@tinycloud/cli 1.1.0-beta.6 → 1.1.0-beta.8

package/dist/legacy-entry.js

@@ -260,7 +260,7 @@ var init_formatter = __esm({
 // src/output/errors.ts
 import { readFileSync, readdirSync } from "fs";
 import { join as join2 } from "path";
-import { ProfileLockTimeoutError } from "@tinycloud/operations/state";
+import { ProfileDeletedError, ProfileLockTimeoutError } from "@tinycloud/operations/state";
 function setActiveProfileName(name) {
   activeProfileName = name;
 }
@@ -286,6 +286,9 @@ function wrapError(error) {
       { hint: "Wait for the other command to finish and retry. A crashed process's lock is reclaimed automatically after 30 s." }
     );
   }
+  if (error instanceof ProfileDeletedError) {
+    return new CLIError("PROFILE_NOT_FOUND", message);
+  }
   if (message.includes("Not signed in") || message.includes("AUTH_EXPIRED") || message.includes("Session expired")) {
     return new CLIError("AUTH_REQUIRED", message, ExitCode.AUTH_REQUIRED);
   }
@@ -644,6 +647,8 @@ import { join as join3 } from "path";
 import {
   profilePath,
   readSession,
+  recordProfileDeletion,
+  refuseWriteToDeletedProfile,
   removeSession,
   withProfileLock,
   writeSession
@@ -758,10 +763,12 @@ var init_profiles = __esm({
        * removed while holding the profile lock, so another writer's critical
        * section never sees them vanish midway: session and key first, settings
        * last, so a crash midway never leaves a session or key without its
-       * profile. `.lock` itself is left to the lock's release; the then-empty
-       * directory is removed afterwards unless another writer took the lock (or
-       * wrote) meanwhile. A profile directory that is a symlink is unlinked, its
-       * target left alone.
+       * profile. The deletion is then recorded, so a store write that waited for
+       * the lock meanwhile refuses rather than recreating a profile with only a
+       * session in it. `.lock` itself is left to the lock's release; the
+       * then-empty directory is removed afterwards unless another writer took
+       * the lock (or wrote) meanwhile. A profile directory that is a symlink is
+       * unlinked, its target left alone.
        * Throws if the name is not one path segment or names the default profile.
        */
       static async deleteProfile(name) {
@@ -782,11 +789,12 @@ var init_profiles = __esm({
             `Cannot delete the default profile "${name}". Change the default first with \`tc profile default <other>\`.`
           );
         }
-        const isLink = await lstat(profileDir).then((stats) => stats.isSymbolicLink(), (error) => {
-          if (error.code === "ENOENT") return false;
+        const kind = await lstat(profileDir).then((stats) => stats.isSymbolicLink() ? "link" : "present", (error) => {
+          if (error.code === "ENOENT") return "missing";
           throw error;
         });
-        if (isLink) {
+        if (kind === "missing") return;
+        if (kind === "link") {
           await rm2(profileDir, { force: true });
           return;
         }
@@ -796,6 +804,7 @@ var init_profiles = __esm({
             if (entry !== ".lock" && entry !== "profile.json") await rm2(join3(profileDir, entry), { recursive: true, force: true });
           }
           await rm2(join3(profileDir, "profile.json"), { force: true });
+          await recordProfileDeletion(name);
         });
         await rmdir(profileDir).catch((error) => {
           if (error.code !== "ENOENT" && error.code !== "ENOTEMPTY" && error.code !== "EEXIST") throw error;
@@ -808,9 +817,14 @@ var init_profiles = __esm({
       static async getKey(name) {
         return readJson(join3(PROFILES_DIR, name, "key.json"));
       }
-      /** Saves a JWK key under the profile lock (0600, in an owner-only profile directory). */
+      /**
+       * Saves a JWK key under the profile lock (0600, in an owner-only profile
+       * directory). Refused (PROFILE_NOT_FOUND) if the profile was deleted while
+       * this waited for the lock, rather than leaving a key-only profile.
+       */
       static async setKey(name, jwk) {
         await _ProfileManager.withLock(name, async () => {
+          await refuseWriteToDeletedProfile(name);
           await writeJson(join3(await _ProfileManager.ensureProfileDir(name), "key.json"), jwk);
         });
       }
@@ -1779,7 +1793,8 @@ import {
   profileStoreMetadataPath,
   readAdditionalDelegations,
   readAuthRequests,
-  upsertProfileRecord,
+  refuseWriteToDeletedProfile as refuseWriteToDeletedProfile2,
+  updateProfileStore,
   withProfileLock as withProfileLock2,
   writeJsonAtomic
 } from "@tinycloud/operations/state";
@@ -13123,17 +13138,15 @@ function didWithoutFragment(did) {
 async function loadAdditionalDelegations(profile) {
   return readAdditionalDelegations(profile);
 }
-async function saveAdditionalDelegations(profile, entries) {
-  await replaceSharedRecords(profile, "additional-delegations", entries);
+async function appendAdditionalDelegations(profile, entries) {
+  const { mergeDelegationsWithoutRequest } = await import("@tinycloud/operations/delegation-binding");
+  await updateProfileStore(profile, "additional-delegations", (stored) => ({
+    records: mergeDelegationsWithoutRequest(stored, entries.map((entry) => ({ ...entry }))),
+    result: void 0
+  }));
 }
 async function appendAdditionalDelegation(profile, entry) {
-  await upsertProfileRecord(
-    profile,
-    "additional-delegations",
-    entry.delegation.cid,
-    entry,
-    (candidate) => candidate.delegation.cid
-  );
+  await appendAdditionalDelegations(profile, [entry]);
 }
 async function loadPermissionRequestArtifacts(profile) {
   const raw = await readAuthRequests(profile);
@@ -13147,10 +13160,8 @@ async function appendPermissionRequestArtifact(profile, artifact) {
     await writeSharedRecords(profile, "auth-requests", next);
   });
 }
-async function replaceSharedRecords(profile, store, entries) {
-  await withProfileLock2(profile, () => writeSharedRecords(profile, store, entries));
-}
 async function writeSharedRecords(profile, store, entries) {
+  await refuseWriteToDeletedProfile2(profile);
   const path = store === "additional-delegations" ? additionalDelegationsPath(profile) : permissionRequestsPath(profile);
   await writeJsonAtomic(path, entries);
   await writeJsonAtomic(profileStoreMetadataPath(profile, store), { formatVersion: 1 });
@@ -13163,13 +13174,48 @@ async function getLastPermissionRequestArtifact(profile) {
   const existing = await loadPermissionRequestArtifacts(profile);
   return existing.at(-1) ?? null;
 }
-async function replayAdditionalDelegations(node, profile) {
+async function replayAdditionalDelegations(node, profile, options) {
+  const {
+    operationSpaceResolver,
+    prepareStoredDelegationReplay,
+    replayStoredDelegation,
+    storedDelegationKind
+  } = await import("@tinycloud/operations/delegation-binding");
+  const activator = node;
+  const migrated = await prepareStoredDelegationReplay(profile, activator, {
+    host: options.host,
+    migrate: options.migrate
+  });
+  const resolveSpace = operationSpaceResolver(node, options.ownerSpace);
   const entries = await loadAdditionalDelegations(profile);
-  for (const entry of entries) {
+  for (const stored of entries) {
+    const kind = storedDelegationKind(stored);
+    if (kind === "compact" || kind === "signed-login") {
+      const installed = await replayStoredDelegation(activator, stored, {
+        host: options.host,
+        migrated,
+        resolveSpace
+      });
+      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
+      }
+      continue;
+    }
+    if (kind === "refused") {
+      if (process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write("[replay] skipping a malformed stored record or one bound to a request it cannot be held to\n");
+      }
+      continue;
+    }
+    const entry = stored;
     const expiry = entry.delegation.expiry instanceof Date ? entry.delegation.expiry : new Date(entry.delegation.expiry);
     if (expiry.getTime() <= Date.now()) continue;
     try {
-      await node.useRuntimeDelegation({ ...entry.delegation, expiry });
+      await node.useRuntimeDelegation({
+        ...entry.delegation,
+        delegationHeader: { Authorization: entry.delegation.delegationHeader.Authorization },
+        expiry
+      });
     } catch (err2) {
       if (process.env.TC_DEBUG_REPLAY === "1") {
         process.stderr.write(`[replay] skipping ${entry.delegation.cid}: ${err2.message}
@@ -13474,6 +13520,7 @@ async function createSDKInstance(ctx, options) {
       host: ctx.host,
       privateKey: effectivePrivateKey
     });
+    let restoredOwnSession2 = false;
     if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
       await node2.restoreSession({
         delegationHeader: session.delegationHeader,
@@ -13486,16 +13533,22 @@ async function createSDKInstance(ctx, options) {
         siwe: session.siwe,
         signature: session.signature
       });
+      restoredOwnSession2 = true;
     } else {
       await node2.signIn();
     }
-    await replayAdditionalDelegations(node2, ctx.profile);
+    await replayAdditionalDelegations(node2, ctx.profile, {
+      host: ctx.host,
+      ownerSpace: profile.spaceId,
+      migrate: restoredOwnSession2 && options?.privateKey === void 0
+    });
     return node2;
   }
   const node = new TinyCloudNode({
     host: ctx.host,
     privateKey: options?.privateKey
   });
+  let restoredOwnSession = false;
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
@@ -13510,10 +13563,16 @@ async function createSDKInstance(ctx, options) {
       siwe: session.siwe,
       signature: session.signature
     });
+    restoredOwnSession = true;
   }
-  await replayAdditionalDelegations(node, ctx.profile);
+  await replayAdditionalDelegations(node, ctx.profile, {
+    host: ctx.host,
+    ownerSpace: profile?.spaceId,
+    migrate: restoredOwnSession
+  });
   return node;
 }
+var BOOTSTRAP_PROFILE_FIELDS = ["sessionDid", "spaceId"];
 async function bootstrapDelegatedSession(ctx, delegation) {
   const written = await ProfileManager.withLock(ctx.profile, async () => {
     const previousProfile = await ProfileManager.getProfile(ctx.profile);
@@ -13563,13 +13622,13 @@ async function bootstrapDelegatedSession(ctx, delegation) {
         throw error;
       });
       const session = await ProfileManager.getSession(ctx.profile);
-      if (JSON.stringify(profile) !== JSON.stringify(written.profile) || JSON.stringify(session) !== JSON.stringify(written.session)) {
+      if (profile === null || BOOTSTRAP_PROFILE_FIELDS.some((field) => profile[field] !== written.profile[field]) || JSON.stringify(session) !== JSON.stringify(written.session)) {
         return `Profile "${ctx.profile}" changed while the import was pending (another login, logout or profile update), so its newer state was kept and the provisional session was not rolled back.`;
       }
       return restoreBeforeBootstrap(ctx.profile, written.previousProfile);
     }, { timeoutMs: PROFILE_COMMIT_LOCK_TIMEOUT_MS }).catch((error) => (
       // The lock or a read failed: the import's error stays the one reported.
-      `Rolling back the provisional session of profile "${ctx.profile}" could not run (${error instanceof Error ? error.message : String(error)}); check \`tc --profile ${ctx.profile} context\`.`
+      `Rolling back the provisional session of profile "${ctx.profile}" could not run (${failureName(error)}); check \`tc --profile ${ctx.profile} context\`.`
     ));
     throw annotate(cause, note);
   };
@@ -13585,15 +13644,27 @@ async function restoreBeforeBootstrap(profileName, previousProfile) {
   const failures = [];
   for (const write of [
     () => ProfileManager.clearSession(profileName),
-    () => ProfileManager.setProfile(profileName, previousProfile)
+    () => ProfileManager.updateProfile(profileName, (current) => {
+      const restored = { ...current };
+      for (const field of BOOTSTRAP_PROFILE_FIELDS) {
+        if (previousProfile[field] === void 0) delete restored[field];
+        else restored[field] = previousProfile[field];
+      }
+      return restored;
+    })
   ]) {
     await write().catch((error) => {
-      failures.push(error instanceof Error ? error.message : String(error));
+      failures.push(failureName(error));
     });
   }
   if (failures.length === 0) return void 0;
   return `Rolling back the provisional session of profile "${profileName}" failed too (${failures.join("; ")}); check \`tc --profile ${profileName} context\`.`;
 }
+function failureName(error) {
+  if (error instanceof SyntaxError) return "a profile file is not valid JSON";
+  if (typeof error === "object" && error !== null && "code" in error && typeof error.code === "string") return error.code;
+  return error instanceof Error ? error.name : "unknown error";
+}
 function annotate(error, note) {
   if (note === void 0) return error;
   const cause = wrapError(error);
@@ -13605,7 +13676,7 @@ async function ensureAuthenticated(ctx, options) {
   }
   const profile = await ProfileManager.getProfile(ctx.profile).catch(() => null);
   if (profile?.authMethod === "local" && profile.privateKey) {
-    return createSDKInstance(ctx, { privateKey: profile.privateKey });
+    return createSDKInstance(ctx);
   }
   const session = await ProfileManager.getSession(ctx.profile);
   if (!session) {
@@ -15496,6 +15567,15 @@ function registerAuthCommand(program) {
         return;
       }
       const imported = normalizeDelegationImport(parsed);
+      const { activateUnboundCompactImport, storedDelegationKind } = await import("@tinycloud/operations/delegation-binding");
+      const kind = storedDelegationKind({ delegation: imported.delegation });
+      if (kind === "refused") {
+        throw new CLIError(
+          "INVALID_AUTH_IMPORT",
+          "Imported delegation must carry exactly one string Authorization header.",
+          ExitCode.USAGE_ERROR
+        );
+      }
       let node;
       try {
         node = await ensureAuthenticated(ctx);
@@ -15505,18 +15585,33 @@ function registerAuthCommand(program) {
         if (session || resolveProfilePosture(profile) !== "delegate-session") throw error;
         node = (await bootstrapDelegatedSession(ctx, imported.delegation)).node;
       }
-      await appendAdditionalDelegation(ctx.profile, storedAdditionalDelegation(
-        imported.delegation,
-        imported.permissions
-      ));
       const targetsSessionKey = typeof imported.delegation.delegateDID === "string" && principalDidEquals(imported.delegation.delegateDID, node.sessionDid);
       let activated = false;
-      if (targetsSessionKey) {
-        await node.useRuntimeDelegation(imported.delegation);
+      let permissions = imported.permissions;
+      if (targetsSessionKey && kind === "compact") {
+        const record = await activateUnboundCompactImport(
+          node,
+          imported.delegation,
+          ctx.host
+        );
+        await appendAdditionalDelegation(ctx.profile, record);
+        permissions = record.permissions;
         activated = true;
+      } else {
+        await appendAdditionalDelegation(ctx.profile, storedAdditionalDelegation(
+          imported.delegation,
+          imported.permissions
+        ));
+        if (targetsSessionKey) {
+          await node.useRuntimeDelegation({
+            ...imported.delegation,
+            delegationHeader: { Authorization: imported.delegation.delegationHeader.Authorization }
+          });
+          activated = true;
+        }
       }
       await appendGrantHistory(ctx.profile, {
-        addedCaps: imported.permissions,
+        addedCaps: permissions,
         source: "cli",
         delegationCid: imported.delegation.cid,
         expiry: imported.delegation.expiry.toISOString()
@@ -15527,7 +15622,7 @@ function registerAuthCommand(program) {
         kind: "tinycloud.auth.delegation",
         requestId: imported.requestId ?? null,
         delegationCid: imported.delegation.cid,
-        permissions: imported.permissions,
+        permissions,
         expiry: imported.delegation.expiry.toISOString()
       });
     } catch (error) {
@@ -15901,8 +15996,6 @@ async function activateAndStoreOpenKeyGrants(profileName, node, grants, source)
   for (const { delegation } of grants) await node.useRuntimeDelegation(delegation);
   if (grants.length === 0) return;
   await ProfileManager.withLock(profileName, async () => {
-    const existing = await loadAdditionalDelegations(profileName);
-    const replacing = new Set(grants.map(({ delegation }) => delegation.cid));
     for (const { delegation, effective } of grants) {
       await appendGrantHistory(profileName, {
         addedCaps: effective,
@@ -15911,10 +16004,10 @@ async function activateAndStoreOpenKeyGrants(profileName, node, grants, source)
         expiry: delegation.expiry.toISOString()
       });
     }
-    await saveAdditionalDelegations(profileName, [
-      ...existing.filter(({ delegation }) => !replacing.has(delegation.cid)),
-      ...grants.map(({ delegation, effective }) => storedAdditionalDelegation(delegation, effective))
-    ]);
+    await appendAdditionalDelegations(
+      profileName,
+      grants.map(({ delegation, effective }) => storedAdditionalDelegation(delegation, effective))
+    );
   });
 }
 async function ensureDelegationAuthority(params) {
@@ -29981,7 +30074,13 @@ async function readHasKey(name, issues) {
 }
 async function readDelegations(name, issues) {
   try {
-    return await loadAdditionalDelegations(name);
+    const entries = await loadAdditionalDelegations(name);
+    const { storedDelegationKind } = await import("@tinycloud/operations/delegation-binding");
+    const readable = entries.filter((entry) => storedDelegationKind(entry) !== "refused");
+    if (readable.length < entries.length) {
+      issues.push(`delegations: ${entries.length - readable.length} unreadable stored record(s) skipped`);
+    }
+    return readable;
   } catch (error) {
     issues.push(`delegations: ${messageFromError(error)}`);
     return [];