@tinycloud/node-sdk 2.3.0 → 2.4.0-beta.1

package/dist/{core-BdlIWB-K.d.cts → core-Dbzm1kA_.d.cts}

@@ -914,6 +914,27 @@ declare class TinyCloudNode {
     private ownedSpaceId;
     private writeManifestRegistryRecords;
     private ensureOwnedSpaceHosted;
+    /**
+     * Host one of this user's owned spaces by name (e.g. `"applications"`).
+     *
+     * Resolves the name to the owned space URI
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+     * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+     * that space succeed instead of returning `404 - Space not found`. The
+     * caller is the root authority of their own owned spaces, so no additional
+     * delegation is required.
+     *
+     * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+     * delegation rather than inferring hosting from session activation: a space
+     * the current session has never referenced is reported neither as
+     * `activated` nor `skipped`, so activation-based detection would wrongly
+     * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+     * existing space is a safe no-op. Must be called after {@link signIn}.
+     *
+     * @param name - The owned space name (e.g. `"applications"`).
+     * @returns The hosted space URI.
+     */
+    hostOwnedSpace(name: string): Promise<string>;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1427,6 +1448,28 @@ declare class TinyCloudNode {
     private delegatedResourcesForEntries;
     private operationsFromDelegation;
     private flatDelegationResources;
+    /**
+     * Build the abilities/rawAbilities maps for a wallet-mode activation
+     * sub-delegation from the FULL resource set of a received delegation.
+     *
+     * Each entry in `delegation.resources[]` is one `(service, space, path,
+     * actions)` grant; the flat top-level `path`/`actions` mirror only the
+     * first resource. We must reconstruct every grant so the activated
+     * session carries all of them (e.g. both `tinycloud.kv/get` and
+     * `tinycloud.encryption/decrypt`) — not just the primary one.
+     *
+     * Encryption resources are raw network URNs (space-independent) and go
+     * into `rawAbilities`. All other resources are space-scoped and go into
+     * `abilities` keyed by short service name. The activation `prepareSession`
+     * call uses a single `spaceId` (`delegation.spaceId`), so every
+     * non-encryption resource must target that same space — which is exactly
+     * what the multi-resource issuance path enforces. A resource targeting a
+     * different space cannot be activated in one call, so we fail loudly
+     * rather than silently dropping it.
+     *
+     * @internal
+     */
+    private buildActivationAbilities;
     private selectInvocationSession;
     private findGrantForOperations;
     private findGrantForOperation;

package/dist/{core-BdlIWB-K.d.ts → core-Dbzm1kA_.d.ts}

@@ -914,6 +914,27 @@ declare class TinyCloudNode {
     private ownedSpaceId;
     private writeManifestRegistryRecords;
     private ensureOwnedSpaceHosted;
+    /**
+     * Host one of this user's owned spaces by name (e.g. `"applications"`).
+     *
+     * Resolves the name to the owned space URI
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+     * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+     * that space succeed instead of returning `404 - Space not found`. The
+     * caller is the root authority of their own owned spaces, so no additional
+     * delegation is required.
+     *
+     * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+     * delegation rather than inferring hosting from session activation: a space
+     * the current session has never referenced is reported neither as
+     * `activated` nor `skipped`, so activation-based detection would wrongly
+     * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+     * existing space is a safe no-op. Must be called after {@link signIn}.
+     *
+     * @param name - The owned space name (e.g. `"applications"`).
+     * @returns The hosted space URI.
+     */
+    hostOwnedSpace(name: string): Promise<string>;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1427,6 +1448,28 @@ declare class TinyCloudNode {
     private delegatedResourcesForEntries;
     private operationsFromDelegation;
     private flatDelegationResources;
+    /**
+     * Build the abilities/rawAbilities maps for a wallet-mode activation
+     * sub-delegation from the FULL resource set of a received delegation.
+     *
+     * Each entry in `delegation.resources[]` is one `(service, space, path,
+     * actions)` grant; the flat top-level `path`/`actions` mirror only the
+     * first resource. We must reconstruct every grant so the activated
+     * session carries all of them (e.g. both `tinycloud.kv/get` and
+     * `tinycloud.encryption/decrypt`) — not just the primary one.
+     *
+     * Encryption resources are raw network URNs (space-independent) and go
+     * into `rawAbilities`. All other resources are space-scoped and go into
+     * `abilities` keyed by short service name. The activation `prepareSession`
+     * call uses a single `spaceId` (`delegation.spaceId`), so every
+     * non-encryption resource must target that same space — which is exactly
+     * what the multi-resource issuance path enforces. A resource targeting a
+     * different space cannot be activated in one call, so we fail loudly
+     * rather than silently dropping it.
+     *
+     * @internal
+     */
+    private buildActivationAbilities;
     private selectInvocationSession;
     private findGrantForOperations;
     private findGrantForOperation;

package/dist/core.cjs

@@ -1971,6 +1971,52 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
   }
+  /**
+   * Host one of this user's owned spaces by name (e.g. `"applications"`).
+   *
+   * Resolves the name to the owned space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+   * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+   * that space succeed instead of returning `404 - Space not found`. The
+   * caller is the root authority of their own owned spaces, so no additional
+   * delegation is required.
+   *
+   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * delegation rather than inferring hosting from session activation: a space
+   * the current session has never referenced is reported neither as
+   * `activated` nor `skipped`, so activation-based detection would wrongly
+   * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+   * existing space is a safe no-op. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"applications"`).
+   * @returns The hosted space URI.
+   */
+  async hostOwnedSpace(name) {
+    if (!this.auth || !this.auth.tinyCloudSession) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const spaceId = this.ownedSpaceId(name);
+    const host = this.hosts[0] ?? this.config.host;
+    if (!host) {
+      throw new Error("Owned space hosting requires a TinyCloud host");
+    }
+    const hosted = await this.auth.hostOwnedSpace(
+      spaceId
+    );
+    if (!hosted) {
+      throw new Error(`Failed to host owned space: ${spaceId}`);
+    }
+    const activation = await (0, import_sdk_core6.activateSessionWithHost)(
+      host,
+      this.auth.tinyCloudSession.delegationHeader
+    );
+    if (!activation.success || activation.skipped?.includes(spaceId)) {
+      throw new Error(
+        `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
+      );
+    }
+    return spaceId;
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -3951,6 +3997,59 @@ var _TinyCloudNode = class _TinyCloudNode {
       actions
     }));
   }
+  /**
+   * Build the abilities/rawAbilities maps for a wallet-mode activation
+   * sub-delegation from the FULL resource set of a received delegation.
+   *
+   * Each entry in `delegation.resources[]` is one `(service, space, path,
+   * actions)` grant; the flat top-level `path`/`actions` mirror only the
+   * first resource. We must reconstruct every grant so the activated
+   * session carries all of them (e.g. both `tinycloud.kv/get` and
+   * `tinycloud.encryption/decrypt`) — not just the primary one.
+   *
+   * Encryption resources are raw network URNs (space-independent) and go
+   * into `rawAbilities`. All other resources are space-scoped and go into
+   * `abilities` keyed by short service name. The activation `prepareSession`
+   * call uses a single `spaceId` (`delegation.spaceId`), so every
+   * non-encryption resource must target that same space — which is exactly
+   * what the multi-resource issuance path enforces. A resource targeting a
+   * different space cannot be activated in one call, so we fail loudly
+   * rather than silently dropping it.
+   *
+   * @internal
+   */
+  buildActivationAbilities(delegation) {
+    var _a, _b, _c;
+    const resources = delegation.resources !== void 0 && delegation.resources.length > 0 ? delegation.resources : this.flatDelegationResources(delegation);
+    const abilities = {};
+    const rawAbilities = {};
+    const addActions = (target, actions) => {
+      const seen = new Set(target);
+      for (const action of actions) {
+        if (!seen.has(action)) {
+          target.push(action);
+          seen.add(action);
+        }
+      }
+    };
+    for (const resource of resources) {
+      const service = this.invocationServiceName(resource.service);
+      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+        rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
+        addActions(rawAbilities[resource.path], resource.actions);
+        continue;
+      }
+      if (resource.space !== delegation.spaceId) {
+        throw new Error(
+          `useDelegation: resource targets space '${resource.space}' but the delegation activates space '${delegation.spaceId}'. Multi-space delegations cannot be activated in a single useDelegation call.`
+        );
+      }
+      abilities[service] ?? (abilities[service] = {});
+      (_b = abilities[service])[_c = resource.path] ?? (_b[_c] = []);
+      addActions(abilities[service][resource.path], resource.actions);
+    }
+    return { abilities, rawAbilities };
+  }
   selectInvocationSession(fallback, service, path, action) {
     const grant = this.findGrantForOperation({
       spaceId: fallback.spaceId,
@@ -4297,26 +4396,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const jwk = mySession.jwk;
-    const abilities = {};
-    const kvActions = delegation.actions.filter((a) => a.startsWith("tinycloud.kv/"));
-    const sqlActions = delegation.actions.filter((a) => a.startsWith("tinycloud.sql/"));
-    const duckdbActions = delegation.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
-    const encryptionActions = delegation.actions.filter(
-      (a) => a.startsWith("tinycloud.encryption/")
-    );
-    const rawAbilities = {};
-    if (kvActions.length > 0) {
-      abilities.kv = { [delegation.path]: kvActions };
-    }
-    if (sqlActions.length > 0) {
-      abilities.sql = { [delegation.path]: sqlActions };
-    }
-    if (duckdbActions.length > 0) {
-      abilities.duckdb = { [delegation.path]: duckdbActions };
-    }
-    if (encryptionActions.length > 0 && delegation.path.startsWith("urn:tinycloud:encryption:")) {
-      rawAbilities[delegation.path] = encryptionActions;
-    }
+    const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
     const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
     const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;