@tinycloud/cli 1.1.0-beta.13 → 1.1.0-beta.15

package/dist/legacy-entry.js

@@ -165,8 +165,14 @@ import ora from "ora";
 function outputJson(data) {
   process.stdout.write(JSON.stringify(data, null, 2) + "\n");
 }
-function outputError(code3, message, hint, meta) {
-  if (isInteractive()) {
+function warningLine(warnings) {
+  const which = warnings.map((warning) => `${warning.grantCid ?? "unidentified"}: ${warning.reason}`).join(", ");
+  const subject = warnings.length === 1 ? "A stored grant was" : `${warnings.length} stored grants were`;
+  return `${subject} not used (${which}). Approve access again when a command needs it; the old grant expires on its own.`;
+}
+function outputError(code3, message, hint, details = {}) {
+  const { meta, warnings = [] } = details;
+  if (!shouldOutputJson()) {
     process.stderr.write(
       `${theme.error("\u2717")} ${theme.label(code3)}: ${message}
 `
@@ -177,20 +183,40 @@ function outputError(code3, message, hint, meta) {
 `);
       }
     }
+    if (warnings.length > 0) process.stderr.write(`  ${theme.warn(warningLine(warnings))}
+`);
   } else {
     const payload = {
       error: { code: code3, message }
     };
     if (hint) payload.error.hint = hint;
     if (meta) payload.error.meta = meta;
+    if (warnings.length > 0) payload.error.warnings = warnings;
     process.stderr.write(JSON.stringify(payload, null, 2) + "\n");
   }
 }
+function outputWarnings(warnings) {
+  if (warnings.length === 0) return;
+  process.stderr.write(shouldOutputJson() ? `${JSON.stringify({ warnings })}
+` : `${theme.warn("!")} ${warningLine(warnings)}
+`);
+}
+function operationWarnings(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((warning) => {
+    if (warning === null || typeof warning !== "object") return [];
+    const { code: code3, reason, grantCid } = warning;
+    if (typeof code3 !== "string" || !WARNING_CODE.test(code3) || typeof reason !== "string" || !WARNING_REASON.test(reason)) {
+      return [];
+    }
+    return [{ code: code3, reason, ...typeof grantCid === "string" && DELEGATION_CID.test(grantCid) ? { grantCid } : {} }];
+  });
+}
 function isInteractive() {
   return Boolean(process.stdout.isTTY);
 }
 async function withSpinner(label, fn) {
-  if (!isInteractive()) {
+  if (shouldOutputJson()) {
     return fn();
   }
   const spinner = ora(label).start();
@@ -204,7 +230,7 @@ async function withSpinner(label, fn) {
   }
 }
 function shouldOutputJson() {
-  return !isInteractive() || process.argv.includes("--json");
+  return !isInteractive() || (globalThis[JSON_REQUESTED] ?? process.argv.includes("--json"));
 }
 function formatField(label, value) {
   if (value === null || value === void 0) return `  ${theme.label(label + ":")} ${theme.muted("\u2014")}`;
@@ -253,10 +279,15 @@ function formatTimeAgo(date) {
   if (seconds < 86400) return `${Math.floor(seconds / 3600)}h ago`;
   return `${Math.floor(seconds / 86400)}d ago`;
 }
+var WARNING_CODE, WARNING_REASON, DELEGATION_CID, JSON_REQUESTED;
 var init_formatter = __esm({
   "src/output/formatter.ts"() {
     "use strict";
     init_theme();
+    WARNING_CODE = /^[A-Z][A-Z_]{0,63}$/;
+    WARNING_REASON = /^[a-z][a-z_]{0,63}$/;
+    DELEGATION_CID = /^bafkr4i[a-z2-7]{52}$/;
+    JSON_REQUESTED = /* @__PURE__ */ Symbol.for("tinycloud.cli.jsonOutputRequested");
   }
 });
 
@@ -361,11 +392,12 @@ function cliErrorFromService(error, message = error.message) {
     return missingPrivateKeyError();
   }
   const missingCapability = validatedCapabilityOf({ ...error, meta }) !== void 0;
-  const denied = verdict === "forbidden" || verdict === "unauthenticated" && missingCapability;
+  const denied = verdict === "forbidden" || verdict === "unauthenticated" && missingCapability || verdict === void 0 && error.code === "PERMISSION_DENIED";
+  const unauthenticated = !denied && (verdict === "unauthenticated" || verdict === void 0 && error.code === "AUTH_REQUIRED");
   return new CLIError(
-    denied ? "PERMISSION_DENIED" : verdict === "unauthenticated" ? "AUTH_REQUIRED" : error.code,
+    denied ? "PERMISSION_DENIED" : unauthenticated ? "AUTH_REQUIRED" : error.code,
     message,
-    denied ? ExitCode.PERMISSION_DENIED : verdict === "unauthenticated" ? ExitCode.AUTH_REQUIRED : ExitCode.ERROR,
+    denied ? ExitCode.PERMISSION_DENIED : unauthenticated ? ExitCode.AUTH_REQUIRED : ExitCode.ERROR,
     meta
   );
 }
@@ -437,7 +469,10 @@ function handleError(error) {
     meta.resource = capability.resource;
     meta.requiredAction = capability.requiredAction;
   }
-  outputError(cliError.code, cliError.message, hint, Object.keys(meta).length ? meta : void 0);
+  outputError(cliError.code, cliError.message, hint, {
+    ...Object.keys(meta).length ? { meta } : {},
+    warnings: operationWarnings(cliError.metadata?.warnings)
+  });
   process.exit(cliError.exitCode);
 }
 function buildAuthHint(error) {
@@ -1942,6 +1977,8 @@ var CAPABILITIES = [
   { urn: "tinycloud.kv/put", service: "tinycloud.kv", status: "active" },
   { urn: "tinycloud.kv/del", service: "tinycloud.kv", status: "active" },
   { urn: "tinycloud.kv/delete", service: "tinycloud.kv", status: "deprecated-alias", aliasOf: "tinycloud.kv/del" },
+  { urn: "tinycloud.kv/sync", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/retain", service: "tinycloud.kv", status: "active" },
   { urn: "tinycloud.sql/read", service: "tinycloud.sql", status: "active" },
   { urn: "tinycloud.sql/select", service: "tinycloud.sql", status: "deprecated-alias", aliasOf: "tinycloud.sql/read" },
   { urn: "tinycloud.sql/write", service: "tinycloud.sql", status: "active" },
@@ -6521,6 +6558,10 @@ var ErrorCodes = {
   AUTH_EXPIRED: "AUTH_EXPIRED",
   AUTH_REQUIRED: "AUTH_REQUIRED",
   AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
+  /** HTTP 401: the delegation the invocation cites was revoked. */
+  AUTH_DELEGATION_REVOKED: "AUTH_DELEGATION_REVOKED",
+  /** HTTP 401: a delegation the cited one rests on was revoked. */
+  AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
   NETWORK_ERROR: "NETWORK_ERROR",
   TIMEOUT: "TIMEOUT",
   ABORTED: "ABORTED",
@@ -6532,6 +6573,10 @@ var ErrorCodes = {
   KV_PRECONDITION_FAILED: "KV_PRECONDITION_FAILED",
   KV_CONFLICT: "KV_CONFLICT",
   KV_RESPONSE_TOO_LARGE: "KV_RESPONSE_TOO_LARGE",
+  /** HTTP 410 from the change feed: discard sync state and restart without a cursor; `meta.reason` says why. */
+  KV_SYNC_RESET_REQUIRED: "KV_SYNC_RESET_REQUIRED",
+  /** HTTP 403 from the change feed: the retention grant was refused; `meta.reason` says why. */
+  KV_RETENTION_GRANT_REFUSED: "KV_RETENTION_GRANT_REFUSED",
   // SQL-specific errors
   SQL_ERROR: "SQL_ERROR",
   SQL_PERMISSION_DENIED: "SQL_PERMISSION_DENIED",
@@ -7592,6 +7637,30 @@ var PrefixedKVService = class _PrefixedKVService {
       removePrefix
     });
   }
+  /**
+   * Read the change feed for everything under this prefix. A view with an
+   * empty prefix (`""` or `"/"`) is refused: the node does not serve a
+   * whole-space feed.
+   */
+  async changes(options) {
+    if (this._prefix.replace(/\/+$/, "") === "") {
+      return err(serviceError(
+        ErrorCodes.INVALID_INPUT,
+        "KV changes needs a non-empty prefix; this view has none",
+        "kv"
+      ));
+    }
+    const syncPrefix = `${this._prefix}/`;
+    const response = await this._kv.changes({ ...options, prefix: syncPrefix });
+    if (!response.ok) return response;
+    return ok({
+      ...response.data,
+      changes: response.data.changes.map((change) => ({
+        ...change,
+        key: change.key.startsWith(syncPrefix) ? change.key.slice(syncPrefix.length) : change.key
+      }))
+    });
+  }
   /**
    * Delete a key.
    */
@@ -7642,9 +7711,16 @@ var KVAction = {
   PUT: "tinycloud.kv/put",
   LIST: "tinycloud.kv/list",
   DELETE: "tinycloud.kv/del",
-  HEAD: "tinycloud.kv/metadata"
+  HEAD: "tinycloud.kv/metadata",
+  /** The change feed; never implied by `*` or `tinycloud.kv/*`. */
+  SYNC: "tinycloud.kv/sync",
+  /** Retention attestation; presented through `retentionGrant`, never invoked or implied. */
+  RETAIN: "tinycloud.kv/retain"
 };
 var MAX_KV_BATCH_READ_ITEMS = 100;
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function encodeKvBatchPartName(path) {
   return encodeURIComponent(path).replace(
     /[!'()*]/g,
@@ -8563,6 +8639,169 @@ var KVService = class extends BaseService {
       }
     });
   }
+  /**
+   * Read one page of the `tinycloud.kv/sync` change feed for a prefix.
+   */
+  async changes(options) {
+    return this.withTelemetry("changes", options?.prefix, async () => {
+      if (!this.requireAuth()) {
+        return err(authRequiredError("kv"));
+      }
+      if (typeof options?.prefix !== "string" || options.prefix.length === 0) {
+        return err(serviceError(
+          ErrorCodes.INVALID_INPUT,
+          "KV changes prefix must be a non-empty string",
+          "kv"
+        ));
+      }
+      if (options.limit !== void 0 && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 1e3)) {
+        return err(serviceError(
+          ErrorCodes.INVALID_INPUT,
+          "KV changes limit must be an integer from 1 through 1000",
+          "kv"
+        ));
+      }
+      const headers = {};
+      if (options.limit !== void 0) headers["x-tinycloud-limit"] = String(options.limit);
+      if (options.cursor !== void 0) headers["x-tinycloud-cursor"] = options.cursor;
+      if (options.retentionGrant !== void 0) {
+        headers["x-tinycloud-retention-grant"] = options.retentionGrant;
+      }
+      const request = this.createRequestSignal(options.signal, options.timeout);
+      try {
+        const response = await this.invokeOperation(
+          options.prefix,
+          KVAction.SYNC,
+          void 0,
+          request.signal,
+          headers
+        );
+        if (!response.ok) {
+          return await this.changesFailure(response, options.prefix, request.signal);
+        }
+        const text = await response.text();
+        let body;
+        try {
+          body = JSON.parse(text);
+        } catch {
+          body = void 0;
+        }
+        const page = this.normalizeChangesResponse(body);
+        if (!page) {
+          return err(serviceError(
+            ErrorCodes.NETWORK_ERROR,
+            "KV changes response was not a tinycloud.kv/sync page",
+            "kv",
+            { meta: { status: response.status, statusText: response.statusText } }
+          ));
+        }
+        return ok(page);
+      } catch (error) {
+        return err(wrapError2("kv", error));
+      } finally {
+        request.dispose();
+      }
+    });
+  }
+  /**
+   * Map a failed `kv/sync` response. 410 and the retention 403 carry
+   * `{"error":{"code","reason"}}`; a revoked grant is a 401 whose text names
+   * `delegation-revoked` or `delegation-ancestor-revoked`. A body read that
+   * fails because the request was cancelled or timed out rethrows, so the
+   * caller sees `ABORTED`/`TIMEOUT` rather than a mapped status.
+   */
+  async changesFailure(response, prefix, signal) {
+    if (response.status === 404) {
+      return this.classifyNotFound(response, prefix);
+    }
+    let errorText;
+    try {
+      errorText = await response.text();
+    } catch (error) {
+      if (signal.aborted) throw error;
+      errorText = "";
+    }
+    const meta = { status: response.status, statusText: response.statusText };
+    let reason;
+    let bodyCode;
+    try {
+      const body = JSON.parse(errorText);
+      const error = isJsonObject(body) ? body.error : void 0;
+      if (isJsonObject(error)) {
+        if (typeof error.code === "string") bodyCode = error.code;
+        if (typeof error.reason === "string") reason = error.reason;
+      }
+    } catch {
+    }
+    const context = `Failed to read KV changes for ${JSON.stringify(prefix)}`;
+    if (response.status === 410) {
+      return err(serviceError(
+        ErrorCodes.KV_SYNC_RESET_REQUIRED,
+        `${context}: the node requires a reset (${reason ?? "reason not given"}); discard sync state and restart without a cursor`,
+        "kv",
+        { meta: { ...meta, reason } }
+      ));
+    }
+    if (response.status === 403 && bodyCode === "RETENTION_GRANT_REFUSED") {
+      return err(serviceError(
+        ErrorCodes.KV_RETENTION_GRANT_REFUSED,
+        `${context}: the retention grant was refused (${reason ?? "reason not given"})`,
+        "kv",
+        { meta: { ...meta, reason } }
+      ));
+    }
+    if (response.status === 401) {
+      const revoked = /\bdelegation-ancestor-revoked\b/.test(errorText) ? ErrorCodes.AUTH_DELEGATION_ANCESTOR_REVOKED : /\bdelegation-revoked\b/.test(errorText) ? ErrorCodes.AUTH_DELEGATION_REVOKED : void 0;
+      if (revoked !== void 0) {
+        return err(serviceError(revoked, `${context}: 401 - ${errorText}`, "kv", { meta }));
+      }
+    }
+    if (response.status === 401 || response.status === 403) {
+      return this.authorizationFailure(context, response, errorText, [prefix], KVAction.SYNC);
+    }
+    return err(serviceError(
+      response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR,
+      `${context}: ${response.status} - ${errorText}`,
+      "kv",
+      { meta }
+    ));
+  }
+  normalizeChangesResponse(data) {
+    if (!isJsonObject(data)) return void 0;
+    const { changes, more, cursor, source, authority } = data;
+    if (!Array.isArray(changes) || typeof more !== "boolean" || typeof cursor !== "string" || !isJsonObject(source) || typeof source.nodeDid !== "string" || typeof source.space !== "string" || typeof source.prefix !== "string" || !isJsonObject(authority)) {
+      return void 0;
+    }
+    const { notBefore, expiresAt, retainUntil } = authority;
+    if (notBefore !== null && typeof notBefore !== "string" || expiresAt !== null && typeof expiresAt !== "string" || retainUntil !== null && typeof retainUntil !== "string") {
+      return void 0;
+    }
+    const parsed = [];
+    for (const change of changes) {
+      if (!isJsonObject(change) || typeof change.key !== "string") return void 0;
+      if (change.deleted === true) {
+        parsed.push({ key: change.key, deleted: true });
+        continue;
+      }
+      const { metadata } = change;
+      if (change.deleted !== false || typeof change.etag !== "string" || !isJsonObject(metadata) || !Object.values(metadata).every((value) => typeof value === "string")) {
+        return void 0;
+      }
+      parsed.push({
+        key: change.key,
+        deleted: false,
+        etag: change.etag,
+        metadata
+      });
+    }
+    return {
+      changes: parsed,
+      more,
+      cursor,
+      source: { nodeDid: source.nodeDid, space: source.space, prefix: source.prefix },
+      authority: { notBefore, expiresAt, retainUntil }
+    };
+  }
   /**
    * Delete a key.
    */
@@ -13471,6 +13710,10 @@ function canonicalOwnerDid(did, label = "--owner") {
   }
   return `did:pkh:eip155:${match[1]}:${ensureEip55(match[2])}`;
 }
+function canonicalNetworkUrn(path) {
+  const match = /^urn:tinycloud:encryption:(did:pkh:eip155:[1-9]\d*:0x[0-9a-fA-F]{40}):([^:]*)$/.exec(path);
+  return match ? `urn:tinycloud:encryption:${canonicalOwnerDid(match[1])}:${match[2]}` : path;
+}
 function rawEncryptionOwnerMatches(path, ownerDid) {
   const match = /^urn:tinycloud:encryption:(did:pkh:eip155:.+):([a-z0-9][a-z0-9-]*)$/.exec(path);
   if (!match) return false;
@@ -13613,13 +13856,14 @@ async function replayAdditionalDelegations(node, profile, options) {
   for (const stored of entries) {
     const kind = storedDelegationKind(stored);
     if (kind === "compact" || kind === "signed-login") {
-      const installed = await replayStoredDelegation(activator, stored, {
+      const replay = await replayStoredDelegation(activator, stored, {
         host: options.host,
         migrated,
         resolveSpace
       });
-      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
+      if (replay.status === "skipped" && process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write(`[replay] skipping a stored delegation: ${replay.reason}
+`);
       }
       continue;
     }
@@ -13649,6 +13893,14 @@ async function replayAdditionalDelegations(node, profile, options) {
 function storedAdditionalDelegation(delegation, permissions) {
   return { delegation, permissions };
 }
+async function cliGrantRecord(node, delegation, permissions, host) {
+  const { bindCliGrant } = await import("@tinycloud/operations/delegation-binding");
+  return bindCliGrant(
+    node,
+    storedAdditionalDelegation(delegation, permissions),
+    host
+  );
+}
 async function appendGrantHistory(profile, entry) {
   await ProfileManager.ensureProfileDir(profile);
   const line = JSON.stringify({
@@ -13803,7 +14055,8 @@ function permissionsFromDelegation(delegation) {
 }
 function compactPermission(permission) {
   const service = permission.service;
-  const space = permission.space.startsWith("tinycloud:") ? permission.space.slice(permission.space.lastIndexOf(":") + 1) : permission.space;
+  const fullSpace = permission.space ?? (isRawEncryptionPermission(permission) ? ENCRYPTION_MANIFEST_SPACE2 : "");
+  const space = fullSpace.startsWith("tinycloud:") ? fullSpace.slice(fullSpace.lastIndexOf(":") + 1) : fullSpace;
   const actions = permission.actions.map((action) => action.startsWith(`${service}/`) ? action.slice(service.length + 1) : action).join(",");
   return `${service}:${space}:${permission.path}:${actions}`;
 }
@@ -13899,6 +14152,35 @@ function serviceFromActions(actions) {
   return first.includes("/") ? first.slice(0, first.indexOf("/")) : "tinycloud.unknown";
 }
 
+// src/auth/session-expired.ts
+init_constants();
+init_errors();
+var SESSION_EXPIRED_REASON = "session_expired";
+function signInAgainHint(profileName, posture) {
+  if (posture === "local-owner-key") {
+    return `Sign in again with: tc --profile ${profileName} auth login --method local`;
+  }
+  if (posture === "delegate-session") {
+    return `Have the owner approve a new scoped login: tc --profile ${profileName} auth login --method openkey --paste --manifest <manifest.json>. Pass the owner's code on stdin, newline-terminated.`;
+  }
+  return `Sign in again with: tc --profile ${profileName} auth login --method openkey`;
+}
+function sessionExpiredError(profileName, posture) {
+  return new CLIError(
+    "AUTH_REQUIRED",
+    `The session for profile "${profileName}" has expired or is no longer valid.`,
+    ExitCode.AUTH_REQUIRED,
+    { hint: signInAgainHint(profileName, posture), reason: SESSION_EXPIRED_REASON }
+  );
+}
+function withSignInHint(error, profileName, posture) {
+  if (error.code !== "AUTH_REQUIRED") return error;
+  return new CLIError(error.code, error.message, error.exitCode, {
+    ...error.metadata,
+    hint: signInAgainHint(profileName, posture)
+  });
+}
+
 // src/lib/sdk.ts
 function jwkHasPrivateParameter(jwk) {
   if (!jwk || typeof jwk !== "object") return false;
@@ -13925,6 +14207,16 @@ function signerJwkForProfile(profileName, sessionJwk, key) {
     }
   );
 }
+async function restoreProfileSession(node, profileName, profile, sessionData) {
+  try {
+    await node.restoreSession(sessionData);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
+      throw sessionExpiredError(profileName, profile === null ? void 0 : resolveProfilePosture(profile));
+    }
+    throw error;
+  }
+}
 async function createSDKInstance(ctx, options) {
   const profile = options?.privateKey ? await ProfileManager.getProfile(ctx.profile).catch(() => null) : await ProfileManager.getProfile(ctx.profile);
   const session = await ProfileManager.getSession(ctx.profile);
@@ -13944,7 +14236,7 @@ async function createSDKInstance(ctx, options) {
     });
     let restoredOwnSession2 = false;
     if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-      await node2.restoreSession({
+      await restoreProfileSession(node2, ctx.profile, profile, {
         delegationHeader: session.delegationHeader,
         delegationCid: session.delegationCid,
         spaceId: session.spaceId,
@@ -13974,7 +14266,7 @@ async function createSDKInstance(ctx, options) {
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-    await node.restoreSession({
+    await restoreProfileSession(node, ctx.profile, profile, {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
       spaceId: session.spaceId,
@@ -14556,6 +14848,41 @@ function validateDelegationCallbackPayload(value) {
   }
   return null;
 }
+async function delegationFromInput(input, did, options) {
+  const trimmed = input.trim();
+  let parsed;
+  if (/^[a-z2-7]{4}-[a-z2-7]{4}$/i.test(trimmed)) {
+    if (!options.jwk) throw new Error("A CLI session key is required to retrieve a delegation.");
+    const apiHost = process.env.TC_OPENKEY_API_HOST ?? options.openkeyApiHost ?? (options.openkeyHost && options.openkeyHost !== DEFAULT_OPENKEY_HOST ? options.openkeyHost : DEFAULT_OPENKEY_DEVICE_API_HOST);
+    const response = await fetch(`${apiHost.replace(/\/$/, "")}/api/delegation-codes/${trimmed.toLowerCase()}`, {
+      redirect: "error"
+    });
+    if (!response.ok) {
+      throw new Error(response.status === 404 ? "Delegation code not found or expired. Use the full code shown in OpenKey instead." : `Could not retrieve delegation code (HTTP ${response.status}).`);
+    }
+    const result = await response.json();
+    parsed = result.delegation;
+    const delegation = parsed;
+    const jwk = delegation?.jwk;
+    const localJwk = publicJwkForDelegation(options.jwk);
+    if (typeof delegation?.verificationMethod !== "string" || delegation.verificationMethod.split("#")[0] !== did.split("#")[0] || !jwk || typeof jwk !== "object" || Array.isArray(jwk) || jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string" || jwk.x !== localJwk.x || [...PRIVATE_JWK_FIELDS].some((field) => field in jwk)) {
+      throw new Error("Delegation is bound to a different CLI key.");
+    }
+  } else {
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      try {
+        parsed = JSON.parse(Buffer.from(trimmed, "base64").toString("utf-8"));
+      } catch {
+        throw new Error("Invalid delegation code. Expected JSON, base64-encoded JSON, or XXXX-XXXX.");
+      }
+    }
+  }
+  const invalid = validateDelegationCallbackPayload(parsed);
+  if (invalid) throw new Error(`Invalid delegation code: ${invalid}`);
+  return parsed;
+}
 function shouldOpenBrowser(options) {
   if (options.noPopup) return false;
   const env = process.env.TC_AUTH_NO_POPUP ?? process.env.TC_NO_POPUP;
@@ -14580,21 +14907,6 @@ async function callbackFlow(did, options = {}) {
         reject(result.error);
       }
     }
-    function parsePasteInput(input) {
-      const trimmed = input.trim();
-      let parsed;
-      try {
-        parsed = JSON.parse(trimmed);
-      } catch {
-        const decoded = Buffer.from(trimmed, "base64").toString("utf-8");
-        parsed = JSON.parse(decoded);
-      }
-      const invalid = validateDelegationCallbackPayload(parsed);
-      if (invalid) {
-        throw new Error(`Invalid delegation code: ${invalid}`);
-      }
-      return parsed;
-    }
     const server = createServer((req, res) => {
       if (req.method === "POST" && req.url === "/callback") {
         let body = "";
@@ -14663,18 +14975,21 @@ async function callbackFlow(did, options = {}) {
       }
       if (process.stdin.isTTY) {
         console.error(`
-If the browser can't connect back, paste the delegation code here:`);
+If the browser can't connect back, enter the short code or paste the full delegation code here:`);
         rl = createInterface({
           input: process.stdin,
           output: process.stderr
         });
-        rl.on("line", (input) => {
-          if (settled) return;
+        let resolving = false;
+        rl.on("line", async (input) => {
+          if (settled || resolving) return;
+          resolving = true;
           try {
-            const data = parsePasteInput(input);
-            settle({ data });
-          } catch {
-            console.error("Invalid delegation code. Expected JSON or base64-encoded JSON. Try again:");
+            settle({ data: await delegationFromInput(input, did, options) });
+          } catch (error) {
+            console.error(error instanceof Error ? error.message : "Invalid delegation code. Try again:");
+          } finally {
+            resolving = false;
           }
         });
       }
@@ -14701,24 +15016,7 @@ Open this URL in a browser to authenticate:
       if (answered || input.trim() === "") return;
       answered = true;
       rl.close();
-      let parsed;
-      try {
-        parsed = JSON.parse(input.trim());
-      } catch {
-        try {
-          const decoded = Buffer.from(input.trim(), "base64").toString("utf-8");
-          parsed = JSON.parse(decoded);
-        } catch {
-          reject(new Error("Invalid delegation code. Expected JSON or base64-encoded JSON."));
-          return;
-        }
-      }
-      const invalid = validateDelegationCallbackPayload(parsed);
-      if (invalid) {
-        reject(new Error(`Invalid delegation code: ${invalid}`));
-        return;
-      }
-      resolve4(parsed);
+      void delegationFromInput(input, did, options).then(resolve4, reject);
     });
     rl.on("close", () => {
       if (answered) return;
@@ -14733,7 +15031,7 @@ Open this URL in a browser to authenticate:
         }
       ));
     });
-    rl.setPrompt("Paste delegation code: ");
+    rl.setPrompt("Enter short code or paste full delegation code: ");
     rl.prompt();
   });
 }
@@ -15017,7 +15315,13 @@ function validateLoginPermissions(permissions) {
   }
 }
 function scopedLoginPermissions(permissions) {
-  const space = permissions.find((p) => !isRawEncryptionPermission(p)).space ?? "";
+  return withCapabilitiesRead(permissions, permissions.find((p) => !isRawEncryptionPermission(p)).space ?? "");
+}
+function grantRequestPermissions(group, anchorSpace) {
+  const request = group.map((p) => isRawEncryptionPermission(p) ? { ...p, space: ENCRYPTION_MANIFEST_SPACE2, path: canonicalNetworkUrn(p.path) } : p);
+  return withCapabilitiesRead(request, request.find((p) => !isRawEncryptionPermission(p))?.space ?? anchorSpace);
+}
+function withCapabilitiesRead(permissions, space) {
   const hasRead = permissions.some((p) => p.service === "tinycloud.capabilities" && p.path === "" && p.actions.includes(CAPABILITIES_READ) && normalizePkhIdentifier(p.space ?? "") === normalizePkhIdentifier(space));
   return hasRead ? permissions : [{ service: "tinycloud.capabilities", space, path: "", actions: [CAPABILITIES_READ] }, ...permissions];
 }
@@ -15904,6 +16208,7 @@ function registerAuthCommand(program) {
             "Grant requested TinyCloud permissions from `tc auth request --grant`.",
             group
           );
+          const request = grantRequestPermissions(group, profile.spaceId ?? profile.spaceName);
           let delegationData;
           if (options.device) {
             const approval = await acquireDeviceDelegation({
@@ -15911,7 +16216,7 @@ function registerAuthCommand(program) {
               jwk: key,
               nodeOrigin: ctx.host,
               shareOrigin: DEFAULT_SHARE_ORIGIN,
-              permissions: group,
+              permissions: request,
               expiry: parseRequestedExpiry(expiryOption ?? "7d"),
               reason,
               expectedOwner: pinnedOwner(profile),
@@ -15923,17 +16228,17 @@ function registerAuthCommand(program) {
             delegationData = await startAuthFlow(profile.did, {
               jwk: key,
               host: ctx.host,
-              permissions: group,
+              permissions: request,
               reason,
               openkeyHost,
               expiry: expiryCap === void 0 ? void 0 : openKeyExpiryParam(expiryCap),
               noPopup: options.popup === false
             });
           }
-          const delegation = portableFromOpenKeyDelegation(delegationData, group, ctx.host, proof);
+          const delegation = portableFromOpenKeyDelegation(delegationData, request, ctx.host, proof);
           grants.push({ delegation, effective: permissionsFromDelegation(delegation) });
         }
-        await activateAndStoreOpenKeyGrants(ctx.profile, node, grants, options.manifest ? "manifest" : "cli");
+        await activateAndStoreOpenKeyGrants(ctx.profile, ctx.host, node, grants, options.manifest ? "manifest" : "cli");
         const delegationCids2 = grants.map(({ delegation }) => delegation.cid);
         const expiry2 = grants.at(-1)?.delegation.expiry.toISOString();
         reportDeclined(declined);
@@ -15969,8 +16274,7 @@ function registerAuthCommand(program) {
       for (const delegation of delegations) {
         const covering = permissionsFromDelegation(delegation);
         localEffective.push(...covering);
-        const stored = storedAdditionalDelegation(delegation, covering);
-        await appendAdditionalDelegation(ctx.profile, stored);
+        await appendAdditionalDelegation(ctx.profile, await cliGrantRecord(node, delegation, covering, ctx.host));
         delegationCids.push(delegation.cid);
         expiry = delegation.expiry.toISOString();
         await appendGrantHistory(ctx.profile, {
@@ -16392,6 +16696,8 @@ async function importRequestBoundDelegation(ctx, artifact) {
     { profile: ctx.profile, host: ctx.host, allowOwnerProfile: true },
     artifact
   );
+  const warnings = operationWarnings(result.warnings);
+  const metadata = warnings.length === 0 ? void 0 : { warnings };
   switch (result.status) {
     case "ok": {
       const output2 = result.output;
@@ -16404,22 +16710,25 @@ async function importRequestBoundDelegation(ctx, artifact) {
         permissions: output2.effectivePermissions,
         expiry: output2.expiry
       });
+      outputWarnings(warnings);
       return;
     }
     case "authority_required":
       throw new CLIError(
         "AUTHORITY_REQUIRED",
         "The active session requires additional authority before importing this delegation.",
-        ExitCode.PERMISSION_DENIED
+        ExitCode.PERMISSION_DENIED,
+        metadata
       );
     case "setup_required":
       throw new CLIError(
         "SETUP_REQUIRED",
         "The active profile requires setup before importing this delegation.",
-        ExitCode.ERROR
+        ExitCode.ERROR,
+        metadata
       );
     case "error":
-      throw cliErrorFromService(result.error);
+      throw withSignInHint(cliErrorFromService({ ...result.error, meta: metadata }), ctx.profile, result.context.posture);
   }
 }
 function isStoredDelegationLike(value) {
@@ -16444,9 +16753,10 @@ function normalizePortableDelegation(delegation) {
   }
   return { ...delegation, expiry };
 }
-async function activateAndStoreOpenKeyGrants(profileName, node, grants, source) {
-  for (const { delegation } of grants) await node.useRuntimeDelegation(delegation);
+async function activateAndStoreOpenKeyGrants(profileName, host, node, grants, source) {
   if (grants.length === 0) return;
+  const records = await Promise.all(grants.map(({ delegation, effective }) => cliGrantRecord(node, delegation, effective, host)));
+  for (const { delegation } of grants) await node.useRuntimeDelegation(delegation);
   await ProfileManager.withLock(profileName, async () => {
     for (const { delegation, effective } of grants) {
       await appendGrantHistory(profileName, {
@@ -16456,10 +16766,7 @@ async function activateAndStoreOpenKeyGrants(profileName, node, grants, source)
         expiry: delegation.expiry.toISOString()
       });
     }
-    await appendAdditionalDelegations(
-      profileName,
-      grants.map(({ delegation, effective }) => storedAdditionalDelegation(delegation, effective))
-    );
+    await appendAdditionalDelegations(profileName, records);
   });
 }
 async function ensureDelegationAuthority(params) {
@@ -16482,20 +16789,22 @@ async function ensureDelegationAuthority(params) {
       expectedOwner: pinnedOwner(params.profile),
       expiry: expiryCap
     };
+    const anchorSpace = params.anchorSpace ?? params.profile.spaceId ?? params.profile.spaceName;
     const grants = [];
     for (const group of groupPermissionsBySpace(params.requested)) {
+      const request = grantRequestPermissions(group, anchorSpace);
       const delegationData = await acquireOpenKey(params.profile.did, {
         jwk: key,
         host: params.ctx.host,
-        permissions: group,
+        permissions: request,
         reason: permissionGrantReason(params.reason, group),
         openkeyHost,
         expiry: expiryCap === void 0 ? void 0 : openKeyExpiryParam(expiryCap)
       });
-      const delegation = portableFromOpenKeyDelegation(delegationData, group, params.ctx.host, proof);
+      const delegation = portableFromOpenKeyDelegation(delegationData, request, params.ctx.host, proof);
       grants.push({ delegation, effective: permissionsFromDelegation(delegation) });
     }
-    await activateAndStoreOpenKeyGrants(params.ctx.profile, params.node, grants, "cli");
+    await activateAndStoreOpenKeyGrants(params.ctx.profile, params.ctx.host, params.node, grants, "cli");
     return;
   }
   if (isInteractive()) {
@@ -16517,7 +16826,7 @@ async function ensureDelegationAuthority(params) {
     const covering = permissionsFromDelegation(delegation);
     await appendAdditionalDelegation(
       params.ctx.profile,
-      storedAdditionalDelegation(delegation, covering)
+      await cliGrantRecord(params.node, delegation, covering, params.ctx.host)
     );
     await appendGrantHistory(params.ctx.profile, {
       addedCaps: covering,
@@ -16649,7 +16958,8 @@ function portableFromOpenKeyDelegation(data, requested, host, proof) {
   }
   const returnedSpace = data.spaceId;
   const effective = session.permissions;
-  const primary = effective.find((permission) => !isRawEncryptionPermission(permission)) ?? effective[0];
+  const spaced = effective.filter((permission) => !isRawEncryptionPermission(permission));
+  const primary = spaced.find((permission) => permission.service !== "tinycloud.capabilities") ?? spaced[0] ?? effective[0];
   const resources = effective.map((permission) => ({
     service: permission.service.slice("tinycloud.".length),
     space: isVerifiedRawEncryptionPermission(permission) ? "encryption" : returnedSpace,
@@ -16669,7 +16979,9 @@ function portableFromOpenKeyDelegation(data, requested, host, proof) {
     delegateDID: data.verificationMethod,
     ownerAddress: ownerParts[4],
     chainId: Number(ownerParts[3]),
-    host
+    host,
+    // Verified above; replay rebuilds the CACAO from it before trusting the grant.
+    siweProof: { siwe: data.siwe, signature: data.signature }
   };
 }
 async function rotateAuthKey(profileName, host, options = {}) {
@@ -18394,6 +18706,7 @@ async function runSecretOperation(params) {
       reason: secretPermissionReason(params.action, params.name),
       yes: true,
       force: true,
+      anchorSpace: params.space ?? SECRETS_SPACE3,
       openKeyAcquisition: params.openKeyAcquisition
     })
   );
@@ -18478,7 +18791,26 @@ async function runSecretOperationAttempt(label, operation) {
     throw error;
   }
 }
+function withOperationWarnings(error, warnings) {
+  if (warnings === void 0 || warnings.length === 0) return error;
+  const cliError = wrapError(error);
+  cliError.metadata = { ...cliError.metadata, warnings };
+  return cliError;
+}
 async function invokeCanonicalSecretGet(params) {
+  const warnings = /* @__PURE__ */ new Map();
+  const collect = (result) => {
+    for (const warning of result.warnings ?? []) warnings.set(JSON.stringify(warning), warning);
+    return result;
+  };
+  try {
+    const result = await canonicalSecretGet(params, collect);
+    return warnings.size === 0 ? result : { ...result, warnings: [...warnings.values()] };
+  } catch (error) {
+    throw withOperationWarnings(error, [...warnings.values()]);
+  }
+}
+async function canonicalSecretGet(params, collect) {
   const auth = authOptions(params.options);
   let ownerNode;
   if (!auth?.privateKey) {
@@ -18501,10 +18833,10 @@ async function invokeCanonicalSecretGet(params) {
     ...params.scope === void 0 ? {} : { scope: params.scope },
     ...params.space === void 0 ? {} : { space: params.space }
   };
-  const invoke = () => withSpinner(
+  const invoke = async () => collect(await withSpinner(
     params.label,
     () => auth?.privateKey ? invokeSecretsGetWithLocalAuthorityRetry(target, input) : invokeOperation2("tinycloud.secrets.get", 1, target, input)
-  );
+  ));
   let first = await invoke();
   if (first.status === "error" && first.error.code === "SESSION_NOT_FOUND" && auth?.privateKey === void 0) {
     const profile2 = await ProfileManager.getProfile(params.ctx.profile);
@@ -18542,6 +18874,7 @@ async function invokeCanonicalSecretGet(params) {
       reason: secretPermissionReason("get", params.name),
       yes: true,
       force: true,
+      anchorSpace: params.space ?? SECRETS_SPACE3,
       openKeyAcquisition: params.openKeyAcquisition
     })
   );
@@ -18553,7 +18886,7 @@ function throwCanonicalSecretGetError(result, name) {
       throw new CLIError(
         "PERMISSION_DENIED",
         "Permission denied while reading secret",
-        ExitCode.ERROR
+        ExitCode.PERMISSION_DENIED
       );
     case "setup_required":
       throw new CLIError(
@@ -18575,11 +18908,10 @@ ${result.setup.message}`, setup: result.setup }
       if (result.error.code === "NODE_UNREACHABLE") {
         throw new CLIError("NETWORK_ERROR", result.error.message, ExitCode.NETWORK_ERROR);
       }
-      throw new CLIError(
-        result.error.code,
-        result.error.message,
-        result.error.code === "PERMISSION_HINT_INVALID" ? ExitCode.PERMISSION_DENIED : ExitCode.ERROR
-      );
+      if (result.error.code === "PERMISSION_HINT_INVALID") {
+        throw new CLIError(result.error.code, result.error.message, ExitCode.PERMISSION_DENIED);
+      }
+      throw withSignInHint(cliErrorFromService(result.error), result.context.profile, result.context.posture);
     case "ok":
       throw new Error("Expected a failed canonical secret result.");
   }
@@ -19195,19 +19527,26 @@ function registerSecretsCommand(program, openKeyAcquisition) {
         openKeyAcquisition
       });
       if (result.status !== "ok") {
-        throwCanonicalSecretGetError(result, name);
+        try {
+          throwCanonicalSecretGetError(result, name);
+        } catch (error) {
+          throw withOperationWarnings(error, result.warnings);
+        }
       }
       const value = result.output.value;
-      if (options.output) {
-        await writeSecretFile(options.output, value);
-        outputJson({ name, written: options.output });
-        return;
-      }
-      if (options.raw || options.valueOnly) {
-        process.stdout.write(value);
-        return;
+      try {
+        if (options.output) {
+          await writeSecretFile(options.output, value);
+          outputJson({ name, written: options.output });
+        } else if (options.raw || options.valueOnly) {
+          process.stdout.write(value);
+        } else {
+          outputJson({ name, value });
+        }
+      } catch (error) {
+        throw withOperationWarnings(error, result.warnings);
       }
-      outputJson({ name, value });
+      outputWarnings(operationWarnings(result.warnings));
     } catch (error) {
       handleError(error);
     }