@tinycloud/cli 1.1.0-beta.13 → 1.1.0-beta.14

package/dist/legacy-entry.js

@@ -165,8 +165,14 @@ import ora from "ora";
 function outputJson(data) {
   process.stdout.write(JSON.stringify(data, null, 2) + "\n");
 }
-function outputError(code3, message, hint, meta) {
-  if (isInteractive()) {
+function warningLine(warnings) {
+  const which = warnings.map((warning) => `${warning.grantCid ?? "unidentified"}: ${warning.reason}`).join(", ");
+  const subject = warnings.length === 1 ? "A stored grant was" : `${warnings.length} stored grants were`;
+  return `${subject} not used (${which}). Approve access again when a command needs it; the old grant expires on its own.`;
+}
+function outputError(code3, message, hint, details = {}) {
+  const { meta, warnings = [] } = details;
+  if (!shouldOutputJson()) {
     process.stderr.write(
       `${theme.error("\u2717")} ${theme.label(code3)}: ${message}
 `
@@ -177,20 +183,40 @@ function outputError(code3, message, hint, meta) {
 `);
       }
     }
+    if (warnings.length > 0) process.stderr.write(`  ${theme.warn(warningLine(warnings))}
+`);
   } else {
     const payload = {
       error: { code: code3, message }
     };
     if (hint) payload.error.hint = hint;
     if (meta) payload.error.meta = meta;
+    if (warnings.length > 0) payload.error.warnings = warnings;
     process.stderr.write(JSON.stringify(payload, null, 2) + "\n");
   }
 }
+function outputWarnings(warnings) {
+  if (warnings.length === 0) return;
+  process.stderr.write(shouldOutputJson() ? `${JSON.stringify({ warnings })}
+` : `${theme.warn("!")} ${warningLine(warnings)}
+`);
+}
+function operationWarnings(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((warning) => {
+    if (warning === null || typeof warning !== "object") return [];
+    const { code: code3, reason, grantCid } = warning;
+    if (typeof code3 !== "string" || !WARNING_CODE.test(code3) || typeof reason !== "string" || !WARNING_REASON.test(reason)) {
+      return [];
+    }
+    return [{ code: code3, reason, ...typeof grantCid === "string" && DELEGATION_CID.test(grantCid) ? { grantCid } : {} }];
+  });
+}
 function isInteractive() {
   return Boolean(process.stdout.isTTY);
 }
 async function withSpinner(label, fn) {
-  if (!isInteractive()) {
+  if (shouldOutputJson()) {
     return fn();
   }
   const spinner = ora(label).start();
@@ -204,7 +230,7 @@ async function withSpinner(label, fn) {
   }
 }
 function shouldOutputJson() {
-  return !isInteractive() || process.argv.includes("--json");
+  return !isInteractive() || (globalThis[JSON_REQUESTED] ?? process.argv.includes("--json"));
 }
 function formatField(label, value) {
   if (value === null || value === void 0) return `  ${theme.label(label + ":")} ${theme.muted("\u2014")}`;
@@ -253,10 +279,15 @@ function formatTimeAgo(date) {
   if (seconds < 86400) return `${Math.floor(seconds / 3600)}h ago`;
   return `${Math.floor(seconds / 86400)}d ago`;
 }
+var WARNING_CODE, WARNING_REASON, DELEGATION_CID, JSON_REQUESTED;
 var init_formatter = __esm({
   "src/output/formatter.ts"() {
     "use strict";
     init_theme();
+    WARNING_CODE = /^[A-Z][A-Z_]{0,63}$/;
+    WARNING_REASON = /^[a-z][a-z_]{0,63}$/;
+    DELEGATION_CID = /^bafkr4i[a-z2-7]{52}$/;
+    JSON_REQUESTED = /* @__PURE__ */ Symbol.for("tinycloud.cli.jsonOutputRequested");
   }
 });
 
@@ -361,11 +392,12 @@ function cliErrorFromService(error, message = error.message) {
     return missingPrivateKeyError();
   }
   const missingCapability = validatedCapabilityOf({ ...error, meta }) !== void 0;
-  const denied = verdict === "forbidden" || verdict === "unauthenticated" && missingCapability;
+  const denied = verdict === "forbidden" || verdict === "unauthenticated" && missingCapability || verdict === void 0 && error.code === "PERMISSION_DENIED";
+  const unauthenticated = !denied && (verdict === "unauthenticated" || verdict === void 0 && error.code === "AUTH_REQUIRED");
   return new CLIError(
-    denied ? "PERMISSION_DENIED" : verdict === "unauthenticated" ? "AUTH_REQUIRED" : error.code,
+    denied ? "PERMISSION_DENIED" : unauthenticated ? "AUTH_REQUIRED" : error.code,
     message,
-    denied ? ExitCode.PERMISSION_DENIED : verdict === "unauthenticated" ? ExitCode.AUTH_REQUIRED : ExitCode.ERROR,
+    denied ? ExitCode.PERMISSION_DENIED : unauthenticated ? ExitCode.AUTH_REQUIRED : ExitCode.ERROR,
     meta
   );
 }
@@ -437,7 +469,10 @@ function handleError(error) {
     meta.resource = capability.resource;
     meta.requiredAction = capability.requiredAction;
   }
-  outputError(cliError.code, cliError.message, hint, Object.keys(meta).length ? meta : void 0);
+  outputError(cliError.code, cliError.message, hint, {
+    ...Object.keys(meta).length ? { meta } : {},
+    warnings: operationWarnings(cliError.metadata?.warnings)
+  });
   process.exit(cliError.exitCode);
 }
 function buildAuthHint(error) {
@@ -13471,6 +13506,10 @@ function canonicalOwnerDid(did, label = "--owner") {
   }
   return `did:pkh:eip155:${match[1]}:${ensureEip55(match[2])}`;
 }
+function canonicalNetworkUrn(path) {
+  const match = /^urn:tinycloud:encryption:(did:pkh:eip155:[1-9]\d*:0x[0-9a-fA-F]{40}):([^:]*)$/.exec(path);
+  return match ? `urn:tinycloud:encryption:${canonicalOwnerDid(match[1])}:${match[2]}` : path;
+}
 function rawEncryptionOwnerMatches(path, ownerDid) {
   const match = /^urn:tinycloud:encryption:(did:pkh:eip155:.+):([a-z0-9][a-z0-9-]*)$/.exec(path);
   if (!match) return false;
@@ -13613,13 +13652,14 @@ async function replayAdditionalDelegations(node, profile, options) {
   for (const stored of entries) {
     const kind = storedDelegationKind(stored);
     if (kind === "compact" || kind === "signed-login") {
-      const installed = await replayStoredDelegation(activator, stored, {
+      const replay = await replayStoredDelegation(activator, stored, {
         host: options.host,
         migrated,
         resolveSpace
       });
-      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
+      if (replay.status === "skipped" && process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write(`[replay] skipping a stored delegation: ${replay.reason}
+`);
       }
       continue;
     }
@@ -13649,6 +13689,14 @@ async function replayAdditionalDelegations(node, profile, options) {
 function storedAdditionalDelegation(delegation, permissions) {
   return { delegation, permissions };
 }
+async function cliGrantRecord(node, delegation, permissions, host) {
+  const { bindCliGrant } = await import("@tinycloud/operations/delegation-binding");
+  return bindCliGrant(
+    node,
+    storedAdditionalDelegation(delegation, permissions),
+    host
+  );
+}
 async function appendGrantHistory(profile, entry) {
   await ProfileManager.ensureProfileDir(profile);
   const line = JSON.stringify({
@@ -13803,7 +13851,8 @@ function permissionsFromDelegation(delegation) {
 }
 function compactPermission(permission) {
   const service = permission.service;
-  const space = permission.space.startsWith("tinycloud:") ? permission.space.slice(permission.space.lastIndexOf(":") + 1) : permission.space;
+  const fullSpace = permission.space ?? (isRawEncryptionPermission(permission) ? ENCRYPTION_MANIFEST_SPACE2 : "");
+  const space = fullSpace.startsWith("tinycloud:") ? fullSpace.slice(fullSpace.lastIndexOf(":") + 1) : fullSpace;
   const actions = permission.actions.map((action) => action.startsWith(`${service}/`) ? action.slice(service.length + 1) : action).join(",");
   return `${service}:${space}:${permission.path}:${actions}`;
 }
@@ -13899,6 +13948,35 @@ function serviceFromActions(actions) {
   return first.includes("/") ? first.slice(0, first.indexOf("/")) : "tinycloud.unknown";
 }
 
+// src/auth/session-expired.ts
+init_constants();
+init_errors();
+var SESSION_EXPIRED_REASON = "session_expired";
+function signInAgainHint(profileName, posture) {
+  if (posture === "local-owner-key") {
+    return `Sign in again with: tc --profile ${profileName} auth login --method local`;
+  }
+  if (posture === "delegate-session") {
+    return `Have the owner approve a new scoped login: tc --profile ${profileName} auth login --method openkey --paste --manifest <manifest.json>. Pass the owner's code on stdin, newline-terminated.`;
+  }
+  return `Sign in again with: tc --profile ${profileName} auth login --method openkey`;
+}
+function sessionExpiredError(profileName, posture) {
+  return new CLIError(
+    "AUTH_REQUIRED",
+    `The session for profile "${profileName}" has expired or is no longer valid.`,
+    ExitCode.AUTH_REQUIRED,
+    { hint: signInAgainHint(profileName, posture), reason: SESSION_EXPIRED_REASON }
+  );
+}
+function withSignInHint(error, profileName, posture) {
+  if (error.code !== "AUTH_REQUIRED") return error;
+  return new CLIError(error.code, error.message, error.exitCode, {
+    ...error.metadata,
+    hint: signInAgainHint(profileName, posture)
+  });
+}
+
 // src/lib/sdk.ts
 function jwkHasPrivateParameter(jwk) {
   if (!jwk || typeof jwk !== "object") return false;
@@ -13925,6 +14003,16 @@ function signerJwkForProfile(profileName, sessionJwk, key) {
     }
   );
 }
+async function restoreProfileSession(node, profileName, profile, sessionData) {
+  try {
+    await node.restoreSession(sessionData);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
+      throw sessionExpiredError(profileName, profile === null ? void 0 : resolveProfilePosture(profile));
+    }
+    throw error;
+  }
+}
 async function createSDKInstance(ctx, options) {
   const profile = options?.privateKey ? await ProfileManager.getProfile(ctx.profile).catch(() => null) : await ProfileManager.getProfile(ctx.profile);
   const session = await ProfileManager.getSession(ctx.profile);
@@ -13944,7 +14032,7 @@ async function createSDKInstance(ctx, options) {
     });
     let restoredOwnSession2 = false;
     if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-      await node2.restoreSession({
+      await restoreProfileSession(node2, ctx.profile, profile, {
         delegationHeader: session.delegationHeader,
         delegationCid: session.delegationCid,
         spaceId: session.spaceId,
@@ -13974,7 +14062,7 @@ async function createSDKInstance(ctx, options) {
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-    await node.restoreSession({
+    await restoreProfileSession(node, ctx.profile, profile, {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
       spaceId: session.spaceId,
@@ -14556,6 +14644,41 @@ function validateDelegationCallbackPayload(value) {
   }
   return null;
 }
+async function delegationFromInput(input, did, options) {
+  const trimmed = input.trim();
+  let parsed;
+  if (/^[a-z2-7]{4}-[a-z2-7]{4}$/i.test(trimmed)) {
+    if (!options.jwk) throw new Error("A CLI session key is required to retrieve a delegation.");
+    const apiHost = process.env.TC_OPENKEY_API_HOST ?? options.openkeyApiHost ?? (options.openkeyHost && options.openkeyHost !== DEFAULT_OPENKEY_HOST ? options.openkeyHost : DEFAULT_OPENKEY_DEVICE_API_HOST);
+    const response = await fetch(`${apiHost.replace(/\/$/, "")}/api/delegation-codes/${trimmed.toLowerCase()}`, {
+      redirect: "error"
+    });
+    if (!response.ok) {
+      throw new Error(response.status === 404 ? "Delegation code not found or expired. Use the full code shown in OpenKey instead." : `Could not retrieve delegation code (HTTP ${response.status}).`);
+    }
+    const result = await response.json();
+    parsed = result.delegation;
+    const delegation = parsed;
+    const jwk = delegation?.jwk;
+    const localJwk = publicJwkForDelegation(options.jwk);
+    if (typeof delegation?.verificationMethod !== "string" || delegation.verificationMethod.split("#")[0] !== did.split("#")[0] || !jwk || typeof jwk !== "object" || Array.isArray(jwk) || jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string" || jwk.x !== localJwk.x || [...PRIVATE_JWK_FIELDS].some((field) => field in jwk)) {
+      throw new Error("Delegation is bound to a different CLI key.");
+    }
+  } else {
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      try {
+        parsed = JSON.parse(Buffer.from(trimmed, "base64").toString("utf-8"));
+      } catch {
+        throw new Error("Invalid delegation code. Expected JSON, base64-encoded JSON, or XXXX-XXXX.");
+      }
+    }
+  }
+  const invalid = validateDelegationCallbackPayload(parsed);
+  if (invalid) throw new Error(`Invalid delegation code: ${invalid}`);
+  return parsed;
+}
 function shouldOpenBrowser(options) {
   if (options.noPopup) return false;
   const env = process.env.TC_AUTH_NO_POPUP ?? process.env.TC_NO_POPUP;
@@ -14580,21 +14703,6 @@ async function callbackFlow(did, options = {}) {
         reject(result.error);
       }
     }
-    function parsePasteInput(input) {
-      const trimmed = input.trim();
-      let parsed;
-      try {
-        parsed = JSON.parse(trimmed);
-      } catch {
-        const decoded = Buffer.from(trimmed, "base64").toString("utf-8");
-        parsed = JSON.parse(decoded);
-      }
-      const invalid = validateDelegationCallbackPayload(parsed);
-      if (invalid) {
-        throw new Error(`Invalid delegation code: ${invalid}`);
-      }
-      return parsed;
-    }
     const server = createServer((req, res) => {
       if (req.method === "POST" && req.url === "/callback") {
         let body = "";
@@ -14663,18 +14771,21 @@ async function callbackFlow(did, options = {}) {
       }
       if (process.stdin.isTTY) {
         console.error(`
-If the browser can't connect back, paste the delegation code here:`);
+If the browser can't connect back, enter the short code or paste the full delegation code here:`);
         rl = createInterface({
           input: process.stdin,
           output: process.stderr
         });
-        rl.on("line", (input) => {
-          if (settled) return;
+        let resolving = false;
+        rl.on("line", async (input) => {
+          if (settled || resolving) return;
+          resolving = true;
           try {
-            const data = parsePasteInput(input);
-            settle({ data });
-          } catch {
-            console.error("Invalid delegation code. Expected JSON or base64-encoded JSON. Try again:");
+            settle({ data: await delegationFromInput(input, did, options) });
+          } catch (error) {
+            console.error(error instanceof Error ? error.message : "Invalid delegation code. Try again:");
+          } finally {
+            resolving = false;
           }
         });
       }
@@ -14701,24 +14812,7 @@ Open this URL in a browser to authenticate:
       if (answered || input.trim() === "") return;
       answered = true;
       rl.close();
-      let parsed;
-      try {
-        parsed = JSON.parse(input.trim());
-      } catch {
-        try {
-          const decoded = Buffer.from(input.trim(), "base64").toString("utf-8");
-          parsed = JSON.parse(decoded);
-        } catch {
-          reject(new Error("Invalid delegation code. Expected JSON or base64-encoded JSON."));
-          return;
-        }
-      }
-      const invalid = validateDelegationCallbackPayload(parsed);
-      if (invalid) {
-        reject(new Error(`Invalid delegation code: ${invalid}`));
-        return;
-      }
-      resolve4(parsed);
+      void delegationFromInput(input, did, options).then(resolve4, reject);
     });
     rl.on("close", () => {
       if (answered) return;
@@ -14733,7 +14827,7 @@ Open this URL in a browser to authenticate:
         }
       ));
     });
-    rl.setPrompt("Paste delegation code: ");
+    rl.setPrompt("Enter short code or paste full delegation code: ");
     rl.prompt();
   });
 }
@@ -15017,7 +15111,13 @@ function validateLoginPermissions(permissions) {
   }
 }
 function scopedLoginPermissions(permissions) {
-  const space = permissions.find((p) => !isRawEncryptionPermission(p)).space ?? "";
+  return withCapabilitiesRead(permissions, permissions.find((p) => !isRawEncryptionPermission(p)).space ?? "");
+}
+function grantRequestPermissions(group, anchorSpace) {
+  const request = group.map((p) => isRawEncryptionPermission(p) ? { ...p, space: ENCRYPTION_MANIFEST_SPACE2, path: canonicalNetworkUrn(p.path) } : p);
+  return withCapabilitiesRead(request, request.find((p) => !isRawEncryptionPermission(p))?.space ?? anchorSpace);
+}
+function withCapabilitiesRead(permissions, space) {
   const hasRead = permissions.some((p) => p.service === "tinycloud.capabilities" && p.path === "" && p.actions.includes(CAPABILITIES_READ) && normalizePkhIdentifier(p.space ?? "") === normalizePkhIdentifier(space));
   return hasRead ? permissions : [{ service: "tinycloud.capabilities", space, path: "", actions: [CAPABILITIES_READ] }, ...permissions];
 }
@@ -15904,6 +16004,7 @@ function registerAuthCommand(program) {
             "Grant requested TinyCloud permissions from `tc auth request --grant`.",
             group
           );
+          const request = grantRequestPermissions(group, profile.spaceId ?? profile.spaceName);
           let delegationData;
           if (options.device) {
             const approval = await acquireDeviceDelegation({
@@ -15911,7 +16012,7 @@ function registerAuthCommand(program) {
               jwk: key,
               nodeOrigin: ctx.host,
               shareOrigin: DEFAULT_SHARE_ORIGIN,
-              permissions: group,
+              permissions: request,
               expiry: parseRequestedExpiry(expiryOption ?? "7d"),
               reason,
               expectedOwner: pinnedOwner(profile),
@@ -15923,17 +16024,17 @@ function registerAuthCommand(program) {
             delegationData = await startAuthFlow(profile.did, {
               jwk: key,
               host: ctx.host,
-              permissions: group,
+              permissions: request,
               reason,
               openkeyHost,
               expiry: expiryCap === void 0 ? void 0 : openKeyExpiryParam(expiryCap),
               noPopup: options.popup === false
             });
           }
-          const delegation = portableFromOpenKeyDelegation(delegationData, group, ctx.host, proof);
+          const delegation = portableFromOpenKeyDelegation(delegationData, request, ctx.host, proof);
           grants.push({ delegation, effective: permissionsFromDelegation(delegation) });
         }
-        await activateAndStoreOpenKeyGrants(ctx.profile, node, grants, options.manifest ? "manifest" : "cli");
+        await activateAndStoreOpenKeyGrants(ctx.profile, ctx.host, node, grants, options.manifest ? "manifest" : "cli");
         const delegationCids2 = grants.map(({ delegation }) => delegation.cid);
         const expiry2 = grants.at(-1)?.delegation.expiry.toISOString();
         reportDeclined(declined);
@@ -15969,8 +16070,7 @@ function registerAuthCommand(program) {
       for (const delegation of delegations) {
         const covering = permissionsFromDelegation(delegation);
         localEffective.push(...covering);
-        const stored = storedAdditionalDelegation(delegation, covering);
-        await appendAdditionalDelegation(ctx.profile, stored);
+        await appendAdditionalDelegation(ctx.profile, await cliGrantRecord(node, delegation, covering, ctx.host));
         delegationCids.push(delegation.cid);
         expiry = delegation.expiry.toISOString();
         await appendGrantHistory(ctx.profile, {
@@ -16392,6 +16492,8 @@ async function importRequestBoundDelegation(ctx, artifact) {
     { profile: ctx.profile, host: ctx.host, allowOwnerProfile: true },
     artifact
   );
+  const warnings = operationWarnings(result.warnings);
+  const metadata = warnings.length === 0 ? void 0 : { warnings };
   switch (result.status) {
     case "ok": {
       const output2 = result.output;
@@ -16404,22 +16506,25 @@ async function importRequestBoundDelegation(ctx, artifact) {
         permissions: output2.effectivePermissions,
         expiry: output2.expiry
       });
+      outputWarnings(warnings);
       return;
     }
     case "authority_required":
       throw new CLIError(
         "AUTHORITY_REQUIRED",
         "The active session requires additional authority before importing this delegation.",
-        ExitCode.PERMISSION_DENIED
+        ExitCode.PERMISSION_DENIED,
+        metadata
       );
     case "setup_required":
       throw new CLIError(
         "SETUP_REQUIRED",
         "The active profile requires setup before importing this delegation.",
-        ExitCode.ERROR
+        ExitCode.ERROR,
+        metadata
       );
     case "error":
-      throw cliErrorFromService(result.error);
+      throw withSignInHint(cliErrorFromService({ ...result.error, meta: metadata }), ctx.profile, result.context.posture);
   }
 }
 function isStoredDelegationLike(value) {
@@ -16444,9 +16549,10 @@ function normalizePortableDelegation(delegation) {
   }
   return { ...delegation, expiry };
 }
-async function activateAndStoreOpenKeyGrants(profileName, node, grants, source) {
-  for (const { delegation } of grants) await node.useRuntimeDelegation(delegation);
+async function activateAndStoreOpenKeyGrants(profileName, host, node, grants, source) {
   if (grants.length === 0) return;
+  const records = await Promise.all(grants.map(({ delegation, effective }) => cliGrantRecord(node, delegation, effective, host)));
+  for (const { delegation } of grants) await node.useRuntimeDelegation(delegation);
   await ProfileManager.withLock(profileName, async () => {
     for (const { delegation, effective } of grants) {
       await appendGrantHistory(profileName, {
@@ -16456,10 +16562,7 @@ async function activateAndStoreOpenKeyGrants(profileName, node, grants, source)
         expiry: delegation.expiry.toISOString()
       });
     }
-    await appendAdditionalDelegations(
-      profileName,
-      grants.map(({ delegation, effective }) => storedAdditionalDelegation(delegation, effective))
-    );
+    await appendAdditionalDelegations(profileName, records);
   });
 }
 async function ensureDelegationAuthority(params) {
@@ -16482,20 +16585,22 @@ async function ensureDelegationAuthority(params) {
       expectedOwner: pinnedOwner(params.profile),
       expiry: expiryCap
     };
+    const anchorSpace = params.anchorSpace ?? params.profile.spaceId ?? params.profile.spaceName;
     const grants = [];
     for (const group of groupPermissionsBySpace(params.requested)) {
+      const request = grantRequestPermissions(group, anchorSpace);
       const delegationData = await acquireOpenKey(params.profile.did, {
         jwk: key,
         host: params.ctx.host,
-        permissions: group,
+        permissions: request,
         reason: permissionGrantReason(params.reason, group),
         openkeyHost,
         expiry: expiryCap === void 0 ? void 0 : openKeyExpiryParam(expiryCap)
       });
-      const delegation = portableFromOpenKeyDelegation(delegationData, group, params.ctx.host, proof);
+      const delegation = portableFromOpenKeyDelegation(delegationData, request, params.ctx.host, proof);
       grants.push({ delegation, effective: permissionsFromDelegation(delegation) });
     }
-    await activateAndStoreOpenKeyGrants(params.ctx.profile, params.node, grants, "cli");
+    await activateAndStoreOpenKeyGrants(params.ctx.profile, params.ctx.host, params.node, grants, "cli");
     return;
   }
   if (isInteractive()) {
@@ -16517,7 +16622,7 @@ async function ensureDelegationAuthority(params) {
     const covering = permissionsFromDelegation(delegation);
     await appendAdditionalDelegation(
       params.ctx.profile,
-      storedAdditionalDelegation(delegation, covering)
+      await cliGrantRecord(params.node, delegation, covering, params.ctx.host)
     );
     await appendGrantHistory(params.ctx.profile, {
       addedCaps: covering,
@@ -16649,7 +16754,8 @@ function portableFromOpenKeyDelegation(data, requested, host, proof) {
   }
   const returnedSpace = data.spaceId;
   const effective = session.permissions;
-  const primary = effective.find((permission) => !isRawEncryptionPermission(permission)) ?? effective[0];
+  const spaced = effective.filter((permission) => !isRawEncryptionPermission(permission));
+  const primary = spaced.find((permission) => permission.service !== "tinycloud.capabilities") ?? spaced[0] ?? effective[0];
   const resources = effective.map((permission) => ({
     service: permission.service.slice("tinycloud.".length),
     space: isVerifiedRawEncryptionPermission(permission) ? "encryption" : returnedSpace,
@@ -16669,7 +16775,9 @@ function portableFromOpenKeyDelegation(data, requested, host, proof) {
     delegateDID: data.verificationMethod,
     ownerAddress: ownerParts[4],
     chainId: Number(ownerParts[3]),
-    host
+    host,
+    // Verified above; replay rebuilds the CACAO from it before trusting the grant.
+    siweProof: { siwe: data.siwe, signature: data.signature }
   };
 }
 async function rotateAuthKey(profileName, host, options = {}) {
@@ -18394,6 +18502,7 @@ async function runSecretOperation(params) {
       reason: secretPermissionReason(params.action, params.name),
       yes: true,
       force: true,
+      anchorSpace: params.space ?? SECRETS_SPACE3,
       openKeyAcquisition: params.openKeyAcquisition
     })
   );
@@ -18478,7 +18587,26 @@ async function runSecretOperationAttempt(label, operation) {
     throw error;
   }
 }
+function withOperationWarnings(error, warnings) {
+  if (warnings === void 0 || warnings.length === 0) return error;
+  const cliError = wrapError(error);
+  cliError.metadata = { ...cliError.metadata, warnings };
+  return cliError;
+}
 async function invokeCanonicalSecretGet(params) {
+  const warnings = /* @__PURE__ */ new Map();
+  const collect = (result) => {
+    for (const warning of result.warnings ?? []) warnings.set(JSON.stringify(warning), warning);
+    return result;
+  };
+  try {
+    const result = await canonicalSecretGet(params, collect);
+    return warnings.size === 0 ? result : { ...result, warnings: [...warnings.values()] };
+  } catch (error) {
+    throw withOperationWarnings(error, [...warnings.values()]);
+  }
+}
+async function canonicalSecretGet(params, collect) {
   const auth = authOptions(params.options);
   let ownerNode;
   if (!auth?.privateKey) {
@@ -18501,10 +18629,10 @@ async function invokeCanonicalSecretGet(params) {
     ...params.scope === void 0 ? {} : { scope: params.scope },
     ...params.space === void 0 ? {} : { space: params.space }
   };
-  const invoke = () => withSpinner(
+  const invoke = async () => collect(await withSpinner(
     params.label,
     () => auth?.privateKey ? invokeSecretsGetWithLocalAuthorityRetry(target, input) : invokeOperation2("tinycloud.secrets.get", 1, target, input)
-  );
+  ));
   let first = await invoke();
   if (first.status === "error" && first.error.code === "SESSION_NOT_FOUND" && auth?.privateKey === void 0) {
     const profile2 = await ProfileManager.getProfile(params.ctx.profile);
@@ -18542,6 +18670,7 @@ async function invokeCanonicalSecretGet(params) {
       reason: secretPermissionReason("get", params.name),
       yes: true,
       force: true,
+      anchorSpace: params.space ?? SECRETS_SPACE3,
       openKeyAcquisition: params.openKeyAcquisition
     })
   );
@@ -18553,7 +18682,7 @@ function throwCanonicalSecretGetError(result, name) {
       throw new CLIError(
         "PERMISSION_DENIED",
         "Permission denied while reading secret",
-        ExitCode.ERROR
+        ExitCode.PERMISSION_DENIED
       );
     case "setup_required":
       throw new CLIError(
@@ -18575,11 +18704,10 @@ ${result.setup.message}`, setup: result.setup }
       if (result.error.code === "NODE_UNREACHABLE") {
         throw new CLIError("NETWORK_ERROR", result.error.message, ExitCode.NETWORK_ERROR);
       }
-      throw new CLIError(
-        result.error.code,
-        result.error.message,
-        result.error.code === "PERMISSION_HINT_INVALID" ? ExitCode.PERMISSION_DENIED : ExitCode.ERROR
-      );
+      if (result.error.code === "PERMISSION_HINT_INVALID") {
+        throw new CLIError(result.error.code, result.error.message, ExitCode.PERMISSION_DENIED);
+      }
+      throw withSignInHint(cliErrorFromService(result.error), result.context.profile, result.context.posture);
     case "ok":
       throw new Error("Expected a failed canonical secret result.");
   }
@@ -19195,19 +19323,26 @@ function registerSecretsCommand(program, openKeyAcquisition) {
         openKeyAcquisition
       });
       if (result.status !== "ok") {
-        throwCanonicalSecretGetError(result, name);
+        try {
+          throwCanonicalSecretGetError(result, name);
+        } catch (error) {
+          throw withOperationWarnings(error, result.warnings);
+        }
       }
       const value = result.output.value;
-      if (options.output) {
-        await writeSecretFile(options.output, value);
-        outputJson({ name, written: options.output });
-        return;
-      }
-      if (options.raw || options.valueOnly) {
-        process.stdout.write(value);
-        return;
+      try {
+        if (options.output) {
+          await writeSecretFile(options.output, value);
+          outputJson({ name, written: options.output });
+        } else if (options.raw || options.valueOnly) {
+          process.stdout.write(value);
+        } else {
+          outputJson({ name, value });
+        }
+      } catch (error) {
+        throw withOperationWarnings(error, result.warnings);
       }
-      outputJson({ name, value });
+      outputWarnings(operationWarnings(result.warnings));
     } catch (error) {
       handleError(error);
     }