@tinycloud/cli 1.2.2-beta.1 → 1.2.2-beta.3

package/dist/legacy-entry.js

@@ -16288,7 +16288,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
   const { prehash } = eddsaOpts;
   const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
-  const randomBytes8 = eddsaOpts.randomBytes || randomBytes;
+  const randomBytes9 = eddsaOpts.randomBytes || randomBytes;
   const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
   const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
     _abool2(phflag, "phflag");
@@ -16370,7 +16370,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     signature: 2 * _size,
     seed: _size
   };
-  function randomSecretKey(seed = randomBytes8(lengths.seed)) {
+  function randomSecretKey(seed = randomBytes9(lengths.seed)) {
     return _abytes2(seed, lengths.seed, "seed");
   }
   function keygen(seed) {
@@ -17797,6 +17797,7 @@ __export(sdk_exports, {
   storedSessionVerifiesLocally: () => storedSessionVerifiesLocally
 });
 import { TinyCloudNode, signedCompactUcanExpiry } from "@tinycloud/node-sdk";
+import { ownerSessionLacksProof } from "@tinycloud/operations/profile";
 function jwkHasPrivateParameter(jwk) {
   if (!jwk || typeof jwk !== "object") return false;
   const d = jwk.d;
@@ -17828,11 +17829,15 @@ function signedLifetimePassed(delegation) {
   return expiry !== void 0 && expiry.getTime() <= Date.now();
 }
 async function restoreProfileSession(node, profileName2, profile, sessionData) {
+  const posture = profile === null ? void 0 : resolveProfilePosture(profile);
+  if (ownerSessionLacksProof(sessionData, profile)) {
+    throw sessionExpiredError(profileName2, posture);
+  }
   try {
     await node.restoreSession(sessionData);
   } catch (error) {
     if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
-      throw sessionExpiredError(profileName2, profile === null ? void 0 : resolveProfilePosture(profile));
+      throw sessionExpiredError(profileName2, posture);
     }
     throw error;
   }
@@ -20277,6 +20282,7 @@ init_types();
 init_constants();
 init_errors();
 import { createServer } from "http";
+import { randomBytes as randomBytes3 } from "crypto";
 import { createInterface } from "readline";
 var PRIVATE_JWK_FIELDS = /* @__PURE__ */ new Set([
   "d",
@@ -20288,6 +20294,7 @@ var PRIVATE_JWK_FIELDS = /* @__PURE__ */ new Set([
   "oth",
   "k"
 ]);
+var MAX_CALLBACK_BODY_BYTES = 1024 * 1024;
 function publicJwkForDelegation(jwk) {
   const publicJwk = {};
   for (const [key, value] of Object.entries(jwk)) {
@@ -20438,6 +20445,7 @@ async function callbackFlow(did, options = {}) {
       settled = true;
       clearTimeout(timeout);
       server.close();
+      server.closeAllConnections();
       if (rl) {
         rl.close();
       }
@@ -20447,37 +20455,50 @@ async function callbackFlow(did, options = {}) {
         reject(result.error);
       }
     }
-    const server = createServer((req, res) => {
-      if (req.method === "POST" && req.url === "/callback") {
-        let body = "";
+    const callbackPath = `/callback/${randomBytes3(16).toString("base64url")}`;
+    const openKeyOrigin = new URL(options.openkeyHost ?? DEFAULT_OPENKEY_HOST).origin;
+    const cors = { "Access-Control-Allow-Origin": openKeyOrigin, "Vary": "Origin" };
+    const server = createServer({ connectionsCheckingInterval: 1e3 }, (req, res) => {
+      if (req.headers.origin !== openKeyOrigin) {
+        res.writeHead(403);
+        res.end();
+        return;
+      }
+      if (req.method === "POST" && req.url === callbackPath) {
+        const chunks = [];
+        let size = 0;
         req.on("data", (chunk) => {
-          body += chunk.toString();
+          size += chunk.length;
+          if (size > MAX_CALLBACK_BODY_BYTES) {
+            res.writeHead(413, cors);
+            res.end();
+            req.destroy();
+            return;
+          }
+          chunks.push(chunk);
         });
         req.on("end", () => {
+          let data;
           try {
-            const data = JSON.parse(body);
-            const invalid2 = validateDelegationCallbackPayload(data);
-            if (invalid2) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end(JSON.stringify({ error: invalid2 }));
-              settle({ error: new Error(`Invalid delegation payload: ${invalid2}`) });
-              return;
-            }
-            res.writeHead(200, {
-              "Content-Type": "application/json",
-              "Access-Control-Allow-Origin": "*"
-            });
-            res.end(JSON.stringify({ success: true }));
-            settle({ data });
-          } catch (err2) {
-            res.writeHead(400, { "Content-Type": "application/json" });
+            data = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          } catch {
+            res.writeHead(400, { ...cors, "Content-Type": "application/json" });
             res.end(JSON.stringify({ error: "Invalid JSON" }));
-            settle({ error: new Error("Invalid delegation data received") });
+            return;
           }
+          const invalid2 = validateDelegationCallbackPayload(data);
+          if (invalid2) {
+            res.writeHead(400, { ...cors, "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: invalid2 }));
+            return;
+          }
+          res.writeHead(200, { ...cors, "Content-Type": "application/json" });
+          res.end(JSON.stringify({ success: true }));
+          settle({ data });
         });
-      } else if (req.method === "OPTIONS") {
+      } else if (req.method === "OPTIONS" && req.url === callbackPath) {
         res.writeHead(204, {
-          "Access-Control-Allow-Origin": "*",
+          ...cors,
           "Access-Control-Allow-Methods": "POST, OPTIONS",
           "Access-Control-Allow-Headers": "Content-Type"
         });
@@ -20487,6 +20508,8 @@ async function callbackFlow(did, options = {}) {
         res.end();
       }
     });
+    server.headersTimeout = 1e4;
+    server.requestTimeout = 1e4;
     server.listen(0, "127.0.0.1", async () => {
       const addr = server.address();
       if (!addr || typeof addr === "string") {
@@ -20494,7 +20517,7 @@ async function callbackFlow(did, options = {}) {
         return;
       }
       const port = addr.port;
-      const callbackUrl = `http://127.0.0.1:${port}/callback`;
+      const callbackUrl = `http://127.0.0.1:${port}${callbackPath}`;
       const authUrl = buildAuthUrl(did, { ...options, callback: callbackUrl });
       const openBrowser = shouldOpenBrowser(options);
       const hasTerminal = Boolean(process.stdin.isTTY || process.stderr.isTTY);
@@ -20584,14 +20607,14 @@ import {
   createECDH,
   createHash,
   createHmac,
-  randomBytes as randomBytes4
+  randomBytes as randomBytes5
 } from "crypto";
 
 // src/auth/local-key.ts
 init_replication_config();
 import { TCWSessionManager, importKey, initPanicHook } from "@tinycloud/node-sdk-wasm";
 import { PrivateKeySigner } from "@tinycloud/node-sdk";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 var wasmInitialized = false;
 function ensureWasm() {
   if (!wasmInitialized) {
@@ -20616,7 +20639,7 @@ function keyToDID(jwk) {
   return mgr.getDID(keyId);
 }
 function generateEthereumPrivateKey() {
-  const keyBytes = randomBytes3(32);
+  const keyBytes = randomBytes4(32);
   return "0x" + keyBytes.toString("hex");
 }
 async function deriveAddress(privateKey) {
@@ -20670,7 +20693,7 @@ async function localKeySignIn(options) {
 init_errors();
 init_constants();
 import { NodeWasmBindings, signedCompactUcanExpiry as signedCompactUcanExpiry2 } from "@tinycloud/node-sdk";
-import { isLocalOwnerProfile as isLocalOwnerProfile2 } from "@tinycloud/operations/profile";
+import { isLocalOwnerProfile as isLocalOwnerProfile2, ownerSessionLacksProof as ownerSessionLacksProof2 } from "@tinycloud/operations/profile";
 
 // src/lib/duration.ts
 function parseDuration(input) {
@@ -20772,8 +20795,9 @@ function sessionExpiresAt(session) {
   if (typeof value === "string") return new Date(value).toISOString();
   return null;
 }
-function storedSessionState(session) {
+function storedSessionState(session, profile) {
   if (session === null) return { state: "missing", expiresAt: null };
+  if (ownerSessionLacksProof2(session, profile)) return { state: "unverified", expiresAt: null };
   const siweExpiry = typeof session.siwe === "string" ? session.siwe.match(/^Expiration Time:\s*(.+)$/m)?.[1] : void 0;
   const expiresAt = siweExpiry !== void 0 && Number.isFinite(Date.parse(siweExpiry)) ? new Date(siweExpiry).toISOString() : sessionExpiresAt(session);
   if (expiresAt === null) return { state: "unknown-expiry", expiresAt };
@@ -21134,6 +21158,11 @@ function warnIfNotPrimaryKey(ownerDid, primary) {
   if (primary !== false || ownerDid === void 0) return;
   process.stderr.write(nonPrimaryKeyWarning(ownerDid));
 }
+function announceFirstOwner(profileName2, expectedOwner, ownerDid) {
+  if (expectedOwner !== void 0 || ownerDid === void 0) return;
+  process.stderr.write(`Profile "${profileName2}" now belongs to ${ownerDid}. If that isn't your OpenKey account, stop using this profile and create a new one with tc init.
+`);
+}
 function ownerLoginPermissions(owner) {
   const space = ownerSpaceId("default", owner);
   return [
@@ -21379,8 +21408,8 @@ async function acquireDeviceDelegation(input) {
   const nodeOrigin = canonicalOrigin(input.nodeOrigin, "TinyCloud node origin");
   const shareOrigin = canonicalOrigin(input.shareOrigin, "Share origin");
   const fetchFn = input.fetchFn ?? globalThis.fetch;
-  const deviceSecret = randomBytes4(32).toString("base64url");
-  const codeVerifier = randomBytes4(32).toString("base64url");
+  const deviceSecret = randomBytes5(32).toString("base64url");
+  const codeVerifier = randomBytes5(32).toString("base64url");
   const relayKey = createECDH("prime256v1");
   relayKey.generateKeys();
   const relayPublicJwk = relayPublicJwkOf(relayKey);
@@ -21495,15 +21524,6 @@ async function acquireDeviceDelegation(input) {
   }
   throw new CLIError("DEVICE_AUTH_EXPIRED", "OpenKey device authorization expired before approval. Run the command again.", ExitCode.AUTH_REQUIRED);
 }
-function mergePrivateJwkIntoSession(session, key) {
-  const sessionJwk = session.jwk;
-  if (!sessionJwk || typeof sessionJwk !== "object") return session;
-  const sessionJwkRecord = sessionJwk;
-  if (typeof sessionJwkRecord.d === "string" && sessionJwkRecord.d.length > 0) return session;
-  const privateParameter = key.d;
-  if (typeof privateParameter !== "string" || privateParameter.length === 0) return session;
-  return { ...session, jwk: { ...sessionJwkRecord, d: privateParameter } };
-}
 async function loginWithDeviceAuthorization(input) {
   const snapshot = await readProfileSnapshot(input.profileName);
   const existing = snapshot.profile;
@@ -21548,6 +21568,7 @@ async function loginWithDeviceAuthorization(input) {
     approved: { scope: result.session.permissions, ownerDid: result.ownerDid, replaceSession: input.replaceSession === true }
   });
   warnIfNotPrimaryKey(result.ownerDid, result.primary);
+  announceFirstOwner(input.profileName, expectedOwner, result.ownerDid);
   return { profile, result };
 }
 
@@ -22254,7 +22275,7 @@ function registerAuthCommand(program, options) {
       }
       const posture = profile ? resolveProfilePosture(profile) : null;
       const operatorType = profile ? resolveProfileOperatorType(profile) : null;
-      const { state: sessionState, expiresAt } = storedSessionState(session);
+      const { state: sessionState, expiresAt } = storedSessionState(session, profile);
       const authenticated = sessionStateIsUsable(sessionState);
       if (shouldOutputJson()) {
         outputJson({
@@ -22289,7 +22310,7 @@ function registerAuthCommand(program, options) {
         process.stdout.write(formatField("Address", profile?.address ?? null) + "\n");
         process.stdout.write(formatField("Space ID", profile?.spaceId ?? null) + "\n");
         process.stdout.write(formatField("Has Key", hasKey !== null) + "\n");
-        if (sessionState === "expired") {
+        if (sessionState === "expired" || sessionState === "unverified") {
           process.stdout.write(`
 ${signInAgainHint(ctx.profile, posture ?? void 0)}
 `);
@@ -22741,9 +22762,9 @@ ${signInAgainHint(ctx.profile, posture ?? void 0)}
       const ctx = await ProfileManager.resolveContext(globalOpts, { storedSession: "unused" });
       const profile = await ProfileManager.getProfile(ctx.profile);
       const session = await ProfileManager.getSession(ctx.profile);
-      const { state: sessionState, expiresAt } = storedSessionState(session);
-      const authenticated = sessionStateIsUsable(sessionState);
       const posture = resolveProfilePosture(profile);
+      const { state: sessionState, expiresAt } = storedSessionState(session, profile);
+      const authenticated = sessionStateIsUsable(sessionState);
       const operatorType = resolveProfileOperatorType(profile);
       if (shouldOutputJson()) {
         outputJson({
@@ -22790,6 +22811,8 @@ function describeSession(state2, expiresAt) {
       return `active until ${expiresAt}`;
     case "unknown-expiry":
       return "active (no recorded expiry)";
+    case "unverified":
+      return "not usable (no signed OpenKey proof)";
   }
 }
 async function emitPermissionRequestArtifact(artifact, emitOption) {
@@ -23437,10 +23460,10 @@ async function handleOpenKeyAuth(profileName2, host, options = {}) {
     profile: profileName2,
     did: profile.did,
     spaceId: delegationData.spaceId,
+    ownerDid: profile.ownerDid ?? null,
     authMethod: "openkey",
     ...options.permissions ? {
       scoped: true,
-      ownerDid: profile.ownerDid,
       host,
       permissions: delegationData.permissions,
       declined,
@@ -23534,15 +23557,13 @@ async function refreshOpenKeySession(profileName2, host, options = {}) {
     verifiedOwner = sanitizedSession.ownerDid;
     declined = declinedPermissions(permissions, sanitizedSession.permissions, verifiedOwner);
   } else {
-    const carriesProof = typeof delegationData.siwe === "string" && typeof delegationData.signature === "string";
-    const merged = mergePrivateJwkIntoSession(delegationData, key);
-    if (carriesProof || expiry !== void 0 || expectedOwner !== void 0) {
-      const signed = verifySignedSession(delegationData, key, sessionDid, { expectedOwner, expiry });
-      verifiedOwner = signed.ownerDid;
-      sanitizedSession = withVerifiedAuthority(merged, signed);
-    } else {
-      sanitizedSession = Object.fromEntries(Object.entries(withoutTrustFields(merged)).filter(([name]) => name !== "siwe" && name !== "signature"));
+    const signed = verifySignedSession(delegationData, key, sessionDid, { expectedOwner, expiry });
+    const spaceId = String(delegationData.spaceId);
+    if (normalizePkhIdentifier(ownerSpaceId(spaceId.split(":").at(-1) ?? "", signed.ownerDid)) !== normalizePkhIdentifier(spaceId)) {
+      throw new CLIError("OPENKEY_SCOPE_MISMATCH", "The approved session is for a space the signing account doesn't own. No session was saved.", ExitCode.PERMISSION_DENIED);
     }
+    verifiedOwner = signed.ownerDid;
+    sanitizedSession = withVerifiedAuthority({ ...delegationData, jwk: key }, signed);
   }
   const ownerKeyPrimary = verifiedOwner === void 0 ? void 0 : openKeyPrimaryFlag(delegationData);
   const updatedProfile = withOwnerKeyPrimary({
@@ -23562,6 +23583,7 @@ async function refreshOpenKeySession(profileName2, host, options = {}) {
     ...permissions && verifiedOwner ? { approved: { scope: sanitizedSession.permissions, ownerDid: verifiedOwner, replaceSession: options.replaceSession === true } } : {}
   });
   warnIfNotPrimaryKey(verifiedOwner, ownerKeyPrimary);
+  announceFirstOwner(profileName2, expectedOwner, verifiedOwner);
   return { profile: updatedProfile, delegationData: sanitizedSession, declined, legacyNested };
 }
 
@@ -23731,7 +23753,7 @@ function registerContextCommand(program) {
         host: ctx.host,
         spaceId,
         session: {
-          ...storedSessionState(session),
+          ...storedSessionState(session, profile),
           evidence: "local-metadata"
         },
         access: "not-tested"
@@ -23861,6 +23883,8 @@ init_constants();
 init_formatter();
 init_theme();
 init_errors();
+init_session_expired();
+init_types();
 function registerDoctorCommand(program) {
   program.command("doctor").description("Run diagnostic checks").action(async (_options, cmd) => {
     try {
@@ -23906,8 +23930,14 @@ function registerDoctorCommand(program) {
       if (profileOk && profileName2) {
         try {
           const session = await ProfileManager.getSession(profileName2);
-          sessionOk = session !== null;
-          sessionDetail = sessionOk ? "active" : "no session \u2014 run tc auth login";
+          const { state: state2, expiresAt } = storedSessionState(session);
+          sessionOk = sessionStateIsUsable(state2);
+          if (state2 === "expired") {
+            const posture = resolveProfilePosture(await ProfileManager.getProfile(profileName2));
+            sessionDetail = `expired ${expiresAt} \u2014 ${signInAgainHint(profileName2, posture)}`;
+          } else {
+            sessionDetail = sessionOk ? "active" : "no session \u2014 run tc auth login";
+          }
         } catch {
           sessionDetail = "error reading session";
         }
@@ -23920,7 +23950,7 @@ function registerDoctorCommand(program) {
       try {
         const host = profileOk && profileName2 ? (await ProfileManager.getProfile(profileName2)).host : globalOpts.host || DEFAULT_HOST;
         const start = Date.now();
-        const response = await fetch(`${host}/health`);
+        const response = await fetch(`${host}/healthz`);
         const latency = Date.now() - start;
         nodeReachable = response.ok;
         nodeDetail = nodeReachable ? `${host} (${latency}ms)` : `${host} returned ${response.status}`;
@@ -23939,7 +23969,7 @@ function registerDoctorCommand(program) {
           spaceDetail = "error checking space";
         }
       } else {
-        spaceDetail = "skipped (no session)";
+        spaceDetail = "skipped (no active session)";
       }
       checks.push({ name: "Space", ok: spaceOk, detail: spaceDetail });
       const result = {
@@ -24925,7 +24955,7 @@ function parseOperatorType(raw) {
 // src/commands/replica.ts
 init_sdk();
 init_replication_registry();
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { constants as fsConstants2 } from "fs";
 import { open as open4, readdir as readdir5, rename as rename3, stat as stat3, unlink as unlink2, readFile as readFile9, lstat as lstat4 } from "fs/promises";
 import { basename as basename3, dirname as dirname5, join as join10, resolve as resolve2 } from "path";
@@ -25272,7 +25302,7 @@ function describeStatus(status) {
 }
 async function writeFileAtomic(path, bytes) {
   const target = resolve2(path);
-  const temp = join10(dirname5(target), `.${basename3(target)}.${randomBytes5(6).toString("hex")}.tmp`);
+  const temp = join10(dirname5(target), `.${basename3(target)}.${randomBytes6(6).toString("hex")}.tmp`);
   const handle = await open4(temp, fsConstants2.O_CREAT | fsConstants2.O_EXCL | fsConstants2.O_WRONLY, 384);
   try {
     await handle.writeFile(bytes);
@@ -25459,7 +25489,7 @@ or coverage incomplete; 5 grant expired, revoked or not yet valid; 6 network;
         chooseGrant(grants, deviceDid, space, prefix);
         store = await createReplica(profile, {
           name,
-          replicaId: randomBytes5(16).toString("hex"),
+          replicaId: randomBytes6(16).toString("hex"),
           host,
           space,
           prefix,
@@ -35549,7 +35579,7 @@ function receiveJson(result, path) {
 // src/share/io.ts
 import { constants } from "fs";
 import { lstat as lstat5, mkdir as mkdir4, mkdtemp, open as open7, readFile as readFile11, realpath as realpath2, stat as stat4, link as link2, rename as rename4, rm as rm6, unlink as unlink3 } from "fs/promises";
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 import { basename as basename4, join as join12, resolve as resolve3, sep as sep2 } from "path";
 init_errors();
 var MAX_SHARE_STDIN_BYTES = 100 * 1024 * 1024;
@@ -35636,7 +35666,7 @@ async function writeShareOutput(directory, filename, bytes, force) {
   const stagingDirectory = await mkdtemp(join12(stableDirectory, ".tinycloud-share-stage-"));
   const stagingInfo = await lstat5(stagingDirectory);
   if (!stagingInfo.isDirectory() || (stagingInfo.mode & 511) !== 448) throw new Error("OUTPUT_EXISTS");
-  const stagingPath = join12(stagingDirectory, `.tinycloud-share-${randomBytes6(16).toString("hex")}.tmp`);
+  const stagingPath = join12(stagingDirectory, `.tinycloud-share-${randomBytes7(16).toString("hex")}.tmp`);
   let temporaryPath;
   let handle;
   try {
@@ -36094,7 +36124,7 @@ init_constants();
 init_sdk();
 init_host();
 init_theme();
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes8 } from "crypto";
 import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname6 } from "path";
 function didWithoutFragment2(did) {
@@ -36175,7 +36205,7 @@ it directly with \`tc space host <name>\` (no request needed).
       const artifact = {
         kind: "tinycloud.host.request",
         version: 1,
-        requestId: `hostreq_${Date.now().toString(36)}_${randomBytes7(4).toString("hex")}`,
+        requestId: `hostreq_${Date.now().toString(36)}_${randomBytes8(4).toString("hex")}`,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
         spaceName,
         spaceId,
@@ -36517,6 +36547,7 @@ init_permissions();
 import {
   NodeWasmBindings as NodeWasmBindings2
 } from "@tinycloud/node-sdk";
+import { ownerSessionLacksProof as ownerSessionLacksProof3 } from "@tinycloud/operations/profile";
 var wasmBindings = null;
 function registerStatusCommand(program) {
   program.command("status").description("Show local TinyCloud profile, session, delegation, and permission state").action(async (_options, cmd) => {
@@ -36583,7 +36614,7 @@ async function inspectProfile(params) {
   ]);
   const hasPrivateKey = typeof profile?.privateKey === "string" && profile.privateKey.length > 0;
   const localKeyAuthenticated = profile?.authMethod === "local" && hasPrivateKey;
-  const sessionAuthenticated = session !== null && sessionExpired !== true;
+  const sessionAuthenticated = session !== null && sessionExpired !== true && !ownerSessionLacksProof3(session, profile);
   const authenticated = localKeyAuthenticated || sessionAuthenticated;
   const status = resolveStatus({
     exists: profile !== null,