@tinycloud/cli 1.1.0-beta.11 → 1.1.0-beta.13

package/dist/legacy-entry.js

@@ -59,7 +59,9 @@ var init_constants = __esm({
       NOT_FOUND: 4,
       PERMISSION_DENIED: 5,
       NETWORK_ERROR: 6,
-      NODE_ERROR: 7
+      NODE_ERROR: 7,
+      /** A write was refused because the owner's TinyCloud storage is full. */
+      STORAGE_FULL: 10
     };
   }
 });
@@ -258,6 +260,86 @@ var init_formatter = __esm({
   }
 });
 
+// src/output/storage.ts
+function storageRejection(error) {
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null; depth += 1) {
+    const record = node;
+    let code3;
+    if (record.code === "STORAGE_QUOTA_EXCEEDED" || record.code === "STORAGE_LIMIT_REACHED") {
+      code3 = record.code;
+    } else if (record.code !== void 0) {
+      return void 0;
+    } else if (isStorageStatus(record)) {
+      code3 = storageCodeFromText(record.message);
+    }
+    if (code3) {
+      const account = accountTotals(record) ?? accountTotals(record.meta) ?? accountTotals(record.metadata);
+      return account ? { code: code3, account } : { code: code3 };
+    }
+    node = record.cause;
+  }
+  return void 0;
+}
+function describeStorageRejection(rejection, progress) {
+  const reason = rejection.code === "STORAGE_LIMIT_REACHED" ? "This write is larger than the TinyCloud storage you have left" : "TinyCloud storage is full";
+  const message = progress ? `${progress}${reason}.` : `${reason}; nothing was written.`;
+  const { account } = rejection;
+  const totals = account ? `${formatStorageBytes(account.usedBytes)} used of ${formatStorageBytes(account.limitBytes)}${account.plan ? ` (${account.plan} plan)` : ""}. ` : "";
+  return {
+    message,
+    hint: `${totals}Reading still works.
+Free up space or upgrade: ${MANAGE_STORAGE_URL}`
+  };
+}
+function formatStorageBytes(bytes) {
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  if (bytes < 1024) return `${bytes} B`;
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(1).replace(/\.0$/, "")} ${units[unit]}`;
+}
+function storageCodeFromText(message) {
+  if (typeof message !== "string") return void 0;
+  if (message.includes("larger than the TinyCloud storage you have left")) return "STORAGE_LIMIT_REACHED";
+  if (message.includes("TinyCloud storage is full") || /storage quota exceeded/i.test(message)) {
+    return "STORAGE_QUOTA_EXCEEDED";
+  }
+  return void 0;
+}
+function isStorageStatus(record) {
+  const meta = "meta" in record && typeof record.meta === "object" && record.meta !== null ? record.meta : {};
+  const statuses = [
+    "status" in record ? record.status : void 0,
+    "statusCode" in record ? record.statusCode : void 0,
+    "status" in meta ? meta.status : void 0
+  ];
+  return statuses.some((value) => value === 402 || value === 413);
+}
+function accountTotals(meta) {
+  if (typeof meta !== "object" || meta === null) return void 0;
+  const account = meta.account;
+  if (typeof account !== "object" || account === null) return void 0;
+  const { usedBytes, limitBytes, plan } = account;
+  if (!isByteCount(usedBytes) || !isByteCount(limitBytes) || limitBytes === 0) return void 0;
+  return typeof plan === "string" && /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/.test(plan) ? { usedBytes, limitBytes, plan } : { usedBytes, limitBytes };
+}
+function isByteCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var MANAGE_STORAGE_URL, MAX_CAUSE_DEPTH;
+var init_storage2 = __esm({
+  "src/output/storage.ts"() {
+    "use strict";
+    MANAGE_STORAGE_URL = "https://account.tinycloud.xyz/billing";
+    MAX_CAUSE_DEPTH = 4;
+  }
+});
+
 // src/output/errors.ts
 import { readFileSync, readdirSync } from "fs";
 import { join as join2 } from "path";
@@ -268,6 +350,8 @@ function setActiveProfileName(name) {
 }
 function cliErrorFromService(error, message = error.message) {
   if (error instanceof CLIError) return error;
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   const meta = { ...error.meta };
   delete meta.hint;
   const status = error.status ?? error.statusCode;
@@ -286,6 +370,8 @@ function cliErrorFromService(error, message = error.message) {
   );
 }
 function wrapError(error) {
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   if (error instanceof CLIError) return error;
   const message = error instanceof Error ? error.message : String(error);
   const verdict = authorizationVerdictOf(error);
@@ -332,6 +418,13 @@ function missingPrivateKeyError() {
     { hint: `Sign in again with: tc --profile ${profileName} auth login --method openkey` }
   );
 }
+function storageFullError(error, progress) {
+  if (error instanceof CLIError && error.exitCode === ExitCode.STORAGE_FULL) return error;
+  const rejection = storageRejection(error);
+  if (!rejection) return void 0;
+  const { message, hint } = describeStorageRejection(rejection, progress);
+  return new CLIError(rejection.code, message, ExitCode.STORAGE_FULL, { hint });
+}
 function handleError(error) {
   const cliError = wrapError(error);
   const prebuilt = typeof cliError.metadata?.hint === "string" ? cliError.metadata.hint : void 0;
@@ -414,6 +507,7 @@ var init_errors = __esm({
     "use strict";
     init_constants();
     init_formatter();
+    init_storage2();
     CLIError = class extends Error {
       constructor(code3, message, exitCode = ExitCode.ERROR, metadata) {
         super(message);
@@ -7055,7 +7149,7 @@ function validatedCapabilityOf2(error) {
   if (verdict !== "unauthenticated" && verdict !== "forbidden") return void 0;
   const seen = /* @__PURE__ */ new Set();
   let node = error;
-  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH2 && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
     seen.add(node);
     const record = node;
     const status = errorStatusOf(record);
@@ -7075,7 +7169,7 @@ function validatedCapabilityOf2(error) {
   }
   return void 0;
 }
-var MAX_CAUSE_DEPTH = 8;
+var MAX_CAUSE_DEPTH2 = 8;
 function errorStatusOf(node) {
   const meta = node.meta;
   const candidates = [
@@ -7094,7 +7188,7 @@ function authorizationVerdictOf2(error) {
   const seen = /* @__PURE__ */ new Set();
   let sawUnauthorizedCode = false;
   let node = error;
-  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH2 && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
     seen.add(node);
     const record = node;
     const status = errorStatusOf(record);
@@ -15117,6 +15211,34 @@ async function commitLogin(profileName, snapshot, commit) {
   });
 }
 
+// src/auth/owner-key.ts
+init_theme();
+function openKeyPrimaryFlag(delegation) {
+  return typeof delegation.primary === "boolean" ? delegation.primary : void 0;
+}
+function withOwnerKeyPrimary(profile, primary) {
+  const { ownerKeyPrimary: _previous, ...rest } = profile;
+  return primary === void 0 ? rest : { ...rest, ownerKeyPrimary: primary };
+}
+function nonPrimaryKeyWarning(ownerDid) {
+  const address = ownerDid.split(":")[4] ?? ownerDid;
+  return `${theme.warn("Warning:")} you signed in with OpenKey key ${address} (${ownerDid}), which is not your account's primary OpenKey key. This key is a separate owner with its own spaces and data, so this profile does not see the data stored under your primary key.
+To use your primary key, log in again and choose the primary key in OpenKey, for example into a new profile: tc init --name <profile>
+`;
+}
+function warnIfNotPrimaryKey(ownerDid, primary) {
+  if (primary !== false || ownerDid === void 0) return;
+  process.stderr.write(nonPrimaryKeyWarning(ownerDid));
+}
+function ownerLoginPermissions(owner) {
+  const space = ownerSpaceId("default", owner);
+  return [
+    { service: "tinycloud.kv", space, path: "", actions: ["tinycloud.kv/put", "tinycloud.kv/get", "tinycloud.kv/del", "tinycloud.kv/list", "tinycloud.kv/metadata"] },
+    { service: "tinycloud.sql", space, path: "", actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/admin"] },
+    { service: "tinycloud.capabilities", space, path: "", actions: ["tinycloud.capabilities/read"] }
+  ];
+}
+
 // src/auth/device-auth.ts
 var DEVICE_DELEGATION_MAX_SECONDS = 30 * 24 * 60 * 60;
 var DEVICE_APPROVAL_WINDOW_MAX_SECONDS = 60 * 60;
@@ -15321,7 +15443,8 @@ async function verifyApproval(input) {
     spaceId: delegation.spaceId,
     expiresAt: session.expiresAt,
     approved: permissionsFromTuples(signed),
-    declined: declinedPermissions(input.requested, session.permissions, ownerDid)
+    declined: declinedPermissions(input.requested, session.permissions, ownerDid),
+    ...openKeyPrimaryFlag(delegation) === void 0 ? {} : { primary: openKeyPrimaryFlag(delegation) }
   };
 }
 function writeApprovalPrompt(prompt) {
@@ -15498,7 +15621,7 @@ async function loginWithDeviceAuthorization(input) {
     openkeyHost: input.openkeyHost ?? resolveDeviceApiHost(existing),
     expectedOwner
   });
-  const profile = {
+  const profile = withOwnerKeyPrimary({
     ...existing,
     name: input.profileName,
     host: input.persistHost === true || !existing?.host ? input.nodeOrigin : existing.host,
@@ -15512,7 +15635,7 @@ async function loginWithDeviceAuthorization(input) {
     posture: "owner-openkey",
     operatorType: existing?.operatorType ?? "human",
     authMethod: "openkey"
-  };
+  }, result.primary);
   await commitLogin(input.profileName, snapshot, {
     key,
     session: result.session,
@@ -15520,6 +15643,7 @@ async function loginWithDeviceAuthorization(input) {
     // The signed permissions, with their caveats; `approved` is the action summary.
     approved: { scope: result.session.permissions, ownerDid: result.ownerDid, replaceSession: input.replaceSession === true }
   });
+  warnIfNotPrimaryKey(result.ownerDid, result.primary);
   return { profile, result };
 }
 
@@ -15557,7 +15681,7 @@ async function promptAuthMethod() {
 }
 function registerAuthCommand(program) {
   const auth = program.command("auth").description("Authentication management");
-  auth.command("login").description("Authenticate with TinyCloud").option("--device", "Approve on another device (e.g. a phone) through OpenKey device authorization; requires a KV-scoped --manifest (SQL and secret decrypt need browser or --paste login)").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").option("--manifest <fileOrBase64>", `Request only this manifest's permissions (one space, plus raw encryption network entries such as a secrets decrypt grant); ${SHARE_PUBLISHING_MANIFEST_REF} covers \`tc share publish\``).option("--expiry <duration>", "OpenKey session lifetime, e.g. 1h or 7d (device login: at most 30d, default 30d)").option("--owner <did>", "Require this existing primary DID (did:pkh:eip155:CHAIN:ADDRESS) for scoped login; names the secrets owner for a manifest's `secrets` on a profile with no recorded owner").option("--replace-session", "Scoped or device login: replace this profile's live session even though the new scope would narrow, change or shorten it (prefer a new profile)").action(async (options, cmd) => {
+  auth.command("login").description("Authenticate with TinyCloud").option("--device", "Approve on another device (e.g. a phone) through OpenKey device authorization; requires a KV-scoped --manifest (SQL and secret decrypt need browser or --paste login)").option("--paste", "Use manual paste mode instead of browser callback").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--method <method>", "Authentication method: local or openkey").option("--manifest <fileOrBase64>", `Request only this manifest's permissions (one space, plus raw encryption network entries such as a secrets decrypt grant); ${SHARE_PUBLISHING_MANIFEST_REF} covers \`tc share publish\``).option("--expiry <duration>", "OpenKey session lifetime, e.g. 1h or 7d (device login: at most 30d, default 30d)").option("--owner <did>", "Sign in as this owner (did:pkh:eip155:CHAIN:ADDRESS): OpenKey preselects that key, e.g. one that is not the account's primary key, and an approval by any other identity is refused. With --manifest, also names the secrets owner for a manifest's `secrets` on a profile with no recorded owner").option("--replace-session", "Scoped or device login: replace this profile's live session even though the new scope would narrow, change or shorten it (prefer a new profile)").action(async (options, cmd) => {
     try {
       if (options.device && options.paste) {
         throw new CLIError("INVALID_ARGUMENT", "--device and --paste are mutually exclusive.", ExitCode.USAGE_ERROR);
@@ -15566,9 +15690,6 @@ function registerAuthCommand(program) {
       if (scoped && options.method === "local") {
         throw new CLIError("INVALID_ARGUMENT", "--device, --manifest, --expiry and --owner require OpenKey login.", ExitCode.USAGE_ERROR);
       }
-      if (options.owner && !options.manifest) {
-        throw new CLIError("INVALID_ARGUMENT", "--owner requires --manifest so the signed identity is verified.", ExitCode.USAGE_ERROR);
-      }
       if (options.device && !options.manifest) {
         throw new CLIError(
           "MANIFEST_REQUIRED",
@@ -15691,6 +15812,7 @@ function registerAuthCommand(program) {
           did: profile?.did ?? null,
           sessionDid: profile?.sessionDid ?? null,
           ownerDid: profile?.ownerDid ?? null,
+          ownerKeyPrimary: profile?.ownerKeyPrimary ?? null,
           spaceId: profile?.spaceId ?? null,
           host: ctx.host,
           profile: ctx.profile,
@@ -15711,6 +15833,7 @@ function registerAuthCommand(program) {
         process.stdout.write(formatField("DID", profile?.did ?? null) + "\n");
         process.stdout.write(formatField("Session DID", profile?.sessionDid ?? null) + "\n");
         process.stdout.write(formatField("Owner DID", profile?.ownerDid ?? null) + "\n");
+        process.stdout.write(formatField("Primary Key", profile?.ownerKeyPrimary ?? "unknown") + "\n");
         process.stdout.write(formatField("Address", profile?.address ?? null) + "\n");
         process.stdout.write(formatField("Space ID", profile?.spaceId ?? null) + "\n");
         process.stdout.write(formatField("Has Key", hasKey !== null) + "\n");
@@ -16783,7 +16906,9 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     jwk: key,
     host,
     openkeyHost: resolveOpenKeyHost(profile),
-    permissions,
+    // A plain login with --owner names that owner's space, so OpenKey
+    // preselects its key; the signed owner is verified below.
+    permissions: permissions ?? (options.expectedOwner === void 0 ? void 0 : ownerLoginPermissions(expectedOwner)),
     expiry: openKeyExpiry,
     ...permissions ? { reason: "Allow this TinyCloud CLI profile to use the permissions in the requested manifest." } : {}
   });
@@ -16809,7 +16934,8 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
       sanitizedSession = Object.fromEntries(Object.entries(withoutTrustFields(merged)).filter(([name]) => name !== "siwe" && name !== "signature"));
     }
   }
-  const updatedProfile = {
+  const ownerKeyPrimary = verifiedOwner === void 0 ? void 0 : openKeyPrimaryFlag(delegationData);
+  const updatedProfile = withOwnerKeyPrimary({
     ...profile,
     host: options.persistHost === true || !profile.host ? host : profile.host,
     sessionDid: profile.sessionDid ?? profile.did,
@@ -16818,13 +16944,14 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     authMethod: "openkey",
     ...typeof sanitizedSession.spaceId === "string" ? { spaceId: sanitizedSession.spaceId } : {},
     ...verifiedOwner === void 0 ? {} : { ownerDid: verifiedOwner }
-  };
+  }, ownerKeyPrimary);
   await commitLogin(profileName, snapshot, {
     key,
     session: sanitizedSession,
     profile: updatedProfile,
     ...permissions && verifiedOwner ? { approved: { scope: sanitizedSession.permissions, ownerDid: verifiedOwner, replaceSession: options.replaceSession === true } } : {}
   });
+  warnIfNotPrimaryKey(verifiedOwner, ownerKeyPrimary);
   return { profile: updatedProfile, delegationData: sanitizedSession, declined, legacyNested };
 }
 
@@ -17498,15 +17625,6 @@ async function throwKvError(error, spaceUri, profileName) {
   if (hosted) throw hosted;
   throw cliErrorFromService(error);
 }
-function isByteCount(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
-function storageQuotaError(error) {
-  if (error.code !== "STORAGE_QUOTA_EXCEEDED") return void 0;
-  const { usedBytes, limitBytes } = typeof error.meta === "object" && error.meta !== null ? error.meta : {};
-  const sizes = isByteCount(usedBytes) && isByteCount(limitBytes) ? ` (${formatBytes(usedBytes)} used of ${formatBytes(limitBytes)} limit)` : "";
-  return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was written`, ExitCode.ERROR);
-}
 function assertAddressableKey(key) {
   for (let i = 0; i < key.length; i++) {
     const code3 = key.charCodeAt(i);
@@ -17602,8 +17720,6 @@ function registerKvCommand(program) {
       const { kv: kv2, spaceUri } = await kvHandle(node, options.space, ctx.profile);
       const result = await withSpinner(`Writing ${key}...`, () => kv2.put(key, putValue));
       if (!result.ok) {
-        const quota = storageQuotaError(result.error);
-        if (quota) throw quota;
         await throwKvError(result.error, spaceUri, ctx.profile);
       }
       outputJson({ key, written: true });
@@ -29279,7 +29395,6 @@ var MAX_INLINE_BYTES2 = 256 * 1024;
 
 // src/commands/share.ts
 import { ProfileLockTimeoutError as ProfileLockTimeoutError3 } from "@tinycloud/operations/state";
-init_formatter();
 init_errors();
 
 // src/share/output.ts
@@ -29542,9 +29657,8 @@ function shareCliError(error, operation = "publish") {
     if (failure.kind === "registry-rejected") {
       return new CLIError("REGISTRY_REJECTED", "the TinyCloud location registry rejected this session's location record, so nothing was shared; retrying will not help. Log in again, and report the problem if it persists", 6);
     }
-    if (failure.kind === "storage-quota-exceeded") {
-      const sizes = failure.usedBytes === void 0 || failure.limitBytes === void 0 ? "" : ` (${formatBytes(failure.usedBytes)} used of ${formatBytes(failure.limitBytes)} limit)`;
-      return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was shared`, 4);
+    if (failure.kind === "storage-full") {
+      return storageFullError(failure);
     }
     if (failure.kind === "upload-failed") {
       return new CLIError("UPLOAD_FAILED", "share source upload failed; nothing was shared", 4);
@@ -29564,6 +29678,8 @@ function shareCliError(error, operation = "publish") {
     const code3 = error.code === "fetch-failed" ? "NOT_FOUND" : error.code.replaceAll("-", "_").toUpperCase();
     return new CLIError(code3, error.message, exit);
   }
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   const message = error instanceof Error ? error.message : String(error);
   const nodeCode = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
   const known = {
@@ -30021,6 +30137,8 @@ async function dbHandle(node, dbName, spaceInput, profileName) {
   return { handle: sql.db(dbName), spaceUri };
 }
 async function throwSqlError(error, spaceUri, profileName, prefix) {
+  const storageFull = storageFullError(error, prefix);
+  if (storageFull) throw storageFull;
   const hosted = await unhostedSpaceError(error, spaceUri, profileName);
   if (hosted) throw hosted;
   const message = prefix ? `${prefix}${error.message}` : error.message;