @sigma-auth/cli identity create \
 | `sigma backup push` | POST ciphertext only |
 | `sigma oauth register` | Session `/api/oauth-clients` or RFC 7591 DCR |
 | `sigma doctor` | Env, files, RFC 8414, session |
+| `sigma diagnose bap` | Public BAP profile; optional `--pubkey` registered-list check |
+| `sigma diagnose identities` | `GET /api/user/bap-ids` (`--pubkey` or session cookie) |
+| `sigma diagnose last-oauth` | Last selected BAP for `--pubkey` `--client-id` |
+| `sigma diagnose client` | Public OAuth client metadata |
 
 Password sources (exactly one): `--password-file`, `--password-stdin`, or `SIGMA_BACKUP_PASSWORD`. `--password` on argv is rejected.
 
+## Diagnose (no private keys)
+
+Public HTTP lookups against `https://auth.sigmaidentity.com`. Use these when a Sigma login shows the wrong faucet, a profile 404s, or last-selected identity looks stuck.
+
+```bash
+bunx @sigma-auth/cli diagnose bap --bap-id 3QpdyNb9HScYmWEyfqtRQbKzwyf --json
+bunx @sigma-auth/cli diagnose bap --bap-id 33mGVYzkGE9XMbu346XkUaMHyzwV --pubkey 03a42932… --json
+bunx @sigma-auth/cli diagnose identities --pubkey 03a42932… --json
+bunx @sigma-auth/cli diagnose last-oauth --pubkey 03a42932… --client-id droplit --json
+```
+
+`diagnose bap` treats a profile 404 as a successful diagnosis (`found: false`), not a command failure.
+
 Contract: `docs/specs/sigma-cli-v1.md` in [sigma-auth](https://github.com/b-open-io/sigma-auth).

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@sigma-auth/cli",
-	"version": "0.0.2",
-	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, push encrypted backups, register OAuth clients",
+	"version": "0.0.3",
+	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, diagnose public identities, push encrypted backups, register OAuth clients",
 	"type": "module",
 	"bin": {
 		"sigma": "./src/index.ts"

package/src/commands.ts

@@ -593,6 +593,10 @@ Commands:
   backup push        POST ciphertext with session; never decrypt
   oauth register     Register an OAuth client (session path or DCR)
   doctor             Non-interactive health check
+  diagnose bap       Public BAP profile (+ --pubkey registered-list check)
+  diagnose identities  GET /api/user/bap-ids [--pubkey]
+  diagnose last-oauth  Last selected BAP for --pubkey --client-id
+  diagnose client    Public OAuth client metadata --client-id
 
 Global flags:
   --base-url <url>   SIGMA_AUTH_URL (default https://auth.sigmaidentity.com)

package/src/diagnose.ts

@@ -0,0 +1,191 @@
+import type { ParsedArgs } from "./args.ts";
+import { flag } from "./args.ts";
+import type { RuntimeConfig } from "./config.ts";
+import { usage } from "./error.ts";
+import { createHttp, requestJson, throwHttp } from "./http.ts";
+import { printHuman, printJson, type OutputMode } from "./output.ts";
+
+function mode(cfg: RuntimeConfig): OutputMode {
+	return { json: cfg.json, quiet: cfg.quiet };
+}
+
+function succeed(cfg: RuntimeConfig, data: Record<string, unknown>, human: string): number {
+	if (cfg.json) {
+		printJson(true, data);
+	} else {
+		printHuman(mode(cfg), human);
+	}
+	return 0;
+}
+
+function record(json: unknown): Record<string, unknown> {
+	return json && typeof json === "object" ? (json as Record<string, unknown>) : {};
+}
+
+export async function diagnoseBap(args: ParsedArgs, cfg: RuntimeConfig): Promise<number> {
+	const bapId = flag(args, "bap-id");
+	if (!bapId) {
+		usage("--bap-id is required");
+	}
+	const pubkey = flag(args, "pubkey");
+	const client = createHttp(cfg);
+	const profileRes = await requestJson(
+		client,
+		"GET",
+		`/api/bap/profile?bapId=${encodeURIComponent(bapId)}`
+	);
+	if (profileRes.status >= 500) {
+		throwHttp(
+			"/api/bap/profile",
+			profileRes.status,
+			profileRes.json,
+			profileRes.text,
+			profileRes.headers
+		);
+	}
+	const found = profileRes.status === 200 && record(profileRes.json).status === "OK";
+	const profile = found ? record(profileRes.json).result ?? record(profileRes.json) : null;
+
+	let registeredToPubkey: boolean | null = null;
+	let identities: unknown[] | undefined;
+	if (pubkey) {
+		const listRes = await requestJson(
+			client,
+			"GET",
+			`/api/user/bap-ids?pubkey=${encodeURIComponent(pubkey)}`
+		);
+		if (listRes.status >= 400) {
+			throwHttp(
+				"/api/user/bap-ids",
+				listRes.status,
+				listRes.json,
+				listRes.text,
+				listRes.headers
+			);
+		}
+		const bapIds = record(listRes.json).bapIds;
+		identities = Array.isArray(bapIds) ? bapIds : [];
+		registeredToPubkey = identities.some((row) => {
+			const item = record(row);
+			return item.identity_key === bapId || item.id === bapId || item.bapId === bapId;
+		});
+	}
+
+	let hint: string;
+	if (registeredToPubkey === true && found) {
+		hint = "registered to this pubkey and has a published profile";
+	} else if (registeredToPubkey === true && !found) {
+		hint = "registered to this pubkey but no published BAP profile";
+	} else if (registeredToPubkey === false && found) {
+		hint = "published profile exists but this BAP is not in this pubkey's registered list";
+	} else if (registeredToPubkey === false && !found) {
+		hint = "not in this pubkey's registered list and no published BAP profile (typical leftover HD identity)";
+	} else if (found) {
+		hint = "published BAP profile found";
+	} else {
+		hint = "no published BAP profile (404). Pass --pubkey to also check GET /api/user/bap-ids";
+	}
+
+	const data: Record<string, unknown> = {
+		bapId,
+		found,
+		profile,
+		hint,
+	};
+	if (pubkey) {
+		data.pubkey = pubkey;
+		data.registeredToPubkey = registeredToPubkey;
+		data.registeredCount = identities?.length ?? 0;
+	}
+
+	const lines = [
+		`bapId  ${bapId}`,
+		`found  ${found}`,
+		pubkey ? `registeredToPubkey  ${registeredToPubkey}` : null,
+		hint,
+	].filter((line): line is string => line !== null);
+	return succeed(cfg, data, lines.join("\n"));
+}
+
+export async function diagnoseIdentities(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const pubkey = flag(args, "pubkey");
+	const client = createHttp(cfg);
+	const path = pubkey
+		? `/api/user/bap-ids?pubkey=${encodeURIComponent(pubkey)}`
+		: "/api/user/bap-ids";
+	const result = await requestJson(client, "GET", path, {
+		withCookies: !pubkey,
+	});
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const bapIds = record(result.json).bapIds;
+	const list = Array.isArray(bapIds) ? bapIds : [];
+	const names = list
+		.map((row) => {
+			const item = record(row);
+			const id = String(item.identity_key ?? item.id ?? "");
+			const name = typeof item.name === "string" ? item.name : "";
+			const primary = item.is_primary === true ? " (primary)" : "";
+			return `${id}${name ? `  ${name}` : ""}${primary}`;
+		})
+		.join("\n");
+	return succeed(
+		cfg,
+		{ pubkey: pubkey ?? null, count: list.length, bapIds: list },
+		names || "(none)"
+	);
+}
+
+export async function diagnoseLastOauth(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const pubkey = flag(args, "pubkey");
+	const clientId = flag(args, "client-id");
+	if (!pubkey || !clientId) {
+		usage("--pubkey and --client-id are required");
+	}
+	const client = createHttp(cfg);
+	const path = `/api/user/last-oauth-identity?pubkey=${encodeURIComponent(pubkey)}&clientId=${encodeURIComponent(clientId)}`;
+	const result = await requestJson(client, "GET", path);
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const lastSelectedBapId = record(result.json).lastSelectedBapId ?? null;
+	return succeed(
+		cfg,
+		{ pubkey, clientId, lastSelectedBapId },
+		typeof lastSelectedBapId === "string" ? lastSelectedBapId : "(none)"
+	);
+}
+
+export async function diagnoseClient(
+	args: ParsedArgs,
+	cfg: RuntimeConfig
+): Promise<number> {
+	const clientId = flag(args, "client-id");
+	if (!clientId) {
+		usage("--client-id is required");
+	}
+	const client = createHttp(cfg);
+	const path = `/api/oauth-clients?clientId=${encodeURIComponent(clientId)}`;
+	const result = await requestJson(client, "GET", path);
+	if (result.status >= 400) {
+		throwHttp(path, result.status, result.json, result.text, result.headers);
+	}
+	const payload = record(result.json);
+	const clients = Array.isArray(payload.clients) ? payload.clients : [];
+	const first = clients[0] ? record(clients[0]) : payload;
+	if (!first.clientId && !first.name) {
+		return succeed(cfg, { clientId, client: null }, "(not found)");
+	}
+	return succeed(
+		cfg,
+		{ clientId, client: first },
+		`${String(first.clientId ?? clientId)}  ${String(first.name ?? "")}`
+	);
+}

package/src/index.ts

@@ -11,6 +11,12 @@ import {
 	identityInfo,
 	oauthRegister,
 } from "./commands.ts";
+import {
+	diagnoseBap,
+	diagnoseClient,
+	diagnoseIdentities,
+	diagnoseLastOauth,
+} from "./diagnose.ts";
 import { loadConfig } from "./config.ts";
 import { usage } from "./error.ts";
 import { reportError } from "./output.ts";
@@ -47,6 +53,18 @@ export async function run(argv: string[]): Promise<number> {
 		if (group === "doctor") {
 			return await doctor(args, cfg);
 		}
+		if (group === "diagnose" && command === "bap") {
+			return await diagnoseBap(args, cfg);
+		}
+		if (group === "diagnose" && command === "identities") {
+			return await diagnoseIdentities(args, cfg);
+		}
+		if (group === "diagnose" && command === "last-oauth") {
+			return await diagnoseLastOauth(args, cfg);
+		}
+		if (group === "diagnose" && command === "client") {
+			return await diagnoseClient(args, cfg);
+		}
 		if (!group) {
 			process.stdout.write(HELP);
 			return 0;