@interop/was-client 0.13.2 → 0.14.0

package/dist/internal/revoke.js

@@ -0,0 +1,106 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The revocation primitive shared by `was.revoke()` and `space.revoke()` -- the
+ * inverse of `grant.ts`. Submits a delegated capability to its Space's
+ * revocation endpoint (`POST /space/:spaceId/zcaps/revocations/:capabilityId`),
+ * where the URL names the capability's `id` and the body is that capability
+ * verbatim, proof and capability chain included.
+ *
+ * The submission invokes the revocation URL's **own** root capability, whose
+ * controller the server synthesizes as every controller in the to-be-revoked
+ * capability's delegation chain. That chain is dereferenced root-first, so it
+ * includes the root capability -- whose controller is the Space controller.
+ * A single invocation therefore authorizes both legitimate callers of the
+ * server's dual-root rule ("the delegator revokes" and "a delegee revokes its
+ * own capability"), with no need to know which one this client is.
+ */
+import { spaceRevocation, toUrl, parseSpaceTarget } from './paths.js';
+import { send } from './request.js';
+import { ValidationError } from '../errors.js';
+/**
+ * The zcap JSON-LD context URL, the sole `@context` of a root capability.
+ */
+const ZCAP_CONTEXT_URL = 'https://w3id.org/zcap/v1';
+/**
+ * Builds the root capability for `target` in **object** form.
+ *
+ * The object form is load-bearing: `@interop/ezcap` accepts a *string* root
+ * capability id only when its invocation target is `https:`, which would break
+ * against an `http://localhost` server. Both forms reduce to the same
+ * `zcap id="..."` invocation header.
+ *
+ * `controller` is client-side only -- the server re-derives the real controller
+ * when it synthesizes the root capability -- so the caller's own DID is fine.
+ *
+ * @param options {object}
+ * @param options.target {string}       the absolute invocation target URL
+ * @param options.controller {string}   the invoking client's DID
+ * @returns {IRootZcap}
+ */
+function rootCapability({ target, controller }) {
+    return {
+        '@context': ZCAP_CONTEXT_URL,
+        id: `urn:zcap:root:${encodeURIComponent(target)}`,
+        invocationTarget: target,
+        controller
+    };
+}
+/**
+ * Derives the id of the Space a capability is rooted in, from its
+ * `invocationTarget`. A Space-rooted capability's target is the Space URL or a
+ * path beneath it (the server enforces this when it verifies the chain), so
+ * every depth `parseSpaceTarget` recognizes -- Space, Collection, Resource, or a
+ * reserved sub-resource such as `/space/s/c/r/meta` -- carries the Space id.
+ *
+ * @param context {ClientContext}
+ * @param zcap {IZcap}   the capability to locate
+ * @returns {string}
+ */
+export function spaceIdOf(context, zcap) {
+    const parsed = parseSpaceTarget({
+        serverUrl: context.serverUrl,
+        target: zcap.invocationTarget
+    });
+    if (parsed === null) {
+        throw new ValidationError(`Cannot derive a Space from invocationTarget ` +
+            `"${zcap.invocationTarget}": it does not address a Space on ` +
+            `"${context.serverUrl}". Revocation is scoped to one Space.`);
+    }
+    return parsed.spaceId;
+}
+/**
+ * Revokes a Space-rooted delegated capability: `POST`s it to
+ * `/space/:spaceId/zcaps/revocations/:capabilityId`, invoking that URL's own
+ * root capability. Resolves on the server's 204.
+ *
+ * The `action` is deliberately left unset: `send()` defaults it to the HTTP
+ * method, and this route expects `POST` (WAS capabilities are scoped by HTTP
+ * method, unlike the webkms `/kms` revocation route's `write`).
+ *
+ * @param context {ClientContext}
+ * @param options {object}
+ * @param options.spaceId {string}          the Space the capability is rooted in
+ * @param options.zcap {IDelegatedZcap}     the capability to revoke
+ * @returns {Promise<void>}
+ */
+export async function submitRevocation(context, { spaceId, zcap }) {
+    if (!('parentCapability' in zcap)) {
+        throw new ValidationError('A root capability cannot be revoked; only a delegated capability can.');
+    }
+    const url = toUrl({
+        serverUrl: context.serverUrl,
+        path: spaceRevocation(spaceId, zcap.id)
+    });
+    await send(context, {
+        url,
+        method: 'POST',
+        capability: rootCapability({
+            target: url,
+            controller: context.controllerDid
+        }),
+        json: zcap
+    });
+}
+//# sourceMappingURL=revoke.js.map

package/dist/internal/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/internal/revoke.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG9C;;GAEG;AACH,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,cAAc,CAAC,EACtB,MAAM,EACN,UAAU,EAIX;IACC,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,EAAE;QACjD,gBAAgB,EAAE,MAAM;QACxB,UAAU;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,OAAsB,EAAE,IAAW;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,IAAI,CAAC,gBAAgB;KAC9B,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,8CAA8C;YAC5C,IAAI,IAAI,CAAC,gBAAgB,oCAAoC;YAC7D,IAAI,OAAO,CAAC,SAAS,uCAAuC,CAC/D,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAsB,EACtB,EAAE,OAAO,EAAE,IAAI,EAA6C;IAE5D,IAAI,CAAC,CAAC,kBAAkB,IAAI,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IACF,MAAM,IAAI,CAAC,OAAO,EAAE;QAClB,GAAG;QACH,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,cAAc,CAAC;YACzB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,OAAO,CAAC,aAAa;SAClC,CAAC;QACF,IAAI,EAAE,IAAI;KACX,CAAC,CAAA;AACJ,CAAC"}

package/dist/types.d.ts

@@ -12,10 +12,10 @@
  * the handle/delegation options, and the low-level `request()` input. ZCap and
  * signer types are re-used from `@interop/data-integrity-core`.
  */
-import type { IZcap, IDelegatedZcap } from '@interop/data-integrity-core/zcap';
+import type { IZcap, IDelegatedZcap, IRootZcap } from '@interop/data-integrity-core/zcap';
 import type { ISigner } from '@interop/data-integrity-core';
 import type { ActionInput } from '@interop/storage-core';
-export type { IZcap, IDelegatedZcap, ISigner };
+export type { IZcap, IDelegatedZcap, IRootZcap, ISigner };
 /**
  * Re-export the shared WAS wire model from `@interop/storage-core`. The
  * resources-in-a-collection listing is `CollectionResourcesList` (formerly

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;AAE9C;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,KAAK,EACL,cAAc,EACd,SAAS,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAEzD;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -42,17 +42,17 @@
   "types": "dist/index.d.ts",
   "sideEffects": false,
   "dependencies": {
-    "@interop/data-integrity-core": "^8.1.0",
+    "@interop/data-integrity-core": "^8.2.0",
     "@interop/ed25519-signature": "^7.1.3",
-    "@interop/edv-client": "^17.5.0",
+    "@interop/edv-client": "^17.6.0",
     "@interop/ezcap": "^7.3.2",
     "@interop/http-client": "^1.0.4",
-    "@interop/storage-core": "^0.3.2"
+    "@interop/storage-core": "^0.3.3"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@interop/ed25519-verification-key": "^8.0.2",
-    "@interop/x25519-key-agreement-key": "^5.1.1",
+    "@interop/x25519-key-agreement-key": "^5.1.2",
     "@playwright/test": "^1.60.0",
     "@types/node": "^25.9.1",
     "@vitest/coverage-v8": "^4.1.7",