@tinycloud/cli 0.7.0-beta.7 → 0.7.0-beta.9

package/dist/index.js

@@ -816,12 +816,19 @@ function buildAuthUrl(did, options = {}) {
   if (options.host) {
     params.set("host", options.host);
   }
+  const reason = typeof options.reason === "string" ? options.reason.trim() : "";
   if (options.permissions?.length) {
     params.set(
       "permissions",
-      Buffer.from(JSON.stringify({ permissions: options.permissions })).toString("base64url")
+      Buffer.from(JSON.stringify({
+        permissions: options.permissions,
+        ...reason ? { reason } : {}
+      })).toString("base64url")
     );
   }
+  if (reason) {
+    params.set("reason", reason);
+  }
   if (options.expiry !== void 0) {
     params.set("expiry", String(options.expiry));
   }
@@ -912,8 +919,8 @@ async function callbackFlow(did, options = {}) {
       }
       if (openBrowser) {
         try {
-          const open = (await import("open")).default;
-          await open(authUrl);
+          const open2 = (await import("open")).default;
+          await open2(authUrl);
         } catch {
           server.close();
           throw new Error("Failed to open browser");
@@ -11391,6 +11398,10 @@ function registerAuthCommand(program2) {
             jwk: key,
             host: ctx.host,
             permissions: group,
+            reason: permissionGrantReason(
+              "Grant requested TinyCloud permissions from `tc auth request --grant`.",
+              group
+            ),
             openkeyHost,
             expiry: expiryOption,
             noPopup: options.popup === false
@@ -11535,6 +11546,7 @@ function registerAuthCommand(program2) {
         node,
         requested: parsed.requested,
         expiryOption: parsed.requestedExpiry,
+        reason: "Grant permissions requested by a TinyCloud auth request artifact.",
         yes: options.yes === true
       });
       const grant = await grantAuthRequest(node, parsed);
@@ -11818,6 +11830,7 @@ async function ensureDelegationAuthority(params) {
         jwk: key,
         host: params.ctx.host,
         permissions: group,
+        reason: permissionGrantReason(params.reason, group),
         openkeyHost,
         expiry: params.expiryOption
       });
@@ -11865,6 +11878,12 @@ async function ensureDelegationAuthority(params) {
     });
   }
 }
+function permissionGrantReason(context, permissions) {
+  const first = permissions[0];
+  const summary = first ? compactPermission(first) : "no permissions";
+  const more = permissions.length > 1 ? ` and ${permissions.length - 1} more permission${permissions.length === 2 ? "" : "s"}` : "";
+  return `${context} Requested: ${summary}${more}.`;
+}
 function execCapturedCommand(command) {
   return new Promise((resolve3, reject) => {
     const child = spawn(process.execPath, [process.argv[1], ...command.argv], {
@@ -13541,12 +13560,17 @@ async function runSecretOperation(params) {
       node: params.node,
       requested,
       expiryOption: void 0,
+      reason: secretPermissionReason(params.action, params.name),
       yes: true,
       force: true
     })
   );
   return runSecretOperationAttempt(params.label, params.operation);
 }
+function secretPermissionReason(action, name) {
+  const target = name ? ` secret "${name}"` : " secrets";
+  return `Allow \`tc secrets ${action}${name ? ` ${name}` : ""}\` to access${target} with the required TinyCloud permissions.`;
+}
 async function runSecretOperationAttempt(label, operation) {
   try {
     return await withSpinner(label, operation);
@@ -14257,8 +14281,8 @@ function registerSecretsCommand(program2) {
   });
   secrets.command("manage").description("Open the TinyCloud Secrets Manager in your browser").action(async () => {
     try {
-      const open = (await import("open")).default;
-      await open("https://secrets.tinycloud.xyz");
+      const open2 = (await import("open")).default;
+      await open2("https://secrets.tinycloud.xyz");
       outputJson({ opened: "https://secrets.tinycloud.xyz" });
     } catch (error) {
       handleError(error);
@@ -15474,6 +15498,310 @@ function plural(count, label) {
   return `${count} ${label}${count === 1 ? "" : "s"}`;
 }
 
+// src/commands/account.ts
+import open from "open";
+import { readFile as readFile10 } from "fs/promises";
+var ACCOUNT_BILLING_URL = "https://account.tinycloud.xyz/billing";
+function registerAccountCommand(program2) {
+  const account = program2.command("account").description("Account applications, spaces, delegations, and billing");
+  account.command("status").description("Show account status").action(async (_options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const status = await node.account.status();
+      assertOk(status);
+      outputJson(status.data);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  const apps = account.command("apps").description("Manage account application registry");
+  apps.command("list").description("List applications registered under account/applications").option("--live", "Read canonical account KV records instead of the SQLite index").action(async (_options, cmd) => {
+    try {
+      const options = _options;
+      const node = await authenticatedNode(cmd);
+      const result = options.live ? await node.account.applications.list() : await node.account.index.applications.list();
+      assertOk(result);
+      const payload = { applications: result.data, count: result.data.length };
+      if (shouldOutputJson()) {
+        outputJson(payload);
+        return;
+      }
+      if (result.data.length === 0) {
+        process.stdout.write(theme.muted("No account applications registered.") + "\n");
+        return;
+      }
+      process.stdout.write(
+        formatTable(
+          ["App ID", "Name", "Manifests", "Updated"],
+          result.data.map((app) => [
+            app.appId,
+            app.name ?? "\u2014",
+            String(app.manifests.length),
+            app.updatedAt ?? "\u2014"
+          ])
+        ) + "\n"
+      );
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  const spaces = account.command("spaces").description("Manage account space registry");
+  spaces.command("list").description("List spaces registered under account/spaces").option("--live", "Read canonical account KV records instead of the SQLite index").action(async (options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = options.live ? await node.account.spaces.list() : await node.account.index.spaces.list();
+      assertOk(result);
+      const payload = { spaces: result.data.map(formatSpace), count: result.data.length };
+      if (shouldOutputJson()) {
+        outputJson(payload);
+        return;
+      }
+      if (result.data.length === 0) {
+        process.stdout.write(theme.muted("No account spaces registered.") + "\n");
+        return;
+      }
+      process.stdout.write(
+        formatTable(
+          ["Space", "Type", "Owner", "Status", "Updated"],
+          result.data.map((space) => [
+            space.name,
+            space.type,
+            space.ownerDid,
+            space.status,
+            space.updatedAt ?? "\u2014"
+          ])
+        ) + "\n"
+      );
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  spaces.command("info <space-id>").description("Show a registered account space").action(async (spaceId, _options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.spaces.get(spaceId);
+      assertOk(result);
+      outputJson(formatSpace(result.data));
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  spaces.command("register <space-id>").description("Register a space in account/spaces").requiredOption("--name <name>", "Display name for the space").requiredOption("--owner <did>", "Owner DID for the space").option("--type <type>", "Space type: owned, delegated, or discovered", "discovered").option("--permission <permission...>", "Permission strings for the space").action(async (spaceId, options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.spaces.register({
+        spaceId,
+        name: options.name,
+        ownerDid: options.owner,
+        type: options.type,
+        permissions: options.permission ?? [],
+        status: "active"
+      });
+      assertOk(result);
+      outputJson({ space: formatSpace(result.data), registered: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  spaces.command("sync").description("Register currently accessible spaces into account/spaces").action(async (_options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.spaces.syncAccessible();
+      assertOk(result);
+      outputJson({ spaces: result.data.map(formatSpace), count: result.data.length, synced: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  spaces.command("remove <space-id>").alias("delete").description("Remove a space registry entry").action(async (spaceId, _options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.spaces.remove(spaceId);
+      assertOk(result);
+      outputJson({ spaceId, removed: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  apps.command("info <app-id>").description("Show a registered account application").action(async (appId, _options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.applications.get(appId);
+      assertOk(result);
+      outputJson(result.data);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  apps.command("register <manifest>").description("Register an app manifest in account/applications").action(async (manifestSource, _options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const manifest = await loadManifestSource2(manifestSource);
+      const result = await node.account.applications.register(manifest);
+      assertOk(result);
+      outputJson({ application: result.data, registered: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  apps.command("remove <app-id>").alias("delete").description("Remove an application registry entry").action(async (appId, _options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.applications.remove(appId);
+      assertOk(result);
+      outputJson({ appId, removed: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  const delegations = account.command("delegations").description("View and revoke account delegations");
+  delegations.command("list").description("List delegations granted by or to this account").option("--granted", "Show only delegations granted by this account").option("--received", "Show only delegations granted to this account").option("--space <space>", "Filter by space name or ID").option("--live", "Read live delegation services instead of the SQLite index").action(async (options, cmd) => {
+    try {
+      if (options.granted && options.received) {
+        throw new CLIError("USAGE_ERROR", "Use only one of --granted or --received.", ExitCode.USAGE_ERROR);
+      }
+      const node = await authenticatedNode(cmd);
+      const direction = options.granted ? "granted" : options.received ? "received" : "all";
+      const result = options.live ? await node.account.delegations.list({ direction, space: options.space }) : await node.account.index.delegations.list({ direction, space: options.space });
+      assertOk(result);
+      const payload = { delegations: result.data.map(formatDelegation2), count: result.data.length };
+      if (shouldOutputJson()) {
+        outputJson(payload);
+        return;
+      }
+      if (result.data.length === 0) {
+        process.stdout.write(theme.muted("No delegations found.") + "\n");
+        return;
+      }
+      process.stdout.write(
+        formatTable(
+          ["CID", "Direction", "Space", "Counterparty", "Status", "Expiry"],
+          result.data.map((delegation) => [
+            delegation.cid,
+            delegation.direction,
+            delegation.spaceName ?? delegation.spaceId,
+            delegation.counterpartyDid,
+            delegation.status,
+            delegation.expiry.toISOString()
+          ])
+        ) + "\n"
+      );
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  delegations.command("revoke <cid>").description("Revoke an active delegation granted by this account").requiredOption("--space <space>", "Space name or ID containing the delegation").action(async (cid, options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.delegations.revoke({ cid, space: options.space });
+      assertOk(result);
+      outputJson({ cid, space: options.space, revoked: true });
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  const index = account.command("index").description("Manage the materialized account SQLite index");
+  index.command("status").description("Show account SQLite index sync status").action(async (_options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.index.status();
+      assertOk(result);
+      outputJson(result.data);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  index.command("rebuild").description("Rebuild account SQLite index from canonical account data").action(async (_options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const result = await node.account.index.rebuild();
+      assertOk(result);
+      outputJson(result.data);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  index.command("query <sql>").description("Query the materialized account SQLite index").option("--params <json>", "Bind parameters as a JSON array for ? placeholders").action(async (sql, options, cmd) => {
+    try {
+      const node = await authenticatedNode(cmd);
+      const params = parseParams(options.params);
+      const result = await node.account.index.query(sql, params);
+      assertOk(result);
+      outputJson(result.data);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  const billing = account.command("billing").description("Open account billing");
+  for (const name of ["status", "checkout", "portal"]) {
+    billing.command(name).description(`${name === "status" ? "Show" : "Open"} account billing page`).option("--open", "Open account.tinycloud.xyz in your browser").action(async (options) => {
+      try {
+        if (options.open) {
+          await open(ACCOUNT_BILLING_URL);
+        }
+        outputJson({ url: ACCOUNT_BILLING_URL, opened: Boolean(options.open) });
+      } catch (error) {
+        handleError(error);
+      }
+    });
+  }
+}
+async function authenticatedNode(cmd) {
+  const globalOpts = cmd.optsWithGlobals();
+  const ctx = await ProfileManager.resolveContext(globalOpts);
+  return ensureAuthenticated(ctx);
+}
+function assertOk(result) {
+  if (!result.ok) {
+    throw new CLIError(result.error.code, result.error.message, ExitCode.ERROR);
+  }
+}
+async function loadManifestSource2(source) {
+  const raw = /^https?:\/\//i.test(source) ? await fetchManifest(source) : await readFile10(source, "utf8");
+  return JSON.parse(raw);
+}
+async function fetchManifest(source) {
+  const response = await fetch(source);
+  if (!response.ok) {
+    throw new CLIError(
+      "MANIFEST_FETCH_FAILED",
+      `Failed to fetch manifest from ${source}: ${response.status} ${response.statusText}`,
+      ExitCode.NETWORK_ERROR
+    );
+  }
+  return response.text();
+}
+function parseParams(input) {
+  if (!input) return void 0;
+  const parsed = JSON.parse(input);
+  if (!Array.isArray(parsed)) {
+    throw new CLIError("INVALID_PARAMS", "--params must be a JSON array.", ExitCode.USAGE_ERROR);
+  }
+  return parsed;
+}
+function formatDelegation2(delegation) {
+  return {
+    cid: delegation.cid,
+    direction: delegation.direction,
+    spaceId: delegation.spaceId,
+    spaceName: delegation.spaceName,
+    counterpartyDid: delegation.counterpartyDid,
+    delegateDid: delegation.delegateDid,
+    delegatorDid: delegation.delegatorDid,
+    path: delegation.path,
+    actions: delegation.actions,
+    expiry: delegation.expiry.toISOString(),
+    status: delegation.status,
+    createdAt: delegation.createdAt?.toISOString()
+  };
+}
+function formatSpace(space) {
+  return {
+    ...space,
+    expiresAt: space.expiresAt?.toISOString()
+  };
+}
+
 // src/index.ts
 var { version } = JSON.parse(
   readFileSync3(new URL("../package.json", import.meta.url), "utf-8")
@@ -15524,6 +15852,7 @@ registerDuckdbCommand(program);
 registerManifestCommand(program);
 registerUpgradeCommand(program);
 registerStatusCommand(program);
+registerAccountCommand(program);
 program.addHelpText("before", () => `${theme.label("Version:")} ${theme.value(version)}
 `);
 program.addHelpText("afterAll", () => {
@@ -15535,6 +15864,7 @@ ${theme.heading("Examples:")}
   ${theme.command('tc kv put greeting "Hello"')}           ${theme.muted("Store a value")}
   ${theme.command("tc kv list")}                           ${theme.muted("List all keys")}
   ${theme.command("tc secrets network init")}              ${theme.muted("Create the default secrets network")}
+  ${theme.command("tc account apps list")}                 ${theme.muted("List registered account apps")}
   ${theme.command("tc delegation create --to did:pkh:...")}  ${theme.muted("Grant access to another user")}
   ${theme.command("tc space list")}                        ${theme.muted("Show your spaces")}