@tinycloud/node-sdk 2.3.0 → 2.3.1-beta.0

package/dist/{core-BdlIWB-K.d.cts → core-D2hPECHW.d.cts}

@@ -1427,6 +1427,28 @@ declare class TinyCloudNode {
     private delegatedResourcesForEntries;
     private operationsFromDelegation;
     private flatDelegationResources;
+    /**
+     * Build the abilities/rawAbilities maps for a wallet-mode activation
+     * sub-delegation from the FULL resource set of a received delegation.
+     *
+     * Each entry in `delegation.resources[]` is one `(service, space, path,
+     * actions)` grant; the flat top-level `path`/`actions` mirror only the
+     * first resource. We must reconstruct every grant so the activated
+     * session carries all of them (e.g. both `tinycloud.kv/get` and
+     * `tinycloud.encryption/decrypt`) — not just the primary one.
+     *
+     * Encryption resources are raw network URNs (space-independent) and go
+     * into `rawAbilities`. All other resources are space-scoped and go into
+     * `abilities` keyed by short service name. The activation `prepareSession`
+     * call uses a single `spaceId` (`delegation.spaceId`), so every
+     * non-encryption resource must target that same space — which is exactly
+     * what the multi-resource issuance path enforces. A resource targeting a
+     * different space cannot be activated in one call, so we fail loudly
+     * rather than silently dropping it.
+     *
+     * @internal
+     */
+    private buildActivationAbilities;
     private selectInvocationSession;
     private findGrantForOperations;
     private findGrantForOperation;

package/dist/{core-BdlIWB-K.d.ts → core-D2hPECHW.d.ts}

@@ -1427,6 +1427,28 @@ declare class TinyCloudNode {
     private delegatedResourcesForEntries;
     private operationsFromDelegation;
     private flatDelegationResources;
+    /**
+     * Build the abilities/rawAbilities maps for a wallet-mode activation
+     * sub-delegation from the FULL resource set of a received delegation.
+     *
+     * Each entry in `delegation.resources[]` is one `(service, space, path,
+     * actions)` grant; the flat top-level `path`/`actions` mirror only the
+     * first resource. We must reconstruct every grant so the activated
+     * session carries all of them (e.g. both `tinycloud.kv/get` and
+     * `tinycloud.encryption/decrypt`) — not just the primary one.
+     *
+     * Encryption resources are raw network URNs (space-independent) and go
+     * into `rawAbilities`. All other resources are space-scoped and go into
+     * `abilities` keyed by short service name. The activation `prepareSession`
+     * call uses a single `spaceId` (`delegation.spaceId`), so every
+     * non-encryption resource must target that same space — which is exactly
+     * what the multi-resource issuance path enforces. A resource targeting a
+     * different space cannot be activated in one call, so we fail loudly
+     * rather than silently dropping it.
+     *
+     * @internal
+     */
+    private buildActivationAbilities;
     private selectInvocationSession;
     private findGrantForOperations;
     private findGrantForOperation;

package/dist/core.cjs

@@ -3951,6 +3951,59 @@ var _TinyCloudNode = class _TinyCloudNode {
       actions
     }));
   }
+  /**
+   * Build the abilities/rawAbilities maps for a wallet-mode activation
+   * sub-delegation from the FULL resource set of a received delegation.
+   *
+   * Each entry in `delegation.resources[]` is one `(service, space, path,
+   * actions)` grant; the flat top-level `path`/`actions` mirror only the
+   * first resource. We must reconstruct every grant so the activated
+   * session carries all of them (e.g. both `tinycloud.kv/get` and
+   * `tinycloud.encryption/decrypt`) — not just the primary one.
+   *
+   * Encryption resources are raw network URNs (space-independent) and go
+   * into `rawAbilities`. All other resources are space-scoped and go into
+   * `abilities` keyed by short service name. The activation `prepareSession`
+   * call uses a single `spaceId` (`delegation.spaceId`), so every
+   * non-encryption resource must target that same space — which is exactly
+   * what the multi-resource issuance path enforces. A resource targeting a
+   * different space cannot be activated in one call, so we fail loudly
+   * rather than silently dropping it.
+   *
+   * @internal
+   */
+  buildActivationAbilities(delegation) {
+    var _a, _b, _c;
+    const resources = delegation.resources !== void 0 && delegation.resources.length > 0 ? delegation.resources : this.flatDelegationResources(delegation);
+    const abilities = {};
+    const rawAbilities = {};
+    const addActions = (target, actions) => {
+      const seen = new Set(target);
+      for (const action of actions) {
+        if (!seen.has(action)) {
+          target.push(action);
+          seen.add(action);
+        }
+      }
+    };
+    for (const resource of resources) {
+      const service = this.invocationServiceName(resource.service);
+      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+        rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
+        addActions(rawAbilities[resource.path], resource.actions);
+        continue;
+      }
+      if (resource.space !== delegation.spaceId) {
+        throw new Error(
+          `useDelegation: resource targets space '${resource.space}' but the delegation activates space '${delegation.spaceId}'. Multi-space delegations cannot be activated in a single useDelegation call.`
+        );
+      }
+      abilities[service] ?? (abilities[service] = {});
+      (_b = abilities[service])[_c = resource.path] ?? (_b[_c] = []);
+      addActions(abilities[service][resource.path], resource.actions);
+    }
+    return { abilities, rawAbilities };
+  }
   selectInvocationSession(fallback, service, path, action) {
     const grant = this.findGrantForOperation({
       spaceId: fallback.spaceId,
@@ -4297,26 +4350,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const jwk = mySession.jwk;
-    const abilities = {};
-    const kvActions = delegation.actions.filter((a) => a.startsWith("tinycloud.kv/"));
-    const sqlActions = delegation.actions.filter((a) => a.startsWith("tinycloud.sql/"));
-    const duckdbActions = delegation.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
-    const encryptionActions = delegation.actions.filter(
-      (a) => a.startsWith("tinycloud.encryption/")
-    );
-    const rawAbilities = {};
-    if (kvActions.length > 0) {
-      abilities.kv = { [delegation.path]: kvActions };
-    }
-    if (sqlActions.length > 0) {
-      abilities.sql = { [delegation.path]: sqlActions };
-    }
-    if (duckdbActions.length > 0) {
-      abilities.duckdb = { [delegation.path]: duckdbActions };
-    }
-    if (encryptionActions.length > 0 && delegation.path.startsWith("urn:tinycloud:encryption:")) {
-      rawAbilities[delegation.path] = encryptionActions;
-    }
+    const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
     const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
     const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;