@tinycloud/operations 0.5.1 → 0.5.2-beta.1

package/dist/cli-runtime.cjs

@@ -8559,6 +8559,9 @@ function resolvePosture(profile) {
 function isLocalOwnerProfile(profile) {
   return resolvePosture(profile) === "local-owner-key" || profile.authMethod === "local" || typeof profile.privateKey === "string";
 }
+function ownerSessionLacksProof(session, profile) {
+  return profile !== null && resolvePosture(profile) === "owner-openkey" && (typeof session.siwe !== "string" || typeof session.signature !== "string");
+}
 function profileNotFound2(profile) {
   return {
     ok: false,
@@ -8694,6 +8697,12 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
           "The selected profile does not have an active session."
         ));
       }
+    } else if (ownerSessionLacksProof(activeSession, profile)) {
+      return failed(summary, operationError(
+        "AUTH_REQUIRED",
+        "The stored OpenKey session has no signed proof. Sign in again.",
+        { retryable: false, details: { recovery: signInRecovery(profileName, summary.posture) } }
+      ));
     } else {
       try {
         await node.restoreSession(activeSession);
@@ -8789,6 +8798,13 @@ async function createRestoredRuntime(target, resolved) {
         { details: { recovery: signInRecovery(profileName, summary.posture) } }
       ));
     }
+    if (ownerSessionLacksProof(activeSession, profile)) {
+      return failed(summary, operationError(
+        "AUTH_REQUIRED",
+        "The stored OpenKey session has no signed proof. Sign in again.",
+        { retryable: false, details: { recovery: signInRecovery(profileName, summary.posture) } }
+      ));
+    }
     if (!await bindingMigrationRecorded(profileName)) {
       const records = await readAdditionalDelegations(profileName);
       if (records.some(