@tinycloud/node-sdk 2.10.0 → 2.11.0-beta.1

package/dist/{core-B_i2KfID.d.cts → core-CQ_5wXQT.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -856,19 +856,9 @@ type SecretReadResult = {
 } | {
     status: "invalid_payload";
 };
-interface CreateOwnerDelegationParams {
-    readonly delegateDid: string;
-    readonly spaceId: string;
-    readonly path: string;
-    readonly actions: readonly string[];
-    readonly expiresAt: Date;
-}
-interface OwnerDelegationReceipt {
+type CreateOwnerDelegationParams = CreateOwnerDelegationParams$1;
+interface OwnerDelegationReceipt extends OwnerDelegationReceipt$1 {
     readonly delegation: Delegation;
-    /** Exact signed DAG-CBOR bytes submitted in the Authorization header. */
-    readonly signedDagCbor: Uint8Array;
-    /** Locally derived by the node WASM implementation; this is delegation identity. */
-    readonly delegationCid: string;
     readonly nodeReceipt: {
         /** Raw /delegate response CID: a commit-event id, not delegation identity. */
         readonly commitEventCid?: string;

package/dist/{core-B_i2KfID.d.ts → core-CQ_5wXQT.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -856,19 +856,9 @@ type SecretReadResult = {
 } | {
     status: "invalid_payload";
 };
-interface CreateOwnerDelegationParams {
-    readonly delegateDid: string;
-    readonly spaceId: string;
-    readonly path: string;
-    readonly actions: readonly string[];
-    readonly expiresAt: Date;
-}
-interface OwnerDelegationReceipt {
+type CreateOwnerDelegationParams = CreateOwnerDelegationParams$1;
+interface OwnerDelegationReceipt extends OwnerDelegationReceipt$1 {
     readonly delegation: Delegation;
-    /** Exact signed DAG-CBOR bytes submitted in the Authorization header. */
-    readonly signedDagCbor: Uint8Array;
-    /** Locally derived by the node WASM implementation; this is delegation identity. */
-    readonly delegationCid: string;
     readonly nodeReceipt: {
         /** Raw /delegate response CID: a commit-event id, not delegation identity. */
         readonly commitEventCid?: string;

package/dist/core.cjs

@@ -1890,19 +1890,87 @@ function persistedExpiry(value) {
 function sameInstant(left, right) {
   return left.getTime() === right.getTime();
 }
-function sharingActionsToAbilities(path, actions) {
-  var _a;
+function ownerDelegationPermissions(params) {
+  const hasPermissions = Object.prototype.hasOwnProperty.call(params, "permissions");
+  const hasLegacy = Object.prototype.hasOwnProperty.call(params, "path") || Object.prototype.hasOwnProperty.call(params, "actions");
+  if (hasPermissions === hasLegacy) {
+    throw new Error("Owner delegation requires exactly one authority shape: path/actions or permissions");
+  }
+  const permissions = [];
+  if (hasPermissions) {
+    if (!Array.isArray(params.permissions)) {
+      throw new Error("Owner delegation permissions are invalid");
+    }
+    permissions.push(...params.permissions.map((permission) => ({
+      service: permission.service,
+      path: permission.path,
+      actions: [...permission.actions]
+    })));
+  } else {
+    if (typeof params.path !== "string" || !Array.isArray(params.actions)) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const byService = /* @__PURE__ */ new Map();
+    for (const action of params.actions) {
+      if (typeof action !== "string") {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const slash = action.indexOf("/");
+      const service = slash === -1 ? "" : action.slice(0, slash);
+      if (import_sdk_core8.SERVICE_LONG_TO_SHORT[service] === void 0) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const actions = byService.get(service) ?? [];
+      actions.push(action);
+      byService.set(service, actions);
+    }
+    for (const [service, actions] of byService) {
+      permissions.push({ service, path: params.path, actions });
+    }
+  }
+  if (permissions.length === 0 || permissions.length > 16) {
+    throw new Error("Owner delegation requires bounded capabilities");
+  }
+  const resources = /* @__PURE__ */ new Set();
+  for (const permission of permissions) {
+    if (typeof permission.service !== "string" || import_sdk_core8.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const resourceKey = `${permission.service}\0${permission.path}`;
+    if (resources.has(resourceKey)) {
+      throw new Error("Owner delegation permissions contain duplicate resources");
+    }
+    resources.add(resourceKey);
+    const actions = /* @__PURE__ */ new Set();
+    for (const action of permission.actions) {
+      if (typeof action !== "string" || !action.startsWith(`${permission.service}/`) || action.length === permission.service.length + 1 || actions.has(action)) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      actions.add(action);
+    }
+    if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE) {
+      try {
+        (0, import_sdk_core8.parseNetworkId)(permission.path);
+      } catch {
+        throw new Error("Owner delegation encryption permission requires a canonical network URN");
+      }
+    }
+  }
+  return permissions;
+}
+function ownerPermissionsToAbilities(permissions) {
   const abilities = {};
-  for (const action of actions) {
-    const slash = action.indexOf("/");
-    if (slash === -1) return void 0;
-    const shortService = import_sdk_core8.SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
-    if (shortService === void 0) return void 0;
+  const rawAbilities = {};
+  for (const permission of permissions) {
+    if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE) {
+      rawAbilities[permission.path] = [...permission.actions];
+      continue;
+    }
+    const shortService = import_sdk_core8.SERVICE_LONG_TO_SHORT[permission.service];
     abilities[shortService] ?? (abilities[shortService] = {});
-    (_a = abilities[shortService])[path] ?? (_a[path] = []);
-    abilities[shortService][path].push(action);
+    abilities[shortService][permission.path] = [...permission.actions];
   }
-  return Object.keys(abilities).length > 0 ? abilities : void 0;
+  return { abilities, rawAbilities };
 }
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -4276,21 +4344,29 @@ var _TinyCloudNode = class _TinyCloudNode {
   async createOwnerDelegation(params, assertActive) {
     const assertOwnerGraphActive = assertActive ?? this._serviceGraph.assertActive.bind(this._serviceGraph);
     assertOwnerGraphActive();
-    if (!params.delegateDid.startsWith("did:key:") || params.actions.length === 0 || params.path.length === 0) {
+    if (!params.delegateDid.startsWith("did:key:")) {
       throw new Error("Owner delegation requires an external did:key audience and bounded capabilities");
     }
+    const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core8.EXPIRY.MAX_MS) {
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core8.EXPIRY.MAX_MS) {
       throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
     }
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
-    const abilities = sharingActionsToAbilities(params.path, [...params.actions]);
-    if (!abilities) throw new Error("Owner delegation capabilities are unsupported");
+    const ownerDid = (0, import_sdk_core8.pkhDid)(session.address, session.chainId);
+    for (const permission of permissions) {
+      if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core8.principalDidEquals)((0, import_sdk_core8.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
+        throw new Error("Owner delegation cannot grant a foreign encryption network");
+      }
+    }
+    const { abilities, rawAbilities } = ownerPermissionsToAbilities(permissions);
+    const primary = permissions[0];
     const host = this.config.host;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
+      ...Object.keys(rawAbilities).length === 0 ? {} : { rawAbilities },
       address: this.wasmBindings.ensureEip55(session.address),
       chainId: session.chainId,
       domain: this.siweDomain,
@@ -4310,10 +4386,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const delegation = {
       cid: delegationSession.delegationCid,
       delegateDID: params.delegateDid,
-      delegatorDID: (0, import_sdk_core8.pkhDid)(session.address, session.chainId),
+      delegatorDID: ownerDid,
       spaceId: params.spaceId,
-      path: params.path,
-      actions: [...params.actions],
+      path: primary.path,
+      actions: [...primary.actions],
       expiry: params.expiresAt,
       isRevoked: false,
       allowSubDelegation: true,
@@ -4324,6 +4400,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegation,
       signedDagCbor: decodeAuthorizationBytes(delegationSession.delegationHeader.Authorization),
       delegationCid: delegationSession.delegationCid,
+      permissions,
       nodeReceipt: {
         commitEventCid: activation.commitEventCid,
         activated: activation.activated ?? [],