@tinycloud/node-sdk 2.10.0 → 2.11.0-beta.1

package/dist/core.d.cts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerSharePolicyRegistrationReceipt, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { C as CreateOwnerDelegationParams, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, h as RuntimePermissionGrantOptions, S as SecretPermissionHint, i as SecretReadInput, j as SecretReadResult, k as SignStrategy, T as TinyCloudNode, l as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, m as WasmKeyProviderConfig, o as createWasmKeyProvider, p as defaultSignStrategy, q as deserializeDelegation, s as serializeDelegation } from './core-B_i2KfID.cjs';
+export { C as CreateOwnerDelegationParams, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, h as RuntimePermissionGrantOptions, S as SecretPermissionHint, i as SecretReadInput, j as SecretReadResult, k as SignStrategy, T as TinyCloudNode, l as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, m as WasmKeyProviderConfig, o as createWasmKeyProvider, p as defaultSignStrategy, q as deserializeDelegation, s as serializeDelegation } from './core-CQ_5wXQT.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerSharePolicyRegistrationReceipt, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { C as CreateOwnerDelegationParams, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, h as RuntimePermissionGrantOptions, S as SecretPermissionHint, i as SecretReadInput, j as SecretReadResult, k as SignStrategy, T as TinyCloudNode, l as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, m as WasmKeyProviderConfig, o as createWasmKeyProvider, p as defaultSignStrategy, q as deserializeDelegation, s as serializeDelegation } from './core-B_i2KfID.js';
+export { C as CreateOwnerDelegationParams, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, h as RuntimePermissionGrantOptions, S as SecretPermissionHint, i as SecretReadInput, j as SecretReadResult, k as SignStrategy, T as TinyCloudNode, l as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, m as WasmKeyProviderConfig, o as createWasmKeyProvider, p as defaultSignStrategy, q as deserializeDelegation, s as serializeDelegation } from './core-CQ_5wXQT.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -1883,19 +1883,87 @@ function persistedExpiry(value) {
 function sameInstant(left, right) {
   return left.getTime() === right.getTime();
 }
-function sharingActionsToAbilities(path, actions) {
-  var _a;
+function ownerDelegationPermissions(params) {
+  const hasPermissions = Object.prototype.hasOwnProperty.call(params, "permissions");
+  const hasLegacy = Object.prototype.hasOwnProperty.call(params, "path") || Object.prototype.hasOwnProperty.call(params, "actions");
+  if (hasPermissions === hasLegacy) {
+    throw new Error("Owner delegation requires exactly one authority shape: path/actions or permissions");
+  }
+  const permissions = [];
+  if (hasPermissions) {
+    if (!Array.isArray(params.permissions)) {
+      throw new Error("Owner delegation permissions are invalid");
+    }
+    permissions.push(...params.permissions.map((permission) => ({
+      service: permission.service,
+      path: permission.path,
+      actions: [...permission.actions]
+    })));
+  } else {
+    if (typeof params.path !== "string" || !Array.isArray(params.actions)) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const byService = /* @__PURE__ */ new Map();
+    for (const action of params.actions) {
+      if (typeof action !== "string") {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const slash = action.indexOf("/");
+      const service = slash === -1 ? "" : action.slice(0, slash);
+      if (SERVICE_LONG_TO_SHORT[service] === void 0) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const actions = byService.get(service) ?? [];
+      actions.push(action);
+      byService.set(service, actions);
+    }
+    for (const [service, actions] of byService) {
+      permissions.push({ service, path: params.path, actions });
+    }
+  }
+  if (permissions.length === 0 || permissions.length > 16) {
+    throw new Error("Owner delegation requires bounded capabilities");
+  }
+  const resources = /* @__PURE__ */ new Set();
+  for (const permission of permissions) {
+    if (typeof permission.service !== "string" || SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const resourceKey = `${permission.service}\0${permission.path}`;
+    if (resources.has(resourceKey)) {
+      throw new Error("Owner delegation permissions contain duplicate resources");
+    }
+    resources.add(resourceKey);
+    const actions = /* @__PURE__ */ new Set();
+    for (const action of permission.actions) {
+      if (typeof action !== "string" || !action.startsWith(`${permission.service}/`) || action.length === permission.service.length + 1 || actions.has(action)) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      actions.add(action);
+    }
+    if (permission.service === ENCRYPTION_PERMISSION_SERVICE2) {
+      try {
+        parseNetworkId2(permission.path);
+      } catch {
+        throw new Error("Owner delegation encryption permission requires a canonical network URN");
+      }
+    }
+  }
+  return permissions;
+}
+function ownerPermissionsToAbilities(permissions) {
   const abilities = {};
-  for (const action of actions) {
-    const slash = action.indexOf("/");
-    if (slash === -1) return void 0;
-    const shortService = SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
-    if (shortService === void 0) return void 0;
+  const rawAbilities = {};
+  for (const permission of permissions) {
+    if (permission.service === ENCRYPTION_PERMISSION_SERVICE2) {
+      rawAbilities[permission.path] = [...permission.actions];
+      continue;
+    }
+    const shortService = SERVICE_LONG_TO_SHORT[permission.service];
     abilities[shortService] ?? (abilities[shortService] = {});
-    (_a = abilities[shortService])[path] ?? (_a[path] = []);
-    abilities[shortService][path].push(action);
+    abilities[shortService][permission.path] = [...permission.actions];
   }
-  return Object.keys(abilities).length > 0 ? abilities : void 0;
+  return { abilities, rawAbilities };
 }
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -4269,21 +4337,29 @@ var _TinyCloudNode = class _TinyCloudNode {
   async createOwnerDelegation(params, assertActive) {
     const assertOwnerGraphActive = assertActive ?? this._serviceGraph.assertActive.bind(this._serviceGraph);
     assertOwnerGraphActive();
-    if (!params.delegateDid.startsWith("did:key:") || params.actions.length === 0 || params.path.length === 0) {
+    if (!params.delegateDid.startsWith("did:key:")) {
       throw new Error("Owner delegation requires an external did:key audience and bounded capabilities");
     }
+    const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > EXPIRY3.MAX_MS) {
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > EXPIRY3.MAX_MS) {
       throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
     }
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
-    const abilities = sharingActionsToAbilities(params.path, [...params.actions]);
-    if (!abilities) throw new Error("Owner delegation capabilities are unsupported");
+    const ownerDid = pkhDid2(session.address, session.chainId);
+    for (const permission of permissions) {
+      if (permission.service === ENCRYPTION_PERMISSION_SERVICE2 && !principalDidEquals2(parseNetworkId2(permission.path).ownerDid, ownerDid)) {
+        throw new Error("Owner delegation cannot grant a foreign encryption network");
+      }
+    }
+    const { abilities, rawAbilities } = ownerPermissionsToAbilities(permissions);
+    const primary = permissions[0];
     const host = this.config.host;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
+      ...Object.keys(rawAbilities).length === 0 ? {} : { rawAbilities },
       address: this.wasmBindings.ensureEip55(session.address),
       chainId: session.chainId,
       domain: this.siweDomain,
@@ -4303,10 +4379,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const delegation = {
       cid: delegationSession.delegationCid,
       delegateDID: params.delegateDid,
-      delegatorDID: pkhDid2(session.address, session.chainId),
+      delegatorDID: ownerDid,
       spaceId: params.spaceId,
-      path: params.path,
-      actions: [...params.actions],
+      path: primary.path,
+      actions: [...primary.actions],
       expiry: params.expiresAt,
       isRevoked: false,
       allowSubDelegation: true,
@@ -4317,6 +4393,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegation,
       signedDagCbor: decodeAuthorizationBytes(delegationSession.delegationHeader.Authorization),
       delegationCid: delegationSession.delegationCid,
+      permissions,
       nodeReceipt: {
         commitEventCid: activation.commitEventCid,
         activated: activation.activated ?? [],