buckyos 0.7.115 → 0.7.118

package/cli/dist/cli.mjs

@@ -2,7 +2,7 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 import * as nodePath from "node:path";
 import { resolve as resolve$5, dirname as dirname$3 } from "node:path";
-import { namelib, BuckyOSSDK, RuntimeType, buckyos, VerifyHubClient, createAppInstanceId, parseSessionTokenClaims, ndn, ndm_proxy } from "buckyos/node";
+import { BuckyOSSDK, RuntimeType, buckyos, namelib, VerifyHubClient, createAppInstanceId, parseSessionTokenClaims, ndn, ndm_proxy } from "buckyos/node";
 import { createHash } from "node:crypto";
 import { readFile, writeFile, readdir, stat, lstat, realpath, mkdtemp, rename, rm, mkdir, chmod, symlink, copyFile, open } from "node:fs/promises";
 import { createReadStream, createWriteStream } from "node:fs";
@@ -94,8 +94,6 @@ const STRING_GLOBALS = /* @__PURE__ */ new Map([
   ["zone", "zone"],
   ["endpoint", "endpoint"],
   ["identity", "identity"],
-  ["identity-root", "identityRoot"],
-  ["security-root", "securityRoot"],
   ["session-token", "sessionToken"],
   ["session-token-file", "sessionTokenFile"],
   ["output", "output"],
@@ -104,6 +102,9 @@ const STRING_GLOBALS = /* @__PURE__ */ new Map([
   ["trace-id", "traceId"],
   ["idempotency-key", "idempotencyKey"]
 ]);
+const REPEATABLE_STRING_GLOBALS = /* @__PURE__ */ new Map([
+  ["allow-read", "allowRead"]
+]);
 const BOOLEAN_GLOBALS = /* @__PURE__ */ new Map([
   ["cli", "cli"],
   ["wait", "wait"],
@@ -149,11 +150,16 @@ function parseInvocation(argv) {
       continue;
     }
     const stringProperty = STRING_GLOBALS.get(parsed.name);
-    if (!stringProperty) {
+    const repeatableStringProperty = REPEATABLE_STRING_GLOBALS.get(parsed.name);
+    if (!stringProperty && !repeatableStringProperty) {
       throw new UsageError("UNKNOWN_OPTION", `unknown global option: --${parsed.name}`);
     }
     const { value, consumed } = readOptionValue(argv, index, parsed);
-    setGlobal(global, stringProperty, normalizeGlobalValue(parsed.name, value));
+    if (repeatableStringProperty === "allowRead") {
+      global.allowRead = [...global.allowRead ?? [], value];
+    } else {
+      setGlobal(global, stringProperty, normalizeGlobalValue(parsed.name, value));
+    }
     index += consumed;
   }
   const module = argv[index];
@@ -214,7 +220,7 @@ function parseCommandArgs(command, argv, inputObject, allowReplScopedGlobals = f
       index += consumed2;
       continue;
     }
-    if (allowReplScopedGlobals && (STRING_GLOBALS.has(parsed.name) || BOOLEAN_GLOBALS.has(parsed.name))) {
+    if (allowReplScopedGlobals && (STRING_GLOBALS.has(parsed.name) || REPEATABLE_STRING_GLOBALS.has(parsed.name) || BOOLEAN_GLOBALS.has(parsed.name))) {
       throw new UsageError(
         "SESSION_OPTION_FROZEN",
         `--${parsed.name} is frozen for the interactive session`
@@ -477,8 +483,6 @@ const TOOL_ENVIRONMENT_NAMES = [
   "BUCKYOS_TOOL_ENDPOINT",
   "BUCKYOS_TOOL_IDENTITY",
   "BUCKYOS_TOOL_OUTPUT",
-  "BUCKYOS_IDENTITY_ROOT",
-  "BUCKYOS_SECURITY_ROOT",
   "BUCKYOS_APPCLIENT_SESSION_TOKEN",
   "BUCKYOS_ROOT",
   "SOURCE_DATE_EPOCH"
@@ -491,14 +495,16 @@ function buildDistributionPolicy(options) {
   const configRoot = path.resolve(
     environment2.BUCKYOS_TOOL_CONFIG_DIR ?? path.join(homeDir, ".buckyos_tool")
   );
-  const readPaths = /* @__PURE__ */ new Set([path.resolve(packageRoot2), path.resolve(cwd), configRoot]);
+  const readPaths = /* @__PURE__ */ new Set([
+    path.resolve(packageRoot2),
+    path.resolve(cwd),
+    configRoot,
+    path.resolve(path.join(homeDir, ".buckyos")),
+    path.resolve(path.join(homeDir, ".buckycli"))
+  ]);
   const writePaths = /* @__PURE__ */ new Set([path.resolve(cwd), configRoot]);
   if (options.distribution === "system")
     readPaths.add(buckyosRoot);
-  if (environment2.BUCKYOS_IDENTITY_ROOT && environment2.BUCKYOS_SECURITY_ROOT) {
-    readPaths.add(path.resolve(environment2.BUCKYOS_IDENTITY_ROOT));
-    readPaths.add(path.resolve(environment2.BUCKYOS_SECURITY_ROOT));
-  }
   const parsed = collectArgumentPaths(argv);
   for (const candidate of parsed.read)
     readPaths.add(resolveInputPath(candidate, cwd, path));
@@ -593,7 +599,9 @@ function collectArgumentPaths(argv) {
       if (name === "config-dir") {
         read.push(value);
         write.push(value);
-      } else if (["input", "session-token-file", "identity-root", "security-root", "pikg"].includes(name)) {
+      } else if (name === "allow-read") {
+        read.push(value);
+      } else if (["input", "session-token-file", "pikg"].includes(name)) {
         if (value !== "-")
           read.push(value);
       } else if (name === "source" && module === "pikg") {
@@ -676,8 +684,6 @@ const ENVIRONMENT_NAMES = [
   "BUCKYOS_TOOL_ENDPOINT",
   "BUCKYOS_TOOL_IDENTITY",
   "BUCKYOS_TOOL_OUTPUT",
-  "BUCKYOS_IDENTITY_ROOT",
-  "BUCKYOS_SECURITY_ROOT",
   "BUCKYOS_APPCLIENT_SESSION_TOKEN",
   "BUCKYOS_ROOT"
 ];
@@ -820,34 +826,6 @@ async function resolveConfig(explicit, environment2 = readEnvironment(), options
     void 0,
     sources
   );
-  const identityRoot = select(
-    "identity_root",
-    explicit.identityRoot,
-    environment2.BUCKYOS_IDENTITY_ROOT,
-    void 0,
-    void 0,
-    sources
-  );
-  const securityRoot = select(
-    "security_root",
-    explicit.securityRoot,
-    environment2.BUCKYOS_SECURITY_ROOT,
-    void 0,
-    void 0,
-    sources
-  );
-  if (!!explicit.identityRoot !== !!explicit.securityRoot) {
-    throw new UsageError(
-      "IDENTITY_ROOT_PAIR_REQUIRED",
-      "--identity-root and --security-root must be provided together"
-    );
-  }
-  if (!!environment2.BUCKYOS_IDENTITY_ROOT !== !!environment2.BUCKYOS_SECURITY_ROOT && !explicit.identityRoot) {
-    throw new UsageError(
-      "IDENTITY_ROOT_PAIR_REQUIRED",
-      "BUCKYOS_IDENTITY_ROOT and BUCKYOS_SECURITY_ROOT must be provided together"
-    );
-  }
   let output;
   if (options.interactive && explicit.output === void 0) {
     output = "table";
@@ -880,8 +858,6 @@ async function resolveConfig(explicit, environment2 = readEnvironment(), options
       zone,
       endpoint,
       identity,
-      identityRoot,
-      securityRoot,
       sessionToken,
       sessionTokenFile: explicit.sessionTokenFile,
       output,
@@ -915,8 +891,6 @@ function localResolvedConfig(explicit, environment2 = readEnvironment(), options
       zone: explicit.zone ?? environment2.BUCKYOS_TOOL_ZONE,
       endpoint: explicit.endpoint ?? environment2.BUCKYOS_TOOL_ENDPOINT,
       identity: explicit.identity ?? environment2.BUCKYOS_TOOL_IDENTITY,
-      identityRoot: explicit.identityRoot ?? environment2.BUCKYOS_IDENTITY_ROOT,
-      securityRoot: explicit.securityRoot ?? environment2.BUCKYOS_SECURITY_ROOT,
       sessionToken: explicit.sessionToken ?? environment2.BUCKYOS_APPCLIENT_SESSION_TOKEN,
       sessionTokenFile: explicit.sessionTokenFile,
       output,
@@ -1081,6 +1055,196 @@ function redactUrl(value) {
 function configValueError(message) {
   return new ToolError("INVALID_CONFIG_VALUE", message, 2);
 }
+class BuckyOSRuntimeAdapter {
+  #sdk = new BuckyOSSDK("node");
+  async initialize(config, session) {
+    const authenticated = session.current();
+    const zoneHost = resolveZoneHost(config);
+    const initialize = this.#sdk.initBuckyOS;
+    await initialize.call(this.#sdk, authenticated.principal.appId, {
+      appId: authenticated.principal.appId,
+      ownerUserId: authenticated.principal.id,
+      runtimeType: RuntimeType.AppClient,
+      zoneHost,
+      defaultProtocol: config.defaultProtocol,
+      sessionToken: authenticated.token,
+      privateKeySearchPaths: [],
+      autoRenew: false,
+      verifyHubServiceUrl: resolveServiceUrl(config, "verify-hub")
+    });
+    return {
+      zone: config.zone ?? zoneHost,
+      endpoint: config.endpoint ?? `${config.defaultProtocol}${zoneHost}`,
+      defaultProtocol: config.defaultProtocol
+    };
+  }
+}
+class BuckyOSServiceClientRegistry {
+  #config;
+  #session;
+  #clients = /* @__PURE__ */ new Map();
+  constructor(config, session) {
+    this.#config = config;
+    this.#session = session;
+  }
+  async call(service, method, params, options) {
+    let client = this.#clients.get(service);
+    if (!client) {
+      const RpcClient = buckyos.kRPCClient;
+      client = new RpcClient(resolveServiceUrl(this.#config, service), null, null, {
+        sessionTokenProvider: async () => (await this.#session.ensureValid()).token
+      });
+      this.#clients.set(service, client);
+    }
+    const request = client.call(method, params, { traceId: options.traceId });
+    return await withDeadline(request, options.timeoutMs, options.signal);
+  }
+  async createEventReader(pattern, signal) {
+    return await buckyos.createEventReader(pattern, { keepaliveMs: 5e3, signal });
+  }
+}
+class InteractiveSession {
+  constructor(authentication, clients, connection) {
+    this.authentication = authentication;
+    this.clients = clients;
+    this.connection = connection;
+    this.startedAt = Date.now();
+  }
+  static async create(config, authentication, runtime = new BuckyOSRuntimeAdapter(), clients) {
+    await authentication.connect();
+    const connection = await runtime.initialize(config, authentication);
+    return new InteractiveSession(
+      authentication,
+      clients ?? new BuckyOSServiceClientRegistry(config, authentication),
+      connection
+    );
+  }
+  async reconnect() {
+    await this.authentication.reconnect();
+  }
+}
+function resolveServiceUrl(config, service) {
+  if (config.endpoint) {
+    const endpoint = new URL(config.endpoint);
+    const marker = endpoint.pathname.indexOf("/kapi/");
+    if (marker >= 0)
+      endpoint.pathname = `${endpoint.pathname.slice(0, marker)}/kapi/${service}`;
+    else if (endpoint.pathname.endsWith("/kapi")) {
+      endpoint.pathname = `${endpoint.pathname}/${service}`;
+    } else
+      endpoint.pathname = `${endpoint.pathname.replace(/\/$/, "")}/kapi/${service}`;
+    endpoint.search = "";
+    endpoint.hash = "";
+    return endpoint.toString().replace(/\/$/, "");
+  }
+  const host2 = resolveZoneHost(config);
+  return `${config.defaultProtocol}${host2}/kapi/${service}`;
+}
+function resolveZoneHost(config) {
+  if (config.zone) {
+    try {
+      return namelib.DID.fromStr(config.zone).toRawHostName();
+    } catch {
+      throw new UsageError("INVALID_ZONE", `invalid zone host or DID: ${config.zone}`);
+    }
+  }
+  if (config.endpoint)
+    return new URL(config.endpoint).host;
+  throw new UsageError("CONNECTION_REQUIRED", "an endpoint or zone is required for online commands");
+}
+async function withDeadline(promise, timeoutMs, signal) {
+  if (signal?.aborted)
+    throw new ToolError("CANCELED", "operation canceled", 8);
+  let timer;
+  let abortHandler;
+  const guards = [
+    new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new ToolError("TIMEOUT", "operation timed out", 8, true)),
+        timeoutMs
+      );
+    })
+  ];
+  if (signal) {
+    guards.push(
+      new Promise((_, reject) => {
+        abortHandler = () => reject(new ToolError("CANCELED", "operation canceled", 8));
+        signal.addEventListener("abort", abortHandler, { once: true });
+      })
+    );
+  }
+  try {
+    return await Promise.race([promise, ...guards]);
+  } finally {
+    if (timer !== void 0)
+      clearTimeout(timer);
+    if (signal && abortHandler)
+      signal.removeEventListener("abort", abortHandler);
+  }
+}
+const BUCKYOS_DEV_CONFIG_SCHEMA_VERSION = 1;
+async function readTargetDevelopmentMode(config) {
+  try {
+    const url = resolveServiceUrl(config, "control-panel");
+    const client = new buckyos.kRPCClient(url);
+    const value = await withTimeout(
+      client.call("system.dev_mode.get", {}),
+      config.timeoutMs
+    );
+    const parsed = parseBuckyOSDevConfig(value);
+    return parsed.enabled ? { state: "enabled", config: parsed } : { state: "disabled", config: parsed };
+  } catch (error) {
+    return {
+      state: "unavailable",
+      reason: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function parseBuckyOSDevConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("BuckyOSDevConfig must be an object");
+  }
+  const config = value;
+  const keys = Object.keys(config).sort();
+  const expectedKeys = ["enabled", "enabled_at", "enabled_by", "schema_version"];
+  if (JSON.stringify(keys) !== JSON.stringify(expectedKeys)) {
+    throw new Error("BuckyOSDevConfig contains missing or unsupported fields");
+  }
+  if (config.schema_version !== BUCKYOS_DEV_CONFIG_SCHEMA_VERSION) {
+    throw new Error(`unsupported BuckyOSDevConfig schema_version ${String(config.schema_version)}`);
+  }
+  if (typeof config.enabled !== "boolean") {
+    throw new Error("BuckyOSDevConfig enabled must be a boolean");
+  }
+  const enabledAt = config.enabled_at;
+  const enabledBy = config.enabled_by;
+  const hasAuditFields = Number.isSafeInteger(enabledAt) && enabledAt > 0 && typeof enabledBy === "string" && enabledBy.trim().length > 0;
+  const hasNoAuditFields = enabledAt === null && enabledBy === null;
+  if (!hasAuditFields && !hasNoAuditFields) {
+    throw new Error("BuckyOSDevConfig enabled_at and enabled_by must be valid and present together");
+  }
+  if (config.enabled && !hasAuditFields) {
+    throw new Error("enabled BuckyOSDevConfig requires enable audit fields");
+  }
+  return {
+    schema_version: 1,
+    enabled: config.enabled,
+    enabled_at: enabledAt,
+    enabled_by: enabledBy
+  };
+}
+async function withTimeout(promise, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("developer-mode lookup timed out")), timeoutMs);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer !== void 0)
+      clearTimeout(timer);
+  }
+}
 const join$2 = (...parts) => getHost().path.join(...parts);
 const LOCAL_NODE_GATEWAY_ENDPOINT = "http://127.0.0.1:3180";
 const IDENTITY_CANDIDATE_LIMIT = 8;
@@ -1164,45 +1328,38 @@ async function readCurrentDeviceIdentity(environment2 = readEnvironment()) {
     securityRoot: join$2(buckyosRoot, "security")
   };
 }
-function identityRootPairs(config, environment2 = readEnvironment()) {
+function identityRootPairs(config, environment2 = readEnvironment(), options = {}) {
+  const device = config.implicitDeviceIdentity;
+  if (device) {
+    return [{
+      publicRoot: device.publicRoot,
+      securityRoot: device.securityRoot,
+      source: "current-device"
+    }];
+  }
+  const home = environment2.HOME ?? environment2.USERPROFILE ?? getHost().homeDir();
   const pairs = [];
-  if (config.identityRoot && config.securityRoot) {
+  if (options.includeOperations ?? true) {
     pairs.push({
-      publicRoot: config.identityRoot,
-      securityRoot: config.securityRoot,
-      source: "explicit"
+      publicRoot: join$2(home, ".buckyos", "local", "identity"),
+      securityRoot: join$2(home, ".buckyos", "security"),
+      source: "buckyos-home"
     });
   }
-  pairs.push({
-    publicRoot: join$2(config.configDir, "local", "identity"),
-    securityRoot: join$2(config.configDir, "security"),
-    source: "tool"
-  });
-  if (environment2.BUCKYOS_IDENTITY_ROOT && environment2.BUCKYOS_SECURITY_ROOT) {
-    const duplicate = config.identityRoot === environment2.BUCKYOS_IDENTITY_ROOT && config.securityRoot === environment2.BUCKYOS_SECURITY_ROOT;
-    if (!duplicate) {
-      pairs.push({
-        publicRoot: environment2.BUCKYOS_IDENTITY_ROOT,
-        securityRoot: environment2.BUCKYOS_SECURITY_ROOT,
-        source: "environment"
-      });
-    }
-  }
-  if (getHost().policy.distribution === "system") {
-    const buckyosRoot = environment2.BUCKYOS_ROOT ?? defaultBuckyOSRoot(environment2);
+  if (options.includeDeveloper ?? false) {
     pairs.push({
-      publicRoot: join$2(buckyosRoot, "local", "identity"),
-      securityRoot: join$2(buckyosRoot, "security"),
-      source: "buckyos-root"
+      publicRoot: join$2(home, ".buckycli", "local", "identity"),
+      securityRoot: join$2(home, ".buckycli", "security"),
+      source: "buckycli-home"
     });
   }
   return deduplicatePairs(pairs);
 }
-async function resolveIdentityMaterial(selectedIdentity, config, environment2 = readEnvironment()) {
+async function resolveIdentityMaterial(selectedIdentity, config, environment2 = readEnvironment(), options = {}) {
   const selected = selectedIdentity.trim();
   if (!selected)
     throw new UsageError("IDENTITY_REQUIRED", "identity is empty");
-  for (const roots of identityRootPairs(config, environment2)) {
+  for (const roots of identityRootPairs(config, environment2, options)) {
     for (const directory of await candidateDirectories(roots.publicRoot, selected)) {
       const material = await loadIdentityMaterial(roots, directory, selected);
       if (material)
@@ -1215,11 +1372,11 @@ async function resolveIdentityMaterial(selectedIdentity, config, environment2 =
     EXIT_AUTH
   );
 }
-async function scanIdentityCandidates(config, environment2 = readEnvironment()) {
+async function scanIdentityCandidates(config, environment2 = readEnvironment(), options = {}) {
   const candidates = [];
   const skipped = [];
   const seen = /* @__PURE__ */ new Set();
-  const roots = identityRootPairs(config, environment2);
+  const roots = identityRootPairs(config, environment2, options);
   for (const pair of roots) {
     let directories;
     try {
@@ -1273,16 +1430,18 @@ async function scanIdentityCandidates(config, environment2 = readEnvironment())
       break;
   }
   return {
-    order: Object.freeze(["explicit", "tool", "environment", "buckyos-root"]),
+    order: Object.freeze(roots.map((pair) => pair.source)),
     limit: IDENTITY_CANDIDATE_LIMIT,
     candidates,
     skipped
   };
 }
-async function identityCandidateView(config, environment2 = readEnvironment()) {
+async function identityCandidateView(config, environment2 = readEnvironment(), developerModeEnabled = false) {
   if (config.identity) {
     try {
-      const material = await resolveIdentityMaterial(config.identity, config, environment2);
+      const material = await resolveIdentityMaterial(config.identity, config, environment2, {
+        includeDeveloper: developerModeEnabled
+      });
       return {
         mode: "explicit",
         order: [material.did],
@@ -1307,7 +1466,9 @@ async function identityCandidateView(config, environment2 = readEnvironment()) {
       };
     }
   }
-  const scan = await scanIdentityCandidates(config, environment2);
+  const scan = await scanIdentityCandidates(config, environment2, {
+    includeDeveloper: developerModeEnabled
+  });
   return {
     mode: "search",
     order: scan.order,
@@ -1343,7 +1504,8 @@ async function loadIdentityMaterial(roots, directory, selected) {
       securityRoot: roots.securityRoot,
       documentPath,
       privateKeyPath,
-      privateKeyPem
+      privateKeyPem,
+      source: roots.source
     };
   } catch (error) {
     if (!isHostError(error, "NotFound"))
@@ -1428,133 +1590,6 @@ function deduplicatePairs(pairs) {
     return true;
   });
 }
-class BuckyOSRuntimeAdapter {
-  #sdk = new BuckyOSSDK("node");
-  async initialize(config, session) {
-    const authenticated = session.current();
-    const zoneHost = resolveZoneHost(config);
-    const initialize = this.#sdk.initBuckyOS;
-    await initialize.call(this.#sdk, authenticated.principal.appId, {
-      appId: authenticated.principal.appId,
-      ownerUserId: authenticated.principal.id,
-      runtimeType: RuntimeType.AppClient,
-      zoneHost,
-      defaultProtocol: config.defaultProtocol,
-      sessionToken: authenticated.token,
-      privateKeySearchPaths: [],
-      autoRenew: false,
-      verifyHubServiceUrl: resolveServiceUrl(config, "verify-hub")
-    });
-    return {
-      zone: config.zone ?? zoneHost,
-      endpoint: config.endpoint ?? `${config.defaultProtocol}${zoneHost}`,
-      defaultProtocol: config.defaultProtocol
-    };
-  }
-}
-class BuckyOSServiceClientRegistry {
-  #config;
-  #session;
-  #clients = /* @__PURE__ */ new Map();
-  constructor(config, session) {
-    this.#config = config;
-    this.#session = session;
-  }
-  async call(service, method, params, options) {
-    let client = this.#clients.get(service);
-    if (!client) {
-      const RpcClient = buckyos.kRPCClient;
-      client = new RpcClient(resolveServiceUrl(this.#config, service), null, null, {
-        sessionTokenProvider: async () => (await this.#session.ensureValid()).token
-      });
-      this.#clients.set(service, client);
-    }
-    const request = client.call(method, params, { traceId: options.traceId });
-    return await withDeadline(request, options.timeoutMs, options.signal);
-  }
-  async createEventReader(pattern, signal) {
-    return await buckyos.createEventReader(pattern, { keepaliveMs: 5e3, signal });
-  }
-}
-class InteractiveSession {
-  constructor(authentication, clients, connection) {
-    this.authentication = authentication;
-    this.clients = clients;
-    this.connection = connection;
-    this.startedAt = Date.now();
-  }
-  static async create(config, authentication, runtime = new BuckyOSRuntimeAdapter(), clients) {
-    await authentication.connect();
-    const connection = await runtime.initialize(config, authentication);
-    return new InteractiveSession(
-      authentication,
-      clients ?? new BuckyOSServiceClientRegistry(config, authentication),
-      connection
-    );
-  }
-  async reconnect() {
-    await this.authentication.reconnect();
-  }
-}
-function resolveServiceUrl(config, service) {
-  if (config.endpoint) {
-    const endpoint = new URL(config.endpoint);
-    const marker = endpoint.pathname.indexOf("/kapi/");
-    if (marker >= 0)
-      endpoint.pathname = `${endpoint.pathname.slice(0, marker)}/kapi/${service}`;
-    else if (endpoint.pathname.endsWith("/kapi")) {
-      endpoint.pathname = `${endpoint.pathname}/${service}`;
-    } else
-      endpoint.pathname = `${endpoint.pathname.replace(/\/$/, "")}/kapi/${service}`;
-    endpoint.search = "";
-    endpoint.hash = "";
-    return endpoint.toString().replace(/\/$/, "");
-  }
-  const host2 = resolveZoneHost(config);
-  return `${config.defaultProtocol}${host2}/kapi/${service}`;
-}
-function resolveZoneHost(config) {
-  if (config.zone) {
-    try {
-      return namelib.DID.fromStr(config.zone).toRawHostName();
-    } catch {
-      throw new UsageError("INVALID_ZONE", `invalid zone host or DID: ${config.zone}`);
-    }
-  }
-  if (config.endpoint)
-    return new URL(config.endpoint).host;
-  throw new UsageError("CONNECTION_REQUIRED", "an endpoint or zone is required for online commands");
-}
-async function withDeadline(promise, timeoutMs, signal) {
-  if (signal?.aborted)
-    throw new ToolError("CANCELED", "operation canceled", 8);
-  let timer;
-  let abortHandler;
-  const guards = [
-    new Promise((_, reject) => {
-      timer = setTimeout(
-        () => reject(new ToolError("TIMEOUT", "operation timed out", 8, true)),
-        timeoutMs
-      );
-    })
-  ];
-  if (signal) {
-    guards.push(
-      new Promise((_, reject) => {
-        abortHandler = () => reject(new ToolError("CANCELED", "operation canceled", 8));
-        signal.addEventListener("abort", abortHandler, { once: true });
-      })
-    );
-  }
-  try {
-    return await Promise.race([promise, ...guards]);
-  } finally {
-    if (timer !== void 0)
-      clearTimeout(timer);
-    if (signal && abortHandler)
-      signal.removeEventListener("abort", abortHandler);
-  }
-}
 const LOGIN_APP_ID = "buckycli";
 const LOGIN_TOKEN_TTL_SECONDS = 10 * 60;
 class AuthenticationSession {
@@ -1565,15 +1600,18 @@ class AuthenticationSession {
     this.#transport = dependencies.transport ?? new SdkAuthenticationTransport();
     this.#readPassword = dependencies.readPassword ?? readSecret;
     this.#readUsername = dependencies.readUsername ?? readVisible;
+    this.#readDevelopmentMode = dependencies.readDevelopmentMode ?? readTargetDevelopmentMode;
     this.#now = dependencies.now ?? Date.now;
   }
   #environment;
   #transport;
   #readPassword;
   #readUsername;
+  #readDevelopmentMode;
   #now;
   #session;
   #acceptedIdentity;
+  #developmentMode;
   #identityAttempts;
   async connect() {
     if (this.#session)
@@ -1621,6 +1659,7 @@ class AuthenticationSession {
       renewable: session.renewable,
       expires_at: expiresAt ?? null,
       remaining_seconds: remainingSeconds,
+      developer_mode: this.#developmentMode?.state ?? null,
       identity_attempts: this.#identityAttempts
     };
   }
@@ -1648,34 +1687,39 @@ class AuthenticationSession {
     const injected = this.#environment.BUCKYOS_APPCLIENT_SESSION_TOKEN?.trim();
     if (injected)
       return externalSession(injected, "environment", this.#now());
-    if (this.#acceptedIdentity)
+    if (this.#acceptedIdentity) {
+      if (this.#acceptedIdentity.source === "buckycli-home") {
+        await this.#requireDeveloperIdentityAccess();
+      }
       return await this.#loginWithIdentity(this.#acceptedIdentity);
+    }
     if (this.config.identity) {
-      const material = await resolveIdentityMaterial(
-        this.config.identity,
-        this.config,
-        this.#environment
-      );
+      const material = await this.#resolveExplicitIdentity(this.config.identity);
       const session = await this.#loginWithIdentity(material);
       this.#acceptedIdentity = material;
       return session;
     }
-    const candidates = await scanIdentityCandidates(this.config, this.#environment);
     this.#identityAttempts = [];
-    for (const candidate of candidates.candidates) {
-      try {
-        const session = await this.#loginWithIdentity(candidate.material);
-        this.#acceptedIdentity = candidate.material;
-        return session;
-      } catch (error) {
-        if (!isIdentityRejection(error))
-          throw error;
-        this.#identityAttempts.push({
-          identity: candidate.material.did,
-          code: error.code,
-          message: sanitizeMessage(error.message)
-        });
-      }
+    const operations = await scanIdentityCandidates(this.config, this.#environment);
+    const operationsSession = await this.#tryIdentityCandidates(operations.candidates);
+    if (operationsSession)
+      return operationsSession;
+    const developmentMode = await this.#checkDevelopmentMode();
+    if (developmentMode.state === "enabled" && operations.candidates.length < IDENTITY_CANDIDATE_LIMIT) {
+      const operationsDids = new Set(
+        operations.candidates.map((candidate) => candidate.material.did)
+      );
+      const developer = await scanIdentityCandidates(this.config, this.#environment, {
+        includeOperations: false,
+        includeDeveloper: true
+      });
+      const remaining = IDENTITY_CANDIDATE_LIMIT - operations.candidates.length;
+      const candidates = developer.candidates.filter(
+        (candidate) => !operationsDids.has(candidate.material.did)
+      ).slice(0, remaining);
+      const developerSession = await this.#tryIdentityCandidates(candidates);
+      if (developerSession)
+        return developerSession;
     }
     if (this.#identityAttempts.length > 0) {
       throw new ToolError(
@@ -1706,6 +1750,40 @@ class AuthenticationSession {
     );
     return authenticatedSession(token, "password", true, this.#now());
   }
+  async #resolveExplicitIdentity(selectedIdentity) {
+    if (this.config.implicitDeviceIdentity) {
+      return await resolveIdentityMaterial(selectedIdentity, this.config, this.#environment);
+    }
+    try {
+      return await resolveIdentityMaterial(selectedIdentity, this.config, this.#environment);
+    } catch (error) {
+      if (!(error instanceof ToolError) || error.code !== "IDENTITY_NOT_FOUND")
+        throw error;
+    }
+    await this.#requireDeveloperIdentityAccess();
+    return await resolveIdentityMaterial(selectedIdentity, this.config, this.#environment, {
+      includeOperations: false,
+      includeDeveloper: true
+    });
+  }
+  async #tryIdentityCandidates(candidates) {
+    for (const candidate of candidates) {
+      try {
+        const session = await this.#loginWithIdentity(candidate.material);
+        this.#acceptedIdentity = candidate.material;
+        return session;
+      } catch (error) {
+        if (!isIdentityRejection(error))
+          throw error;
+        this.#identityAttempts.push({
+          identity: candidate.material.did,
+          code: error.code,
+          message: sanitizeMessage(error.message)
+        });
+      }
+    }
+    return void 0;
+  }
   async #loginWithIdentity(material) {
     const loginJwt = await createLoginJwt(
       material.subject,
@@ -1721,6 +1799,30 @@ class AuthenticationSession {
     );
     return authenticatedSession(token, "identity", true, this.#now());
   }
+  async #checkDevelopmentMode() {
+    this.#developmentMode = await this.#readDevelopmentMode(this.config);
+    return this.#developmentMode;
+  }
+  async #requireDeveloperIdentityAccess() {
+    const decision = await this.#checkDevelopmentMode();
+    if (decision.state === "enabled")
+      return;
+    this.#acceptedIdentity = void 0;
+    if (decision.state === "disabled") {
+      throw new ToolError(
+        "DEVELOPER_IDENTITY_DISABLED",
+        "the target Zone has developer mode disabled; local developer identities are unavailable",
+        EXIT_AUTH
+      );
+    }
+    throw new ToolError(
+      "DEVELOPER_MODE_UNAVAILABLE",
+      "the target Zone developer-mode configuration could not be verified",
+      EXIT_AUTH,
+      true,
+      { reason: sanitizeMessage(decision.reason) }
+    );
+  }
 }
 function isIdentityRejection(error) {
   return error instanceof ToolError && IDENTITY_REJECTION_CODES.includes(error.code);
@@ -1984,12 +2086,17 @@ function displayValue(value) {
 const KEBAB_CASE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const GLOBAL_OPTIONS = [
   { name: "config-dir", property: "configDir", type: "string", scope: "process" },
+  {
+    name: "allow-read",
+    property: "allowRead",
+    type: "string",
+    scope: "process",
+    repeatable: true
+  },
   { name: "profile", property: "profile", type: "string", scope: "session" },
   { name: "zone", property: "zone", type: "string", scope: "session" },
   { name: "endpoint", property: "endpoint", type: "string", scope: "session" },
   { name: "identity", property: "identity", type: "string", scope: "session" },
-  { name: "identity-root", property: "identityRoot", type: "string", scope: "session" },
-  { name: "security-root", property: "securityRoot", type: "string", scope: "session" },
   {
     name: "session-token",
     property: "sessionToken",
@@ -4741,7 +4848,7 @@ function invalid(stage, message, entry) {
 function stableJsonDigest(value) {
   return sha256Bytes(new TextEncoder().encode(ndn.toCanonicalJsonString(value)));
 }
-const PACKAGE_VERSION = "0.7.115";
+const PACKAGE_VERSION = "0.7.118";
 const TOOL_VERSION = PACKAGE_VERSION;
 const SDK_VERSION = PACKAGE_VERSION;
 const PROTOCOL_VERSION = "1";
@@ -8795,6 +8902,7 @@ function topLevelHelp(registry) {
     "",
     "Global options:",
     "  --config-dir <path>  --profile <name>  --zone <host-or-did>",
+    "  --allow-read <path>  Add a readable filesystem root (repeatable)",
     "  --endpoint <url>      --identity <did-or-name>",
     "  --session-token <token> | --session-token-file <path>",
     "    Prefer --session-token-file for automation; argv tokens may appear in process listings.",