@storacha/clawracha 0.3.6 → 0.3.8

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAiB3C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAID,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACnE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAmC/B;AAID,MAAM,WAAW,UAAU;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBnE;AAED,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC,CAsGtB;AAoBD,wBAAsB,MAAM,CAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACrD,OAAO,CAAC,UAAU,CAAC,CA+DrB;AAED,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,GACnC,OAAO,CAAC,UAAU,CAAC,CAwDrB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAiB3C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAID,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACnE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAmC/B;AAID,MAAM,WAAW,UAAU;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBnE;AAED,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC,CAoGtB;AAoBD,wBAAsB,MAAM,CAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACvC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GACrD,OAAO,CAAC,UAAU,CAAC,CA+DrB;AAED,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,GACnC,OAAO,CAAC,UAAU,CAAC,CAyDrB"}

package/dist/commands.js

@@ -156,18 +156,16 @@ export async function doSetup(workspace, agentId, email, spaceName, pluginConfig
     // Delegate space access from the new space to our clawracha agent
     const agent = Agent.parse(deviceConfig.agentKey);
     const audience = { did: () => agent.did() };
-    const uploadDelegation = await tempClient.createDelegation(audience, Object.keys(spaceAccess).concat(["space/content/decrypt"]), { expiration: Infinity });
+    const uploadDelegation = await tempClient.createDelegation(audience, Object.keys(spaceAccess), { expiration: Infinity });
     const { ok: uploadArchive } = await uploadDelegation.archive();
     if (!uploadArchive)
         throw new Error("Failed to archive upload delegation");
     // Delegate plan/get from account → clawracha agent
     const accountDID = account.did();
-    const planProofs = tempClient.agent.proofs([
-        {
+    const planProofs = tempClient.agent.proofs([{
             can: "plan/get",
             with: accountDID,
-        },
-    ]);
+        }]);
     const planDelegation = await delegate({
         issuer: tempClient.agent.issuer,
         audience: { did: () => agent.did() },
@@ -273,7 +271,7 @@ export async function doGrant(workspace, targetDID) {
     const storachaClient = await createStorachaClient(deviceConfig);
     const { spaceAccess } = await import("@storacha/client/capability/access");
     const audience = { did: () => targetDID };
-    const uploadDel = await storachaClient.createDelegation(audience, Object.keys(spaceAccess).concat(["space/content/decrypt"]), { expiration: Infinity });
+    const uploadDel = await storachaClient.createDelegation(audience, Object.keys(spaceAccess), { expiration: Infinity });
     const { ok: uploadArchive } = await uploadDel.archive();
     if (!uploadArchive)
         throw new Error("Failed to archive upload delegation");

package/dist/handlers/remote.d.ts

@@ -9,11 +9,13 @@
 import type { CID } from "multiformats/cid";
 import type { BlockFetcher, ValueView } from "@storacha/ucn/pail/api";
 import type { DecryptionConfig, EncryptedClient } from "@storacha/encrypt-upload-client/types";
+import type { Signer } from "@ucanto/interface";
 export declare function applyRemoteChanges(changedPaths: string[], entries: Map<string, CID>, workspace: string, options?: {
     gateway?: string;
     blocks?: BlockFetcher;
     current?: ValueView;
     encryptedClient?: EncryptedClient;
     decryptionConfig?: DecryptionConfig;
+    agent?: Signer;
 }): Promise<void>;
 //# sourceMappingURL=remote.d.ts.map

package/dist/handlers/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/handlers/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AA2B/F,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,GACA,OAAO,CAAC,IAAI,CAAC,CA8Cf"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/handlers/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAwBhD,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/handlers/remote.js

@@ -47,12 +47,14 @@ export async function applyRemoteChanges(changedPaths, entries, workspace, optio
                     throw err;
             }
         }
-        else if (isMarkdown(relativePath) && options?.blocks && options?.current) {
+        else if (isMarkdown(relativePath) &&
+            options?.blocks &&
+            options?.current) {
             // Markdown: resolve via mdsync CRDT merge.
             // For single-device, unencrypted blocks are stored locally.
             // TODO: For multi-device private spaces, add decrypt layer to resolveValue.
             const decrypt = isEncrypted
-                ? makeDecryptFn(options.encryptedClient, options.decryptionConfig)
+                ? makeDecryptFn(options.encryptedClient, options.decryptionConfig, options.agent)
                 : undefined;
             const content = await mdsync.get(options.blocks, options.current, relativePath, decrypt);
             if (content != null) {

package/dist/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,YAAY,EACb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4BxE,qBAAa,UAAU;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,eAAe,CAAC,CAAkB;gBAE9B,SAAS,EAAE,MAAM;IAK7B;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqE/C;;OAEG;IACH,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAMb,UAAU;IAwDxB;;OAEG;YACW,iBAAiB;IAe/B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAc5C;;OAEG;YACW,kBAAkB;IAYhC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAMrB,gBAAgB;IA4B9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAkBI,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAW5B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;YAM5B,WAAW;CAK1B"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,YAAY,EACb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4BxE,qBAAa,UAAU;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,eAAe,CAAC,CAAkB;gBAE9B,SAAS,EAAE,MAAM;IAK7B;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAoE/C;;OAEG;IACH,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAMb,UAAU;IAwDxB;;OAEG;YACW,iBAAiB;IAe/B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAc5C;;OAEG;YACW,kBAAkB;IAYhC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAMrB,gBAAgB;IA6B9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAkBI,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAW5B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;YAM5B,WAAW;CAK1B"}

package/dist/sync.js

@@ -78,7 +78,7 @@ export class SyncEngine {
                 throw new Error("Failed to extract upload delegation");
             this.encryptionConfig = makeEncryptionConfig(agent, config.spaceDID, [planDelForKMS, uploadDel]);
             // For decrypt, uploadDelegation covers space/content/decrypt
-            this.decryptionConfig = makeDecryptionConfig(config.spaceDID, uploadDel, [planDelForKMS]);
+            this.decryptionConfig = makeDecryptionConfig(config.spaceDID, uploadDel, [planDelForKMS, uploadDel]);
             this.encryptedClient = await getEncryptedClient(storachaClient);
         }
         try {
@@ -276,6 +276,7 @@ export class SyncEngine {
                 current: this.current ?? undefined,
                 encryptedClient: this.encryptedClient,
                 decryptionConfig: this.decryptionConfig,
+                agent: name.agent,
             });
         }
         this.lastSync = Date.now();

package/dist/utils/crypto.d.ts

@@ -5,14 +5,13 @@
 import type { Block } from "multiformats";
 import type { CID } from "multiformats/cid";
 import type { Client } from "@storacha/client";
-import type { Proof } from "@ucanto/interface";
+import type { Proof, Signer } from "@ucanto/interface";
 type SpaceDID = `did:key:${string}`;
 import type { CryptoAdapter, EncryptionConfig, DecryptionConfig, BlobLike, EncryptedClient } from "@storacha/encrypt-upload-client/types";
 import { Delegation } from "@ucanto/interface";
-import { EdSigner } from "@storacha/client/principal/ed25519";
 export declare function getKMSCryptoAdapter(): CryptoAdapter;
 export declare function getEncryptedClient(storachaClient: Client): Promise<EncryptedClient>;
-export declare function delegatePlanningDelegationToKMS(agent: EdSigner, planDelegation: Delegation): Promise<Proof>;
+export declare function delegatePlanningDelegationToKMS(agent: Signer, planDelegation: Delegation): Promise<Proof>;
 export declare function makeEncryptionConfig(issuer: {
     did: () => `did:key:${string}`;
 }, spaceDID: SpaceDID, proofs: Proof[]): EncryptionConfig;
@@ -26,6 +25,6 @@ export declare function encryptToBlockStream(file: BlobLike, encryptionConfig: E
  * Create a decrypt function for mdsync resolveValue.
  * Fetches encrypted content by CID via EncryptedClient and returns decrypted bytes.
  */
-export declare function makeDecryptFn(encryptedClient: EncryptedClient, decryptionConfig: DecryptionConfig): (cid: CID) => Promise<Uint8Array>;
+export declare function makeDecryptFn(encryptedClient: EncryptedClient, decryptionConfig: DecryptionConfig, agent: Signer): (cid: CID) => Promise<Uint8Array>;
 export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/utils/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,KAAK,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;AACpC,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAQ9D,wBAAgB,mBAAmB,IAAI,aAAa,CAInD;AAED,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,QAAQ,EACf,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,KAAK,CAAC,CAUhB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,WAAW,MAAM,EAAE,CAAA;CAAE,EAC1C,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,KAAK,EAAE,GACd,gBAAgB,CAMlB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,iBAAiB,EAAE,KAAK,EACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GACf,gBAAgB,CAMlB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,QAAQ,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAIhC;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,eAAe,EAAE,eAAe,EAChC,gBAAgB,EAAE,gBAAgB,GACjC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,CAQnC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACvD,KAAK,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;AACpC,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAU/C,wBAAgB,mBAAmB,IAAI,aAAa,CAInD;AAED,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,KAAK,CAAC,CAUhB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,WAAW,MAAM,EAAE,CAAA;CAAE,EAC1C,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,KAAK,EAAE,GACd,gBAAgB,CAMlB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,iBAAiB,EAAE,KAAK,EACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GACf,gBAAgB,CAMlB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,QAAQ,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAIhC;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,eAAe,EAAE,eAAe,EAChC,gBAAgB,EAAE,gBAAgB,EAClC,KAAK,EAAE,MAAM,GACZ,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,CAkBnC"}

package/dist/utils/crypto.js

@@ -6,6 +6,7 @@ import { createGenericKMSAdapter } from "@storacha/encrypt-upload-client/factori
 import { create as createEncryptedClient } from "@storacha/encrypt-upload-client";
 import { encryptFile, encryptedBlockStream, } from "@storacha/encrypt-upload-client/utils/encrypt";
 import { delegate } from "@ucanto/core";
+import { decrypt } from "@storacha/capabilities/space";
 const KMS_SERVICE_URL = "https://ucan-kms-production.protocol-labs.workers.dev";
 const KMS_SERVICE_DID = "did:key:z6MksQJobJmBfPhjHWgFXVppqM6Fcjc1k7xu4z6xvusVrtKv";
 let cachedAdapter = null;
@@ -81,9 +82,22 @@ async function drainStream(stream) {
  * Create a decrypt function for mdsync resolveValue.
  * Fetches encrypted content by CID via EncryptedClient and returns decrypted bytes.
  */
-export function makeDecryptFn(encryptedClient, decryptionConfig) {
+export function makeDecryptFn(encryptedClient, decryptionConfig, agent) {
     return async (cid) => {
-        const { stream } = await encryptedClient.retrieveAndDecryptFile(cid, decryptionConfig);
+        const decryptDelegation = await decrypt.delegate({
+            issuer: agent,
+            audience: agent,
+            with: decryptionConfig.spaceDID,
+            nb: {
+                resource: cid,
+            },
+            expiration: Math.floor(Date.now() / 1000) + 60 * 15, // 15 minutes
+            proofs: [decryptionConfig.decryptDelegation],
+        });
+        const { stream } = await encryptedClient.retrieveAndDecryptFile(cid, {
+            ...decryptionConfig,
+            decryptDelegation,
+        });
         return drainStream(stream);
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@storacha/clawracha",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "OpenClaw plugin for Storacha workspace sync via UCN Pail",
   "type": "module",
   "files": [
@@ -28,6 +28,7 @@
   "dependencies": {
     "@ipld/car": "^5.2.0",
     "@ipld/dag-cbor": "^9.2.5",
+    "@storacha/capabilities": "^2.2.0",
     "@storacha/client": "^2.0.4",
     "@storacha/encrypt-upload-client": "1.1.76-rc.1",
     "@storacha/md-merge": "0.9.0",