@ixo/editor 6.33.0 → 6.34.0

package/dist/chunk-7W7UUUIE.js

@@ -0,0 +1,609 @@
+// src/core/lib/ucanDelegationStore.ts
+var ROOT_DELEGATION_KEY = "__root__";
+var STORE_VERSION_KEY = "__version__";
+var CURRENT_VERSION = 2;
+function normalizeAbility(value) {
+  const trimmed = value.trim();
+  const lastDot = trimmed.lastIndexOf(".");
+  return !trimmed.includes("/") && lastDot > 0 ? `${trimmed.slice(0, lastDot)}/${trimmed.slice(lastDot + 1)}` : trimmed;
+}
+function abilityCovers(granted, requested) {
+  const pattern = normalizeAbility(granted);
+  const target = normalizeAbility(requested);
+  if (pattern === "*" || pattern === target) return true;
+  return pattern.endsWith("/*") && target.startsWith(pattern.slice(0, -1));
+}
+function resourceCovers(granted, requested) {
+  if (granted === "*" || granted === requested) return true;
+  return granted.endsWith("*") && requested.startsWith(granted.slice(0, -1));
+}
+function canonicalCaveat(value) {
+  if (!value || typeof value !== "object") return JSON.stringify(value ?? null);
+  if (Array.isArray(value)) return `[${value.map(canonicalCaveat).join(",")}]`;
+  return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalCaveat(entry)}`).join(",")}}`;
+}
+function ucanCapabilityCovers(granted, requested) {
+  if (!abilityCovers(granted.can, requested.can) || !resourceCovers(granted.with, requested.with)) return false;
+  if (granted.nb === void 0) return true;
+  return canonicalCaveat(granted.nb) === canonicalCaveat(requested.nb);
+}
+var isValidEntry = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const entry = value;
+  return entry.v === CURRENT_VERSION && entry.data !== void 0;
+};
+var isReservedKey = (key) => key === ROOT_DELEGATION_KEY || key === STORE_VERSION_KEY;
+var createUcanDelegationStore = (yMap) => {
+  const get = (cid) => {
+    if (isReservedKey(cid)) return null;
+    const raw = yMap.get(cid);
+    if (!raw) return null;
+    if (isValidEntry(raw)) return raw.data;
+    return null;
+  };
+  const set = (delegation) => {
+    const entry = { v: CURRENT_VERSION, data: delegation };
+    yMap.set(delegation.cid, entry);
+  };
+  const remove = (cid) => {
+    yMap.delete(cid);
+  };
+  const has = (cid) => {
+    return yMap.has(cid) && !isReservedKey(cid);
+  };
+  const getRoot = () => {
+    const rootCid = yMap.get(ROOT_DELEGATION_KEY);
+    if (!rootCid) return null;
+    return get(rootCid);
+  };
+  const setRootCid = (cid) => {
+    yMap.set(ROOT_DELEGATION_KEY, cid);
+  };
+  const getRootCid = () => {
+    return yMap.get(ROOT_DELEGATION_KEY) || null;
+  };
+  const getAll = () => {
+    const delegations = [];
+    yMap.forEach((value, key) => {
+      if (isReservedKey(key)) return;
+      if (isValidEntry(value)) {
+        delegations.push(value.data);
+      }
+    });
+    return delegations;
+  };
+  const getByAudience = (audienceDid) => {
+    return getAll().filter((d) => d.audienceDid === audienceDid);
+  };
+  const getByIssuer = (issuerDid) => {
+    return getAll().filter((d) => d.issuerDid === issuerDid);
+  };
+  const findByCapability = (can, withUri) => {
+    return getAll().filter((d) => d.capabilities.some((capability) => ucanCapabilityCovers(capability, { can, with: withUri })));
+  };
+  return {
+    get,
+    set,
+    remove,
+    has,
+    getRoot,
+    setRootCid,
+    getRootCid,
+    getAll,
+    getByAudience,
+    getByIssuer,
+    findByCapability
+  };
+};
+var createMemoryUcanDelegationStore = () => {
+  const store = /* @__PURE__ */ new Map();
+  const get = (cid) => {
+    if (isReservedKey(cid)) return null;
+    const raw = store.get(cid);
+    if (!raw) return null;
+    if (isValidEntry(raw)) return raw.data;
+    return null;
+  };
+  const set = (delegation) => {
+    const entry = { v: CURRENT_VERSION, data: delegation };
+    store.set(delegation.cid, entry);
+  };
+  const remove = (cid) => {
+    store.delete(cid);
+  };
+  const has = (cid) => {
+    return store.has(cid) && !isReservedKey(cid);
+  };
+  const getRoot = () => {
+    const rootCid = store.get(ROOT_DELEGATION_KEY);
+    if (!rootCid) return null;
+    return get(rootCid);
+  };
+  const setRootCid = (cid) => {
+    store.set(ROOT_DELEGATION_KEY, cid);
+  };
+  const getRootCid = () => {
+    return store.get(ROOT_DELEGATION_KEY) || null;
+  };
+  const getAll = () => {
+    const delegations = [];
+    store.forEach((value, key) => {
+      if (isReservedKey(key)) return;
+      if (isValidEntry(value)) {
+        delegations.push(value.data);
+      }
+    });
+    return delegations;
+  };
+  const getByAudience = (audienceDid) => {
+    return getAll().filter((d) => d.audienceDid === audienceDid);
+  };
+  const getByIssuer = (issuerDid) => {
+    return getAll().filter((d) => d.issuerDid === issuerDid);
+  };
+  const findByCapability = (can, withUri) => {
+    return getAll().filter((d) => d.capabilities.some((capability) => ucanCapabilityCovers(capability, { can, with: withUri })));
+  };
+  return {
+    get,
+    set,
+    remove,
+    has,
+    getRoot,
+    setRootCid,
+    getRootCid,
+    getAll,
+    getByAudience,
+    getByIssuer,
+    findByCapability
+  };
+};
+
+// src/core/services/ucanService.ts
+import {
+  createDelegation as ucanCreateDelegation,
+  createInvocation as ucanCreateInvocation,
+  serializeDelegation,
+  serializeInvocation,
+  parseDelegation,
+  parseSigner,
+  signerFromMnemonic
+} from "@ixo/ucan";
+var FLOW_INVOCATION_SIGNER_TTL_SECONDS = 60 * 60;
+function toSupportedDID(did) {
+  if (did.startsWith("did:ixo:") || did.startsWith("did:key:")) {
+    return did;
+  }
+  return void 0;
+}
+function normalizeDid(did) {
+  if (did.startsWith("did:")) return did;
+  if (did.startsWith("ixo1")) return `did:ixo:${did}`;
+  if (!did.startsWith("@did-")) return did;
+  const [localpart] = did.split(":");
+  const parts = localpart.split("-");
+  if (parts.length < 3 || parts[0] !== "@did") return did;
+  return `did:${parts[1]}:${parts.slice(2).join("-")}`;
+}
+function toInvocationAudienceDID(did) {
+  const normalized = normalizeDid(did);
+  const supported = toSupportedDID(normalized);
+  if (!supported) {
+    throw new Error(`Invalid DID "${did}", must start with 'did:'`);
+  }
+  return supported;
+}
+function toUcantoCapabilities(capabilities) {
+  return capabilities.map((cap) => ({
+    can: cap.can,
+    with: cap.with,
+    ...cap.nb && { nb: cap.nb }
+  }));
+}
+async function getSigner(handlers, did, didType, entityRoomId, pin) {
+  const normalizedDid = normalizeDid(did);
+  const supportedDid = toSupportedDID(normalizedDid);
+  if (handlers.getPrivateKey) {
+    const privateKey = await handlers.getPrivateKey({ did: normalizedDid, didType, entityRoomId, pin });
+    return parseSigner(privateKey, supportedDid);
+  }
+  if (handlers.getMnemonic) {
+    const mnemonic = await handlers.getMnemonic({ did: normalizedDid, didType, entityRoomId, pin });
+    const result = await signerFromMnemonic(mnemonic, supportedDid);
+    return result.signer;
+  }
+  throw new Error("No signer handler configured (need getPrivateKey or getMnemonic)");
+}
+function getCidFromDelegation(delegation) {
+  return delegation.cid.toString();
+}
+function rootCapabilityCovers(granted, requested) {
+  if (!requested.can.startsWith("flow/")) return false;
+  if (!ucanCapabilityCovers({ ...granted, with: "*" }, { ...requested, with: "*" })) return false;
+  return requested.with === granted.with || requested.with.startsWith(`${granted.with}:`);
+}
+var createUcanService = (config) => {
+  const { delegationStore, invocationStore, handlers, flowOwnerDid } = config;
+  const delegationCache = /* @__PURE__ */ new Map();
+  const isConfigured = () => {
+    const hasSessionHandlers = !!(handlers.createSignerSession && handlers.signWithSession);
+    const hasLegacyHandlers = !!(handlers.getPrivateKey || handlers.getMnemonic);
+    return hasSessionHandlers || hasLegacyHandlers;
+  };
+  const parseDelegationFromStore = async (cid) => {
+    if (delegationCache.has(cid)) {
+      return delegationCache.get(cid);
+    }
+    const stored = delegationStore.get(cid);
+    if (!stored || !stored.delegation) {
+      return null;
+    }
+    try {
+      const delegation = await parseDelegation(stored.delegation);
+      delegationCache.set(cid, delegation);
+      return delegation;
+    } catch {
+      return null;
+    }
+  };
+  const getProofDelegations = async (proofCids) => {
+    const proofs = [];
+    for (const cid of proofCids) {
+      const delegation = await parseDelegationFromStore(cid);
+      if (delegation) {
+        proofs.push(delegation);
+      }
+    }
+    return proofs;
+  };
+  const getProofCars = async (proofCids) => {
+    const cars = [];
+    for (const cid of proofCids) {
+      const stored = delegationStore.get(cid);
+      if (stored && stored.delegation) {
+        cars.push(stored.delegation);
+      }
+    }
+    return cars;
+  };
+  const createRootDelegation = async (params) => {
+    const { flowOwnerDid: ownerDid, issuerType, entityRoomId, flowUri: uri, pin } = params;
+    const normalizedOwnerDid = normalizeDid(ownerDid);
+    const capabilities = [{ can: "flow/*", with: uri }];
+    if (handlers.createSignerSession && handlers.createDelegationWithSession) {
+      const session = await handlers.createSignerSession({
+        did: normalizedOwnerDid,
+        didType: issuerType,
+        entityRoomId,
+        pin,
+        scope: "operation"
+      });
+      const result = await handlers.createDelegationWithSession({
+        sessionId: session.sessionId,
+        audience: normalizedOwnerDid,
+        capabilities,
+        proofs: []
+      });
+      const storedDelegation2 = {
+        cid: result.cid,
+        delegation: result.delegation,
+        issuerDid: normalizedOwnerDid,
+        audienceDid: normalizedOwnerDid,
+        capabilities,
+        createdAt: Date.now(),
+        format: "car",
+        proofCids: []
+      };
+      delegationStore.set(storedDelegation2);
+      delegationStore.setRootCid(result.cid);
+      return storedDelegation2;
+    }
+    const signer = await getSigner(handlers, ownerDid, issuerType, entityRoomId, pin);
+    const delegation = await ucanCreateDelegation({
+      issuer: signer,
+      audience: toInvocationAudienceDID(normalizedOwnerDid),
+      capabilities,
+      proofs: []
+    });
+    const serialized = await serializeDelegation(delegation);
+    const cid = getCidFromDelegation(delegation);
+    const storedDelegation = {
+      cid,
+      delegation: serialized,
+      issuerDid: normalizedOwnerDid,
+      audienceDid: normalizedOwnerDid,
+      capabilities,
+      createdAt: Date.now(),
+      format: "car",
+      proofCids: []
+    };
+    delegationStore.set(storedDelegation);
+    delegationStore.setRootCid(cid);
+    delegationCache.set(cid, delegation);
+    return storedDelegation;
+  };
+  const createDelegation = async (params) => {
+    const { issuerDid, issuerType, entityRoomId, audience, capabilities, proofs = [], expiration, pin } = params;
+    const normalizedIssuerDid = normalizeDid(issuerDid);
+    const normalizedAudienceDid = normalizeDid(audience);
+    const proofCids = proofs;
+    if (handlers.createSignerSession && handlers.createDelegationWithSession) {
+      const session = await handlers.createSignerSession({
+        did: normalizedIssuerDid,
+        didType: issuerType,
+        entityRoomId,
+        pin,
+        scope: "operation"
+      });
+      const proofCars = await getProofCars(proofCids);
+      const result = await handlers.createDelegationWithSession({
+        sessionId: session.sessionId,
+        audience: normalizedAudienceDid,
+        capabilities,
+        proofs: proofCars,
+        expiration: expiration ? Math.floor(expiration / 1e3) : void 0
+      });
+      const storedDelegation2 = {
+        cid: result.cid,
+        delegation: result.delegation,
+        issuerDid: normalizedIssuerDid,
+        audienceDid: normalizedAudienceDid,
+        capabilities,
+        expiration,
+        createdAt: Date.now(),
+        format: "car",
+        proofCids
+      };
+      delegationStore.set(storedDelegation2);
+      return storedDelegation2;
+    }
+    const signer = await getSigner(handlers, issuerDid, issuerType, entityRoomId, pin);
+    const proofDelegations = await getProofDelegations(proofCids);
+    const delegation = await ucanCreateDelegation({
+      issuer: signer,
+      audience: toInvocationAudienceDID(normalizedAudienceDid),
+      capabilities: toUcantoCapabilities(capabilities),
+      proofs: proofDelegations,
+      expiration: expiration ? Math.floor(expiration / 1e3) : void 0
+    });
+    const serialized = await serializeDelegation(delegation);
+    const cid = getCidFromDelegation(delegation);
+    const storedDelegation = {
+      cid,
+      delegation: serialized,
+      issuerDid: normalizedIssuerDid,
+      audienceDid: normalizedAudienceDid,
+      capabilities,
+      expiration,
+      createdAt: Date.now(),
+      format: "car",
+      proofCids
+    };
+    delegationStore.set(storedDelegation);
+    delegationCache.set(cid, delegation);
+    return storedDelegation;
+  };
+  const revokeDelegation = (cid) => {
+    delegationStore.remove(cid);
+    delegationCache.delete(cid);
+  };
+  const getDelegation = (cid) => {
+    return delegationStore.get(cid);
+  };
+  const getAllDelegations = () => {
+    return delegationStore.getAll();
+  };
+  const getRootDelegation = () => {
+    return delegationStore.getRoot();
+  };
+  const findValidProofs = async (audienceDid, capability) => {
+    const normalizedActorDid = normalizeDid(audienceDid);
+    const delegations = delegationStore.getAll().filter((delegation) => normalizeDid(delegation.audienceDid) === normalizedActorDid);
+    const root = delegationStore.getRoot();
+    if (root && normalizeDid(root.audienceDid) === normalizedActorDid && !(root.expiration && root.expiration < Date.now())) {
+      if (root.capabilities.some((granted) => rootCapabilityCovers(granted, capability))) {
+        return { found: true, proofCids: [root.cid] };
+      }
+    }
+    if (delegations.length === 0) {
+      return { found: false, error: "No delegations found for actor" };
+    }
+    for (const delegation of delegations) {
+      const covers = delegation.capabilities.some((granted) => ucanCapabilityCovers(granted, capability));
+      if (covers) {
+        if (delegation.expiration && delegation.expiration < Date.now()) {
+          continue;
+        }
+        const proofCids = [delegation.cid, ...delegation.proofCids];
+        return { found: true, proofCids };
+      }
+    }
+    return { found: false, error: "No valid delegation found for capability" };
+  };
+  const validateDelegationChain = async (audienceDid, capability) => {
+    const proofsResult = await findValidProofs(audienceDid, capability);
+    if (!proofsResult.found || !proofsResult.proofCids) {
+      return { valid: false, error: proofsResult.error };
+    }
+    const proofChain = [];
+    for (const cid of proofsResult.proofCids) {
+      const delegation = delegationStore.get(cid);
+      if (!delegation) {
+        return { valid: false, error: `Proof delegation ${cid} not found` };
+      }
+      proofChain.push(delegation);
+    }
+    for (let i = 0; i < proofChain.length - 1; i++) {
+      const current = proofChain[i];
+      const parent = proofChain[i + 1];
+      if (normalizeDid(parent.audienceDid) !== normalizeDid(current.issuerDid)) {
+        return {
+          valid: false,
+          error: `Chain broken: ${parent.cid} audience (${parent.audienceDid}) != ${current.cid} issuer (${current.issuerDid})`
+        };
+      }
+    }
+    const isFlowScoped = capability.can === "flow/*" || capability.can.startsWith("flow/");
+    if (isFlowScoped) {
+      const root = proofChain[proofChain.length - 1];
+      if (normalizeDid(root.issuerDid) !== normalizeDid(flowOwnerDid)) {
+        return { valid: false, error: `Root issuer ${root.issuerDid} is not flow owner ${flowOwnerDid}` };
+      }
+    }
+    return { valid: true, proofChain };
+  };
+  const createAndValidateInvocation = async (params, _flowId, _blockId) => {
+    const { invokerDid, invokerType, entityRoomId, capability, proofs, pin } = params;
+    const normalizedInvokerDid = normalizeDid(invokerDid);
+    const validation = await validateDelegationChain(normalizedInvokerDid, capability);
+    if (!validation.valid) {
+      return {
+        cid: "",
+        invocation: "",
+        valid: false,
+        error: validation.error
+      };
+    }
+    const audience = normalizeDid(params.audience ?? flowOwnerDid);
+    if (handlers.createSignerSession && handlers.createInvocationWithSession) {
+      try {
+        const cachedSession = await handlers.getActiveSignerSession?.({ did: normalizedInvokerDid });
+        const session = cachedSession ?? await handlers.createSignerSession({
+          did: normalizedInvokerDid,
+          didType: invokerType,
+          entityRoomId,
+          pin,
+          scope: "session",
+          ttlSeconds: FLOW_INVOCATION_SIGNER_TTL_SECONDS
+        });
+        const proofCars = await getProofCars(proofs);
+        const result = await handlers.createInvocationWithSession({
+          sessionId: session.sessionId,
+          audience,
+          capability: {
+            can: capability.can,
+            with: capability.with,
+            ...capability.nb && { nb: capability.nb }
+          },
+          proofs: proofCars,
+          facts: params.facts
+        });
+        return {
+          cid: result.cid,
+          invocation: result.invocation,
+          valid: true
+        };
+      } catch (err) {
+        return {
+          cid: "",
+          invocation: "",
+          valid: false,
+          error: err instanceof Error ? err.message : "Failed to create invocation via session"
+        };
+      }
+    }
+    const signer = await getSigner(handlers, invokerDid, invokerType, entityRoomId, pin);
+    const proofDelegations = await getProofDelegations(proofs);
+    const ucantoCapability = {
+      can: capability.can,
+      with: capability.with,
+      ...capability.nb && { nb: capability.nb }
+    };
+    const invocation = await ucanCreateInvocation({
+      issuer: signer,
+      audience,
+      capability: ucantoCapability,
+      proofs: proofDelegations,
+      facts: params.facts ? [params.facts] : void 0
+    });
+    const serialized = await serializeInvocation(invocation);
+    const built = await invocation.buildIPLDView();
+    const cid = built.cid.toString();
+    return {
+      cid,
+      invocation: serialized,
+      valid: true
+    };
+  };
+  const executeWithInvocation = async (params, action, flowId, blockId, sessionRunId) => {
+    const invocationResult = await createAndValidateInvocation(params, flowId, blockId);
+    if (!invocationResult.valid) {
+      return {
+        success: false,
+        invocationCid: invocationResult.cid,
+        error: invocationResult.error
+      };
+    }
+    if (invocationStore.hasBeenInvoked(invocationResult.cid)) {
+      return {
+        success: false,
+        invocationCid: invocationResult.cid,
+        error: "Invocation has already been used (replay attack prevented)"
+      };
+    }
+    try {
+      const actionResult = await action();
+      const storedInvocation = {
+        cid: invocationResult.cid,
+        invocation: invocationResult.invocation,
+        invokerDid: params.invokerDid,
+        capability: params.capability,
+        executedAt: Date.now(),
+        flowId,
+        sessionRunId,
+        blockId,
+        result: "success",
+        proofCids: params.proofs,
+        facts: params.facts
+      };
+      invocationStore.add(storedInvocation);
+      return {
+        success: true,
+        invocationCid: invocationResult.cid,
+        result: actionResult,
+        actionResult
+      };
+    } catch (error) {
+      const storedInvocation = {
+        cid: invocationResult.cid,
+        invocation: invocationResult.invocation,
+        invokerDid: params.invokerDid,
+        capability: params.capability,
+        executedAt: Date.now(),
+        flowId,
+        sessionRunId,
+        blockId,
+        result: "failure",
+        error: error instanceof Error ? error.message : "Unknown error",
+        proofCids: params.proofs
+      };
+      invocationStore.add(storedInvocation);
+      return {
+        success: false,
+        invocationCid: invocationResult.cid,
+        error: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  };
+  return {
+    createRootDelegation,
+    createDelegation,
+    revokeDelegation,
+    getDelegation,
+    getAllDelegations,
+    getRootDelegation,
+    createAndValidateInvocation,
+    executeWithInvocation,
+    validateDelegationChain,
+    findValidProofs,
+    parseDelegationFromStore,
+    isConfigured
+  };
+};
+
+export {
+  createUcanDelegationStore,
+  createMemoryUcanDelegationStore,
+  createUcanService
+};
+//# sourceMappingURL=chunk-7W7UUUIE.js.map