@tinycloud/cli 1.2.2-beta.0 → 1.2.2-beta.2

package/dist/legacy-entry.js

@@ -17797,6 +17797,7 @@ __export(sdk_exports, {
   storedSessionVerifiesLocally: () => storedSessionVerifiesLocally
 });
 import { TinyCloudNode, signedCompactUcanExpiry } from "@tinycloud/node-sdk";
+import { ownerSessionLacksProof } from "@tinycloud/operations/profile";
 function jwkHasPrivateParameter(jwk) {
   if (!jwk || typeof jwk !== "object") return false;
   const d = jwk.d;
@@ -17828,11 +17829,15 @@ function signedLifetimePassed(delegation) {
   return expiry !== void 0 && expiry.getTime() <= Date.now();
 }
 async function restoreProfileSession(node, profileName2, profile, sessionData) {
+  const posture = profile === null ? void 0 : resolveProfilePosture(profile);
+  if (ownerSessionLacksProof(sessionData, profile)) {
+    throw sessionExpiredError(profileName2, posture);
+  }
   try {
     await node.restoreSession(sessionData);
   } catch (error) {
     if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
-      throw sessionExpiredError(profileName2, profile === null ? void 0 : resolveProfilePosture(profile));
+      throw sessionExpiredError(profileName2, posture);
     }
     throw error;
   }
@@ -20670,7 +20675,7 @@ async function localKeySignIn(options) {
 init_errors();
 init_constants();
 import { NodeWasmBindings, signedCompactUcanExpiry as signedCompactUcanExpiry2 } from "@tinycloud/node-sdk";
-import { isLocalOwnerProfile as isLocalOwnerProfile2 } from "@tinycloud/operations/profile";
+import { isLocalOwnerProfile as isLocalOwnerProfile2, ownerSessionLacksProof as ownerSessionLacksProof2 } from "@tinycloud/operations/profile";
 
 // src/lib/duration.ts
 function parseDuration(input) {
@@ -20772,6 +20777,17 @@ function sessionExpiresAt(session) {
   if (typeof value === "string") return new Date(value).toISOString();
   return null;
 }
+function storedSessionState(session, profile) {
+  if (session === null) return { state: "missing", expiresAt: null };
+  if (ownerSessionLacksProof2(session, profile)) return { state: "unverified", expiresAt: null };
+  const siweExpiry = typeof session.siwe === "string" ? session.siwe.match(/^Expiration Time:\s*(.+)$/m)?.[1] : void 0;
+  const expiresAt = siweExpiry !== void 0 && Number.isFinite(Date.parse(siweExpiry)) ? new Date(siweExpiry).toISOString() : sessionExpiresAt(session);
+  if (expiresAt === null) return { state: "unknown-expiry", expiresAt };
+  return { state: Date.parse(expiresAt) <= Date.now() ? "expired" : "present", expiresAt };
+}
+function sessionStateIsUsable(state2) {
+  return state2 === "present" || state2 === "unknown-expiry";
+}
 function ownerSpaceId(space, ownerDid) {
   return space.startsWith("tinycloud:") ? space : `tinycloud:${ownerDid.slice("did:".length)}:${space}`;
 }
@@ -21485,15 +21501,6 @@ async function acquireDeviceDelegation(input) {
   }
   throw new CLIError("DEVICE_AUTH_EXPIRED", "OpenKey device authorization expired before approval. Run the command again.", ExitCode.AUTH_REQUIRED);
 }
-function mergePrivateJwkIntoSession(session, key) {
-  const sessionJwk = session.jwk;
-  if (!sessionJwk || typeof sessionJwk !== "object") return session;
-  const sessionJwkRecord = sessionJwk;
-  if (typeof sessionJwkRecord.d === "string" && sessionJwkRecord.d.length > 0) return session;
-  const privateParameter = key.d;
-  if (typeof privateParameter !== "string" || privateParameter.length === 0) return session;
-  return { ...session, jwk: { ...sessionJwkRecord, d: privateParameter } };
-}
 async function loginWithDeviceAuthorization(input) {
   const snapshot = await readProfileSnapshot(input.profileName);
   const existing = snapshot.profile;
@@ -22244,10 +22251,12 @@ function registerAuthCommand(program, options) {
       }
       const posture = profile ? resolveProfilePosture(profile) : null;
       const operatorType = profile ? resolveProfileOperatorType(profile) : null;
-      const authenticated = session !== null;
+      const { state: sessionState, expiresAt } = storedSessionState(session, profile);
+      const authenticated = sessionStateIsUsable(sessionState);
       if (shouldOutputJson()) {
         outputJson({
           authenticated,
+          session: { state: sessionState, expiresAt },
           did: profile?.did ?? null,
           sessionDid: profile?.sessionDid ?? null,
           ownerDid: profile?.ownerDid ?? null,
@@ -22265,6 +22274,7 @@ function registerAuthCommand(program, options) {
         process.stdout.write(theme.heading("Authentication Status") + "\n");
         process.stdout.write(formatField("Profile", ctx.profile) + "\n");
         process.stdout.write(formatField("Authenticated", authenticated) + "\n");
+        process.stdout.write(formatField("Session", describeSession(sessionState, expiresAt)) + "\n");
         process.stdout.write(formatField("Auth Method", profile?.authMethod ?? null) + "\n");
         process.stdout.write(formatField("Posture", posture) + "\n");
         process.stdout.write(formatField("Operator", operatorType) + "\n");
@@ -22276,6 +22286,11 @@ function registerAuthCommand(program, options) {
         process.stdout.write(formatField("Address", profile?.address ?? null) + "\n");
         process.stdout.write(formatField("Space ID", profile?.spaceId ?? null) + "\n");
         process.stdout.write(formatField("Has Key", hasKey !== null) + "\n");
+        if (sessionState === "expired" || sessionState === "unverified") {
+          process.stdout.write(`
+${signInAgainHint(ctx.profile, posture ?? void 0)}
+`);
+        }
       }
     } catch (error) {
       return handleError(error);
@@ -22723,8 +22738,9 @@ function registerAuthCommand(program, options) {
       const ctx = await ProfileManager.resolveContext(globalOpts, { storedSession: "unused" });
       const profile = await ProfileManager.getProfile(ctx.profile);
       const session = await ProfileManager.getSession(ctx.profile);
-      const authenticated = session !== null;
       const posture = resolveProfilePosture(profile);
+      const { state: sessionState, expiresAt } = storedSessionState(session, profile);
+      const authenticated = sessionStateIsUsable(sessionState);
       const operatorType = resolveProfileOperatorType(profile);
       if (shouldOutputJson()) {
         outputJson({
@@ -22735,6 +22751,7 @@ function registerAuthCommand(program, options) {
           spaceId: profile.spaceId ?? null,
           host: profile.host,
           authenticated,
+          session: { state: sessionState, expiresAt },
           authMethod: profile.authMethod ?? null,
           posture,
           operatorType,
@@ -22753,12 +22770,27 @@ function registerAuthCommand(program, options) {
         process.stdout.write(formatField("Space ID", profile.spaceId ?? null) + "\n");
         process.stdout.write(formatField("Host", profile.host) + "\n");
         process.stdout.write(formatField("Authenticated", authenticated) + "\n");
+        process.stdout.write(formatField("Session", describeSession(sessionState, expiresAt)) + "\n");
       }
     } catch (error) {
       return handleError(error);
     }
   });
 }
+function describeSession(state2, expiresAt) {
+  switch (state2) {
+    case "missing":
+      return "none";
+    case "expired":
+      return `expired ${expiresAt}`;
+    case "present":
+      return `active until ${expiresAt}`;
+    case "unknown-expiry":
+      return "active (no recorded expiry)";
+    case "unverified":
+      return "not usable (no signed OpenKey proof)";
+  }
+}
 async function emitPermissionRequestArtifact(artifact, emitOption) {
   if (typeof emitOption === "string" && emitOption.length > 0) {
     await mkdir3(dirname3(emitOption), { recursive: true });
@@ -23501,15 +23533,13 @@ async function refreshOpenKeySession(profileName2, host, options = {}) {
     verifiedOwner = sanitizedSession.ownerDid;
     declined = declinedPermissions(permissions, sanitizedSession.permissions, verifiedOwner);
   } else {
-    const carriesProof = typeof delegationData.siwe === "string" && typeof delegationData.signature === "string";
-    const merged = mergePrivateJwkIntoSession(delegationData, key);
-    if (carriesProof || expiry !== void 0 || expectedOwner !== void 0) {
-      const signed = verifySignedSession(delegationData, key, sessionDid, { expectedOwner, expiry });
-      verifiedOwner = signed.ownerDid;
-      sanitizedSession = withVerifiedAuthority(merged, signed);
-    } else {
-      sanitizedSession = Object.fromEntries(Object.entries(withoutTrustFields(merged)).filter(([name]) => name !== "siwe" && name !== "signature"));
+    const signed = verifySignedSession(delegationData, key, sessionDid, { expectedOwner, expiry });
+    const spaceId = String(delegationData.spaceId);
+    if (normalizePkhIdentifier(ownerSpaceId(spaceId.split(":").at(-1) ?? "", signed.ownerDid)) !== normalizePkhIdentifier(spaceId)) {
+      throw new CLIError("OPENKEY_SCOPE_MISMATCH", "The approved session is for a space the signing account doesn't own. No session was saved.", ExitCode.PERMISSION_DENIED);
     }
+    verifiedOwner = signed.ownerDid;
+    sanitizedSession = withVerifiedAuthority({ ...delegationData, jwk: key }, signed);
   }
   const ownerKeyPrimary = verifiedOwner === void 0 ? void 0 : openKeyPrimaryFlag(delegationData);
   const updatedProfile = withOwnerKeyPrimary({
@@ -23687,7 +23717,6 @@ function registerContextCommand(program) {
       const profile = await ProfileManager.getProfile(ctx.profile);
       const session = await ProfileManager.getSession(ctx.profile);
       const spaceId = await resolveSpaceUri(options.space, ctx.profile) ?? (typeof session?.spaceId === "string" ? session.spaceId : profile.spaceId ?? null);
-      const expiresAt = sessionExpiresAt(session);
       let root = cmd;
       while (root.parent) root = root.parent;
       outputJson({
@@ -23699,8 +23728,7 @@ function registerContextCommand(program) {
         host: ctx.host,
         spaceId,
         session: {
-          state: session === null ? "missing" : expiresAt === null ? "unknown-expiry" : Date.parse(expiresAt) <= Date.now() ? "expired" : "present",
-          expiresAt,
+          ...storedSessionState(session, profile),
           evidence: "local-metadata"
         },
         access: "not-tested"
@@ -36486,6 +36514,7 @@ init_permissions();
 import {
   NodeWasmBindings as NodeWasmBindings2
 } from "@tinycloud/node-sdk";
+import { ownerSessionLacksProof as ownerSessionLacksProof3 } from "@tinycloud/operations/profile";
 var wasmBindings = null;
 function registerStatusCommand(program) {
   program.command("status").description("Show local TinyCloud profile, session, delegation, and permission state").action(async (_options, cmd) => {
@@ -36552,7 +36581,7 @@ async function inspectProfile(params) {
   ]);
   const hasPrivateKey = typeof profile?.privateKey === "string" && profile.privateKey.length > 0;
   const localKeyAuthenticated = profile?.authMethod === "local" && hasPrivateKey;
-  const sessionAuthenticated = session !== null && sessionExpired !== true;
+  const sessionAuthenticated = session !== null && sessionExpired !== true && !ownerSessionLacksProof3(session, profile);
   const authenticated = localKeyAuthenticated || sessionAuthenticated;
   const status = resolveStatus({
     exists: profile !== null,