@tinycloud/node-sdk 2.11.0 → 3.0.0-beta.0

package/dist/index.cjs

@@ -17092,6 +17092,7 @@ __export(index_exports, {
   VaultPublicSpaceKVActions: () => import_sdk_core16.VaultPublicSpaceKVActions,
   VersionCheckError: () => import_sdk_core22.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
+  activateCompactRuntimeDelegation: () => activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation: () => activateValidatedRuntimeDelegation,
   addressStorageKey: () => import_sdk_core11.addressStorageKey,
   buildCanonicalDecryptRequest: () => import_sdk_core17.buildCanonicalDecryptRequest,
@@ -19206,6 +19207,18 @@ var ROOT_DELEGATION_ACTIONS = [
   import_sdk_core7.DUCKDB.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core7.EXPIRY.SESSION_MS;
+function unifiedRootAttenuation(capabilities) {
+  const attenuation = {};
+  for (const capability of capabilities) {
+    if (attenuation[capability.resource] !== void 0) throw new Error("unified owner root contains a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
 function decodeAuthorizationBytes(authorization) {
   const encoded = authorization.replace(/^Bearer /i, "");
   const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
@@ -19585,6 +19598,8 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /** Serializes account-registry writes for the active node instance. */
+    this.accountRegistryTail = Promise.resolve();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -19981,6 +19996,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     this._address = (0, import_sdk_core7.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
@@ -20462,16 +20478,48 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
   }
   scheduleAccountRegistrySync() {
-    void this.withAccountRegistryRetry(async () => {
-      void this.account.index.ensure();
-      await this.writeManifestRegistryRecords();
-      if (this.currentSessionCanListSpaces()) {
-        const spaces = await this.account.spaces.syncAccessible();
-        if (!spaces.ok) {
-          throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+    const session = this.currentTinyCloudSession();
+    if (!session || this.pendingAccountRegistrySync?.session === session) {
+      return;
+    }
+    const promise = this.enqueueAccountRegistryOperation(session, async () => {
+      await this.withAccountRegistryRetry(async () => {
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.account.index.ensure();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.writeManifestRegistryRecords();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
         }
+        if (this.currentSessionCanListSpaces()) {
+          const spaces = await this.account.spaces.syncAccessible();
+          if (!spaces.ok) {
+            throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+          }
+        }
+      });
+    });
+    this.pendingAccountRegistrySync = { session, promise };
+    const clearPendingSync = () => {
+      if (this.pendingAccountRegistrySync?.promise === promise) {
+        this.pendingAccountRegistrySync = void 0;
+      }
+    };
+    void promise.then(clearPendingSync, clearPendingSync);
+  }
+  enqueueAccountRegistryOperation(session, task) {
+    const operation = this.accountRegistryTail.then(async () => {
+      if (this.currentTinyCloudSession() === session) {
+        await task();
       }
     });
+    this.accountRegistryTail = operation.catch(() => {
+    });
+    return operation;
   }
   /**
    * Whether the current primary session may invoke `tinycloud.space/list`.
@@ -20624,7 +20672,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @returns The hosted space URI.
    */
   async hostOwnedSpace(name) {
-    if (!this.auth || !this.auth.tinyCloudSession) {
+    const session = this.auth?.tinyCloudSession;
+    if (!this.auth || !session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
@@ -20640,22 +20689,26 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const activation = await (0, import_sdk_core7.activateSessionWithHost)(
       host,
-      this.auth.tinyCloudSession.delegationHeader
+      session.delegationHeader
     );
     if (!activation.success || activation.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
-    void this.account.spaces.register({
-      spaceId,
-      name,
-      ownerDid: this.did,
-      type: "owned",
-      permissions: ["*"],
-      status: "active"
-    }).catch(() => {
-    });
+    try {
+      await this.enqueueAccountRegistryOperation(session, async () => {
+        await this.account.spaces.register({
+          spaceId,
+          name,
+          ownerDid: this.did,
+          type: "owned",
+          permissions: ["*"],
+          status: "active"
+        });
+      });
+    } catch {
+    }
     return spaceId;
   }
   /**
@@ -20690,23 +20743,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
+    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
     if (await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    const hosted = await this.hostOwnedSpace(name);
-    try {
-      await this.account.spaces.register({
-        spaceId,
-        name,
-        ownerDid: this.did,
-        type: "owned",
-        permissions: ["*"],
-        status: "active"
-      });
-    } catch {
-    }
-    return hosted;
+    return this.hostOwnedSpace(name);
   }
   /** Resolve and authenticate the owner encoded by an owned-space URI. */
   credentialSpaceOwnerDid(spaceId) {
@@ -21259,6 +21301,46 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+  async createUnifiedOwnerRoot(input) {
+    const ownerDid = this.credentialHolderDid;
+    if (input.ownerDid !== ownerDid) throw new Error("unified owner root signer does not match owner DID");
+    const facts = {
+      role: input.role,
+      mode: input.role === "policy-authority" ? "policy-source" : "conditional-mint",
+      ownerDid,
+      policyId: input.policyId,
+      policyDigestHex: input.policyDigestHex,
+      policyCid: input.policyCid,
+      contentSourceDigestHex: input.contentSourceDigestHex,
+      capabilityCeilingHashHex: input.capabilityCeilingHashHex,
+      nativeProjectionHashHex: input.nativeProjectionHashHex,
+      nodeAudience: input.nodeAudience,
+      ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
+    };
+    const root = await (0, import_sdk_core7.signCompactUcanRootAuthorization)({
+      issuerDid: ownerDid,
+      audienceDid: input.audienceDid,
+      attenuation: unifiedRootAttenuation(input.capabilities),
+      facts: [facts],
+      notBefore: Math.floor(input.notBefore.getTime() / 1e3),
+      expiresAt: Math.floor(input.expiresAt.getTime() / 1e3),
+      nonce: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      sign: (bytes) => this.signSessionBytes(bytes)
+    });
+    const kv = input.capabilities.find((capability) => capability.kind === "kv");
+    const resource = kv?.resource ?? "";
+    const marker = resource.indexOf("/kv/");
+    return {
+      cid: root.cid,
+      delegationHeader: { Authorization: root.authorization },
+      delegateDID: input.audienceDid,
+      spaceId: marker === -1 ? "" : resource.slice("tinycloud://".length, marker),
+      path: marker === -1 ? resource : resource.slice(marker + 4),
+      actions: kv?.actions ?? [],
+      expiry: input.expiresAt
+    };
+  }
   /** Apply only an already-enabled signing policy to the exact credential request. */
   async autoSignCredentialBytes(bytes) {
     const strategy = this.config.signStrategy;
@@ -24497,7 +24579,7 @@ function compactUcanPayload(authorization) {
   }
   try {
     const payload = JSON.parse(
-      Buffer.from(parts[1], "base64url").toString("utf8")
+      new TextDecoder("utf-8", { fatal: true }).decode((0, import_sdk_core9.decodeBase64Url)(parts[1]))
     );
     if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
       throw new Error("payload is not an object");
@@ -24589,7 +24671,9 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const match = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const nativeMatch = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const policyMatch = /^tinycloud:\/\/([^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const match = nativeMatch ?? policyMatch;
     if (!match) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
@@ -24761,6 +24845,40 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
     host: normalizedHost(installed.host ?? host)
   };
 }
+async function activateCompactRuntimeDelegation(node, input) {
+  const authorization = input.authorization;
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== input.cid) {
+    throw new Error("Compact runtime delegation CID does not match authorization bytes.");
+  }
+  const signed2 = signedAuthorityFromCompactUcan(authorization);
+  const primary = signed2.resources[0];
+  const signedSpace = signed2.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const delegation = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: input.ownerAddress,
+    chainId: input.chainId,
+    delegatorDID: signed2.issuer,
+    authHeader: authorization,
+    spaceId: signedSpace ?? primary.space,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed2.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed2.expiry),
+    delegateDID: signed2.audience,
+    host: normalizedHost(input.host)
+  };
+  return activateValidatedRuntimeDelegation(node, delegation, {
+    host: input.host
+  });
+}
 async function grantAuthRequest(authority, request, options) {
   if (request.kind !== "tinycloud.auth.request") {
     throw new Error(
@@ -24883,6 +25001,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
+  activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation,
   addressStorageKey,
   buildCanonicalDecryptRequest,