@tinycloud/node-sdk 2.11.0-beta.0 → 2.11.0-beta.3

package/dist/index.cjs

@@ -17578,6 +17578,15 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  /**
+   * The node DID reported by `GET /info` for `host`, if the sign-in (or
+   * restore) that populated it targeted that same host. Returns `undefined`
+   * for any other host, and for nodes whose `/info` omits `nodeId`, so callers
+   * fall back to fetching it themselves rather than using a foreign node's DID.
+   */
+  nodeIdForHost(host) {
+    return this._nodeInfoIdentity?.host === host ? this._nodeInfoIdentity.nodeId : void 0;
+  }
   get lastActivationSkippedSpaceIds() {
     return [...this._lastActivationSkippedSpaceIds];
   }
@@ -18047,11 +18056,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await (0, import_sdk_core2.checkNodeInfo)(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -18217,11 +18228,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await (0, import_sdk_core2.checkNodeInfo)(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -18913,19 +18926,87 @@ function persistedExpiry(value) {
 function sameInstant(left, right) {
   return left.getTime() === right.getTime();
 }
-function sharingActionsToAbilities(path, actions) {
-  var _a;
+function ownerDelegationPermissions(params) {
+  const hasPermissions = Object.prototype.hasOwnProperty.call(params, "permissions");
+  const hasLegacy = Object.prototype.hasOwnProperty.call(params, "path") || Object.prototype.hasOwnProperty.call(params, "actions");
+  if (hasPermissions === hasLegacy) {
+    throw new Error("Owner delegation requires exactly one authority shape: path/actions or permissions");
+  }
+  const permissions = [];
+  if (hasPermissions) {
+    if (!Array.isArray(params.permissions)) {
+      throw new Error("Owner delegation permissions are invalid");
+    }
+    permissions.push(...params.permissions.map((permission) => ({
+      service: permission.service,
+      path: permission.path,
+      actions: [...permission.actions]
+    })));
+  } else {
+    if (typeof params.path !== "string" || !Array.isArray(params.actions)) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const byService = /* @__PURE__ */ new Map();
+    for (const action of params.actions) {
+      if (typeof action !== "string") {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const slash = action.indexOf("/");
+      const service = slash === -1 ? "" : action.slice(0, slash);
+      if (import_sdk_core7.SERVICE_LONG_TO_SHORT[service] === void 0) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      const actions = byService.get(service) ?? [];
+      actions.push(action);
+      byService.set(service, actions);
+    }
+    for (const [service, actions] of byService) {
+      permissions.push({ service, path: params.path, actions });
+    }
+  }
+  if (permissions.length === 0 || permissions.length > 16) {
+    throw new Error("Owner delegation requires bounded capabilities");
+  }
+  const resources = /* @__PURE__ */ new Set();
+  for (const permission of permissions) {
+    if (typeof permission.service !== "string" || import_sdk_core7.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
+      throw new Error("Owner delegation requires bounded capabilities");
+    }
+    const resourceKey = `${permission.service}\0${permission.path}`;
+    if (resources.has(resourceKey)) {
+      throw new Error("Owner delegation permissions contain duplicate resources");
+    }
+    resources.add(resourceKey);
+    const actions = /* @__PURE__ */ new Set();
+    for (const action of permission.actions) {
+      if (typeof action !== "string" || !action.startsWith(`${permission.service}/`) || action.length === permission.service.length + 1 || actions.has(action)) {
+        throw new Error("Owner delegation capabilities are unsupported");
+      }
+      actions.add(action);
+    }
+    if (permission.service === import_sdk_core7.ENCRYPTION_PERMISSION_SERVICE) {
+      try {
+        (0, import_sdk_core7.parseNetworkId)(permission.path);
+      } catch {
+        throw new Error("Owner delegation encryption permission requires a canonical network URN");
+      }
+    }
+  }
+  return permissions;
+}
+function ownerPermissionsToAbilities(permissions) {
   const abilities = {};
-  for (const action of actions) {
-    const slash = action.indexOf("/");
-    if (slash === -1) return void 0;
-    const shortService = import_sdk_core7.SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
-    if (shortService === void 0) return void 0;
+  const rawAbilities = {};
+  for (const permission of permissions) {
+    if (permission.service === import_sdk_core7.ENCRYPTION_PERMISSION_SERVICE) {
+      rawAbilities[permission.path] = [...permission.actions];
+      continue;
+    }
+    const shortService = import_sdk_core7.SERVICE_LONG_TO_SHORT[permission.service];
     abilities[shortService] ?? (abilities[shortService] = {});
-    (_a = abilities[shortService])[path] ?? (_a[path] = []);
-    abilities[shortService][path].push(action);
+    abilities[shortService][permission.path] = [...permission.actions];
   }
-  return Object.keys(abilities).length > 0 ? abilities : void 0;
+  return { abilities, rawAbilities };
 }
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -19043,6 +19124,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._baseSecrets = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
+    /**
+     * Owned space ids this sign-in has already confirmed are hosted. Consulted by
+     * {@link ensureOwnedSpaceHostedById}; cleared on every {@link signIn} because
+     * hosting is confirmed against the session that was active at the time.
+     */
+    this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -19439,6 +19526,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
+    this.confirmedHostedSpaceIds.clear();
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     const oldGraph = this._serviceGraph;
@@ -19621,14 +19709,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
-          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core7.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core7.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+          // Bootstrap only runs on an account with no registry records, so the
+          // manifest-hash pre-read is definitionally a miss. Skip it; the write
+          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          { assumeUnregistered: true }
         );
         if (!registered.ok) {
           throw new Error(`Failed to seed bootstrap applications: ${registered.error.message}`);
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId);
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -19907,6 +19999,22 @@ var _TinyCloudNode = class _TinyCloudNode {
       await this.ensureEncryptionNetwork(networkId);
     }
   }
+  /**
+   * Ensure one of this user's owned spaces is hosted, at most once per space
+   * per sign-in.
+   *
+   * Account bootstrap funnels six calls through here (via
+   * `AccountService.ensureAccountSpaceHosted`), and each one re-submits
+   * `activateSessionWithHost` with the *primary* session. That session's recap
+   * covers only `default` and `secrets`, so the account space appears in
+   * neither `activated` nor `skipped` and the guard below returns immediately
+   * — the repeat calls cannot change the outcome, they only cost round trips.
+   *
+   * The memo is per sign-in ({@link confirmedHostedSpaceIds} is cleared in
+   * `signIn`) and only records confirmed successes. A wrong skip is
+   * self-revealing: the next write to the space fails immediately and loudly
+   * with `404 Space not found`.
+   */
   async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
@@ -19915,12 +20023,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    if (this.confirmedHostedSpaceIds.has(spaceId)) {
+      return;
+    }
     const host = this.hosts[0] ?? this.config.host;
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
     const activation = await (0, import_sdk_core7.activateSessionWithHost)(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
+      this.confirmedHostedSpaceIds.add(spaceId);
       return;
     }
     if (!activation.success && activation.status !== 404) {
@@ -19939,6 +20051,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
       );
     }
+    this.confirmedHostedSpaceIds.add(spaceId);
   }
   /**
    * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -20261,6 +20374,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.tc = stagedGraph.core;
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
+    this.confirmedHostedSpaceIds.clear();
     if (this.auth) {
       this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
       this._restoredTcSession = void 0;
@@ -20843,7 +20957,17 @@ var _TinyCloudNode = class _TinyCloudNode {
       verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core7.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
     };
   }
+  /**
+   * The node DID for {@link config.host}.
+   *
+   * Sign-in already performs `GET /info` for the protocol-version check, and
+   * that response carries `nodeId`, so reuse it rather than fetching `/info` a
+   * second time. Only a value recorded for this exact host qualifies; older
+   * nodes that omit `nodeId` fall through to the fetch.
+   */
   async fetchNodeId() {
+    const cached = this.auth?.nodeIdForHost(this.config.host);
+    if (cached) return cached;
     const response = await fetch(`${this.config.host}/info`);
     if (!response.ok) {
       throw new Error(`Failed to fetch node info: HTTP ${response.status}`);
@@ -21299,21 +21423,29 @@ var _TinyCloudNode = class _TinyCloudNode {
   async createOwnerDelegation(params, assertActive) {
     const assertOwnerGraphActive = assertActive ?? this._serviceGraph.assertActive.bind(this._serviceGraph);
     assertOwnerGraphActive();
-    if (!params.delegateDid.startsWith("did:key:") || params.actions.length === 0 || params.path.length === 0) {
+    if (!params.delegateDid.startsWith("did:key:")) {
       throw new Error("Owner delegation requires an external did:key audience and bounded capabilities");
     }
+    const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core7.EXPIRY.MAX_MS) {
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core7.EXPIRY.MAX_MS) {
       throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
     }
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
-    const abilities = sharingActionsToAbilities(params.path, [...params.actions]);
-    if (!abilities) throw new Error("Owner delegation capabilities are unsupported");
+    const ownerDid = (0, import_sdk_core7.pkhDid)(session.address, session.chainId);
+    for (const permission of permissions) {
+      if (permission.service === import_sdk_core7.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core7.principalDidEquals)((0, import_sdk_core7.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
+        throw new Error("Owner delegation cannot grant a foreign encryption network");
+      }
+    }
+    const { abilities, rawAbilities } = ownerPermissionsToAbilities(permissions);
+    const primary = permissions[0];
     const host = this.config.host;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
+      ...Object.keys(rawAbilities).length === 0 ? {} : { rawAbilities },
       address: this.wasmBindings.ensureEip55(session.address),
       chainId: session.chainId,
       domain: this.siweDomain,
@@ -21333,10 +21465,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const delegation = {
       cid: delegationSession.delegationCid,
       delegateDID: params.delegateDid,
-      delegatorDID: (0, import_sdk_core7.pkhDid)(session.address, session.chainId),
+      delegatorDID: ownerDid,
       spaceId: params.spaceId,
-      path: params.path,
-      actions: [...params.actions],
+      path: primary.path,
+      actions: [...primary.actions],
       expiry: params.expiresAt,
       isRevoked: false,
       allowSubDelegation: true,
@@ -21347,6 +21479,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegation,
       signedDagCbor: decodeAuthorizationBytes(delegationSession.delegationHeader.Authorization),
       delegationCid: delegationSession.delegationCid,
+      permissions,
       nodeReceipt: {
         commitEventCid: activation.commitEventCid,
         activated: activation.activated ?? [],
@@ -21606,6 +21739,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         body
       )
     });
+    if (response.status === 409) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) return existing;
+      throw new Error(
+        `Encryption network ${networkId} already exists but could not be read back`
+      );
+    }
     if (!response.ok) {
       throw new Error(
         `Failed to create encryption network ${networkId}: HTTP ${response.status} ${await response.text()}`
@@ -21614,11 +21754,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+  /**
+   * Ensure an encryption network exists, creating it if necessary.
+   *
+   * @param nameOrNetworkId - Network name or full `urn:tinycloud:encryption:` id.
+   * @param options - See {@link EnsureEncryptionNetworkOptions}.
+   */
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME, options = {}) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
-    const existing = await this.getEncryptionNetwork(networkId);
-    if (existing) {
-      return existing;
+    if (!options.assumeMissing) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) {
+        return existing;
+      }
     }
     const parsed = (0, import_sdk_core7.parseNetworkId)(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {