buckyos 0.7.120 → 0.7.122

package/cli/README.md

@@ -42,6 +42,27 @@ node cli/launcher.mjs --non-interactive --yes pikg clean ./dapp_meta
 `pikg` consumes existing build output; it does not replace an App's Vite, Webpack, Cargo, or Docker
 build scripts. Set `SOURCE_DATE_EPOCH` for byte-reproducible Node/Deno PIKG builds.
 
+## Provision (first activation of an installed root)
+
+`provision status|check|activate` initialise an installed, not yet activated BuckyOS root on this
+machine (single OOD, `did:web`, no SN/BNS). They are local commands: no Zone session, no network, no
+TaskManager. The activation itself is the SDK API exported from `buckyos/provision`
+(`inspectActivationRoot`, `checkOfflineActivation`, `activateOfflineZone`); the module only adds
+argv, host-policy checks, the hidden password prompt / secret `--input` field, confirmation and
+output. See `doc/modules/provision.md` for the commit protocol and error codes.
+
+```bash
+buckyos provision status --root /opt/buckyos
+buckyos provision check --root /opt/buckyos --domain corp.example.com --owner-name admin \
+  --owner-key-backup /secure-backup/corp-owner.pem
+buckyos --non-interactive --yes --input activation.json provision activate \
+  --root /opt/buckyos --owner-key-backup /secure-backup/corp-owner.pem
+```
+
+The launcher grants filesystem permissions only for the `--root` and `--owner-key-backup` paths
+given on the command line; `admin_password` is accepted only as the secret field of `--input` JSON
+or from a terminal prompt.
+
 ## Policy and identity
 
 The developer policy grants the package root, cwd, Tool config, the read-only `~/.buckyos` and
@@ -55,9 +76,9 @@ developer-only `~/.buckycli` root, the Tool reads `system.dev_mode.get` from the
 requires a valid `BuckyOSDevConfig` with `enabled: true`. Automatic discovery tries `~/.buckyos`
 first and consults developer mode only if no operations identity succeeds; the combined search is
 limited to eight usable candidates. An explicitly selected identity is tried once. Rotation occurs
-only during session creation and only for
-`IDENTITY_KIND_NOT_ACCEPTED` or `AUTHENTICATION_REJECTED`; timeouts, network errors, capability
-mismatches and RBAC denial never rotate. Private keys and tokens are never shown.
+only during session creation and only for `IDENTITY_KIND_NOT_ACCEPTED` or `AUTHENTICATION_REJECTED`;
+timeouts, network errors, capability mismatches and RBAC denial never rotate. Private keys and
+tokens are never shown.
 
 ## Verification
 

package/cli/core/app.ts

@@ -33,6 +33,7 @@ import { type AppModuleDependencies, createAppModule } from '../modules/app.ts'
 import { createDiagnosticModule, type DiagnosticModuleDependencies } from '../modules/diagnostic.ts'
 import { createLogModule, type LogModuleDependencies } from '../modules/log.ts'
 import { createTaskModule } from '../modules/task.ts'
+import { createProvisionModule, type ProvisionModuleDependencies } from '../modules/provision.ts'
 import {
   distributionManifestView,
   getHost,
@@ -68,6 +69,7 @@ export interface ApplicationDependencies {
   app?: AppModuleDependencies
   log?: LogModuleDependencies
   diagnostic?: DiagnosticModuleDependencies
+  provision?: ProvisionModuleDependencies
 }
 
 export class BuckyOSToolApplication {
@@ -91,6 +93,7 @@ export class BuckyOSToolApplication {
       dependencies.app,
       dependencies.log,
       dependencies.diagnostic,
+      dependencies.provision,
     )
     this.#environment = dependencies.environment ?? readEnvironment()
     this.#cwd = dependencies.cwd ?? getHost().cwd()
@@ -180,6 +183,7 @@ export class BuckyOSToolApplication {
         await this.#stdio.stdout(`${commandHelp(this.registry, command)}\n`)
         return EXIT_SUCCESS
       }
+      if (command.execution === 'local') assertNoSessionOptions(invocation.global, command)
       const setup = await this.#resolveForCommand(command, invocation.global)
       const inputObject = invocation.global.input
         ? await this.#readInputObject(invocation.global.input)
@@ -456,6 +460,7 @@ export function createRegistry(
   appDependencies?: AppModuleDependencies,
   logDependencies?: LogModuleDependencies,
   diagnosticDependencies?: DiagnosticModuleDependencies,
+  provisionDependencies?: ProvisionModuleDependencies,
 ): CommandRegistry {
   const registry = new CommandRegistry()
   for (const module of createCoreModules(registry)) registry.register(module)
@@ -467,9 +472,32 @@ export function createRegistry(
   registry.register(createTaskModule())
   registry.register(createLogModule(logDependencies))
   registry.register(createDiagnosticModule(diagnosticDependencies))
+  registry.register(createProvisionModule(provisionDependencies))
   return registry
 }
 
+// Commands that declare execution=local run without a Zone, profile, identity,
+// or network; online-only session options must not silently retarget them.
+function assertNoSessionOptions(global: GlobalOptions, command: RegisteredCommand): void {
+  for (
+    const [name, value] of [
+      ['profile', global.profile],
+      ['zone', global.zone],
+      ['endpoint', global.endpoint],
+      ['identity', global.identity],
+      ['session-token', global.sessionToken],
+      ['session-token-file', global.sessionTokenFile],
+    ] as const
+  ) {
+    if (value !== undefined) {
+      throw new UsageError(
+        'ARGUMENT_CONFLICT',
+        `--${name} cannot be combined with the local command ${command.module} ${command.verb}`,
+      )
+    }
+  }
+}
+
 const unavailableClients: ServiceClientRegistry = {
   call: () => Promise.reject(new ToolError('INTERNAL_ERROR', 'service clients are unavailable', 9)),
 }

package/cli/deno.json

@@ -1,7 +1,8 @@
 {
   "imports": {
     "buckyos": "../dist/node.mjs",
-    "buckyos/node": "../dist/node.mjs"
+    "buckyos/node": "../dist/node.mjs",
+    "buckyos/provision": "../dist/provision.mjs"
   },
   "tasks": {
     "run": "deno run --allow-net --allow-read --allow-write --allow-run=docker --allow-env system_launcher.ts",