@tinycloud/cli 1.1.0-beta.10 → 1.1.0-beta.12

package/dist/legacy-entry.js

@@ -6967,11 +6967,31 @@ function authRequiredError(service) {
     service
   };
 }
-function timeoutError(service) {
+var RequestTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`Request timed out after ${timeoutMs}ms.`);
+    this.name = "TimeoutError";
+    this.timeoutMs = timeoutMs;
+  }
+};
+function isRequestTimeoutError(error) {
+  return error instanceof RequestTimeoutError || error instanceof Error && error.name === "TimeoutError" && typeof error.timeoutMs === "number";
+}
+function timeoutError(service, timeoutMs, cause) {
+  if (timeoutMs === void 0) {
+    return {
+      code: ErrorCodes.TIMEOUT,
+      message: "Request timed out.",
+      service,
+      ...cause === void 0 ? {} : { cause }
+    };
+  }
   return {
     code: ErrorCodes.TIMEOUT,
-    message: "Request timed out.",
-    service
+    message: `Request timed out after ${timeoutMs}ms.`,
+    service,
+    ...cause === void 0 ? {} : { cause },
+    meta: { timeoutMs }
   };
 }
 function abortedError(service) {
@@ -7118,6 +7138,9 @@ function storageRejectionError(service, status, meta, responseText) {
 }
 function wrapError2(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
   if (error instanceof Error) {
+    if (isRequestTimeoutError(error)) {
+      return timeoutError(service, error.timeoutMs, error);
+    }
     if (error.name === "AbortError") {
       return abortedError(service);
     }
@@ -7137,6 +7160,7 @@ function wrapError2(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
     service
   };
 }
+var MAX_TIMER_DELAY_MS = 2147483647;
 var BaseService = class {
   constructor() {
     this.abortController = new AbortController();
@@ -7310,6 +7334,64 @@ var BaseService = class {
     }
     return controller.signal;
   }
+  /**
+   * Create the abort signal for one request, bounded by the request timeout.
+   *
+   * The signal aborts when the service signs out, the context aborts, the
+   * caller's `signal` aborts, or the timeout elapses, whichever comes first.
+   * A timeout aborts with a {@link RequestTimeoutError} (`TimeoutError`), which
+   * `wrapError` maps to `ErrorCodes.TIMEOUT`; the other sources keep their own
+   * reason (normally `AbortError`, mapped to `ErrorCodes.ABORTED`).
+   *
+   * The timeout is `timeoutMs` when given, otherwise `config.timeout`. Only a
+   * positive, finite value (at most 2^31-1 ms) applies; `undefined`, `0`, and
+   * `Infinity` mean no timeout, so a per-call `0` opts out of a configured one.
+   *
+   * Callers must call `dispose()` once the response body has been consumed,
+   * which clears the timer and removes the listeners this adds to the
+   * long-lived service and context signals.
+   *
+   * @param signal - The caller's abort signal for this request
+   * @param timeoutMs - Per-request timeout override in milliseconds
+   */
+  createRequestSignal(signal, timeoutMs) {
+    const controller = new AbortController();
+    const detachers = [];
+    let timer;
+    const dispose = () => {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+      for (const detach of detachers.splice(0)) {
+        detach();
+      }
+    };
+    const abort = (reason) => {
+      dispose();
+      controller.abort(reason);
+    };
+    const requestSignal = { signal: controller.signal, dispose };
+    const parents = [
+      this.abortController.signal,
+      this.context?.abortSignal,
+      signal
+    ].filter((parent) => parent !== void 0);
+    for (const parent of parents) {
+      if (parent.aborted) {
+        abort(parent.reason);
+        return requestSignal;
+      }
+      const onAbort = () => abort(parent.reason);
+      parent.addEventListener("abort", onAbort, { once: true });
+      detachers.push(() => parent.removeEventListener("abort", onAbort));
+    }
+    const timeout = timeoutMs ?? this._config.timeout;
+    if (typeof timeout === "number" && timeout > 0 && timeout <= MAX_TIMER_DELAY_MS) {
+      timer = setTimeout(() => abort(new RequestTimeoutError(timeout)), timeout);
+    }
+    return requestSignal;
+  }
   /**
    * Wrap an operation with error handling and telemetry.
    *
@@ -7564,7 +7646,7 @@ var KVService = class extends BaseService {
    * @param path - Resource path
    * @param action - KV action
    * @param body - Optional request body
-   * @param signal - Optional abort signal
+   * @param signal - Request signal from createRequestSignal()
    * @returns Fetch response
    */
   async invokeOperation(path, action, body, signal, extraHeaders) {
@@ -7580,7 +7662,7 @@ var KVService = class extends BaseService {
       method: "POST",
       headers: requestHeaders,
       body,
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   /**
@@ -7757,6 +7839,7 @@ var KVService = class extends BaseService {
         "kv"
       ));
     }
+    const request = this.createRequestSignal(options?.signal, options?.timeout);
     try {
       const session = this.context.session;
       const invocationHeaders = this.context.invokeAny(
@@ -7778,7 +7861,7 @@ var KVService = class extends BaseService {
       const response = await this.context.fetch(`${this.host}/invoke`, {
         method: "POST",
         headers,
-        signal: this.combineSignals(options?.signal)
+        signal: request.signal
       });
       if (!response.ok) {
         const errorText = response.status === 401 || response.status === 403 ? await this.readAuthorizationText(response) : await response.text();
@@ -7843,6 +7926,8 @@ var KVService = class extends BaseService {
       return ok({ results, count: results.length });
     } catch (error) {
       return err(wrapError2("kv", error));
+    } finally {
+      request.dispose();
     }
   }
   /**
@@ -7975,12 +8060,13 @@ var KVService = class extends BaseService {
         ));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.GET,
           void 0,
-          options?.signal,
+          request.signal,
           options?.maxResponseBytes === void 0 ? void 0 : { "x-tinycloud-max-response-bytes": String(options.maxResponseBytes) }
         );
         if (!response.ok) {
@@ -8037,6 +8123,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8064,12 +8152,13 @@ var KVService = class extends BaseService {
       }
       const path = this.getFullPath(key, options?.prefix);
       const body = this.serializePutValue(value, options?.contentType);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.PUT,
           body,
-          options?.signal,
+          request.signal,
           {
             ...options?.ifMatch === void 0 ? {} : { "if-match": options.ifMatch },
             ...options?.ifNoneMatch === void 0 ? {} : { "if-none-match": options.ifNoneMatch }
@@ -8125,6 +8214,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8164,6 +8255,7 @@ var KVService = class extends BaseService {
         seen.add(path);
       }
       let requestMayHaveDispatched = false;
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const body = new FormData();
         for (let index = 0; index < items.length; index++) {
@@ -8186,7 +8278,7 @@ var KVService = class extends BaseService {
           method: "POST",
           headers,
           body,
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         };
         const fetchFn = this.context.fetch;
         requestMayHaveDispatched = true;
@@ -8237,14 +8329,16 @@ var KVService = class extends BaseService {
           rawBody = await response.json();
         } catch (jsonError) {
           const cause = jsonError instanceof Error ? jsonError : new Error(String(jsonError));
+          const timedOut = isRequestTimeoutError(cause);
           return err(
             serviceError(
-              ErrorCodes.NETWORK_ERROR,
-              `KV batchPut response was not valid JSON: ${cause.message}`,
+              timedOut ? ErrorCodes.TIMEOUT : ErrorCodes.NETWORK_ERROR,
+              timedOut ? `KV batchPut response body did not arrive in time: ${cause.message}` : `KV batchPut response was not valid JSON: ${cause.message}`,
               "kv",
               {
                 cause,
                 meta: {
+                  ...timedOut ? { timeoutMs: cause.timeoutMs } : {},
                   requestMayHaveDispatched: true,
                   responseReceived: true,
                   status: response.status,
@@ -8299,6 +8393,8 @@ var KVService = class extends BaseService {
           ...wrapped,
           meta: { ...wrapped.meta, requestMayHaveDispatched }
         });
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8321,12 +8417,13 @@ var KVService = class extends BaseService {
       if (options?.path) {
         listPath = listPath ? `${listPath}/${options.path}` : options.path;
       }
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           listPath,
           KVAction.LIST,
           void 0,
-          options?.signal,
+          request.signal,
           options?.limit === void 0 && options?.cursor === void 0 ? void 0 : {
             ...options?.limit === void 0 ? {} : { "x-tinycloud-limit": String(options.limit) },
             ...options?.cursor === void 0 ? {} : { "x-tinycloud-cursor": options.cursor }
@@ -8367,6 +8464,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8379,12 +8478,13 @@ var KVService = class extends BaseService {
         return err(authRequiredError("kv"));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.DELETE,
           void 0,
-          options?.signal,
+          request.signal,
           options?.ifMatch === void 0 ? void 0 : { "if-match": options.ifMatch }
         );
         if (!response.ok) {
@@ -8432,6 +8532,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8444,12 +8546,13 @@ var KVService = class extends BaseService {
         return err(authRequiredError("kv"));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.HEAD,
           void 0,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           if (response.status === 401 || response.status === 403) {
@@ -8480,6 +8583,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8517,12 +8622,13 @@ var KVService = class extends BaseService {
       if (options?.etag !== void 0) {
         body.etag = options.etag;
       }
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.context.fetch(`${this.host}/signed/kv`, {
           method: "POST",
           headers: this.withJsonContentType(headers),
           body: JSON.stringify(body),
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         });
         if (!response.ok) {
           return this.createSignedReadUrlError(response, key, path);
@@ -8542,6 +8648,8 @@ var KVService = class extends BaseService {
         return ok(signedUrl);
       } catch (error) {
         return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8741,6 +8849,7 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "query",
@@ -8754,7 +8863,7 @@ var SQLService = class extends BaseService {
           dbName,
           action,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "query", dbName, [action]);
@@ -8763,6 +8872,8 @@ var SQLService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8771,6 +8882,7 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "execute",
@@ -8791,7 +8903,7 @@ var SQLService = class extends BaseService {
           dbName,
           requestedActions2,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "execute", dbName, requestedActions2);
@@ -8800,6 +8912,8 @@ var SQLService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8808,13 +8922,14 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const requestedActions2 = this.actionsForSqlBatch(statements);
         const response = await this.invokeSQL(
           dbName,
           requestedActions2,
           { action: "batch", statements },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "batch", dbName, requestedActions2);
@@ -8823,6 +8938,8 @@ var SQLService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8831,12 +8948,13 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeSQL(
           dbName,
           SQLAction.WRITE,
           { action: "execute_statement", name, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "executeStatement", dbName, [SQLAction.WRITE]);
@@ -8845,6 +8963,8 @@ var SQLService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8853,12 +8973,13 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeSQL(
           dbName,
           SQLAction.READ,
           { action: "export" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "export", dbName, [SQLAction.READ]);
@@ -8872,6 +8993,8 @@ var SQLService = class extends BaseService {
         return ok(text);
       } catch (error) {
         return err(wrapError2("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -8962,7 +9085,7 @@ var SQLService = class extends BaseService {
         "Content-Type": "application/json"
       },
       body: JSON.stringify(body),
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   actionForSql(sql, fallback) {
@@ -9219,12 +9342,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "query", sql, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "query");
@@ -9233,6 +9357,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9241,12 +9367,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "query", sql, params: params ?? [] },
-          options?.signal,
+          request.signal,
           { Accept: "application/vnd.apache.arrow.stream" }
         );
         if (!response.ok) {
@@ -9256,6 +9383,8 @@ var DuckDbService = class extends BaseService {
         return ok(buffer);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9264,6 +9393,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "execute",
@@ -9277,7 +9407,7 @@ var DuckDbService = class extends BaseService {
           dbName,
           DuckDbAction.WRITE,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "execute");
@@ -9286,6 +9416,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9294,6 +9426,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "batch",
@@ -9306,7 +9439,7 @@ var DuckDbService = class extends BaseService {
           dbName,
           DuckDbAction.WRITE,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "batch");
@@ -9315,6 +9448,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9323,12 +9458,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.WRITE,
           { action: "executeStatement", name, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "executeStatement");
@@ -9337,6 +9473,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9345,12 +9483,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "describe" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "describe");
@@ -9359,6 +9498,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9367,12 +9508,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.EXPORT,
           { action: "export" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "export");
@@ -9381,6 +9523,8 @@ var DuckDbService = class extends BaseService {
         return ok(blob);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9389,6 +9533,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const session = this.context.session;
         const headers = this.context.invoke(
@@ -9404,7 +9549,7 @@ var DuckDbService = class extends BaseService {
             "Content-Type": "application/x-duckdb"
           },
           body: new Blob([data]),
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         });
         if (!response.ok) {
           return this.handleErrorResponse(response, "import");
@@ -9412,6 +9557,8 @@ var DuckDbService = class extends BaseService {
         return ok(void 0);
       } catch (error) {
         return err(wrapError2("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -9427,7 +9574,7 @@ var DuckDbService = class extends BaseService {
         ...extraHeaders
       },
       body: JSON.stringify(body),
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   async handleErrorResponse(response, operation) {
@@ -14970,6 +15117,34 @@ async function commitLogin(profileName, snapshot, commit) {
   });
 }
 
+// src/auth/owner-key.ts
+init_theme();
+function openKeyPrimaryFlag(delegation) {
+  return typeof delegation.primary === "boolean" ? delegation.primary : void 0;
+}
+function withOwnerKeyPrimary(profile, primary) {
+  const { ownerKeyPrimary: _previous, ...rest } = profile;
+  return primary === void 0 ? rest : { ...rest, ownerKeyPrimary: primary };
+}
+function nonPrimaryKeyWarning(ownerDid) {
+  const address = ownerDid.split(":")[4] ?? ownerDid;
+  return `${theme.warn("Warning:")} you signed in with OpenKey key ${address} (${ownerDid}), which is not your account's primary OpenKey key. This key is a separate owner with its own spaces and data, so this profile does not see the data stored under your primary key.
+To use your primary key, log in again and choose the primary key in OpenKey, for example into a new profile: tc init --name <profile>
+`;
+}
+function warnIfNotPrimaryKey(ownerDid, primary) {
+  if (primary !== false || ownerDid === void 0) return;
+  process.stderr.write(nonPrimaryKeyWarning(ownerDid));
+}
+function ownerLoginPermissions(owner) {
+  const space = ownerSpaceId("default", owner);
+  return [
+    { service: "tinycloud.kv", space, path: "", actions: ["tinycloud.kv/put", "tinycloud.kv/get", "tinycloud.kv/del", "tinycloud.kv/list", "tinycloud.kv/metadata"] },
+    { service: "tinycloud.sql", space, path: "", actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/admin"] },
+    { service: "tinycloud.capabilities", space, path: "", actions: ["tinycloud.capabilities/read"] }
+  ];
+}
+
 // src/auth/device-auth.ts
 var DEVICE_DELEGATION_MAX_SECONDS = 30 * 24 * 60 * 60;
 var DEVICE_APPROVAL_WINDOW_MAX_SECONDS = 60 * 60;
@@ -15174,7 +15349,8 @@ async function verifyApproval(input) {
     spaceId: delegation.spaceId,
     expiresAt: session.expiresAt,
     approved: permissionsFromTuples(signed),
-    declined: declinedPermissions(input.requested, session.permissions, ownerDid)
+    declined: declinedPermissions(input.requested, session.permissions, ownerDid),
+    ...openKeyPrimaryFlag(delegation) === void 0 ? {} : { primary: openKeyPrimaryFlag(delegation) }
   };
 }
 function writeApprovalPrompt(prompt) {
@@ -15351,7 +15527,7 @@ async function loginWithDeviceAuthorization(input) {
     openkeyHost: input.openkeyHost ?? resolveDeviceApiHost(existing),
     expectedOwner
   });
-  const profile = {
+  const profile = withOwnerKeyPrimary({
     ...existing,
     name: input.profileName,
     host: input.persistHost === true || !existing?.host ? input.nodeOrigin : existing.host,
@@ -15365,7 +15541,7 @@ async function loginWithDeviceAuthorization(input) {
     posture: "owner-openkey",
     operatorType: existing?.operatorType ?? "human",
     authMethod: "openkey"
-  };
+  }, result.primary);
   await commitLogin(input.profileName, snapshot, {
     key,
     session: result.session,
@@ -15373,6 +15549,7 @@ async function loginWithDeviceAuthorization(input) {
     // The signed permissions, with their caveats; `approved` is the action summary.
     approved: { scope: result.session.permissions, ownerDid: result.ownerDid, replaceSession: input.replaceSession === true }
   });
+  warnIfNotPrimaryKey(result.ownerDid, result.primary);
   return { profile, result };
 }
 
@@ -15410,7 +15587,7 @@ async function promptAuthMethod() {
 }
 function registerAuthCommand(program) {
   const auth = program.command("auth").description("Authentication management");
-  auth.command("login").description("Authenticate with TinyCloud").option("--device", "Approve on another device (e.g. a phone) through OpenKey device authorization; requires a KV-scoped --manifest (SQL and secret decrypt need browser or --paste login)").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").option("--manifest <fileOrBase64>", `Request only this manifest's permissions (one space, plus raw encryption network entries such as a secrets decrypt grant); ${SHARE_PUBLISHING_MANIFEST_REF} covers \`tc share publish\``).option("--expiry <duration>", "OpenKey session lifetime, e.g. 1h or 7d (device login: at most 30d, default 30d)").option("--owner <did>", "Require this existing primary DID (did:pkh:eip155:CHAIN:ADDRESS) for scoped login; names the secrets owner for a manifest's `secrets` on a profile with no recorded owner").option("--replace-session", "Scoped or device login: replace this profile's live session even though the new scope would narrow, change or shorten it (prefer a new profile)").action(async (options, cmd) => {
+  auth.command("login").description("Authenticate with TinyCloud").option("--device", "Approve on another device (e.g. a phone) through OpenKey device authorization; requires a KV-scoped --manifest (SQL and secret decrypt need browser or --paste login)").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").option("--manifest <fileOrBase64>", `Request only this manifest's permissions (one space, plus raw encryption network entries such as a secrets decrypt grant); ${SHARE_PUBLISHING_MANIFEST_REF} covers \`tc share publish\``).option("--expiry <duration>", "OpenKey session lifetime, e.g. 1h or 7d (device login: at most 30d, default 30d)").option("--owner <did>", "Sign in as this owner (did:pkh:eip155:CHAIN:ADDRESS): OpenKey preselects that key, e.g. one that is not the account's primary key, and an approval by any other identity is refused. With --manifest, also names the secrets owner for a manifest's `secrets` on a profile with no recorded owner").option("--replace-session", "Scoped or device login: replace this profile's live session even though the new scope would narrow, change or shorten it (prefer a new profile)").action(async (options, cmd) => {
     try {
       if (options.device && options.paste) {
         throw new CLIError("INVALID_ARGUMENT", "--device and --paste are mutually exclusive.", ExitCode.USAGE_ERROR);
@@ -15419,9 +15596,6 @@ function registerAuthCommand(program) {
       if (scoped && options.method === "local") {
         throw new CLIError("INVALID_ARGUMENT", "--device, --manifest, --expiry and --owner require OpenKey login.", ExitCode.USAGE_ERROR);
       }
-      if (options.owner && !options.manifest) {
-        throw new CLIError("INVALID_ARGUMENT", "--owner requires --manifest so the signed identity is verified.", ExitCode.USAGE_ERROR);
-      }
       if (options.device && !options.manifest) {
         throw new CLIError(
           "MANIFEST_REQUIRED",
@@ -15544,6 +15718,7 @@ function registerAuthCommand(program) {
           did: profile?.did ?? null,
           sessionDid: profile?.sessionDid ?? null,
           ownerDid: profile?.ownerDid ?? null,
+          ownerKeyPrimary: profile?.ownerKeyPrimary ?? null,
           spaceId: profile?.spaceId ?? null,
           host: ctx.host,
           profile: ctx.profile,
@@ -15564,6 +15739,7 @@ function registerAuthCommand(program) {
         process.stdout.write(formatField("DID", profile?.did ?? null) + "\n");
         process.stdout.write(formatField("Session DID", profile?.sessionDid ?? null) + "\n");
         process.stdout.write(formatField("Owner DID", profile?.ownerDid ?? null) + "\n");
+        process.stdout.write(formatField("Primary Key", profile?.ownerKeyPrimary ?? "unknown") + "\n");
         process.stdout.write(formatField("Address", profile?.address ?? null) + "\n");
         process.stdout.write(formatField("Space ID", profile?.spaceId ?? null) + "\n");
         process.stdout.write(formatField("Has Key", hasKey !== null) + "\n");
@@ -16636,7 +16812,9 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     jwk: key,
     host,
     openkeyHost: resolveOpenKeyHost(profile),
-    permissions,
+    // A plain login with --owner names that owner's space, so OpenKey
+    // preselects its key; the signed owner is verified below.
+    permissions: permissions ?? (options.expectedOwner === void 0 ? void 0 : ownerLoginPermissions(expectedOwner)),
     expiry: openKeyExpiry,
     ...permissions ? { reason: "Allow this TinyCloud CLI profile to use the permissions in the requested manifest." } : {}
   });
@@ -16662,7 +16840,8 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
       sanitizedSession = Object.fromEntries(Object.entries(withoutTrustFields(merged)).filter(([name]) => name !== "siwe" && name !== "signature"));
     }
   }
-  const updatedProfile = {
+  const ownerKeyPrimary = verifiedOwner === void 0 ? void 0 : openKeyPrimaryFlag(delegationData);
+  const updatedProfile = withOwnerKeyPrimary({
     ...profile,
     host: options.persistHost === true || !profile.host ? host : profile.host,
     sessionDid: profile.sessionDid ?? profile.did,
@@ -16671,13 +16850,14 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     authMethod: "openkey",
     ...typeof sanitizedSession.spaceId === "string" ? { spaceId: sanitizedSession.spaceId } : {},
     ...verifiedOwner === void 0 ? {} : { ownerDid: verifiedOwner }
-  };
+  }, ownerKeyPrimary);
   await commitLogin(profileName, snapshot, {
     key,
     session: sanitizedSession,
     profile: updatedProfile,
     ...permissions && verifiedOwner ? { approved: { scope: sanitizedSession.permissions, ownerDid: verifiedOwner, replaceSession: options.replaceSession === true } } : {}
   });
+  warnIfNotPrimaryKey(verifiedOwner, ownerKeyPrimary);
   return { profile: updatedProfile, delegationData: sanitizedSession, declined, legacyNested };
 }