@tinycloud/cli 1.3.0-beta.50 → 1.3.0-beta.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.3.0-beta.50",
+  "version": "1.3.0-beta.51",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -48,7 +48,7 @@
     "siwe": "^3.0.0"
   },
   "devDependencies": {
-    "@tinycloud/courier": "0.2.0-beta.45",
+    "@tinycloud/courier": "0.2.0-beta.46",
     "@tinycloud/replica": "0.3.0-beta.10",
     "@types/node": "^20",
     "tsup": "^8.0.0",

package/skills/tc-cli/AUTH.md

@@ -160,7 +160,9 @@ To replace an old grant without a proof, an owner can approve again with `tinycl
 
 Only an explicit `--host` becomes the profile's stored host; `TC_HOST` and a discovered local node apply to that command only. A command that uses the stored session verifies it locally before probing a configured local node (`localNodeUrl`, `localLinkName`); an expired or invalid one is refused without contacting it. Login, logout, rotate, status, whoami, context, node, profile, `space host-request|switch`, `enable` and `auth request` without `--grant` probe as before, as does any command given `--private-key` or `TC_PRIVATE_KEY`, or a profile with no stored session.
 
-`tinycloud auth logout` clears the local session and keeps the key. It is not node revocation, app disconnection, or removal of an agent's conversation history.
+`tinycloud auth logout` clears the local session. For OpenKey profiles it also replaces the share-history key (see below); a local-owner key is kept. It is not node revocation, app disconnection, or removal of an agent's conversation history.
+
+`tinycloud auth logout` and `tinycloud auth rotate` replace the profile's share-history key. Before either runs, the CLI checks the sender history: if it holds unexpired shares, or cannot be read, the command refuses with `SHARE_HISTORY_UNEXPIRED` or `SHARE_HISTORY_UNAVAILABLE` (exit 5) and changes nothing. Pass `--force` to proceed anyway; `auth logout --revoke` also skips the check. After a key change, `share revoke <id>` can no longer revoke a bearer link issued under the old key (`SHARE_ISSUER_KEY_UNAVAILABLE`), so revoke those links first. An unreadable history file is moved aside, never deleted, only by `tinycloud share history recover`, which moves it to `share-history-v2.json.unreadable-<timestamp>`. A replica-enabled `tinycloud auth login` that replaces the key runs the same check; pass `--force` to skip it. A plain re-login that keeps the key is not checked. Local-owner profiles are not checked.
 
 ## Verify access
 

package/skills/tc-cli/REFERENCE.md

@@ -5,7 +5,7 @@ This release has **Commander coverage tracked, not complete parity**:
 
 - 4 migrated registration(s).
 - 1 partially migrated registration(s).
-- 129 legacy registration(s) remain Commander-owned.
+- 131 legacy registration(s) remain Commander-owned.
 
 - `auth import [source]` → `tinycloud.auth.import@1` (partial; legacy inputs: v1 delegation artifact, v1 permission artifact without command, bare portable delegation, stored delegation wrapper, cross-user delegation persisted with activated=false).
 - `secrets get <name>` → `tinycloud.secrets.get@1` (migrated).
@@ -375,6 +375,7 @@ printf '%s' "$SHARE_URL" | "$TC" share receive - --output .
 "$TC" share show <id> [--reveal-link]
 "$TC" share notify <id> --to alice@example.com                        # retry email delivery within 5 minutes of publication
 "$TC" share revoke <id>                                               # bearer or addressed share this profile created
+"$TC" share history recover [--json]                                  # move an unreadable sender history aside (renamed, never deleted)
 ```
 
 **Artifact versions (pinned shares).** `--artifact <id|new>` stores the file as the next write-once version, `artifacts/<id>/versions/<n>/<file>` plus a `manifest.json` written last (file sha256 and size, parent, `--note`), in the owner's space. The share is pinned to that version: its delegation covers only that file and never carries `put`. Publishing the same bytes again to a bearer link returns the same version; changed content makes the next one. Publishing never overwrites an earlier version, but the node has no write-once ACL for the owner, so the owner (or anyone holding the owner's session) can overwrite a version file afterwards; the CLI will not, and the writes it makes use `If-None-Match: *`. Only addressed artifact shares detect such an overwrite (see Pin below); a bearer artifact share carries no digest and would deliver the new bytes. An addressed share stores ciphertext under a fresh random key each time, so every addressed publish is a new version, and `manifest.json` records only the sha256 of the stored ciphertext, never of the plaintext (an unsalted plaintext hash next to the ciphertext would let a reader of the space confirm a guess). `--artifact new` mints an id. JSON output adds `artifactId`, `version` and `mode` (`pinned`). `--action edit` on an artifact share is refused (a pinned version is read-only). An artifact share takes one file. Every artifact share pins one version; shares that follow later versions are not available yet. Profiles signed in before this feature need `auth login --device --manifest builtin:share-publishing` again, because the manifest now includes `artifacts/`.