@tinycloud/cli 0.9.1-beta.4 → 0.9.1-beta.6

package/dist/legacy-entry.js

@@ -218,6 +218,13 @@ function formatTable(headers, rows) {
   );
   return [headerLine, separator, ...dataLines].join("\n");
 }
+function output(data, humanFormatter) {
+  if (shouldOutputJson() || !humanFormatter) {
+    outputJson(data);
+  } else {
+    process.stdout.write(humanFormatter() + "\n");
+  }
+}
 function formatCheck(ok2, label, detail) {
   const icon = ok2 === "warn" ? theme.warn("\u26A0") : ok2 ? theme.success("\u2713") : theme.error("\u2717");
   const detailStr = detail ? ` ${theme.muted(`(${detail})`)}` : "";
@@ -6225,7 +6232,7 @@ function eddsa(Point2, cHash, eddsaOpts = {}) {
   });
   const { prehash } = eddsaOpts;
   const { BASE, Fp: Fp2, Fn: Fn2 } = Point2;
-  const randomBytes5 = eddsaOpts.randomBytes || randomBytes;
+  const randomBytes6 = eddsaOpts.randomBytes || randomBytes;
   const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
   const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
     _abool2(phflag, "phflag");
@@ -6307,7 +6314,7 @@ function eddsa(Point2, cHash, eddsaOpts = {}) {
     signature: 2 * _size,
     seed: _size
   };
-  function randomSecretKey(seed = randomBytes5(lengths.seed)) {
+  function randomSecretKey(seed = randomBytes6(lengths.seed)) {
     return _abytes2(seed, lengths.seed, "seed");
   }
   function keygen(seed) {
@@ -8989,7 +8996,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k) => k in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash, randomBytes: randomBytes5 } = CURVE;
+    const { hash, randomBytes: randomBytes6 } = CURVE;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -9001,7 +9008,7 @@ function weierstrass(curveDef) {
     const d = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (ent != null && ent !== false) {
-      const e = ent === true ? randomBytes5(Fp2.BYTES) : ent;
+      const e = ent === true ? randomBytes6(Fp2.BYTES) : ent;
       seedArgs.push(ensureBytes2("extraEntropy", e));
     }
     const seed = concatBytes3(...seedArgs);
@@ -14663,7 +14670,7 @@ var init_dist2 = __esm({
       async handleErrorResponse(response, operation) {
         const errorText = await response.text();
         const errorBody = parseServiceErrorBody(errorText);
-        const errorCode = this.mapHttpStatusToErrorCode(
+        const errorCode2 = this.mapHttpStatusToErrorCode(
           response.status,
           errorBody.error
         );
@@ -14681,7 +14688,7 @@ var init_dist2 = __esm({
           if (resource) meta.resource = resource;
         }
         return err(
-          serviceError(errorCode, message, "sql", { meta })
+          serviceError(errorCode2, message, "sql", { meta })
         );
       }
       mapHttpStatusToErrorCode(status, serverError) {
@@ -15011,7 +15018,7 @@ var init_dist2 = __esm({
       async handleErrorResponse(response, operation) {
         const errorText = await response.text();
         const errorBody = parseServiceErrorBody(errorText);
-        const errorCode = this.mapHttpStatusToErrorCode(
+        const errorCode2 = this.mapHttpStatusToErrorCode(
           response.status,
           errorBody.error
         );
@@ -15029,7 +15036,7 @@ var init_dist2 = __esm({
           if (resource) meta.resource = resource;
         }
         return err(
-          serviceError(errorCode, message, "duckdb", { meta })
+          serviceError(errorCode2, message, "duckdb", { meta })
         );
       }
       mapHttpStatusToErrorCode(status, serverError) {
@@ -18210,19 +18217,19 @@ function hex(bytes3) {
 }
 function base32Lower(bytes3) {
   const alphabet2 = "abcdefghijklmnopqrstuvwxyz234567";
-  let output = "";
+  let output2 = "";
   let buffer = 0;
   let bits = 0;
   for (const byte of bytes3) {
     buffer = buffer << 8 | byte;
     bits += 8;
     while (bits >= 5) {
-      output += alphabet2[buffer >>> bits - 5 & 31];
+      output2 += alphabet2[buffer >>> bits - 5 & 31];
       bits -= 5;
     }
   }
-  if (bits > 0) output += alphabet2[buffer << 5 - bits & 31];
-  return output;
+  if (bits > 0) output2 += alphabet2[buffer << 5 - bits & 31];
+  return output2;
 }
 function assertCanonicalCid(cidString) {
   const cid2 = CID.parse(cidString);
@@ -25367,13 +25374,13 @@ function concat2(arrays, length22) {
   if (length22 == null) {
     length22 = arrays.reduce((acc, curr) => acc + curr.length, 0);
   }
-  const output = allocUnsafe(length22);
+  const output2 = allocUnsafe(length22);
   let offset = 0;
   for (const arr of arrays) {
-    output.set(arr, offset);
+    output2.set(arr, offset);
     offset += arr.length;
   }
-  return asUint8Array(output);
+  return asUint8Array(output2);
 }
 function createCodec(name2, prefix, encode52, decode72) {
   return {
@@ -30963,6 +30970,19 @@ Open this URL in a browser to authenticate:
   });
 }
 
+// src/auth/device-auth.ts
+init_constants();
+init_profiles();
+import {
+  createDecipheriv,
+  createHash,
+  createHmac,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  randomBytes as randomBytes3
+} from "crypto";
+
 // src/auth/local-key.ts
 import { TCWSessionManager, importKey, initPanicHook } from "@tinycloud/node-sdk-wasm";
 import { PrivateKeySigner } from "@tinycloud/node-sdk";
@@ -31033,6 +31053,251 @@ async function localKeySignIn(options) {
   };
 }
 
+// src/auth/device-auth.ts
+var SHARE_DEVICE_DELEGATION_SECONDS = 30 * 24 * 60 * 60;
+var SHARE_DEVICE_PERMISSIONS = [{
+  service: "tinycloud.capabilities",
+  space: "applications",
+  path: "",
+  actions: ["tinycloud.capabilities/read"]
+}];
+function digest2(value) {
+  return createHash("sha256").update(value).digest("base64url");
+}
+function canonicalOrigin(value, label) {
+  const url = new URL(value);
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost";
+  if (url.origin !== value || url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new Error(`${label} must be a canonical HTTPS origin`);
+  }
+  return value;
+}
+function jsonEqual(left, right) {
+  const canonical = (value) => Array.isArray(value) ? value.map(canonical) : value && typeof value === "object" ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, canonical(entry)])) : value;
+  return JSON.stringify(canonical(left)) === JSON.stringify(canonical(right));
+}
+function validateStart(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("OpenKey returned an invalid device authorization response");
+  const result = value;
+  if (typeof result.transactionId !== "string" || !/^[A-Za-z0-9_-]{20,}$/.test(result.transactionId) || typeof result.userCode !== "string" || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(result.userCode) || typeof result.verificationUri !== "string" || typeof result.verificationUriComplete !== "string" || !Number.isSafeInteger(result.expiresIn) || Number(result.expiresIn) < 60 || !Number.isSafeInteger(result.interval) || Number(result.interval) < 1) throw new Error("OpenKey returned an invalid device authorization response");
+  canonicalOrigin(new URL(result.verificationUri).origin, "verification URI");
+  if (new URL(result.verificationUriComplete).origin !== new URL(result.verificationUri).origin) {
+    throw new Error("OpenKey returned an invalid verification URI");
+  }
+  return result;
+}
+async function responseJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(`OpenKey device authorization failed (HTTP ${response.status})`);
+  }
+}
+function errorCode(value) {
+  return value && typeof value === "object" && typeof value.error === "string" ? value.error : void 0;
+}
+function publicSessionJwk(value) {
+  const publicJwk = publicJwkForDelegation(value);
+  const record = publicJwk;
+  if (record.kty !== "OKP" || record.crv !== "Ed25519" || typeof record.x !== "string") {
+    throw new Error("CLI session key is not a public Ed25519 JWK");
+  }
+  return publicJwk;
+}
+function publicRelayJwk(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("OpenKey returned an invalid relay key");
+  const jwk = value;
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.x !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(jwk.x) || typeof jwk.y !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(jwk.y) || "d" in jwk) throw new Error("OpenKey returned an invalid relay key");
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+function decodeCanonicalBase64Url(value, label) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`OpenKey returned an invalid ${label}`);
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value) throw new Error(`OpenKey returned an invalid ${label}`);
+  return decoded;
+}
+function deriveRelayKey(sharedSecret, transactionId) {
+  const extracted = createHmac("sha256", Buffer.from(transactionId)).update(sharedSecret).digest();
+  return createHmac("sha256", extracted).update(Buffer.from("openkey-device-relay-v1")).update(Buffer.from([1])).digest();
+}
+function decryptRelayResult(envelope, transactionId, privateKey) {
+  if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) throw new Error("OpenKey returned an invalid encrypted relay result");
+  const relay = envelope;
+  if (relay.version !== 1 || relay.algorithm !== "ECDH-P256-A256GCM") throw new Error("OpenKey returned an unsupported encrypted relay result");
+  const peer = createPublicKey({ key: publicRelayJwk(relay.ephemeralPublicJwk), format: "jwk" });
+  const nonce = decodeCanonicalBase64Url(relay.nonce, "relay nonce");
+  const ciphertext = decodeCanonicalBase64Url(relay.ciphertext, "relay ciphertext");
+  if (nonce.length !== 12 || ciphertext.length <= 16) throw new Error("OpenKey returned an invalid encrypted relay result");
+  const sharedSecret = diffieHellman({ privateKey, publicKey: peer });
+  const key = deriveRelayKey(sharedSecret, transactionId);
+  const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAAD(Buffer.from(transactionId));
+  decipher.setAuthTag(ciphertext.subarray(ciphertext.length - 16));
+  let value;
+  try {
+    value = JSON.parse(Buffer.concat([decipher.update(ciphertext.subarray(0, -16)), decipher.final()]).toString("utf8"));
+  } catch {
+    throw new Error("OpenKey returned an unreadable encrypted relay result");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("OpenKey returned an invalid encrypted relay result");
+  return value;
+}
+function assertShareDelegationPermissions(value) {
+  if (!Array.isArray(value) || value.length !== 1) throw new Error("OpenKey returned a delegation outside the requested Share scope");
+  const permission = value[0];
+  if (!permission || permission.service !== "tinycloud.capabilities" && permission.service !== "capabilities" || permission.space !== "applications" && !(typeof permission.space === "string" && permission.space.endsWith(":applications")) || permission.path !== "" || !Array.isArray(permission.actions) || permission.actions.length !== 1 || permission.actions[0] !== "tinycloud.capabilities/read") throw new Error("OpenKey returned a delegation outside the requested Share scope");
+}
+function assertApprovedBinding(input) {
+  if (input.binding.transactionId !== input.transactionId || input.binding.sessionDid !== input.sessionDid || input.binding.nodeOrigin !== input.nodeOrigin || input.binding.shareOrigin !== input.shareOrigin || !jsonEqual(input.binding.permissions, SHARE_DEVICE_PERMISSIONS)) throw new Error("OpenKey returned a delegation with the wrong device binding");
+  const expiresAt = Date.parse(input.binding.delegationExpiresAt);
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || expiresAt > Date.now() + SHARE_DEVICE_DELEGATION_SECONDS * 1e3 + 3e4) {
+    throw new Error("OpenKey returned a delegation outside the requested expiry window");
+  }
+  if (input.delegation.verificationMethod !== input.sessionDid) {
+    throw new Error("OpenKey returned a delegation for a different CLI session DID");
+  }
+  assertShareDelegationPermissions(input.delegation.permissions);
+  const delegationExpiryValue = input.delegation.expiresAt ?? input.delegation.expirationTime ?? input.delegation.expiry;
+  const delegationExpiresAt = typeof delegationExpiryValue === "string" ? Date.parse(delegationExpiryValue) : Number.NaN;
+  if (!Number.isFinite(delegationExpiresAt) || delegationExpiresAt !== expiresAt) {
+    throw new Error("OpenKey returned a delegation outside the approved expiry window");
+  }
+  if (!input.delegation.jwk || typeof input.delegation.jwk !== "object" || !jsonEqual(publicSessionJwk(input.delegation.jwk), input.publicJwk)) {
+    throw new Error("OpenKey returned a delegation for a different CLI session key");
+  }
+  const invalid = validateDelegationCallbackPayload(input.delegation);
+  if (invalid) throw new Error(`OpenKey returned an invalid delegation: ${invalid}`);
+}
+async function acquireShareDeviceDelegation(input) {
+  const openkeyHost = canonicalOrigin(input.openkeyHost ?? DEFAULT_OPENKEY_HOST, "OpenKey host");
+  const nodeOrigin = canonicalOrigin(input.nodeOrigin, "TinyCloud node origin");
+  const shareOrigin = canonicalOrigin(input.shareOrigin, "Share origin");
+  const fetchFn = input.fetchFn ?? globalThis.fetch;
+  const deviceSecret = randomBytes3(32).toString("base64url");
+  const codeVerifier = randomBytes3(32).toString("base64url");
+  const relayKeys = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  const relayPublicJwk = publicRelayJwk(relayKeys.publicKey.export({ format: "jwk" }));
+  const publicJwk = publicSessionJwk(input.jwk);
+  const startResponse = await fetchFn(`${openkeyHost}/api/device-authorizations`, {
+    method: "POST",
+    credentials: "omit",
+    redirect: "error",
+    referrerPolicy: "no-referrer",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({
+      deviceSecretHash: digest2(deviceSecret),
+      codeChallenge: digest2(codeVerifier),
+      relayPublicJwk,
+      sessionDid: input.sessionDid,
+      publicJwk,
+      permissions: SHARE_DEVICE_PERMISSIONS,
+      nodeOrigin,
+      shareOrigin,
+      delegationTtlSeconds: SHARE_DEVICE_DELEGATION_SECONDS
+    })
+  });
+  const startValue = await responseJson(startResponse);
+  if (!startResponse.ok) throw new Error(`OpenKey device authorization failed: ${errorCode(startValue) ?? startResponse.status}`);
+  const started = validateStart(startValue);
+  (input.emitInstructions ?? ((value) => {
+    process.stderr.write(`OpenKey device authorization
+Visit: ${value.verificationUri}
+Code:  ${value.userCode}
+
+Waiting for approval\u2026
+`);
+  }))({ verificationUri: started.verificationUri, verificationUriComplete: started.verificationUriComplete, userCode: started.userCode });
+  const deadline = Date.now() + started.expiresIn * 1e3;
+  let interval = started.interval;
+  const wait = input.wait ?? ((milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds)));
+  while (Date.now() < deadline) {
+    await wait(interval * 1e3);
+    const response = await fetchFn(`${openkeyHost}/api/device-authorizations/token`, {
+      method: "POST",
+      credentials: "omit",
+      redirect: "error",
+      referrerPolicy: "no-referrer",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ transactionId: started.transactionId, deviceSecret, codeVerifier })
+    });
+    const value = await responseJson(response);
+    const code3 = errorCode(value);
+    if (response.status === 429 && code3 === "slow_down") {
+      interval += 1;
+      continue;
+    }
+    if (!response.ok) throw new Error(`OpenKey device authorization failed: ${code3 ?? response.status}`);
+    const result = value;
+    if (result.status === "pending") {
+      interval = Math.max(interval, result.interval);
+      continue;
+    }
+    if (result.status !== "approved" || !result.relay || !result.binding) {
+      throw new Error("OpenKey returned an invalid device authorization result");
+    }
+    const delegation = decryptRelayResult(result.relay, started.transactionId, relayKeys.privateKey);
+    assertApprovedBinding({ binding: result.binding, transactionId: started.transactionId, sessionDid: input.sessionDid, nodeOrigin, shareOrigin, publicJwk, delegation });
+    return delegation;
+  }
+  throw new Error("OpenKey device authorization expired before approval");
+}
+function mergePrivateJwkIntoSession(session, key) {
+  const sessionJwk = session.jwk;
+  if (!sessionJwk || typeof sessionJwk !== "object") return session;
+  const sessionJwkRecord = sessionJwk;
+  if (typeof sessionJwkRecord.d === "string" && sessionJwkRecord.d.length > 0) return session;
+  const privateParameter = key.d;
+  if (typeof privateParameter !== "string" || privateParameter.length === 0) return session;
+  return { ...session, jwk: { ...sessionJwkRecord, d: privateParameter } };
+}
+async function ensureShareDeviceAuthorization(input) {
+  let profile = await ProfileManager.getProfile(input.profileName).catch(() => null);
+  if (profile?.authMethod === "local" && input.allowReplaceLocal !== true) {
+    throw new Error("This profile uses a local owner key. Run `tc auth login --device` explicitly to replace its authentication posture.");
+  }
+  let key = await ProfileManager.getKey(input.profileName);
+  if (!key) {
+    const generated = generateKey2();
+    key = generated.jwk;
+    await ProfileManager.setKey(input.profileName, key);
+  }
+  const sessionDid = keyToDID(key);
+  profile = {
+    ...profile,
+    name: input.profileName,
+    host: input.nodeOrigin,
+    chainId: profile?.chainId ?? DEFAULT_CHAIN_ID,
+    spaceName: profile?.spaceName ?? "applications",
+    did: sessionDid,
+    sessionDid,
+    createdAt: profile?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    posture: "owner-openkey",
+    operatorType: profile?.operatorType ?? "human",
+    authMethod: "openkey",
+    openkeyHost: input.openkeyHost ?? profile?.openkeyHost
+  };
+  await ProfileManager.setProfile(input.profileName, profile);
+  const delegation = await acquireShareDeviceDelegation({
+    sessionDid,
+    jwk: key,
+    nodeOrigin: input.nodeOrigin,
+    shareOrigin: input.shareOrigin,
+    openkeyHost: input.openkeyHost ?? profile.openkeyHost,
+    fetchFn: input.fetchFn,
+    emitInstructions: input.emitInstructions,
+    wait: input.wait
+  });
+  const session = mergePrivateJwkIntoSession(delegation, key);
+  await ProfileManager.setSession(input.profileName, session);
+  const updatedProfile = {
+    ...profile,
+    ownerDid: typeof session.ownerDid === "string" ? session.ownerDid : profile.ownerDid,
+    spaceId: typeof session.spaceId === "string" ? session.spaceId : profile.spaceId
+  };
+  await ProfileManager.setProfile(input.profileName, updatedProfile);
+  return { profile: updatedProfile, delegation: session };
+}
+
 // src/commands/auth.ts
 init_theme();
 function resolveOpenKeyHost(profile) {
@@ -31040,7 +31305,7 @@ function resolveOpenKeyHost(profile) {
 }
 async function promptAuthMethod() {
   if (!isInteractive()) {
-    return "local";
+    return "openkey";
   }
   const rl = createInterface2({
     input: process.stdin,
@@ -31066,12 +31331,20 @@ async function promptAuthMethod() {
 }
 function registerAuthCommand(program) {
   const auth = program.command("auth").description("Authentication management");
-  auth.command("login").description("Authenticate with TinyCloud").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").action(async (options, cmd) => {
+  auth.command("login").description("Authenticate with TinyCloud").option("--device", "Use OpenKey device authorization (recommended for remote/headless use)").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").action(async (options, cmd) => {
     try {
+      if (options.device && options.paste) {
+        throw new CLIError("INVALID_ARGUMENT", "--device and --paste are mutually exclusive.", ExitCode.USAGE_ERROR);
+      }
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
       let method;
-      if (options.method) {
+      if (options.device && options.method === "local") {
+        throw new CLIError("INVALID_ARGUMENT", "--device requires --method openkey.", ExitCode.USAGE_ERROR);
+      }
+      if (options.device) {
+        method = "openkey";
+      } else if (options.method) {
         if (options.method !== "local" && options.method !== "openkey") {
           throw new CLIError(
             "INVALID_METHOD",
@@ -31088,7 +31361,8 @@ function registerAuthCommand(program) {
       } else {
         await handleOpenKeyAuth(ctx.profile, ctx.host, {
           paste: options.paste,
-          noPopup: options.popup === false
+          noPopup: options.popup === false,
+          device: options.device === true || !isInteractive() && options.paste !== true
         });
       }
     } catch (error) {
@@ -31676,15 +31950,15 @@ async function importRequestBoundDelegation(ctx, artifact) {
   );
   switch (result.status) {
     case "ok": {
-      const output = result.output;
+      const output2 = result.output;
       outputJson({
         imported: true,
-        activated: output.activated,
+        activated: output2.activated,
         kind: "tinycloud.auth.delegation",
         requestId: typeof artifact === "object" && artifact !== null && typeof artifact.requestId === "string" ? artifact.requestId : null,
-        delegationCid: output.cid,
-        permissions: output.effectivePermissions,
-        expiry: output.expiry
+        delegationCid: output2.cid,
+        permissions: output2.effectivePermissions,
+        expiry: output2.expiry
       });
       return;
     }
@@ -32183,6 +32457,24 @@ async function handleLocalAuth(profileName, host, options = {}) {
   return { profile: updatedProfile, sessionResult };
 }
 async function handleOpenKeyAuth(profileName, host, options = {}) {
+  if (options.device) {
+    const result = await ensureShareDeviceAuthorization({
+      profileName,
+      nodeOrigin: host,
+      shareOrigin: "https://share.tinycloud.xyz",
+      openkeyHost: process.env.TC_OPENKEY_HOST,
+      allowReplaceLocal: true
+    });
+    outputJson({
+      authenticated: true,
+      profile: profileName,
+      did: result.profile.did,
+      spaceId: result.profile.spaceId ?? null,
+      authMethod: "openkey",
+      mode: "device"
+    });
+    return;
+  }
   const { profile, delegationData } = await refreshOpenKeySession(profileName, host, options);
   outputJson({
     authenticated: true,
@@ -32192,25 +32484,6 @@ async function handleOpenKeyAuth(profileName, host, options = {}) {
     authMethod: "openkey"
   });
 }
-function mergePrivateJwkIntoSession(session, key) {
-  const sessionJwk = session.jwk;
-  if (!sessionJwk || typeof sessionJwk !== "object") {
-    return session;
-  }
-  const sessionJwkRecord = sessionJwk;
-  const sessionD = sessionJwkRecord.d;
-  if (typeof sessionD === "string" && sessionD.length > 0) {
-    return session;
-  }
-  const keyD = key.d;
-  if (typeof keyD !== "string" || keyD.length === 0) {
-    return session;
-  }
-  return {
-    ...session,
-    jwk: { ...sessionJwkRecord, d: keyD }
-  };
-}
 async function refreshOpenKeySession(profileName, host, options = {}) {
   const key = await ProfileManager.getKey(profileName);
   if (!key) {
@@ -32786,6 +33059,36 @@ ${rowCount} row${rowCount === 1 ? "" : "s"} returned`) + "\n");
   });
 }
 
+// src/commands/enable.ts
+init_profiles();
+init_errors();
+init_formatter();
+function registerEnableCommand(program) {
+  const enable = program.command("enable").description("Enable a narrowly scoped TinyCloud service");
+  enable.command("share").description("Approve Share publishing through OpenKey device authorization").action(async (_options, command) => {
+    try {
+      const context = await ProfileManager.resolveContext(command.optsWithGlobals());
+      const result = await ensureShareDeviceAuthorization({
+        profileName: context.profile,
+        nodeOrigin: context.host,
+        shareOrigin: "https://share.tinycloud.xyz",
+        openkeyHost: process.env.TC_OPENKEY_HOST,
+        allowReplaceLocal: true
+      });
+      const value = {
+        enabled: true,
+        service: "share",
+        profile: context.profile,
+        sessionDid: result.profile.sessionDid ?? result.profile.did,
+        expiresAt: result.delegation.expiresAt ?? result.delegation.expirationTime ?? result.delegation.expiry
+      };
+      output(value, () => `Share enabled for profile ${context.profile}.`);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+}
+
 // src/commands/init.ts
 init_profiles();
 init_formatter();
@@ -34521,7 +34824,7 @@ function receiveJson(result, path) {
 // src/share/io.ts
 import { constants } from "fs";
 import { lstat, mkdir as mkdir3, mkdtemp, open as open3, readFile as readFile9, realpath, stat as stat2, link, rename as rename2, rm as rm2, unlink } from "fs/promises";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { basename as basename2, join as join6, resolve as resolve2, sep } from "path";
 var MAX_SHARE_STDIN_BYTES = 100 * 1024 * 1024;
 var MAX_SHARE_URL_BYTES = 64 * 1024;
@@ -34600,7 +34903,7 @@ async function writeShareOutput(directory, filename, bytes, force) {
   const stagingDirectory = await mkdtemp(join6(stableDirectory, ".tinycloud-share-stage-"));
   const stagingInfo = await lstat(stagingDirectory);
   if (!stagingInfo.isDirectory() || (stagingInfo.mode & 511) !== 448) throw new Error("OUTPUT_EXISTS");
-  const stagingPath = join6(stagingDirectory, `.tinycloud-share-${randomBytes3(16).toString("hex")}.tmp`);
+  const stagingPath = join6(stagingDirectory, `.tinycloud-share-${randomBytes4(16).toString("hex")}.tmp`);
   let temporaryPath;
   let handle;
   try {
@@ -34653,11 +34956,11 @@ function parseShareTarget(value) {
   if (value.includes("@")) return { kind: "email", address: value };
   throw new CLIError("INVALID_ARGUMENT", "--to must be anyone, a did:, an email address, or domain:example.com", 2);
 }
-function publishServices() {
+function publishServices(insecureLocalRegistry = false) {
   return {
     ...shareServices.uploadBlob === void 0 ? {} : { uploadBlob: shareServices.uploadBlob },
     ...shareServices.authorizeUpload === void 0 ? {} : { authorizeUpload: shareServices.authorizeUpload },
-    ...shareServices.authorizeUpload === void 0 ? {} : { authorizationOrigin: SHARE_ORIGIN },
+    ...shareServices.authorizeUpload === void 0 || insecureLocalRegistry ? {} : { authorizationOrigin: SHARE_ORIGIN },
     ...shareServices.credentials === void 0 ? {} : { credentials: shareServices.credentials },
     ...shareServices.fetchFn === void 0 ? {} : { fetchFn: shareServices.fetchFn }
   };
@@ -34703,6 +35006,9 @@ function inputUrl(value, stdin) {
   if (value === void 0 || value.length === 0) throw new CLIError("INVALID_ARGUMENT", "a share URL or - is required", 2);
   return Promise.resolve(value);
 }
+function jsonOutput(options, command) {
+  return options.json === true || command.optsWithGlobals().json === true;
+}
 function expires(value) {
   try {
     return new Date(Date.now() + parseDuration(value));
@@ -34753,8 +35059,9 @@ function assertAggregateInputLimit(inputs, maxBytes) {
 }
 function registerShareCommand(program) {
   const share = program.command("share").description("Publish and consume TinyCloud Share links");
-  share.command("publish <files...>").description("Publish one or more bounded files as a Share").option("--name <filename>", "Filename for stdin input").option("--to <target>", "Share target", "anyone").option("--notify", "Request idempotent email delivery for addressed targets").option("--expires <duration>", "Share lifetime", "7d").option("--max-bytes <bytes>", "Bound input bytes").option("--media-type <type>", "Media type for a single input").option("--action <actions...>", "Addressed permission: read, list, or edit").option("--prefix", "Publish multiple inputs beneath one addressed prefix").option("--binary", "Allow non-UTF-8 bearer content").option("--inline", "Embed the sealed envelope in the URL fragment").option("--compact", "Use a CID-addressed compact link (default)").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Authenticated registry upload endpoint", DEFAULT_REGISTRY).option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).option("--insecure-registry", "Allow an explicit localhost HTTP registry for hermetic tests").action(async (files, options) => {
+  share.command("publish <files...>").description("Publish one or more bounded files as a Share").option("--name <filename>", "Filename for stdin input").option("--to <target>", "Share target", "anyone").option("--notify", "Request idempotent email delivery for addressed targets").option("--expires <duration>", "Share lifetime", "7d").option("--max-bytes <bytes>", "Bound input bytes").option("--media-type <type>", "Media type for a single input").option("--action <actions...>", "Addressed permission: read, list, or edit").option("--prefix", "Publish multiple inputs beneath one addressed prefix").option("--binary", "Allow non-UTF-8 bearer content").option("--inline", "Embed the sealed envelope in the URL fragment").option("--compact", "Use a CID-addressed compact link (default)").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Authenticated registry upload endpoint", DEFAULT_REGISTRY).option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).option("--insecure-registry", "Allow an explicit localhost HTTP registry for hermetic tests").action(async (files, options, command) => {
     try {
+      const json = jsonOutput(options, command);
       if (options.inline && options.compact) throw new CLIError("INVALID_ARGUMENT", "--inline and --compact are mutually exclusive", 2);
       const maxBytes = byteLimit(options.maxBytes);
       if (files.length === 0 || files.includes("-") && files.length > 1) throw new CLIError("INVALID_ARGUMENT", "stdin must be the only publish input", 2);
@@ -34783,10 +35090,10 @@ function registerShareCommand(program) {
         allowInsecureRegistry: options.insecureRegistry === true,
         notify: options.notify === true,
         targetAdapter: shareServices.targetAdapter,
-        ...publishServices()
+        ...publishServices(options.insecureRegistry === true)
       });
       if ("state" in result) {
-        if (options.json) {
+        if (json) {
           writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
           process.exitCode = 6;
           return;
@@ -34799,25 +35106,27 @@ function registerShareCommand(program) {
         const delivery = await notifyShare({ shareId: record.shareId, recipient: target.address, record, adapter: shareServices.delivery });
         if (delivery.state === "partial-failure") process.exitCode = 9;
       }
-      if (options.json) writeJson2(redactPublishedShare(result));
+      if (json) writeJson2(redactPublishedShare(result));
       else publishHuman(result);
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("inspect [url]").description("Verify a share link and print safe metadata").option("--stdin", "Read the complete URL from stdin").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Registry read endpoint", DEFAULT_READ_REGISTRY).option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options) => {
+  share.command("inspect [url]").description("Verify a share link and print safe metadata").option("--stdin", "Read the complete URL from stdin").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Registry read endpoint", DEFAULT_READ_REGISTRY).option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options, command) => {
     try {
+      const json = jsonOutput(options, command);
       const link2 = await inputUrl(url, options.stdin === true);
       const result = await inspectShare(link2, { registryBaseUrl: options.registry, expectedOrigin: options.viewerOrigin, ...fetchServices() });
-      if (options.json) writeJson2(result);
+      if (json) writeJson2(result);
       else inspectHuman(result);
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("receive [url]").description("Verify and receive a share link").option("--stdin", "Read the complete URL from stdin").option("--output <directory>", "Create the file in this directory").option("--stdout", "Write verified plaintext bytes to stdout").option("--force", "Allow replacing an existing non-symlink output").option("--max-bytes <bytes>", "Bound received content bytes").option("--resume-token <token>", "Resume a previously returned recipient authorization step").option("--authorization-proof-file <path>", "Read the JSON authorization proof from a file").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Registry read endpoint", DEFAULT_READ_REGISTRY).option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).option("--legacy", "Read a legacy tc1: link (read-only)").action(async (url, options) => {
+  share.command("receive [url]").description("Verify and receive a share link").option("--stdin", "Read the complete URL from stdin").option("--output <directory>", "Create the file in this directory").option("--stdout", "Write verified plaintext bytes to stdout").option("--force", "Allow replacing an existing non-symlink output").option("--max-bytes <bytes>", "Bound received content bytes").option("--resume-token <token>", "Resume a previously returned recipient authorization step").option("--authorization-proof-file <path>", "Read the JSON authorization proof from a file").option("--json", "Print versioned redacted JSON").option("--registry <url>", "Registry read endpoint", DEFAULT_READ_REGISTRY).option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).option("--legacy", "Read a legacy tc1: link (read-only)").action(async (url, options, command) => {
     try {
-      if (options.stdout && options.json) throw new CLIError("INVALID_ARGUMENT", "--stdout and --json are mutually exclusive", 2);
+      const json = jsonOutput(options, command);
+      if (options.stdout && json) throw new CLIError("INVALID_ARGUMENT", "--stdout and --json are mutually exclusive", 2);
       const maxBytes = byteLimit(options.maxBytes);
       const link2 = await inputUrl(url, options.stdin === true);
       const proof = await authorizationProof(options);
@@ -34828,9 +35137,9 @@ function registerShareCommand(program) {
           process.stdout.write(Buffer.from(bytes));
           return;
         }
-        const output2 = await writeShareOutput(options.output ?? ".", "share.md", bytes, options.force === true);
-        if (options.json) writeJson2({ protocol: "tinycloud-share", version: 1, legacy: true, path: output2 });
-        else receiveHuman(output2);
+        const output3 = await writeShareOutput(options.output ?? ".", "share.md", bytes, options.force === true);
+        if (json) writeJson2({ protocol: "tinycloud-share", version: 1, legacy: true, path: output3 });
+        else receiveHuman(output3);
         return;
       }
       const result = await receiveShare(link2, {
@@ -34843,7 +35152,7 @@ function registerShareCommand(program) {
         ...proof === void 0 ? {} : { authorizationProof: proof }
       });
       if ("state" in result) {
-        if (options.json) {
+        if (json) {
           writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
           process.exitCode = 6;
           return;
@@ -34854,15 +35163,16 @@ function registerShareCommand(program) {
         process.stdout.write(Buffer.from(result.bytes));
         return;
       }
-      const output = await writeShareOutput(options.output ?? ".", result.metadata.display.filename ?? "share.md", result.bytes, options.force === true);
-      if (options.json) receiveJson(result, output);
-      else receiveHuman(output);
+      const output2 = await writeShareOutput(options.output ?? ".", result.metadata.display.filename ?? "share.md", result.bytes, options.force === true);
+      if (json) receiveJson(result, output2);
+      else receiveHuman(output2);
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("migrate [url]").description("Read a legacy tc1 link and re-mint a modern Share link").option("--stdin", "Read the complete legacy link from stdin").option("--name <filename>", "Filename for the migrated content", "migrated.md").option("--to <target>", "Modern Share target", "anyone").option("--notify", "Request idempotent email delivery for addressed targets").option("--expires <duration>", "Modern share lifetime", "7d").option("--max-bytes <bytes>", "Bound migrated content bytes").option("--inline", "Embed the sealed envelope in the URL fragment").option("--registry <url>", "Authenticated registry upload endpoint", DEFAULT_REGISTRY).option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).option("--insecure-registry", "Allow an explicit localhost HTTP registry for hermetic tests").option("--json", "Print versioned redacted JSON").action(async (url, options) => {
+  share.command("migrate [url]").description("Read a legacy tc1 link and re-mint a modern Share link").option("--stdin", "Read the complete legacy link from stdin").option("--name <filename>", "Filename for the migrated content", "migrated.md").option("--to <target>", "Modern Share target", "anyone").option("--notify", "Request idempotent email delivery for addressed targets").option("--expires <duration>", "Modern share lifetime", "7d").option("--max-bytes <bytes>", "Bound migrated content bytes").option("--inline", "Embed the sealed envelope in the URL fragment").option("--registry <url>", "Authenticated registry upload endpoint", DEFAULT_REGISTRY).option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).option("--insecure-registry", "Allow an explicit localhost HTTP registry for hermetic tests").option("--json", "Print versioned redacted JSON").action(async (url, options, command) => {
     try {
+      const json = jsonOutput(options, command);
       if (shareServices.legacyReader === void 0) throw new CLIError("UNSUPPORTED_LINK", "legacy migration requires an installed read-only tc1 adapter", 2);
       const link2 = await inputUrl(url, options.stdin === true);
       if (!isLegacyShareLink(link2)) throw new CLIError("UNSUPPORTED_LINK", "only tc1: links can be migrated", 2);
@@ -34884,7 +35194,7 @@ function registerShareCommand(program) {
             allowInsecureRegistry: options.insecureRegistry === true,
             notify: options.notify === true,
             targetAdapter: shareServices.targetAdapter,
-            ...publishServices()
+            ...publishServices(options.insecureRegistry === true)
           });
           if ("state" in result) throw new CLIError(result.method === "openkey-device" ? "DEVICE_AUTH_REQUIRED" : "CLAIM_REQUIRED", "recipient authorization is required; continue through the configured authority adapter", 6);
           const record = await rememberPublishedShare(result);
@@ -34898,41 +35208,44 @@ function registerShareCommand(program) {
           return result;
         }
       });
-      if (options.json) writeJson2({ protocol: "tinycloud-share", version: 1, legacy: true, migrated: redactPublishedShare(migrated.migrated) });
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, legacy: true, migrated: redactPublishedShare(migrated.migrated) });
       else publishHuman(migrated.migrated);
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("list").description("List encrypted sender history without complete bearer URLs").option("--json", "Print versioned redacted JSON").action(async (options) => {
+  share.command("list").description("List encrypted sender history without complete bearer URLs").option("--json", "Print versioned redacted JSON").action(async (options, command) => {
     try {
+      const json = jsonOutput(options, command);
       if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
       const result = await listShares(shareServices.records);
-      if (options.json) writeJson2({ protocol: "tinycloud-share", version: 1, shares: result });
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, shares: result });
       else process.stdout.write(result.map((item) => `${item.shareId}	${item.target}	${item.expiresAt}`).join("\n") + (result.length ? "\n" : ""));
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("show <id>").description("Show one redacted sender-history record").option("--reveal-link", "Explicitly include the complete link").option("--json", "Print versioned redacted JSON").action(async (id, options) => {
+  share.command("show <id>").description("Show one redacted sender-history record").option("--reveal-link", "Explicitly include the complete link").option("--json", "Print versioned redacted JSON").action(async (id, options, command) => {
     try {
-      if (options.revealLink && options.json) throw new CLIError("INVALID_ARGUMENT", "--reveal-link cannot be combined with --json", 2);
+      const json = jsonOutput(options, command);
+      if (options.revealLink && json) throw new CLIError("INVALID_ARGUMENT", "--reveal-link cannot be combined with --json", 2);
       if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
       const result = await showShare({ storage: shareServices.records, shareId: id, revealLink: options.revealLink === true, link: options.revealLink ? await shareServices.linkFor?.(id) : void 0 });
-      if (options.json) writeJson2({ protocol: "tinycloud-share", version: 1, share: result });
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, share: result });
       else writeJson2(result);
     } catch (error) {
       handleError(shareCliError(error));
     }
   });
-  share.command("notify <id>").description("Retry idempotent delivery without recreating the share").requiredOption("--to <address>", "Recipient email").option("--json", "Print versioned JSON").action(async (id, options) => {
+  share.command("notify <id>").description("Retry idempotent delivery without recreating the share").requiredOption("--to <address>", "Recipient email").option("--json", "Print versioned JSON").action(async (id, options, command) => {
     try {
+      const json = jsonOutput(options, command);
       if (shareServices.delivery === void 0) throw new CLIError("AUTH_REQUIRED", "delivery authority is not configured", 3);
       if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
       const record = await shareServices.records.get(id);
       if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
       const result = await notifyShare({ shareId: id, recipient: options.to, record, adapter: shareServices.delivery });
-      if (options.json) writeJson2(result);
+      if (json) writeJson2(result);
       else process.stdout.write(`${result.state}
 `);
       if (result.state === "partial-failure") process.exitCode = 9;
@@ -34940,8 +35253,9 @@ function registerShareCommand(program) {
       handleError(shareCliError(error));
     }
   });
-  share.command("revoke <id>").description("Revoke addressed shares; report bearer retention honestly").option("--ancestor", "Revoke the owner delegation ancestry").option("--json", "Print versioned JSON").action(async (id, options) => {
+  share.command("revoke <id>").description("Revoke addressed shares; report bearer retention honestly").option("--ancestor", "Revoke the owner delegation ancestry").option("--json", "Print versioned JSON").action(async (id, options, command) => {
     try {
+      const json = jsonOutput(options, command);
       if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
       const record = shareServices.getRecord ? await shareServices.getRecord(id) : await shareServices.records.get(id);
       if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
@@ -34949,7 +35263,7 @@ function registerShareCommand(program) {
       if (result.state === "unsupported") {
         throw new CLIError("UNSUPPORTED_TARGET", result.reason, 2);
       }
-      if (options.json) writeJson2({ protocol: "tinycloud-share", version: 1, result });
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, result });
       else process.stdout.write(`${result.state}
 `);
     } catch (error) {
@@ -34963,7 +35277,7 @@ init_profiles();
 init_formatter();
 init_errors();
 init_constants();
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname3 } from "path";
 init_host();
@@ -35046,7 +35360,7 @@ it directly with \`tc space host <name>\` (no request needed).
       const artifact = {
         kind: "tinycloud.host.request",
         version: 1,
-        requestId: `hostreq_${Date.now().toString(36)}_${randomBytes4(4).toString("hex")}`,
+        requestId: `hostreq_${Date.now().toString(36)}_${randomBytes5(4).toString("hex")}`,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
         spaceName,
         spaceId,
@@ -36128,6 +36442,7 @@ function registerVarsCommand(program) {
 function registerTinyCloudCommands(program) {
   registerInitCommand(program);
   registerAuthCommand(program);
+  registerEnableCommand(program);
   registerKvCommand(program);
   registerSpaceCommand(program);
   registerDelegationCommand(program);