@tinycloud/cli 1.5.0-beta.32 → 1.5.0-beta.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.5.0-beta.32",
+  "version": "1.5.0-beta.33",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",

package/skills/tinycloud-cli/AUTH.md

@@ -156,6 +156,8 @@ To replace an old grant without a proof, approve again with `tinycloud auth requ
 
 `tinycloud init` and `tinycloud auth login` without a manifest request broad default-space consent, including writes, and replace the profile's session as before. Prefer `init --key-only` followed by a scoped login. They still verify OpenKey's signed proof whenever it carries one, the profile records an owner, or `--expiry` is given, and they keep the recorded owner. Non-interactive `auth login` never switches to device mode on its own, and never waits on a browser that cannot open: without `--device --manifest`, `--paste` or `--no-popup` it fails fast with `INTERACTIVE_LOGIN_REQUIRED`.
 
+`tinycloud auth login --method openkey` on a profile that does not exist creates a key-only profile first (a local key and no session, as `init --key-only` does), then continues into the login. Nothing is granted until the owner approves; abandoning the login leaves the key-only profile with no session. A `--manifest` or `--device` login still needs the profile to exist (use `tinycloud init --key-only --name X` first).
+
 Only an explicit `--host` becomes the profile's stored host; `TC_HOST` and a discovered local node apply to that command only. A command that uses the stored session verifies it locally before probing a configured local node (`localNodeUrl`, `localLinkName`); an expired or invalid one is refused without contacting it. Login, logout, rotate, status, whoami, context, node, profile, `space host-request|switch`, `enable` and `auth request` without `--grant` probe as before, as does any command given `--private-key` or `TC_PRIVATE_KEY`, or a profile with no stored session.
 
 `tinycloud auth logout` clears the local session. For OpenKey profiles it also replaces the share-history key (see below); a local-owner key is kept. It is not node revocation, app disconnection, or removal of an agent's conversation history.

package/skills/tinycloud-cli/REFERENCE.md

@@ -57,6 +57,8 @@ tinycloud context --json
 | `--method openkey\|local` | Browser OpenKey flow or local Ethereum key |
 | `--paste`, `--no-popup` | Normal OpenKey login prints a short approval link on stderr, waits for approval, then automatically verifies, durably saves and acknowledges the result. It works in a non-interactive terminal without a localhost callback or return code. `--no-popup` skips opening a local browser, not waiting. Re-run the same command after interruption to resume. `--paste` instead selects the explicit manual fallback with a five-minute, single-use return code on stdin; EOF without a code returns `PASTE_CODE_MISSING` without saving a key or session. Automatic links do not produce a manual code. |
 
+`auth login --method openkey` on a profile that does not exist creates a key-only profile first (as `init --key-only` does), then continues into the login; nothing is granted until the owner approves. A `--manifest` or `--device` login still needs the profile to exist (use `tinycloud init --key-only --name X` first). `auth logout` on a missing profile still fails with `PROFILE_NOT_FOUND` and creates nothing.
+
 Device login JSON lists the signed, approved `permissions`, owner-unchecked `declined` capabilities, `ownerDid`, `spaceId` and `expiresAt`. `tinycloud auth request --manifest FILE --grant --paste` adds another space to the onboarding profile: send the owner the link and pass their code to the CLI exactly as sent (default lifetime 7d; `--grant --device` also works for KV-scoped manifests). `tinycloud enable share [--replace-session]` is shorthand for device login with `builtin:share-publishing`. OpenKey refuses `tinycloud.sql` and other abilities outside its device policy; use normal OpenKey login (`--method openkey --manifest`) for those. Explicit `auth login` can wait for approval non-interactively; data commands never initiate consent to repair missing authority. Only an explicit `--host` is stored on the profile. Errors: `MANIFEST_REQUIRED`, `SCOPE_REJECTED` (OpenKey refused a capability; the message names it), `SESSION_IN_USE` (the request or the approved scope would narrow a live session; use a new profile or `--replace-session`), `PROFILE_CHANGED_DURING_LOGIN` (another login, key rotation or logout changed the profile while approval was pending; nothing saved), `PROFILE_STATE_INCONSISTENT` (profile, key and session disagree after an interrupted write; `--replace-session` or a new profile), `PROFILE_LOCK_TIMEOUT` (another process held the profile lock past 45 s), `LOCAL_OWNER_PROFILE` (scoped or device login on a local-owner-key profile; use a separate profile), `OPENKEY_UNREACHABLE`, `DEVICE_AUTH_DENIED`, `DEVICE_AUTH_EXPIRED`, `DEVICE_AUTH_BINDING_MISMATCH` (OpenKey's approval metadata disagrees with the signed grant), `OPENKEY_OWNER_MISMATCH`, `OPENKEY_GRANT_BROADENED`, `OPENKEY_EXPIRY_EXCEEDED` (the signed session outlives `--expiry`). Owner addresses compare case-insensitively (EIP-55 or lowercase); chain id and space name compare exactly. See [AUTH.md](AUTH.md).
 
 `builtin:share-publishing` requests, in the owner's `default` space, exactly: